Re: WSUS 3.0 - The server is failing to download some updates

"yeiyei1986" <> wrote in message
news:...
>
> Hey. I have the same problem here.
>
> Try this to get the problem solved.
>
> 1. if you have WSUS in a Domain controler computer you may have to
> grant to the folder of wsus (the one selecte in wsus intalation) to user
> NETWORK SERVICE whith full access.
> 2. in the data base selected for wsus use grant access of db_owner to
> NETWORK SERVICE user.

Not unless somebody has changed the parent permissions, or employed a
Security Template after WSUS was installed.

WSUS properly creates all necessary NTFS permissions on WSUS-created
resources.

It *may* be necessary to grant the NETWORK SERVICE account READ permissions
on a non-SYSVOL drive where the \WSUS folder is created, if that has not
been previously done. If you were experiencing issues downloading updates to
a non-SYSVOL drive -- THIS is the change you probably should have made.

The NETWORK SERVICE account does not need any permissions on the \WSUS
folder, but should have
- Full Control permissions on the ~\WSUS\UpdateServicesDBFiles folder and
inherited down
- Full Control permissions on the ~\WSUS\WSUSContent folder and inherited
down
- Read/Write permissions on the ~\WSUS\UpdateServicesPackages folder and
inherited down
- Read & Execute / List Folder Contents / Read permissions on the
%ProgramFiles%\Update Services folder and inherited down.

The permissions have no significance whether WSUS is installed on a DC, a
member server, or a standalone server. The NETWORK SERVICE account is not a
domain member, and exists on all machines.

If you encountered security issues that were "fixed" by granting the
permissions you have documented, you have applied incorrect permissions
changes, and in any event there is absolutely no reason to change the
permissions inside the database.

The correct permissions are documented in the WSUS Operations Guide. You may
want to reconcile your entire installation with those documented permissions
to ensure you have not unnecessarily created any security thruways.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin