1

Hello,

I’ve got WSUS 3.2.7600.226 (3.0 SP2) running on a Windows Server 2008 32-bit server. In the last several days, routine notification emails have stopped coming (my boss and I get a daily status update every day at 6:00 AM). Our email setup is Exchange 2010 SP3 running on a Windows Server 2008 R2 x64 machine. Looking at the event logs, I noticed multiple 10052 errors stating that WSUS is unable to send emails. Googling the error hasn’t yielded much help, other than potential conflicts with McAfee antivirus (we have Symantec) and using the email test function under the E-Mail Notifications Options.

Using the email test yielded the following:

System.Net.Mail.SmtpException: Failure sending mail. —> System.Net.WebException: Unable to connect to the remote server —> System.Exception: A connection attempt failed because the connected party did not properly respond after a period of time, or established connection failed because connected host has failed to respond XXX.XXX.XXX.XXX:25

— End of inner exception stack trace —

— End of inner exception stack trace —

at Microsoft.UpdateServices.Internal.BaseApi.SoapExceptionProcessor.DeserializeAndThrow(SoapException soapException)

at Microsoft.UpdateServices.Internal.DatabaseAccess.AdminDataAccessProxy.SendTestEmail(String emailLanguage, String smtpUserName, String senderEmailAddress, String smtpHostName, Int32 smtpPort, String recipients)

at Microsoft.UpdateServices.Internal.BaseApi.EmailNotificationConfiguration.SendTestEmail()

at Microsoft.UpdateServices.UI.SnapIn.Dialogs.EmailNotificationSettingsDialog.backgroundWorker_DoWork(Object sender, DoWorkEventArgs e)

The email address used for sending these notifications is whitelisted on our spam filter and firewall. I haven’t made any changes to WSUS for months other than approving updates for our servers every month (though I’m thinking of running the cleanup wizard this weekend). Googling the error message above has only yielded only suggestions to use a WSUS Diagnostic Tool. However, none of the links I’ve found to date have yielded anything.

Has anyone else had this problem with WSUS? If so, how were you able to solve it?

3 Spice ups
2

If you’re thinking about the cleanup wizard …you should grab OverDrive’s script instead …

WSUS constipation has set in, most likely

@overdrive

3

Have a peek at my Adamj Clean-WSUS script. It is the last WSUS Script you will ever need.

http://community.spiceworks.com/scripts/show/2998-adamj-clean-wsus

What it does:

  1. Shrink your WSUSContent folder’s size by declining superseded updates.
  2. It will clean out all the synchronization logs that have built up over time (configurable, with the default keeping the last 14 days of logs).
  3. Remove all Drivers from the WSUS Database.
  4. Remove declined updates from the WSUS Database
  5. Run the server cleanup wizard.
  6. Lastly, but most important, it will run the recommended maintenance script on the actual SQL database.

It will email the report out to you or save it to a file, or both.

Follow the instructions at the top of the script, but essentially run .\Clean-WSUS.ps1 -FirstRun and then set a scheduled task to run the script with the -ScheduledRun daily at a time you want.

4

Thanks for your help, guys. The database is cleaned up, although it took multiple runs of the cleanup wizard, which kept hanging. I tried to get my boss to use the cleanup script but was overruled. However, there’s still a problem sending emails. Sometimes the test function works, but most of the time I still get that error message I detailed above. I researched that issue again and I created a separate receive connector, which has not yielded success. The initial test emails worked, but I still didn’t get updates notifications or my daily status update. The “requires authentication” checkbox was turned off, but it’s always been like that. I’ve turned it on and tried the test function again, which sent a successful test email. I guess all I can do now is wait until later. Hopefully tomorrow morning’s status update will come through.

5

Run only the sections you want to run then - like WSUSDBMaintenance. I made my script modular like that so that you can run only the sections you want, or follow my guided version for a cleanup.

If he doesn’t want to run my script because someone else wrote it, then review my script and grab the SQL queries directly - locations linked - from technet and other places. Have him review those, and use those.

6

Thanks for the update, and thanks again for your help. Would the cleanup wizard) have any effect on email notifications? The additional receive connector didn’t work, as I still didn’t get a daily status summary email (which I should get every day at 6 AM). The only thing WSUS-related in the event logs is a 10052 error at 2AM and again at 3AM (unable to send emails). In fact, it was my own research on that code before that led me to create the separate receive connector for WSUS, which did not exist before. I did note that initially that in the “Outgoing e-mail server” field, the IP address for our Exchange server was listed, not the FQDN. I tried changing to the FQDN and sent a test, which went through after the second attempt (the first yielded an error like in my initial post). I checked the event logs after the test attempts any found nothing new. The only thing in the WSUS Configuration Logs was the same message I just mentioned. The other strange thing is that the email test were sent almost immediately one after the other. The only other thing that I can think of is that the email address name for WSUS is update@domain.com, but there is no mailbox set up in Exchange for that (although everything it worked fine that way until the first weekend of this month). Any ideas as to what I could be missing?

7

Exchange 2010 is similar in the creation, except it’s just called a Transport Role, not Frontend Transport

In Exchange 2013, Log into the ECP > Mail Flow > Receive Connectors. Click the + sign to add a new receive connector. Give it a descriptive name, and choose the Frontend Transport role. Choose the type Custom and click Next. Select the port you wish to listen on - which is usually fine at 25 from all available IPv4. Click Next. Edit the remote IP Addresses listing that is there by default, and add only the IPs or IP range that you wish to use this Receive Connector for. Click on OK, and then Finish.

Select the newly created receive connector and click on the Edit icon. Choose the maximum message size you wish to send out using this receive connector (keep in mind that organizational limits may be more or less and the most restrictive will win). Go to the Security section, and make sure that the only boxes checked off are:

  1. Transport Layer Security (TLS)
  2. Externally secured (for example, with IPsec)
  3. Exchange servers

In the FQDN setting at the bottom, type in your external hostname to access your mail (eg. mail.domain.com). Click Save