{"id":664,"date":"2016-11-22T03:19:55","date_gmt":"2016-11-21T20:19:55","guid":{"rendered":"http:\/\/blog.trichev.com\/?p=664"},"modified":"2017-08-10T09:11:26","modified_gmt":"2017-08-10T02:11:26","slug":"sccm-1606-software-updates-deployment-fails-after-enabling-https","status":"publish","type":"post","link":"https:\/\/trichev.com\/blog\/2016\/11\/22\/sccm-1606-software-updates-deployment-fails-after-enabling-https\/","title":{"rendered":"SCCM 1606. Software Updates Deployment fails after enabling HTTPS"},"content":{"rendered":"

After I have enabled HTTPS on every SCCM 1606 component all my windows update client just suddenly stopped working. Windows Update check stopped with “0x80244019”<\/p>\n

WindowsUpdate.log on a client side:
\n2016\/11\/21 13:13:00.7947333 1396 5228 WebServices Auto proxy settings for this web service call.
\n2016\/11\/21 13:13:00.8137726 1396 5228 WebServices Auto proxy settings for this web service call.
\n2016\/11\/21 13:13:00.8267772 1396 5228 WebServices WS error: There was an error communicating with the endpoint at ‘https:\/\/sccmwsusserver.com:8531\/ClientWebService\/client.asmx’.
\n2016\/11\/21 13:13:00.8267778 1396 5228 WebServices WS error: The server returned HTTP status code ‘404 (0x194)’ with text ‘Not Found’.
\n2016\/11\/21 13:13:00.8267778 1396 5228 WebServices WS error: The requested resource was not found.
\n2016\/11\/21 13:13:00.8267787 1396 5228 WebServices Web service call failed with hr = 80244019.
\n2016\/11\/21 13:13:00.8267787 1396 5228 WebServices Current service auth scheme=0.
\n2016\/11\/21 13:13:00.8267790 1396 5228 WebServices Current Proxy auth scheme=0.<\/p>\n

Ok, lets troubleshoot:<\/p>\n

netsh winhttp show proxy<\/p>\n

Current WinHTTP proxy settings:<\/p>\n

Direct access (no proxy server).<\/p>\n

https:\/\/sccmwsusserver.com:8531\/SimpleAuthWebService\/SimpleAuth.asmx – reachable
\nhttps:\/\/sccmwsusserver.com.com:8531\/ClientWebService\/client.asmx – reachable<\/p>\n

Clients\/DMZ firewalls were fine also<\/p>\n

After some useless googling I’ve found this Microsoft TechNet thread <\/a>.
\nAnd last replay was: “Whats in WCM.log on the SUP? Was KB3159706 recently installed? If you do, there is some post installation steps https:\/\/support.microsoft.com\/en-au\/kb\/3159706”. Interesting. I checked updates on my SCCM server and I found KB3159706 installed there. Great. Let me copy-paste from the article:<\/p>\n

Manual steps required to complete the installation of this update<\/p>\n

Open an elevated Command Prompt window, and then run the following command (case sensitive, assume “C” as the system volume):<\/p>\n

“C:\\Program Files\\Update Services\\Tools\\wsusutil.exe” postinstall \/servicing<\/strong><\/p>\n

Select HTTP Activation<\/strong> under .NET Framework 4.5 Features<\/strong> in the Server Manager Add Roles and Features wizard.<\/p>\n

\"HTTP
\nRestart the WSUS service.<\/p>\n

If SSL is enabled on the WSUS server<\/p>\n

Assign ownership of the Web.Config file to the administrators group (run at an elevated command prompt):
\ncd “C:\\Program Files\\Update Services\\WebServices\\ClientWebService\\”
\ntakeown \/f web.config \/a<\/strong><\/p>\n

icacls “C:\\Program Files\\Update Services\\WebServices\\ClientWebService\\Web.config” \/grant administrators:f<\/strong><\/p>\n

Locate the Web.Config file in the following path:
\nC:\\Program Files\\Update Services\\WebServices\\ClientWebService\\Web.Config
\nMake the following changes in the file.<\/p>\n

Note This code sample represents a single text block. The line spacing is used only to emphasize the text changes, which are shown in bold.<\/p>\n

\n
<services>\r\n          <service\r\n                name=\"Microsoft.UpdateServices.Internal.Client\"\r\n                behaviorConfiguration=\"ClientWebServiceBehaviour\"><\/pre>\n
               <!-- \r\n                  These 4 endpoint bindings are required for supporting both http and https\r\n                -->\r\n                <endpoint address=\"\"\r\n                        binding=\"basicHttpBinding\"\r\n                        bindingConfiguration=\"SSL\"\r\n                        contract=\"Microsoft.UpdateServices.Internal.IClientWebService\" \/>\r\n                <endpoint address=\"secured\"\r\n                        binding=\"basicHttpBinding\"\r\n                        bindingConfiguration=\"SSL\"\r\n                        contract=\"Microsoft.UpdateServices.Internal.IClientWebService\" \/><\/strong><\/pre>\n
               <endpoint address=\"\"\r\n                        binding=\"basicHttpBinding\"\r\n                        bindingConfiguration=\"ClientWebServiceBinding\"\r\n                        contract=\"Microsoft.UpdateServices.Internal.IClientWebService\" \/>\r\n                <endpoint address=\"secured\"\r\n                        binding=\"basicHttpBinding\" \r\n                        bindingConfiguration=\"ClientWebServiceBinding\"\r\n                        contract=\"Microsoft.UpdateServices.Internal.IClientWebService\" \/>\r\n          <\/service>\r\n    <\/services><\/pre>\n<\/div>\n
Add the multipleSiteBindingsEnabled=”true”<\/span> attribute to the bottom of the Web.Config file, as shown:<\/p>\n
\n
<\/bindings>\r\n<serviceHostingEnvironment aspNetCompatibilityEnabled=\"true\" multipleSiteBindingsEnabled=\"true\" \/>\r\n<\/system.serviceModel><\/pre>\n<\/div>\n
Links:
\nhttps:\/\/nhogarth.net\/2016\/09\/13\/scan-failed-with-error-0x80244019\/<\/a>
\nhttp:\/\/thedesktopteam.com\/raphael\/sccm-2012-scan-failed-with-error-0x80244019\/<\/a>
\nhttps:\/\/support.microsoft.com\/en-us\/kb\/900935<\/a>
\nhttps:\/\/social.technet.microsoft.com\/Forums\/en-US\/3b85e68e-7ab5-4935-9221-40973487ecae\/software-updates-deployment-fails-after-enabling-https-scan-failed-with-error-0x80244019<\/a>
\nhttps:\/\/support.microsoft.com\/en-au\/kb\/3159706<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
After I have enabled HTTPS on every SCCM 1606 component all my windows update client just suddenly stopped working. Windows Update check stopped with “0x80244019” WindowsUpdate.log on a client side: 2016\/11\/21 13:13:00.7947333 1396 5228 WebServices Auto proxy settings for this web service call. 2016\/11\/21 13:13:00.8137726 1396 5228 WebServices Auto proxy settings for this web service […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[231],"tags":[209,210,234,208,14,11],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/664"}],"collection":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/comments?post=664"}],"version-history":[{"count":1,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/664\/revisions"}],"predecessor-version":[{"id":665,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/posts\/664\/revisions\/665"}],"wp:attachment":[{"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/media?parent=664"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/categories?post=664"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/trichev.com\/blog\/wp-json\/wp\/v2\/tags?post=664"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}