Artica Wiki

Windows Updates: limitations and troubleshooting

Diagnose listener, cache, catalogue and client problems without mistaking traffic for installation.

Microsoft super-cache

The Microsoft super-cache card shows the state, the configured interface and the address really in use.
An error appears under the state, in English.

Message or symptom Checks
address already in use Another service listens on the same port.
Port 80 is often used by the error page service, the HotSpot web service or the proxy-pac service.
Choose another interface or another port.
Artica retries every ten seconds.
listen interface <name> not found The interface no longer exists.
Choose another one in the super-cache settings.
listen interface <name> has no IPv4 address Give the interface an IPv4 address, or choose another interface.
Artica does not fall back to all addresses.
legacy listen address <ip> is not configured on any interface An older version stored an IP address instead of an interface.
That address is not the primary address of any interface.
Open the settings and choose the interface.
Computers still download everything from Microsoft Check CacheHost in Get-DeliveryOptimizationStatus on the computer.
Check that its subnet is in Allowed client networks.
Check that the computer reaches the port in HTTP.
The access log shows HTTP 403 for a computer Its subnet is not allowed, or it asked for a host outside the Microsoft list.
The cached files list stays short Files already on a computer are not downloaded again.
Content without a Microsoft lifetime is relayed and not stored.
Relayed without storage keeps rising The cache cannot make room.
Raise the storage limit or free disk space.
See storage and rotation.

On the computer, the Delivery Optimization log tells why a download left the cache:

Get-DeliveryOptimizationLog | Where-Object Message -Match 'CacheHost|fallback|0x8007' |
    Select-Object -Last 30 TimeCreated, Message

Windows gives up on a cache server after about four seconds without data.
It then uses Microsoft for 30 seconds before it tries the cache again.
A few such fallbacks during the first download of a large file are normal.

Decision-source mode

Qualification limits

Area Current limit
Native Windows dialogue An empty scan is verified on one Windows 10 Pro 22H2 x64 build.
It is not proof of a full update cycle.
Catalogue The imported Microsoft metadata subset is experimental.
Completeness is not established.
Approvals Local decisions and reasons are recorded.
Native distribution readiness remains pending.
Several Windows profiles Separate imports and approvals are available.
Native session routing between profiles is not qualified.
Office MSI and Click-to-Run content families can be selected.
Automatic Office catalogue discovery, repository layout and installation are not provided.
Reporting No per-computer installation or patch-compliance report.
Storage limit Controls new content caching.
Does not cap database growth.
Approved content objects are never removed by rotation.

Service status

Check the left status widget, observed listening address and desired/applied revision.
A saved configuration can still fail to start.
The service error is shown in the dashboard.
Wait for matching revisions before testing the client endpoint.

Symptom Checks
Non-loopback TCP cannot start Select a valid certificate from the certificate centre.
Check that it includes a matching private key.
Unix listener is active but clients cannot connect Confirm that the HTTPS reverse proxy exists and forwards the root paths to the fixed Unix socket.
Reverse proxy reports an upstream error after switching from TCP Reopen the listener settings and save Unix mode.
The console clears internal TLS so the Unix upstream speaks HTTP.
Client receives an access refusal Check its CIDR.
Behind a local reverse proxy, enable trusted client IP handling and overwrite X-Real-IP.
No profile or no catalogue data Select and configure a Windows profile before synchronization.
A server preset alone does not prove catalogue coverage.
Synchronization fails Check DNS, Microsoft HTTPS reachability and the outgoing proxy settings.
Do not expect a failed proxy connection to fall back silently to direct access.
Content request fails Check approval, product selection, expected SHA256, size and source URL expiration.
Source traffic continues after the cache is full This is expected relay behaviour for missing files that rotation cannot make room for.
Statistics unavailable Enable the listener first.
Durable counters remain stored while the service is disabled.
Client still uses another update service Inspect the effective GPO or MDM policy and scan source rules.
Check DNS and certificate trust before changing policies again.

Useful client checks

Get-Service wuauserv
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
    -ErrorAction SilentlyContinue | Select-Object WUServer, WUStatusServer
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
    -ErrorAction SilentlyContinue | Select-Object UseWUServer, NoAutoUpdate
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' `
    -MaxEvents 20 | Select-Object TimeCreated, Id, Message

Do not delete the Windows Update databases or cached files as a first troubleshooting step.
Preserve the error, profile, source URL expiry and service revisions for diagnosis.
Use the pilot rollback procedure before returning a test computer to its normal update policy.

Before wider deployment