To manage software updates using SCCM/Configmgr, software update scan (with help of windows update agent) is mandatory without which ,client cannot download the update catalog (metadata) from WSUS and perform the scan for letting the server know what is required and what is not required using the state messages.
When i was looking at the software update scan reports few days ago ,identified some of the clients (Windows servers) could not able perform software update scan. So i decided to take look at the one of the client logs and troubleshoot further.
After logging into the server ,looked at wuahandler.log ,scanagent.log and windowsupdate.log as these logs will help you help to troubleshoot software update scan issues at the initial stage.
Below is windows update log.
WARNING: IsSessionRemote: WinStationQueryInformationW(WTSIsRemoteSession) failed for session 2, GetLastError=2250
COMAPI FATAL: Unable to connect to the service (hr=80080005)
COMAPI WARNING: Unable to establish connection to the service. (hr=80080005)
After seeing this error ,i tried to stop windows update service but windows update service stuck at “stopping” status (hung) and never finish . So i have to kill the service to stop using taskkill command.
Open cmd as an administrator
- Run: taskkill /f /fi “services eq wuauserv”
After the windows update service start, tried initiating the software update scan to see if that makes any any difference but again issue repeat (same error code in windows update log ,software update scan never move forward using wuahandler.log )
I even tried installing the updates manually to see if that goes through but that also failed.
After doing the basic troubleshooting as said above ,the issue is not with SCCM client or windows update agent rather it is more of windows issue likely to be caused due to a missing/corrupt class in root\microsoft\windows\servermanager
How do you know the issue is related to missing/corrupt wmi class ?
For this ,you need to create dump to analyse what is going on and here is what found in the dump log.
0 0000003ebe29d4c8 00007ffd372713ed ntdll!ZwWaitForMultipleObjects+0xa
1 0000003ebe29d4d0 00007ffd39a1f9e4 KERNELBASE!WaitForMultipleObjectsEx+0xe1
…
4 0000003ebe29d850 00007ffd2f31a1c7 wbemcore!CCoreQueue::QueueWaitForSingleObject+0x5c Waiting for thread running wbemcore!CCoreQueue::Execute
5 0000003ebe29d8a0 00007ffd2f328f5a wbemcore!CWmiFinalizer::GetOperationResult+0x67
6 0000003ebe29d8e0 00007ffd2a999afd wbemcore!CWbemNamespace::ExecQuery+0x2ae
7 0000003ebe29d9b0 00007ffd2aaad24a wuaueng!CSystemExprEvaluator::EvaluateWmiQuery+0x1e1
…
10 0000003ebe29df70 00007ffd2aaa7275 wuaueng!CAgentUpdateManager::EvaluateSingleApplicabilityRule+0x1a6
11 0000003ebe29e0a0 00007ffd2aaa6a76 wuaueng!CAgentUpdateManager::EvaluateUpdateApplicabilityRules+0x51a
12 0000003ebe29e8f0 00007ffd2a9857e9 wuaueng!CAgentUpdateManager::DetectForUpdate+0x3e7
13 0000003ebe29ead0 00007ffd2a997bdf wuaueng!CAgentUpdateManager::EvaluateUpdateSet+0x129
From the dump log ,We can see the hang is due to waiting for WBEM. WBEM is Web-Based Enterprise Management, and its Microsoft implementation is Windows Management Instrumentation (WMI).
When Windows Update is in “scanning for updates” state, the WMI provider in use is ServerManager.DeploymentProvider.
Below command is to compile servermanager.deploymentprovider.mof . If the ServerManager.DeploymentProvider is bad, this command will fix it. If the ServerManager.DeploymentProvider is good, below command will not cause any damage to the machine. Thus running this command is the troubleshooting action I chose.
Open cmd as an administrator
- Run: taskkill /f /fi “services eq wuauserv”
- Run the following command to recompile the MOF file: mofcomp c:\windows\system32\wbem\servermanager.deploymentprovider.mof
- Restart the machine.
After the server reboot, software update scan went through successfully.
I could not able to find a way to check whether ServerManager.DeploymentProvider is good or bad but compiling the MOF do not harm the server and that also fix the issue.
Hope it helps!