Windows 10 computer won't update

Question

My PC (Windows 10 2004) will happily install all updates provided via the company WSUS. But (in contrast to all other company client PCs) it fails to instal updates from Microsoft directly.

It keeps saying that "important security and quality fixes are missing" (which is the reason why I wanted to check directly with MS in the first place), but when I click "Search for updates online with Microsoft", it fails with a message that no connection with the update service could be made. I should check my internet connectivity (as if ...)

Windows troubleshooting for updates says that it cannot find any problems.

A (tiny) bit more helpful is the accompanying event: Id 36871, source SChannel, with internal error status 10013. Google results for this suggest various things such as

enable SSLv3
Make .NET 3.5 use TLS1.2
clear system certificate list
check clock synchronization
check permissions to c:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

None of these helped in my case. What else can I do? Is there a less generic interpretation of the event?

I also tried to use Wireshark and see what happens during the failed attempts. It seems as if a few https (TLS1.2) connections with slscr.update.microsoft.com are being established successfully, but with merely about 64 bytes of payload. By their nature, I can't look deeper into the conversations.

@MichaelHampton I am the IT department and look for competent ideas — Hagen von Eitzen, Sep 20 '20 at 07:46
Do you have a second to jump into a chat session tomorrow some time after 9am eastern US? — Elliot Huffman, Oct 23 '20 at 02:50

score 0 · Answer 1 · edited Oct 23 '20 at 11:36

0

Please check the relevant group policies settings. Because you are using a WSUS in your network, it is common to ban Windows from using the MS Update servers. Which in your case should not be this way, instead use the setting in the picture.

I'll try to find the English text if you did not manage to understand it.

edited Oct 23 '20 at 11:36

Glorfindel

1,213
4
15
22

answered Oct 22 '20 at 09:44

Chris9834

151
1
11

if this does not fix your problem, pls provide me with the html output-file of "gpresult /H c:/gpresult-output.html" Maybe you need to set Scope and pls. run as Domain-Admin. – Chris9834 Oct 22 '20 at 09:50
an set this group policy to "Enabled" also https://www.mustbegeek.com/how-to-disable-windows-update-using-group-policy/ – Chris9834 Oct 22 '20 at 09:55
Given that the GPO is the same as for other boxes, and (according to wireshark) that at least an *attempt* to contact MS servers happens, this did not apply :( -- Btw, I think (but didn't check) that if we had completely banned updates from MS, the link to look for updates at MS would not even show up or at least be disabled – Hagen von Eitzen Oct 24 '20 at 16:57

score 0 · Answer 2 · answered Oct 26 '20 at 08:54

If you would like to fix WSUS instead, make sure that you have selected Windows 10 1903 or later as a product in WSUS which you want to download patches for.

For some reason Microsoft split patches for Windows 10 into Pre-1903 (confusingly named just Windows 10) and 1903 or later.

This would explain why you're not getting any patches for your machine running Windows 10 2004, since if you don't select the "newer" Windows 10 product you won't get any patches to approve.

Windows 10 computer won't update

2 Answers2