WSUS shows incorrect Needed Count (or: how to get it to 100%?)

Question

I want to monitor which of my servers need updates so I installed WSUS. Installation went fine and the servers are getting their updates now from WSUS. However, most of the servers show an incorrect number of needed updates.

For example this one:

It says that the server needs 2 updates.

I checked in the windowsupdate.log on the server which also reports the same number (which is probably where WSUS gets the number from):

But when I check the Windows Update UI, it says that all updates are installed, even after a reboot:

How do I get the required updates showing here, or how do I make the thing report back that it doesn't need any more updates (if that's the case) ?

Solution 1

I think I found out what the error was: not enough disk space. I noticed the disk that has the WSUS content only had 18 mb free. After expanding it, the disk started filling up again, so then I knew not all updates were downloaded. The following morning the server indeed needed two updates.

There was a hint about the disk space in the report you get when you click on a server (Status Report). Clicking on the Not Installed link showed a message, something along the lines of "the update has not yet been downloaded".

Solution 2

Without knowing how you have your WSUS server setup, it would be hard to direct you but from my experience running a WSUS server, typically, you have a test group that you setup to test updates before approving the updates for production machines. You can check the updates showing in the WSUS to make sure those have been approved for the right machines. Also, depending on the synchronization schedule that you have configured in WSUS which indicates how often machines should checkin with the WSUS server for updates would determine when those report stats gets updated. You can you use these commands to force it to checkin with the WSUS server: wuauclt /detectnow and wuauclt /reportnow in an elevated command prompt and then do a manual updates check to see if those gets updated. Also, from you screenshot above, you should be able to add another column which will show you the last time the machine checked in with WSUS. In all

• Check updates approval in WSUS
• Check synchronization schedule or date in WSUS
• Run commands above
• Perform manual updates check

Comments

[Qzen]

Thank you. I added the columns and they show last contact and last report was 2 minutes ago. Also I run commands and then did a re-check for updates. It still says 2 needed in wsus and in the server it says nothing is available. I set up wsus with the steps from here woshub.com/installing-configuring-wsus-on-windows-server-201‌​2

[joeqwerty]

Also, depending on the synchronization schedule that you have configured in WSUS which indicates how often machines should checkin with the WSUS server for updates would determine when those report stats gets updated - This is incorrect. The synch schedule in WSUS tells WSUS how often to sync with it's update source (upstream WSUS server or MS).

[TeNaJ Systems]

@Jao, did you check the approvals for those two updates in WSUS to make sure you approved them for that machine?

[TeNaJ Systems]

@joeqwerty, my mistake, what i meant was on the client side and not the server side.