WSUS clients fail to download IE8

[David Trimboli]

I had a request from a small group to have Internet Explorer 8 installed
on their computers (my organization is generally operating at IE7 for
technical reasons). I have a Workstations group in WSUS, so I created an
IE8 group underneath that, put seven clients into it, and applied the
IE8 update to the new group.

The next day all of the clients failed to install the new browser, and
they have all consistently failed to install it over the last week. This
is the only update that is doing this. Below is the relevant section of
WindowsUpdate.log. The update job fails with "hr = 0x80190193,
BG_ERROR_CONTEXT = 5", and the download manager returns 0x80244018.

There are no proxies to worry about, and there are no firewalls in place
between the clients and the WSUS server.

2010-02-08 08:51:41:763 1056 914 DnldMgr *************
2010-02-08 08:51:41:763 1056 914 DnldMgr ** START ** DnldMgr:
Downloading updates [CallerId = AutomaticUpdates]
2010-02-08 08:51:41:763 1056 914 DnldMgr *********
2010-02-08 08:51:41:763 1056 914 DnldMgr * Call ID =
{BA590A22-DEB1-45D0-B4E3-3B9107A2D61F}
2010-02-08 08:51:41:763 1056 914 DnldMgr * Priority = 2, Interactive =
0, Owner is system = 1, Explicit proxy = 0, Proxy session id = -1,
ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2010-02-08 08:51:41:763 1056 914 DnldMgr * Updates to download = 1
2010-02-08 08:51:41:779 1056 914 Agent * Title = Internet Explorer 8
for Windows XP
2010-02-08 08:51:41:779 1056 914 Agent * UpdateId =
{696BF0A3-E713-432E-96D5-08559C69491D}.100
2010-02-08 08:51:41:779 1056 914 Agent * Bundles 1 updates:
2010-02-08 08:51:41:779 1056 914 Agent *
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100
2010-02-08 08:51:41:779 1056 914 DnldMgr *********** DnldMgr: New
download job [UpdateId = {EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100]
***********
2010-02-08 08:51:42:248 1056 914 DnldMgr * BITS job initialized, JobId
= {4D6E0AA0-D12C-438A-92F0-FFD067D9F70A}
2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe
to
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
(full file).
2010-02-08 08:51:42:435 1056 914 Agent *********
2010-02-08 08:51:42:435 1056 914 Agent ** END ** Agent: Downloading
updates [CallerId = AutomaticUpdates]
2010-02-08 08:51:42:435 1056 914 Agent *************
2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
{4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
BG_ERROR_CONTEXT = 5
2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total
= 16883552, bytes transferred = 0
2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe,
local path =
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred while
downloading update; notifying dependent calls.
2010-02-08 08:51:45:998 1056 85c AU >>## RESUMED ## AU: Download
update [UpdateId = {696BF0A3-E713-432E-96D5-08559C69491D}]
2010-02-08 08:51:45:998 1056 85c AU # WARNING: Download failed, error
= 0x80244018
2010-02-08 08:51:45:998 1056 85c AU #########
2010-02-08 08:51:45:998 1056 85c AU ## END ## AU: Download updates
2010-02-08 08:51:45:998 1056 85c AU #############

[Lawrence Garvin [MVP]]

The update job fails with "hr = 0x80190193, BG_ERROR_CONTEXT = 5", and the
download manager returns 0x80244018.
There are no proxies to worry about, and there are no firewalls in place
between the clients and the WSUS server.
2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe
to
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
(full file).
2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
{4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
BG_ERROR_CONTEXT = 5
2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total =
16883552, bytes transferred = 0
2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe,
local path =
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred while
downloading update; notifying dependent calls.

But you're on the right track . . . something on the server is denying
access to download this file.

The error code offered is an HTTP 403 error.
The next step is to review the IIS logs to obtain the HTTP 403.x sub-error
code,
and refer to this list of '403' suberrors to determine the exact nature of
the issue.

403 Substatus Error Codes for IIS

403.1 - Execute access forbidden.
403.2 - Read access forbidden.
403.3 - Write access forbidden.
403.4 - SSL required.
403.5 - SSL 128 required.
403.6 - IP address rejected.
403.7 - Client certificate required.
403.8 - Site access denied.
403.9 - Too many users.
403.10 - Invalid configuration.
403.11 - Password change.
403.12 - Mapper denied access.
403.13 - Client certificate revoked.
403.14 - Directory listing denied.
403.15 - Client Access Licenses exceeded.
403.16 - Client certificate is untrusted or invalid.
403.17 - Client certificate has expired or is not yet valid.

[David Trimboli]

Post by Lawrence Garvin [MVP]

The update job fails with "hr = 0x80190193, BG_ERROR_CONTEXT = 5", and
the download manager returns 0x80244018.
There are no proxies to worry about, and there are no firewalls in
place between the clients and the WSUS server.
2010-02-08 08:51:42:357 1056 914 DnldMgr * Downloading from
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe
to
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
(full file).
2010-02-08 08:51:45:482 1056 e30 DnldMgr WARNING: BITS job
{4D6E0AA0-D12C-438A-92F0-FFD067D9F70A} failed, updateId =
{EB2D095F-EF0D-438A-B58A-71B12FF5A08A}.100, hr = 0x80190193,
BG_ERROR_CONTEXT = 5
2010-02-08 08:51:45:482 1056 e30 DnldMgr Progress failure bytes total
= 16883552, bytes transferred = 0
2010-02-08 08:51:45:482 1056 e30 DnldMgr Failed job file: URL =
http://halo.cshl.edu:8530/Content/14/808C1E22EA669AE931DB841995F3BA211E00CD14.exe,
local path =
C:\WINDOWS\SoftwareDistribution\Download\3cd2f46df7c3a1cf0afa90212a6a273c\808c1e22ea669ae931db841995f3ba211e00cd14
2010-02-08 08:51:45:779 1056 e30 DnldMgr Error 0x80244018 occurred
while downloading update; notifying dependent calls.

But you're on the right track . . . something on the server is denying
access to download this file.
The error code offered is an HTTP 403 error.
The next step is to review the IIS logs to obtain the HTTP 403.x
sub-error code,
and refer to this list of '403' suberrors to determine the exact nature
of the issue.
403 Substatus Error Codes for IIS
403.1 - Execute access forbidden.
403.2 - Read access forbidden.
403.3 - Write access forbidden.
403.4 - SSL required.
403.5 - SSL 128 required.
403.6 - IP address rejected.
403.7 - Client certificate required.
403.8 - Site access denied.
403.9 - Too many users.
403.10 - Invalid configuration.
403.11 - Password change.
403.12 - Mapper denied access.
403.13 - Client certificate revoked.
403.14 - Directory listing denied.
403.15 - Client Access Licenses exceeded.
403.16 - Client certificate is untrusted or invalid.
403.17 - Client certificate has expired or is not yet valid.

Thanks for the suggestion. I'll talk to the manager of that server so we
can look at the IIS logs.