Symptoms

Windows Server Update Services (WSUS) synchronization fails, and you receive the following error message:

Additionally, an error message that resembles the following is logged in the WSUS log file (%ProgramFiles%Update ServicesLogFilesSoftwareDistribution.log) on the WSUS server:

Cause

This issue occurs if the WSUS servers are configured to use the old synchronization endpoint, https://fe2.update.microsoft.com/v6. This endpoint was fully decommissioned and is no longer reachable after July 8, 2019.

Resolution

To fix the issue, change the synchronization endpoint in WSUS configuration to https://sws.update.microsoft.com.

To do this, follow these steps on the topmost WSUS server that connects directly to Microsoft Update, such as the root WSUS server in a WSUS hierarchy:

1. Close all WSUS consoles.
2. At an elevated PowerShell command prompt, run the following PowerShell scripts. Note Don’t run the scripts on a WSUS server that’s not the topmost server. If the server isn’t connected to the Internet, synchronization may fail.
   For WSUS version 3.x: [void][reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration")
$server = [Microsoft.UpdateServices.Administration.AdminProxy]::GetUpdateServer()
$config = $server.GetConfiguration()
# Check current settings before you change them
$config.MUUrl
$config.RedirectorChangeNumber
# Update the settings if MUUrl is https://fe2.update.microsoft.com/v6
$config.MUUrl = "https://sws.update.microsoft.com"
$config.RedirectorChangeNumber = 4002
$config.Save();
iisreset
Restart-Service *Wsus* -v

   Note WSUS servers that are running Windows Server 2008 (without the latest update) or earlier versions may be using the https://update.microsoft.com/v6 or https://www.update.microsoft.com synchronization endpoints. Because these versions of Windows don’t support SHA256 certificate authentication, use the following settings in the PowerShell scripts:

   $config.MUUrl = " https://sws1.update.microsoft.com"
$config.RedirectorChangeNumber = 3011
   For WSUS on Windows Server 2012 and later versions: $server = Get-WsusServer
$config = $server.GetConfiguration()
# Check current settings before you change them
$config.MUUrl
$config.RedirectorChangeNumber
# Update the settings if MUUrl is https://fe2.update.microsoft.com/v6
$config.MUUrl = "https://sws.update.microsoft.com"
$config.RedirectorChangeNumber = 4002
$config.Save()
iisreset
Restart-Service *Wsus* -v
3. Verify that WSUS synchronization succeeds.

More Information

For more information about how to run PowerShell scripts, see PowerShell Scripting.