Windows Server 2016 — SCCM Patch Deadline Missed Because WUA Service Is Disabled — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

ConfigMgr deployments miss deadline and patches remain required due to disabled Windows Update service.

Environment & Reproduction

Often introduced by hardening scripts that disable wuauserv.

Get-Service wuauserv
sc qc wuauserv

Root Cause Analysis

Software update scan and enforcement rely on WUA components even under SCCM control.

Quick Triage

Validate client health, policy retrieval, and update scan trigger status.

Get-Service ccmexec,wuauserv
Invoke-WmiMethod -Namespace rootccm -Class SMS_Client -Name TriggerSchedule '{00000000-0000-0000-0000-000000000113}'

Step-by-Step Diagnosis

Review UpdatesDeployment.log and WUAHandler.log for service state errors.

Get-Content C:WindowsCCMLogsWUAHandler.log -Tail 80
Get-Content C:WindowsCCMLogsUpdatesDeployment.log -Tail 80

Solution — Primary Fix

Set wuauserv startup mode correctly and restart update stack services.

Set-Service wuauserv -StartupType Manual
Start-Service wuauserv
Restart-Service ccmexec

Solution — Alternative Approaches

Re-install ConfigMgr client repair package if service dependencies are heavily drifted.

C:Windowsccmsetupccmsetup.exe /repair

Verification & Acceptance Criteria

Client successfully scans and applies required updates before next deadline.

Get-Service wuauserv
Get-Content C:WindowsCCMLogsScanAgent.log -Tail 60

Rollback Plan

Restore previous service policy if controlled exception requires temporary disablement.

Set-Service wuauserv -StartupType Disabled

Prevention & Hardening

Block unauthorized service hardening changes through baseline compliance checks.

Get-CimInstance Win32_Service -Filter "Name='wuauserv'"

Related Errors & Cross-Refs

Related: Scan failed error 0x87d00692, CI assignment not evaluated.

Related tutorial: View the step-by-step tutorial for Windows Server 2016.

View all Windows Server 2016 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft Endpoint Configuration Manager software update client prerequisites.