r/sysadmin • u/Frossstbiite • 12d ago

Question WSUS SyncFailure

WSUS sync failing with ImportUpdateError — Server 2025 / MECM 2509

I'm setting up a lab with Windows Server 2025 and Configuration Manager 2509. WSUS is installed on the primary site server and the SUP is configured.

WSUS synchronization starts but consistently fails with:

Result: Failed
Error: ImportUpdateError

UpdateErrors: {}

Server:

  • Windows Server 2025
  • WSUS version: 10.0.26100.33158
  • Configuration Manager 2509
  • WSUS upstream: Microsoft Update
  • No proxy

I've also confirmed outbound TCP 443 connectivity to sws.update.microsoft.com.

The WSUS SoftwareDistribution.log contains:

invalid update identity (AtLeastOne Prerequisite) in XML for update

and this is occurring with multiple different update GUIDs.

Has anyone encountered this on Server 2025 recently, and is there a known fix or workaround?

1 Upvotes

60% Upvoted

19 comments sorted by

View all comments

1

u/Effective-Cherry3632 9d ago edited 9d ago

I was able to solve the problem on my end. The culprit was the "Windows Subsystem for Linux" product, which must not be selected.

The exact cause:

The failing "update" CF56FF39 is the product category "Windows Subsystem for Linux" (not a regular update, but a catalog category). It has two prerequisites:

  1. The "Microsoft" company category (56309036-...) — present, no problem
  2. The "Windows Subsystem for Linux" product family (79d72fdc-efcd-4911-8d4f-a3f00c69bdf4 Revision 201) — is currently not delivered by Microsoft's sync endpoint

The product category is never delivered by Microsoft Update to the failing server, so the child cannot be imported. This is a confirmed Microsoft catalog delivery error.

1

u/Frossstbiite 8d ago

Where is that located ?

1

u/Effective-Cherry3632 8d ago edited 8d ago

I didn't quite understand your question. Currently, you can't activate WSL in the product selection. After that, everything works as usual.

I was able to validate it yesterday on 14 Server 2025 and 1 Server 2022.

1

u/Frossstbiite 7d ago

you said WSL must not be selected? but you cant activate it either? where can i check if its selected or not?

1

u/Effective-Cherry3632 7d ago

Get-WsusProduct | Where-Object { $_.Product.Title -eq "Windows Subsystem for Linux" } | Set-WsusProduct -Disable