SCCM SUP 无法连接 WSUS 服务器 - 未安装 WSUS 服务器 3.0 SP2 或更高版本

Question

6 月 1 日，我们的一个软件更新点失去了连接到其 WSUS 服务器的能力：

WSUS Control Manager failed to monitor WSUS Server "SCCM.ad.contoso.gov". Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.

该SMS_WSUS_CONFIGURATION_MANAGER日志文件表明，无论是WSUS 3.0 SP2未安装或不能够由SMS SUP服务（SMS_WSUS_CONFIGURATION_MANAGER和SMS_WSUS_CONTROL_MANAGER）联系方式：

Error   Milestone   004 6/8/2015 5:01:30 AM SCCM.ad.contoso.gov SMS_WSUS_CONTROL_MANAGER    7003    WSUS Control Manager failed to monitor WSUS Server "SCCM.ad.contoso.gov".    Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.  Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.
Error   Milestone   004 6/8/2015 5:01:30 AM SCCM.ad.contoso.gov SMS_WSUS_CONTROL_MANAGER    7000    WSUS Control Manager failed to configure proxy settings on WSUS Server "SCCM.ad.contoso.gov".    Possible cause: WSUS Server version 3.0 SP2 or above is not installed or cannot be contacted.  Solution: Verify that the WSUS Server version 3.0 SP2 or greater is installed. Verify that the IIS ports configured in the site are same as those configured on the WSUS IIS website.You can receive failure because proxy is set but proxy name is not specified or proxy server port is invalid.
Information Milestone   004 6/8/2015 4:01:39 AM SCCM.ad.contoso.gov SMS_WSUS_CONTROL_MANAGER    4609    Component Status Summarizer set the status of component "SMS_WSUS_CONTROL_MANAGER", running on computer "SCCM.ad.contoso.gov", to Critical.    Possible cause: The component is experiencing a problem.  Solution: Diagnose and fix the problem by:  1. Examining the status messages that the component reports.  2. Correcting the problem.  3. Instructing Component Status Summarizer to reset the counts of Error, Warning, and/or Informational status messages reported by the component. To reset the counts, right-click Reset Counts on the component in the Component Status summary in the Configuration Manager Console. When the counts are reset, Component Status Summarizer will change the status of the component to OK. This might take some time if site "004" is a child site.  4. Delete any unwanted status messages from the site database, if necessary.  5. Monitor the component occasionally to verify that the problem does not reoccur.    Possible cause: The component is OK and you were unnecessarily alerted because the Component Status Thresholds are set too low for the component.  Solution: Increase the Component Status Thresholds for the component using the Thresholds tab of the Component Status Summarizer Properties dialog box in the Configuration Manager Console.    Possible cause: The component is flooding the status system by rapidly reporting the same message repeatedly.  Solution: Diagnose and control the flood of status messages by:  1. Verifying that the component is actually flooding the status system. View the status messages reported by the component and verify that the same message is continually reported every several minutes or seconds.  2. Noting the Message ID of the flooded status message.  3. Creating a Status Filter Rule for site "004" that instructs Status Manager to discard the flooded status message when component "SMS_WSUS_CONTROL_MANAGER" on computer "SCCM.ad.contoso.gov" reports it.   4. Verifying that your sites' databases were not filled up by the flooded status message.  Del
Information Milestone   004 6/8/2015 4:01:39 AM SCCM.ad.contoso.gov SMS_WSUS_CONTROL_MANAGER    4605    Component Status Summarizer detected that component "SMS_WSUS_CONTROL_MANAGER", running on computer "SCCM.ad.contoso.gov", has reported 5 or more Error status messages during the Component Status Threshold Period.    Possible cause: The count equals or exceeds the Component Status Critical Threshold (5 status messages) for Error status messages for the component.  Solution: Component Status Summarizer will set the component's status to Critical in the Component Status summary in the Configuration Manager Console.

