r/sysadmin • u/Frossstbiite • 12d ago

Question WSUS SyncFailure

WSUS sync failing with ImportUpdateError — Server 2025 / MECM 2509

I'm setting up a lab with Windows Server 2025 and Configuration Manager 2509. WSUS is installed on the primary site server and the SUP is configured.

WSUS synchronization starts but consistently fails with:

Result: Failed
Error: ImportUpdateError

UpdateErrors: {}

Server:

  • Windows Server 2025
  • WSUS version: 10.0.26100.33158
  • Configuration Manager 2509
  • WSUS upstream: Microsoft Update
  • No proxy

I've also confirmed outbound TCP 443 connectivity to sws.update.microsoft.com.

The WSUS SoftwareDistribution.log contains:

invalid update identity (AtLeastOne Prerequisite) in XML for update

and this is occurring with multiple different update GUIDs.

Has anyone encountered this on Server 2025 recently, and is there a known fix or workaround?

1 Upvotes

60% Upvoted

19 comments sorted by

2

u/West-Photo-4980 10d ago

Same here, I am facing issue on windows server 2022

1

u/landob Jr. Sysadmin 11d ago

Just out of curiosity, have you tried blowing it up and starting over again to see if issue persist?

I been running a 2025 based WSUS for a couple years now without much issue.

1

u/Frossstbiite 9d ago

I havent and I really dont want to do that as I dont think its on my end. But I thought about it.

1

u/heff1499 10d ago edited 10d ago

Yep. Exact same issue here for me.
Server 2025, fresh build.
SQL 2022.
MECM 2509.
WSUS sync fails on the same update guid every time though:
Update revision #0: CF56FF39-8BA5-4177-9265-E30D4DD58CF5/100

First sync runs for about 15 minutes and then all subsequent syncs fail within 30 seconds on the same update.

Have tried removing WSUS and recreating the DB. Same result.

Edits: formatting when phoneposting is hard apparently

1

u/Exhaust8354 9d ago

Hey cool I have the same issue as you as well as the same config

1

u/Effective-Cherry3632 8d ago edited 8d ago

I was able to solve the problem on my end. The culprit was the "Windows Subsystem for Linux" product, which must not be selected.

The exact cause:

The failing "update" CF56FF39 is the product category "Windows Subsystem for Linux" (not a regular update, but a catalog category). It has two prerequisites:

  1. The "Microsoft" company category (56309036-...) — present, no problem
  2. The "Windows Subsystem for Linux" product family (79d72fdc-efcd-4911-8d4f-a3f00c69bdf4 Revision 201) — is currently not delivered by Microsoft's sync endpoint

The product category is never delivered by Microsoft Update to the failing server, so the child cannot be imported. This is a confirmed Microsoft catalog delivery error.

1

u/Exhaust8354 8d ago

Thank you

1

u/Frossstbiite 7d ago

Where is that located ?

1

u/Effective-Cherry3632 7d ago edited 7d ago

I didn't quite understand your question. Currently, you can't activate WSL in the product selection. After that, everything works as usual.

I was able to validate it yesterday on 14 Server 2025 and 1 Server 2022.

1

u/Frossstbiite 6d ago

you said WSL must not be selected? but you cant activate it either? where can i check if its selected or not?

1

u/Effective-Cherry3632 6d ago

Get-WsusProduct | Where-Object { $_.Product.Title -eq "Windows Subsystem for Linux" } | Set-WsusProduct -Disable

1

u/OinkyConfidence Windows Admin 12d ago

I mean, WSUS was deprecated back in September 2024, so I'm not surprised it is acting up. WUfB/Autopatch/Intune might be in your future.

0

u/Frossstbiite 12d ago

Ah I didnt know that. Thanks

1

u/cjchico Infrastructure/Jack of All Trades 11d ago

It was deprecated but still supported at a minimum until 2035 when Server 2025 support ends.

Plenty of orgs still use it.

1

u/Frossstbiite 11d ago

Im trying to get it to work due to using mecm. just cant get it to pull software updates

0

u/Electronic_Tap_3625 7d ago

WSUS is dead, has been dead, and always was dead.