WSUS clients fail to download IE8

I had a request from a small group to have Internet Explorer 8 installed
on their computers (my organization is generally operating at IE7 for
technical reasons). I have a Workstations group in WSUS, so I created an
IE8 group underneath that, put seven clients into it, and applied the
IE8 update to the new group.

The next day all of the clients failed to install the new browser, and
they have all consistently failed to install it over the last week. This
is the only update that is doing this. Below is the relevant section of
WindowsUpdate.log. The update job fails with "hr = 0x80190193,
BG_ERROR_CONTEXT = 5", and the download manager returns 0x80244018.

There are no proxies to worry about, and there are no firewalls in place
between the clients and the WSUS server.

2010-02-08 08:51:41:763 1056 914 DnldMgr *************
2010-02-08 08:51:41:763 1056 914 DnldMgr ** START ** DnldMgr:
Downloading updates [CallerId = AutomaticUpdates]
2010-02-08 08:51:41:763 1056 914 DnldMgr *********
2010-02-08 08:51:41:763 1056 914 DnldMgr * Call ID =
{BA590A22-DEB1-45D0-B4E3-3B9107A2D61F}
2010-02-08 08:51:41:763 1056 914 DnldMgr * Priority = 2, Interactive =
0, Owner is system = 1, Explicit proxy = 0, Proxy session id = -1,
ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2010-02-08 08:51:41:763 1056 914 DnldMgr * Updates to download = 1
2010-02-08 08:51:41:779 1056 914 Agent * Title = Internet Explorer 8
for Windows XP
2010-02-08 08:51:41:779 1056 914 Agent * UpdateId =
{696BF0A3-E713-432E-96D5-08559C69491D}.100
2010-02-08 08:51:41:779 1056 914 Agent * Bundles 1 updates:
2010-02-08 08:51:41:779 1056 914 Agent *
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100
2010-02-08 08:51:41:779 1056 914 DnldMgr *********** DnldMgr: New
download job [UpdateId = {EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100]
***********
2010-02-08 08:51:42:248 1056 914 DnldMgr * BITS job initialized, JobId
= {4D6E0AA0-D12C-438A-92F0-FFD067D9F70A}
2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
http://halo.cshl.edu:8530/Content/14...211E00CD14.exe
to
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
(full file).
2010-02-08 08:51:42:435 1056 914 Agent *********
2010-02-08 08:51:42:435 1056 914 Agent ** END ** Agent: Downloading
updates [CallerId = AutomaticUpdates]
2010-02-08 08:51:42:435 1056 914 Agent *************
2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
{4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
BG_ERROR_CONTEXT = 5
2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total
= 16883552, bytes transferred = 0
2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
http://halo.cshl.edu:8530/Content/14...211E00CD14.exe,
local path =
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred while
downloading update; notifying dependent calls.
2010-02-08 08:51:45:998 1056 85c AU >>## RESUMED ## AU: Download
update [UpdateId = {696BF0A3-E713-432E-96D5-08559C69491D}]
2010-02-08 08:51:45:998 1056 85c AU # WARNING: Download failed, error
= 0x80244018
2010-02-08 08:51:45:998 1056 85c AU #########
2010-02-08 08:51:45:998 1056 85c AU ## END ## AU: Download updates
2010-02-08 08:51:45:998 1056 85c AU #############


--
David Trimboli
Windows Systems Analyst
Cold Spring Harbor Laboratory

"David Trimboli" <> wrote in message
news:uCc%...

> The update job fails with "hr = 0x80190193, BG_ERROR_CONTEXT = 5", and the
> download manager returns 0x80244018.
>
> There are no proxies to worry about, and there are no firewalls in place
> between the clients and the WSUS server.

> 2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
> http://halo.cshl.edu:8530/Content/14...211E00CD14.exe
> to
> C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
> (full file).

> 2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
> {4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
> {EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
> BG_ERROR_CONTEXT = 5
> 2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total =
> 16883552, bytes transferred = 0
> 2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
> http://halo.cshl.edu:8530/Content/14...211E00CD14.exe,
> local path =
> C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
> 2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred while
> downloading update; notifying dependent calls.


But you're on the right track . . . something on the server is denying
access to download this file.

The error code offered is an HTTP 403 error.
The next step is to review the IIS logs to obtain the HTTP 403.x sub-error
code,
and refer to this list of '403' suberrors to determine the exact nature of
the issue.

403 Substatus Error Codes for IIS

403.1 - Execute access forbidden.
403.2 - Read access forbidden.
403.3 - Write access forbidden.
403.4 - SSL required.
403.5 - SSL 128 required.
403.6 - IP address rejected.
403.7 - Client certificate required.
403.8 - Site access denied.
403.9 - Too many users.
403.10 - Invalid configuration.
403.11 - Password change.
403.12 - Mapper denied access.
403.13 - Client certificate revoked.
403.14 - Directory listing denied.
403.15 - Client Access Licenses exceeded.
403.16 - Client certificate is untrusted or invalid.
403.17 - Client certificate has expired or is not yet valid.


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2010)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

On 2/9/2010 2:21 PM, Lawrence Garvin [MVP] wrote:
> "David Trimboli" <> wrote in message
> news:uCc%...
>
>> The update job fails with "hr = 0x80190193, BG_ERROR_CONTEXT = 5", and
>> the download manager returns 0x80244018.
>>
>> There are no proxies to worry about, and there are no firewalls in
>> place between the clients and the WSUS server.
>
>> 2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
>> http://halo.cshl.edu:8530/Content/14...211E00CD14.exe
>> to
>> C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
>> (full file).
>
>> 2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
>> {4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
>> {EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
>> BG_ERROR_CONTEXT = 5
>> 2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total
>> = 16883552, bytes transferred = 0
>> 2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
>> http://halo.cshl.edu:8530/Content/14...211E00CD14.exe,
>> local path =
>> C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df 7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995 f3ba211e00cd14
>>
>> 2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred
>> while downloading update; notifying dependent calls.
>
>
> But you're on the right track . . . something on the server is denying
> access to download this file.
>
> The error code offered is an HTTP 403 error.
> The next step is to review the IIS logs to obtain the HTTP 403.x
> sub-error code,
> and refer to this list of '403' suberrors to determine the exact nature
> of the issue.
>
> 403 Substatus Error Codes for IIS
>
> 403.1 - Execute access forbidden.
> 403.2 - Read access forbidden.
> 403.3 - Write access forbidden.
> 403.4 - SSL required.
> 403.5 - SSL 128 required.
> 403.6 - IP address rejected.
> 403.7 - Client certificate required.
> 403.8 - Site access denied.
> 403.9 - Too many users.
> 403.10 - Invalid configuration.
> 403.11 - Password change.
> 403.12 - Mapper denied access.
> 403.13 - Client certificate revoked.
> 403.14 - Directory listing denied.
> 403.15 - Client Access Licenses exceeded.
> 403.16 - Client certificate is untrusted or invalid.
> 403.17 - Client certificate has expired or is not yet valid.

Thanks for the suggestion. I'll talk to the manager of that server so we
can look at the IIS logs.

--
David Trimboli
Windows Systems Analyst
Cold Spring Harbor Laboratory