我验证了 WSUS 角色确实仍然安装在 SCCM.ad.contoso.gov 上；但它似乎并不健康。我无法使用 Windows Server Update Services MMC 管理单元与它连接，并且事件日志中充满了以下可追溯到 6/1 的错误：

PS C:\Windows\system32> Get-EventLog -LogName Application -Source "Windows Server Update Services" -After $(Date -Month 06 -Day 07)

  Index Time          EntryType   Source                 InstanceID Message
   ----- ----          ---------   ------                 ---------- -------
  267564 Jun 08 04:14  Error       Windows Server Up...        12052 The DSS Authentication Web Service is not working.
  267563 Jun 08 04:14  Error       Windows Server Up...        12042 The SimpleAuth Web Service is not working.
  267562 Jun 08 04:14  Error       Windows Server Up...        12022 The Client Web Service is not working.
  267561 Jun 08 04:14  Error       Windows Server Up...        12032 The Server Synchronization Web Service is not w...
  267560 Jun 08 04:14  Error       Windows Server Up...        12012 The API Remoting Web Service is not working.
  267559 Jun 08 04:14  Error       Windows Server Up...        12002 The Reporting Web Service is not working.
  267558 Jun 08 04:14  Warning     Windows Server Up...        10021 The catalog was last synchronized successfully ...

我验证了 WsusService 确实在运行，然后检查了 IIS：

呵呵。那可能不太好。WsusPool 应用程序池可能应该正在运行...如果我手动启动 WsusPool，我可以通过浏览到 WSUS WebServices 连接到http://SCCM.ad.contoso.gov:8530/Selfupdate...然后大约 15 分钟后应用程序池停止。

它也在错误的端口（8530/8531）上运行！大约一个月前，在 PFE 的帮助下，我们将此 SUP 配置为可供基于 Internet 的客户端使用。重新配置的一部分意味着 WSUS Web 服务需要重新定位到 80/443，以便它们可以通过我们的外围防火墙使用。

我没有关于我们使用的确切命令的文档，但我有理由确定它是WSUSUtil.exe usecustomwebsite false，它应该将 WSUS 从其“WSUS 管理”IIS 移回绑定在 *:80 和 * 下的默认网站:443。

再次。不是这种情况：

那不好。看起来 WSUS 站点已经神奇地迁移回了它的独立站点，因为...有趣！如果 SCCM SUP 正在寻找 80/443 上的 WSUS 并且它不再存在，难怪它不起作用。

如果我查看WSUSUtil.exe正在操作的注册表项 ( HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup\PortNumbner)，我会发现它仍然认为 WSUS 应该在 80 上运行。

也许我只需要运行WsusUtil.exe不止一次以获得额外的......有趣？

C:\Program Files\Update Services\Tools>WsusUtil.exe usecustomwebsite false
Using port number: 80

除了... IIS 中没有任何变化。我要么不记得我们之前为移动 WSUS IIS 站点所做的步骤，要么是某些东西坏了。

我真的有两个问题：

• WSUS 网站“WSUS 管理”已恢复为作为独立 IIS 网站绑定到 *:8530 和 *:8531 的安装配置，但系统的底层部分认为它应该在绑定到 * 的“默认网站”下运行:80 和 *:443。
• WsusPool 应用程序池不断崩溃或停止阻止我重新配置 SUP 点以在其原始 *:8530 和 *:8531 端口上使用 WSUS。

在这一点上，我对如何继续解决此问题感到茫然。由于明天即将发布 Microsoft 更新，我真的希望尽可能避免重新安装 WSUS 角色和/或 SUP。

有关进一步故障排除的任何建议？

Answer 1

在jscott的帮助下，我将注册表项与他的基础设施中的注册表项进行了比较HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup，发现它们不一致。类似的值IISTargetWebSiteIndex设置为“WSUS 管理”IIS 站点的 ID，但该PortNumber值设置为 80，通过 *:80 绑定到Default Web Site.

由于我们在此服务器上至少进行了三次重新配置 WSUS 的迭代，因此最好重新安装角色以确保一切保持一致，尽管仍然存在问题。

我最后去了 Microsoft 支持，他们友好地指出 WsusPool 应用程序池的专用内存使用限制为 18530 KB。我们昨天早上取消了限制，从那时起一切都运行良好。我不确定这个限制是如何设置的，或者是否是默认的，但对我来说它似乎很小。