Advertisement

SCCM Software Update Patch Package Download Failed with Error 403 HTTP STATUS FORBIDDEN

As part of monthly security patching, we had faced an interesting issue. WSUS sync was completed successfully and we’re able to download some of the patches from Windows Update service however the .NET patches were not getting downloaded. I’ve seen these kind of issues during SCCM/ConfigMgr software update monthly patch package creation. However, most of the time “couple of retries” solved these kind of patch download issues. This time around retry/retries, server restart etc didn’t really help us. It was giving us Error 403 (HttpSendRequest failed HTTP_STATUS_FORBIDDEN or HTTP_STATUS_DENIED).

Software Update Patch Package Download Issue

As a next step, we’ve analysed PatchDownloader.log. As expected we found some clue about the issue. In the PatchDownloader.log located in SCCM site server, we could see that the patch file with “.CAB” extension is getting downloaded without any issue. However, we’re getting download error “403 HTTP STATUS FORBIDDEN” for the patch files with “.EXE” extension. The issues turned out to be  with proxy and Firewall box configuration. There are a bunch of networks nated behind the source SCCM server hence network and proxy team also struggled to get into the root of the issue. Network team was able to find  “TCP_DENIED/403″ log entry and make necessary settings to “TCP_CLIENT_REFRESH_MISS/200”  !! So network and proxy team helped to resolve the issue. More details and log file samples at the bottom of the post.

Following are the log file entries which I found in PatchDownloader.log

Software Update Patch Package Download Issue 1

Download destination = \\ACNCMCAS\SUPackages\Nov\979d1441-d8f7-4844-9a4f-a68abd66a68f.1\MSIPatchRegFix-AMD64.exe . Contentsource = http://wsus.ds.download.windowsupdate.com/msdownload/update/software/secu/2012/10/msipatchregfix-amd64_5011cb29b096fb674a4795ee8fc2f7fdad33863a.exe . Try username configmgr\ServiceAccount from the registry. Proxy enabled proxy server 10.10.10.12 HttpSendRequest failed HTTP_STATUS_FORBIDDEN or HTTP_STATUS_DENIED

Errors noticed in SCCM 2012 Download Software Update Wizard!!!
ERRORS
•There was an error downloading the update. (403)
Warning: Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Windows Vista and Windows Server 2008 x86 (KB2978128)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 x64 (KB2978125)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Vista, Windows 7, Server 2008 x86 (KB2978125)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
Warning: Security Update for Windows Server 2003 x64 Edition (KB3006226)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 (KB3006226)
ERRORS
•There was an error downloading the update. (403)
Warning: Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 x64 Edition (KB3003057)
ERRORS
•There was an error downloading the update. (403)
 Warning: Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 (KB3003057)
ERRORS
•There was an error downloading the update. (403)
 Warning: Cumulative Security Update for Internet Explorer 8 for Windows Server 2003 x64 Edition (KB3003057)
ERRORS
•There was an error downloading the update. (403)
 Warning: Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 x64 Edition (KB3003057)
ERRORS
•There was an error downloading the update. (403)
 Warning: Cumulative Security Update for Internet Explorer 6 for Windows Server 2003 (KB3003057)
ERRORS
•There was an error downloading the update. (403)
 Warning: Cumulative Security Update for Internet Explorer 7 for Windows Server 2003 (KB3003057)
ERRORS
•There was an error downloading the update. (403)
Warning: Security Update for Windows Server 2003 (KB3002885)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 x64 Edition (KB3002885)
ERRORS
•There was an error downloading the update. (403)
Warning: Security Update for Windows Server 2003 x64 Edition (KB2993958)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 (KB2993958)
ERRORS
•There was an error downloading the update. (403)
Warning: Security Update for Windows Server 2003 x64 Edition (KB2992611)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 (KB2992611)
ERRORS
•There was an error downloading the update. (403)
Warning: Security Update for Windows Server 2003 x64 Edition (KB2991963)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 (KB2991963)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 x64 Edition (KB2989935)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Windows Server 2003 (KB2989935)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Vista, Server 2008, Server 2008 R2 x64 (KB2978128)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4.5, 4.5.1 and 4.5.2 on Windows 7, Windows Vista and Windows Server 2008 x86 (KB2978128)
ERRORS
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Vista, Windows 7, Server 2008, Server 2008 R2 x64 (KB2978125)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 4 on Windows Server 2003, Vista, Windows 7, Server 2008 x86 (KB2978125)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 (KB2978124)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
 Warning: Security Update for Microsoft .NET Framework 2.0 SP2 on Windows Server 2003 for x64-based Systems (KB2978124)
ERRORS
•There was an error downloading the update. (403)
•There was an error downloading the update. (403)
Warning: Security Update for Microsoft .NET Framework 1.1 SP1 on Windows Server 2003 and Windows Server 2003 R2 x86 (KB2978114)
ERRORS
•There was an error downloading the update. (403)

Proxy / Network side logging 

TCP_DENIED/403 0 GET http://wsus.ds.download.windowsupdate.com/msdownload/update/software/secu/2012/10/msipatchregfix-amd64_5011cb29b096fb674a4795ee8fc2f7fdad33863a.exe - DIRECT/wsus.ds.download.windowsupdate.com application/x-dosexec CMF:4 DCF:200000 ERR:10 BLOCK_ADMIN_FILE_TYPE_12-No_Auth_for_IP_Policy-No_Auth_for_IP_Identity-NONE-NONE-NONE-DefaultGroup <iw_swup,9.2,-,"-",-,-,-,1,"-",-,-,-,"-",-,-,"-","-",-,-,iw_swup,-,"-","-","unknown","unknown","-","-",0.00,0,-,"-","-",-,"-",-,-,"-","-"> - 376734 -

TCP_CLIENT_REFRESH_MISS/200 178122994 GET http://wsus.ds.download.windowsupdate.com/c/msdownload/update/software/crup/2014/11/mso-x-none_4003f83d82ddccd3c0905c04d80c377e94780c78.cab - DIRECT/wsus.ds.download.windowsupdate.com application/vnd.ms-cab-compressed CMF:4 DCF:0 ERR:0 ALLOW_WBRS_12-No_Auth_for_IP_Policy-No_Auth_for_IP_Identity-NONE-NONE-NONE-DefaultGroup <iw_swup,9.2,-,"-",-,-,-,1,"-",-,-,-,"-",-,-,"-","-",-,-,iw_swup,-,"-","-","unknown","unknown","-","-",13550.37,0,-,"-","-",-,"-",-,-,"-","-"> - 470619 -


About Author 

Anoop is Microsoft MVP and Veeam Vanguard ! He is a Solution Architect on enterprise client management with more than 13 years of experience (calculation done on the year 2014) in IT. He is Blogger, Speaker and Local User Group Community leader. His main focus is on Device Management technologies like SCCM 2012,Current Branch, Intune. He writes about the technologies like SCCM, SCOM, