Windows update not working (2008 R2)

Question

long story short, one of our domain controllers is won't update.

when an update is attempted it says the service is not running (checked and restarted yes it is) and event viewer says its error 0x80072ee2 but this apparently means there is a connection issue but as far as I can work out there isn't.

this isn't a short term issue either seems to have been going on since at least feburary.

any ideas?

Note: Server updates fall to another (more senior) member of the team please do not ask me why they have been so neglected. He doesn't know what the issue is so I'm just trying to get to the bottom of this.

many thanks

Cheers

EDIT: I've put trusted sites on and seems to have sorted it. not sure why I don't believe it set up like this one any other server.

Solution

(Taken from http://support.microsoft.com/kb/836941, which you should read as well as my summary.)

(Windows Update) errors may be caused by any of the following issues:

• Programs or processes that interfere with Internet communications
• Resource issues on the computer
• High Internet activity
• Recoverable database errors

So I guess I'd start by asking can you browse the internet in general from this server? Has anyone installed anything or configured anything that might interfere with downloads (e.g. local firewall, or a download "manager"? Resolve any issues around this first.

Next check BITS and Trusted sites entries, as per the KBase article above. These are both important components of Windows Update.

Ensure that the proxy settings on Internet Explorer are configured correctly to browse the internet from that machine, and then run the following command (it may need to be done from an elevated command prompt):

netsh winhttp import proxy source=ie

This will import the proxy settings from IE into the general windows HTTP connection stack, which is what Windows Update uses. A restart might be needed for this to affect the Windows Update services.

If this works then you need to consider how/why it got changed in the first place... the change may have been made for a good reason and you might have now stopped something else working.

Comments

[Mathias R. Jessen]

Copy/paste the entire event log message please - replace sensitive information if necessary

[Mathias R. Jessen]

The last 2 "methods" in the KB, BITS up-to-dateness and Trusted Sites, might be something that have been overlooked, even though you have internet connectivity

[Rob Moir]

Totally agree @MathiasR.Jessen - thanks for the reminder. I didn't mention them because I didn't want to cut and paste too much from the article, but you're right, I should have drawn attention to those specifically as they're easy to forget. I've edited my question to mention them.

[Krispy K]

Just an FYI to help others who this may apply to - at one client, a server refused to update and though I forgot why, I started pinging the related Windows Update servers (public servers). I found that on this server (which for some reason had DNS servers different from the others), the Windows Update servers were pointed to the wrong IPs. I had to statically set them via the hosts file. (I notified the client but it's a LARGE corporation and getting authorization to change DNS was not forthcoming).