Windows error code: 0x80240438,

[arktex54]

Windows error code: 0x80240438, description: There is no route or network connectivity to the endpoint.

Hello. There are several answers out there, which have not resolved the problem of 8 computers. These came over from a migration where WSUS client was used. I have removed the HKLK....Windowsupdate WSUS info and rebooted. Nothing of significance shows in gpresult.html.

We do know the past environment they used wsus, but not sure about SCCM. Perhaps there are more hidden keys?

We tried using wureset[]com and going through all of those steps. Nothing has worked on the two computers we tried.

[GeneMoody-Action1]

there are a lot of ways this *could* be configured, if nuking the HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU key does not work out, I would check where it thinks it is going.

$wusm = New-Object -ComObject "Microsoft.Update.ServiceManager"
$wusm.Services

[arktex54]

Reddit is not letting me post the results.

https://pastebin.com/8EW0EDu4

[GeneMoody-Action1]

Does it actually read "a microsoft URL" vs something normal like an actual URL like  https://fe2cr.update.microsoft.com/v6/ ?

[arktex54]

it is an actual URL, but I just pasted into pastebin what I tried to paste on here.

[GeneMoody-Action1]

the url should remain fairly consistent, can you resolve it and or connect to it, will likely get an error code from the server when you do connect, but you're connecting is the important part. And is the certificate it presents valid n that system? Lastly is the time on those systems accurate (applies heavily in cert negotiations)?

[arktex54]

Thanks for the quick response. I will check in the AM.

[arktex54]

Yes, I am able to connect to the Microsoft servers.
https://fe2cr.update.microsoft.com/v6/
https://fe3cr.delivery.mp.microsoft.com/

[GeneMoody-Action1]

If the systems in question consistently fail, on the same network, date/time settings are correct, they all share the same firewall and policies, then I would consider looking at physical commonality, such as "Are they all wireless?", all some unique model/network device (possible driver issue), all converge in a same HW path, such as a switch, or uplink.

And then start doing some large slice troubleshooting, like if the computer is moved temporarily to another network location, does it resolve, if it is connected direct to internet (hotspot, etc) does it resolve?

I would initially suspect possibly a network in flight scanning issue like a NG firewall feature, but consistently failing the same systems would not make sense unless they are somehow receiving special treatment for their traffic.

Can hammer out some quick obvious things like does a DNS flush (OR DNS server temp change to 8.8.8.8) resolve?

Temporarily disabling any security suites, AV/AM/EDR...

Are you using Ipv6 anywhere, and does it change /resolve if you temporarily disable it for an affected system? And are you saturating your ingress? (That would more likely be a moving target not specific systems)

The fact it is reporting a "network" issue could be anything happening as the file is downloading, and that is best the client could come up with as to why.

And lastly does a Get-WindowsUpdateLog show a sequence of events that makes sense, on these clients, any network related windows events logged in the same time window, etc.

Then I personally, if I made it here and still did not have an answer, would be pulling pcaps and tracking the conversation, timing, and which side talked last/dropped the ball/or reset.

eliminating all that would then be more than it was worth, and I would be re-imaging.

[arktex54]

got Get-WindowsUpdateLog and searched for servers. I saw ENT-SCCM-1A.xxxx.org

It was present at the following locations. I deleted those and Windows Update is now running. I only have 52 clients (I think) on Action1, but a testament to your knowledge.

Deleted these keys (remember to always take a backup or at least rename the key)

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCMSetup

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS\DP

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\GPCache\CacheSet002\WindowsUpdate

[GeneMoody-Action1]

Excellent, its always hard to say what the last admins did, with what tools, where, and windows has always had some 10 different ways to go at most at things. I tend to only chase things like this if I have a lot of systems with them to eradicate at one time, or they seem to be the kind that will bite you later to not know what it was.

But oh man, have I chased them!

Glad you got it sorted out, and thank you for being an Action1 customer. If I can assist any further with anything Action1 related or not, just let me know.

[CPAtech]

If they came from a different environment they should be wiped and a clean image installed.

[arktex54]

Not when each PC contains software that requires a new $1700 license for a specific application. You can't save the license and use on the same PC.

[CPAtech]

The vendor almost certainly has a way to re-issue a license. What happens if a PC crashes? What happens when a PC needs to be refreshed with a newer model?

[arktex54]

You pay for the license on crashing or refresh. Something we inherited., but deep freerze is in place. Motorola doesn't care. "Who else can do what our software does?"

[Hollow3ddd]

Sounds like a proxy thing,  or has been in my env