Windows 8.1 Update (KB 2919355) prevents interaction with WSUS 3.2 over SSL


Update Monday 4/14/2014 – Please see http://support.microsoft.com/kb/2959977 for additional information.


There is a known issue which causes some PCs updated with the Windows 8.1 Update (KB 2919355) to stop scanning against Windows Server Update Services 3.0 Service Pack 2 (WSUS 3.0 SP2 or WSUS 3.2) servers which are configured to use SSL and have not enabled TLS 1.2.

Issue Description

The problem is specific to the following scenario when all of the following are true

  1. Client PC has installed Windows 8.1 Update KB 2919355
  2. Windows 8.1 with Windows 8.1 Update KB 2919355 attempts to scan against WSUS 3.2 running on any affected platform:
    • Windows Server 2003 SP2, or
    • Windows Server 2003 R2 SP2, or
    • Windows Server 2008 SP2, or
    • Windows Server 2008 R2 SP1
  3. HTTPS and Secure Sockets Layer (SSL) are enabled on the WSUS server
  4. TLS 1.2 is not enabled on the server

Only users who have enabled HTTPS and have not enabled TLS 1.2 on their WSUS 3.2 servers and who are also using these WSUS 3.2 servers to manage PCs running the Windows 8.1 Update KB 2919355 are affected by this issue. Please note, while we do recommend the use of HTTPS on WSUS servers, HTTPS and TLS 1.2 are not enabled by default.

Workarounds

If you are using WSUS 3.2 on Windows Server 2008 R2, you may perform either of the following steps to restore the scan functionality if you have deployed the Windows 8.1 Update KB2919355.

  • Enable TLS 1.2 (follow the instructions under More Information > SCHANNEL\Protocols subkey), or
  • Disable HTTPS on WSUS

If you are using WSUS 3.2 on an operating system other than Windows Server 2008 R2, you may perform the following step to restore the scan functionality.

  • Disable HTTPS on WSUS

When Microsoft releases an update that resolves the issue, you may re-enable HTTPS on WSUS.

Microsoft plans to issue an update as soon as possible that will correct the issue and restore the proper behavior for Windows 8.1 Update KB 2919355 scanning against all supported WSUS configurations. Until that time, we are delaying the distribution of the Windows 8.1 Update KB 2919355 to WSUS servers.

You may still obtain the Windows 8.1 Update (KB 2919355) from the Windows Update Catalog or MSDN. However, we recommend that you suspend deployment of this update in your organization until we release the update that resolves this issue. You may also find the workarounds discussed in this article to be useful for testing this Windows 8.1 Update for your organization. Thank you for your patience during this time.

The WSUS and Windows Update Teams


Comments (42)

  1. st.he.ag says:

    So if TLS 1.2 is now mandatory for secured Connections to WSUS maybe a SHA512 signed certificate in chain might produce the same problem. Maybe someone is able to test this?
    Have a look at: http://www.michaelm.info/blog/?p=1273

  2. Pierre Morissette says:

    Could you not release the update to WSUS on Server 2012R2 since it is out of scope for this issue?

  3. St3fan_ says:

    @a127: You can deploy IE 11 with WSUS. If you don´t see it in the Console, have a look on the Microsoft Update Catalogue. From there you can import it into WSUS

  4. Michael Ratanapintha (ex-Microsoft) says:

    > So if I had a 2012/WSUS 4 server with TLS 1.2 disabled, affected clients would be unable to use it?

    Peter – Yes, that’s correct. There are 3 requirements for a client computer to be unable to connect to WSUS due to this bug:

    1. The client has Windows 8.1 with the spring 2014 Update.
    2. The WSUS server URL is over SSL or TLS (https://…).
    3. On the WSUS server, Windows is not configured to allow the use of TLS 1.2.

    If your WSUS server running Server 2012 was configured to not use TLS 1.2, then 8.1 Update clients wouldn’t be able to use it. But again, this is not the default configuration on Server 2012.

  5. a127 says:

    Hi
    there is also no 2919355 for 2012r2 on wsus yet

  6. a127 says:

    bit off-Topic
    IE 11 (also for W7) now have Enterprise mode. But why still not IE 11 for W7 on WSUS ?

  7. hassan sayed issa20014 says:

    thank you

  8. Michael Ratanapintha (ex-Microsoft) says:

    > Could you not release the update to WSUS on Server 2012R2 since it is out of scope for this issue?

    Pierre and a127 – The problematic update is not an update to the WSUS server code. Rather, the broken update is to the Windows Update Agent, which was updated as part of the Windows 8.1 spring 2014 Update.

    The bug affects all Windows 8.1 systems with the spring 2014 Update. It just happens that client computers are not affected when connecting to WSUS for Windows Server 2012 (with or without R2), because on those WSUS servers, IIS is configured to support TLS 1.2 by default.

  9. hassan sayed issa20014 says:

    thanks

  10. Eddie Thrace says:

    Does this affect the Windows Server 2012 R2 update as well, or only 8.1?

  11. PierreM says:

    Combine this with the *wise* decision to prevent any future updates from being distributed to systems that don’t have this Service Pack in disguise, and I would say that a great big ball is being dropped somewhere in Redmond.

  12. Moha34 says:

    I installed Windows 8.1 update 1, and our family members were not able to use IE 11 on their computers or laptops. I had to go back to original Windows 8.1 as soon as possible. Once Microsoft fixes this problem on IE11, I will be able to go back to Windows again, otherwise we are going with Ubuntu Linux. Microsoft should not provide a fake re-finement that causes more problems that original Windows 8.1 update 1. Fix Windows 8.1 update 1 now or we are moving to Ubuntu Linux and you are not going to be making any profits from our family anymore.

  13. Peter says:

    So if I had a 2012/WSUS 4 server with TLS 1.2 disabled, affected clients would be unable to use it?

  14. Bill says:

    what if SCCM is being used…but this is true of the backing WSUS server?

  15. Anonymous says:

    こんにちは。WSUS サポートチームです。

    2014 年 4 月 9 日に Windows 8.1 の操作性を向上した更新プログラムである Windows 8.1 Update (KB 2919355

  16. Dave says:

    Hello, As SCCM uses WSUS components to update computers, I guess it’s also true for SCCM SUP

  17. Barry says:

    We need an ETA to determine if we proceed with the current updates (which would double the work involved for change management) or wait for the fix for KB 2919355.

  18. Anonymous says:

    Avec la sortie mardi dernier des derniers correctifs pour Windows XP, Microsoft a diffusé la première

  19. Anonymous says:

    Microsoft has been listening to customer feedback. Much of this feedback has been received and some of

  20. Jan says:

    We imported the Update to our WSUS on Win2003 using Catalog as source because we need to distrubte it and HTTPS is not active. Now WSUS is trying to download 3 Updates (Win 8.1.1 as x86 and x64, Win 2012r2) again and again without success. Any hint for us?

  21. om agrwal says:

    windos xp support

  22. Herb Wilhite says:

    I installed Windows 8.1 Update 1 and after updating I can no longer scan or use Bluetooth. Just before the update, my Brother MFC-9440CN scanner worked wonderfully (scan directly to a document in Adobe Acrobat) and I had a Bluetooth receiver that worked just fine to receive Pandora music streamed via my PC. Immediately after the update, neither of these functions work. Windows can’t find the scanner (although the print function isn’t affected) or connect to the Bluetooth device (although it does recognize it). I worked with Brother for a couple of hours last week and installed their latest software for my MFC printer, but no luck.

  23. MS-Wing says:

    !!! IMPORTANT !!!
    I also saw this exact problem on our corporate Windows 2012 R2 Servers.
    After installing KB2919355, I could check again Updates against our WSUS Server on 2008 R2.
    However: I got error 0x80072EE2 when I checked for Microsoft Online Updates via our corporate Proxy Servers.

    After uninstalling KB2919355, I could again successfully check for online updates through our proxy.
    So the problem is not only with local WSUS installations, but also affects customers using a normal http/https proxy to access the internet.

  24. MS-Wing says:

    Sorry, a small correction: It was error 0x80072F8F I got in WindowsUpdateClient log.

  25. tdub says:

    KB2919355 also broke checkpoint ssl vpn snx. After installing the update, we now get a page cannot be displayed message when visiting the ssl VPN portal site. Uninstalling the update resolves the problem

  26. drewhill70 says:

    I’ve got the same issue as WSUS when getting updates from Windows Intune. Any idea when Intune will be fixed?

  27. Anonymous says:

    227 Microsoft Team blogs searched, 56 blogs have new articles. 151 new articles found searching from

  28. MS-Wing says:

    I drilled down the problem to the Update breaking functionality to connect to official microsoft servers via http/https proxies.

  29. MS-Wing says:

    Addition to my comment above: The problem also only occurs when the machine also gets WSUS Settings (corporate WSUS) applied via group policy. Without any WSUS-Settings, it works fine.

  30. Anonymous says:

    Pingback from Windows 8.1 Update halted to some enterprise users amid WSUS issues | Cardiff Computer Rescue

  31. Anonymous says:

    Pingback from Windows Update Breaks After KB 2919355 | The Geek Post

  32. MollyMc says:

    I don’t understand most of the computer speak here, but I can tell you this much: When I bought this laptop I was looking forward to having the most updated and easy to use system. This is so much not the case. Anyhow, back to the topic…
    I installed the 8.1 update that is required, and in the process lost my touchpad mouse. Nothing I tried short of rolling back to the original driver fixed it. I could still use a USB mouse, but if I had wanted to use an add-on mouse, I would have never bought
    the touch screen. And I really miss my XP’s, because at least I got a notifier that the error was reported and had a hope of the bug being worked out…
    I realize that there is a big learning curve, but I really expected so much more from Microsoft. I don’t mind helping with that, but I really only wanted a laptop that was easy to use with the ability to keep current with todays technology and as much ability
    as todays smartphones…

  33. Anonymous says:

    Update 4/16/2014: Please refer to the following updates posted in the blog posts below released on April

  34. StephenK says:

    Is there any chance that a similar issue could be occurring where clients are unable to interact over HTTPS with WSUS 6.2 (Server 2012) after KB2937636 (July 2014) is installed on the WSUS server and the corresponding Win7 clients are updated? I’m noticing
    a new issue recently where our SCCM 2012 R2 Win7 OSD task sequence "Install Software Update" steps are timing out after 30 minutes without finding any updates to install, but then the required updates install fine after the task sequence completes. It might
    not be related, but it sounds like it could be related, and KB2937636 does indicate that KB2919355 (listed here) had already made the Windows Update changes in April 2014 that KB2937636 later did in July 2014. We are an HTTPS-only shop.

    Note that I’m revisiting this topic because it appears similar changes were made beyond just Win8.1 and KB2919355 now. See later blog post: (http://blogs.technet.com/b/wsus/archive/2014/07/08/upcoming-update-to-wsus-kb-2887535.aspx)

  35. Joe says:

    We have a similar problem but with WSUS for Windows Server 2012 (version 6.3.9600.16384) over https – none of our 2012 R2 clients report their daily status to the WSUS server (also 2012 R2) after their initial status report. At the minute, our workaround
    is a scheduled task on each client that does the following on a daily basis:

    net stop wuauserv
    rd /q /s %windir%softwaredistribution
    reg delete HKLMSoftwareMicrosoftWindowsCurrentVersion
    /WindowsUpdate /f
    net start wuauserv

    Is it possible that an update that fixed a prior issue has re-introduced this issue into 2012 clients?

  36. chris says:

    some of my programs will not work on windows 8.1. help please

  37. Serge says:

    March 2015 still no fix ???
    what about the ASAP fix?

  38. Rap says:

    thank you

    http://www.kodes.com Hiphop, Rap, Ceza, sagopa, Kolera

    http://www.gekkog.com Hiphop, Rap, Gekko G

    http://www.maskanimasyon.com Animasyon

  39. ece says:

    Thanks for the its much appreciated..
    http://www.kaderim.net

  40. Victor Povarich says:

    helped enabling SSL on WSUS regedit
    https://support.microsoft.com/ru-ru/kb/245030 – check in the end of page