Reset Windows Update Agent

after 10yrs of windows 7 i would've thought there would be a stand alone file to re install windows update if it continued to give errors whilst trying to install updates. this seems to be a common fault i'm reading. for us non tech guys do the patrons on this website have a solution for us non tech guys to help us get windows 7 upto date before the big switch off in jan 2020. microsoft are not helping the likes of me and my fellow strugglers as all they seem to want us to do is buy laptops or desk top pc's with windows 10.
please help if you can.

Hi tallbaddad,

At the end of Windows 7 support, the update servers will shut down for home versions, while the versions used in banks and companies will continue to run for a while while the transition ends.

I would not recommend acquiring a version of Windows 7 for companies since those available on the Internet are shared by thousands of users.

I could recommend you to make some updates of the business versions manually without any guarantee. However, the best recommendation I could give you is to purchase a Windows 8.1 license that is compatible with some older PCs through an authorized wholesale distributor, since Microsoft will only offer you the most recent versions of its products.

It is important that you consult with an expert about the compatibility of Windows 8.1 with your current device before making a purchase of this license.

I remain attentive to your comments.

Slava Tarasov: "I think the service security descriptors in the script are no longer valid"

If this is true the script should either get updated or removed, or atleast have a BIG notice somewhere for users to see!!!!!

Hi h3ctiic,

I have already included this change in the script version of this tool.

Thanks!

Hi there,

I think the service security descriptors in the script are no longer valid, at least for W10 1803+.
Even you try to run it manually in a CMD prompt - it always gives you: The access control list (ACL) structure is invalid, please advise.

The output sc sdshow in W10 1903 is resulted in the following SDDLs:
wuauserv
D:(A;CI;CCLCSWRPLORC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD)

bits
D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;SAFA;WDWO;;;BA)

cryptsvc
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;CCLCSWLORC;;;AC)(A;;CCLCSWLORC;;;S-1-15-3-1024-3203351429-2120443784-2872670797-1918958302-2829055647-4275794519-765664414-2751773334)

trustedinstaller
D:(A;CI;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;SAFA;WDWO;;;BA)

What I mean are these lines below can be found in the script:
sc.exe sdset wuauserv D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;WD)
	sc.exe sdset bits D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;WD)
	sc.exe sdset cryptsvc D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;WD)
	sc.exe sdset trustedinstaller D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLCRSDRCWDWO;;;SO)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;WD)

Hi Slava,

I'm sorry for being late.

I have already included this change in the script version of this tool.

It will take some time to include it in the executable version since I am preparing several changes for that version.

Thank you for your comments.

A corrupted registry.pol will prevent gpos from applying and software updates from installing via SCCM. It usually corrupts due to missing AV exclusions. I have a script that will detect if it's corrupt or not and delete it if so if you're interested in it?

Hi Russ,

Of course! this tool is built for the users. Any contribution is well received.

Thank so much!

If it's corrupted, it's always full of NULLs/whitespace.  If it's not corrupt, the byte encoded value of the first 4 lines of it will always equal a value of 8082101103. When it's corrupt, there's always a -2147467259 or 0x80004005 in wuahandler.log if using SCCM. There should be various GPO failures in the eventlogs as well when it's broke.

Function Test-IsRegistryPOLGood
    {
        [cmdletbinding()]
        Param
            (
                [Parameter(Mandatory=$false)]
                    [string[]]$PathToRegistryPOLFile = $(Join-Path $env:windir 'System32\GroupPolicy\Machine\Registry.pol')
            )
 
        if(!(Test-Path -Path $PathToRegistryPOLFile -PathType Leaf)) { return $null }
 
        [Byte[]]$FileHeader = Get-Content -Encoding Byte -Path $PathToRegistryPOLFile -TotalCount 4
 
        if(($FileHeader -join '') -eq '8082101103') { return 'Compliant' } else { return 'Not-Compliant' }
    }

Test-IsRegistryPOLGood

I'm sorry for being late.

I'll try implement this PowerShell script in my Windows Shell Script.

Thank you so much.

How i can send it to you for distribution.
you can find it here: 
https://1drv.ms/u/s!Ahekt4Y668a52ctnTz-Cq0bj47U1ug?e=zxIkgT

The only additional text is bei comment in the TOP stating the translation by me.

Hi Alexander Jacubowsky (AJEDV),

Do you agree that I created a post on TechNet and publish it on wureset.com for distribution? Obviously, the credits to your name will be kept.

Sure, that's what I expected.
Thank you.

It's done!

Skript Reset Windows Update Tool (Deutsch) - https://gallery.technet.microsoft.com/scriptcenter/Skript-Reset-Windows-db19560e

Thanks!

Is it possible to run the command line tool remotely from something like PDQ deploy without any user prompts and run the command line tool silently in the background.

Love the tool, but would be awesome if i could run the commands without any user intervention.

Thanks philly169,

It's possible with the executable version.

You can create a self-extracting file with WinRAR for run in background.

For example:

```SFX
Setup=wureset.exe /reset
TempMode
Silent=1
Overwrite=1
```

Also, you can run this tool automatically using Windows Task Scheduler or Regedit.

Download the executable version in https://wureset.com/downloads.php and see more about command line arguments in http://docs.wureset.com in the section `Getting started` > `command line`.

Is it possible to batch run this for multiple machines? 

Hi Shadowz1337,

This tool has changed a lot and the installable or portable version allows to execute commands from cmd.

You can download this in https://wureset.com/downloads.php or see more in http://docs.wureset.com in the section `Getting started` > `command line`.

Your tool is awesome and saved my installation several times!

I'm happy to read your comment. Thanks!

You are awesome

Thank you so much! :)

Hi Manuel
great job, your solution fix my tons of clients that report uncorrect version and/or uncorrect date of contact in wsus.
Does "Resets the Windows Update Components" recreate the SusClientID?
When you clone a lot of pc you have to reset SusClientID otherwise on wsus console all look like the same record.
Before your cmd, sometimes (not often) i recreated SusClientID and it also fixed wsus agent problem.
Thanks
https://blogs.technet.microsoft.com/sus/2009/05/05/resolving-the-duplicate-susclientid-issue-or-why-dont-all-my-clients-show-up-in-the-wsus-console/

Thank you Luca,

The reset SusClientID option it's distributed in several options:

* Deletes any incorrect registry values. This option removes some Windows Update registry keys such as the following: SusClientId, SusClientIdValidation, PingID, AccountDomainSid.

* Searches Windows updates. This option runs the command to force a check-in to the WSUS server: wuauclt /resetauthorization /detectnow command

I recommend the following sequence to reset SusClientID: Deletes any incorrect registry values, Resets the Windows Update Components And Searches Windows updates.

I hope this is helpful to you.

Hi Luca,

Due to the need for a tool that can perform this task, I have created a small script for it:

https://gallery.technet.microsoft.com/scriptcenter/Reset-WSUS-Client-ID-90661da1