WSUS Error: Unexpected Error

In the organization I work for, we have roughly 130K Windows machines that are domain joined that are reporting into our WSUS implementation. We only use one WSUS cluster to manage all of them... if you want to know more about how we set that up, please reach out!

Once we got the majority of clients/servers reporting in, we started seeing an error every time we tired to expand some of the computer groups.

Error: Unexpected Error
An unexpected error occurred. Please contact your system administrator if the problem persists. 

One of my admins, clicked on the Copy Error to Clipboard and sent it to me – there is usually a good start in trouble shooting in that error text, that is when I started hunting. The exact error was: (note: the non-ASCII character is changed to ‘[]’ below)

The WSUS administration console has encountered an unexpected error. This may be a transient error; try restarting the administration console. If this error persists,
Try removing the persisted preferences for the console by deleting the wsus file under %appdata%\Microsoft\MMC\.

System.Xml.XmlException -- '[]', hexadecimal value 0x16, is an invalid character. Line 1, position 11167920. Source System.Xml Stack Trace:
at System.Xml.XmlTextReaderImpl.Throw(String res, String[] args)
at System.Xml.XmlTextReaderImpl.ParseNumericCharRefInline(Int32 startPos, Boolean expand,
StringBuilder internalSubsetBuilder, Int32& charCount, EntityType& entityType)
at System.Xml.XmlTextReaderImpl.ParseCharRefInline(Int32 startPos, Int32& charCount,
EntityType& entityType)
at System.Xml.XmlTextReaderImpl.ParseText(Int32& startPos, Int32& endPos, Int32&
outOrChars)

Okay, so they are apparently using a XML reader from the data they are getting back from the WSUS web services and it chokes to death on a non-ASCII character… cool (seems like that the WSUS database has great data quality checks in place there [sarcasm]).

So where is the data coming actually from?... If you open up Wireshark and reproduce the error, it shows that there are two calls made when you try to expand a group in the WSUS console (one for the group, then another one for the computers in the selected group).

The web service seems to be calling a stored procedure in the database called [dbo].[spSearchComputers] which outputs an XML file... so I manually ran thís stored procedure (for all computer groups) and exported the file as one massive TXT file (which was 133389 lines).

So, I then searched in that text file for this little non-ASCII char – "[]". I found 3 results!

The issue for us was the Model column in the database. In the text file, I grabbed the ComputerID GUID for each of the 3 culprits and queried their data to get their TargetID's since that is how the WSUS database seems to store Make/Model/BIOS, in a different table [dbo].[tbComputerTargetDetail].

I manually updated the ComputerModel column to 'Unknown' for the 3 culprits, then gave it a try in the WSUS console, worked like a charm!!

But, I knew this only fixes the issue until those 3 clients report in again and I assumed there was probably another stored procedure that is called for merging the computer detail table. After looking for a bit, I found a procedure called [dbo].[spRegisterComputer] that I am guessing is called when a computer reports it's data. I ended up actually updating that stored procedure to include this:

DECLARE @newComputerModel nvarchar(64)
IF UNICODE(@ComputerModel) between 32 and 255
SET @newComputerModel = @ComputerModel;
ELSE
SET @newComputerModel = 'Unknown';

That way, when the ComputerModel gets another non-ASCII character, it will write 'Unknown' instead of something that XML will not like.

The root cause of this issue is – that in our domain, there seems to be a couple machines with some "junk" written into the motherboard that is most likely picked up by WMI. Though I really think the WSUS database could do a better job of data quality.

Thanks for reading!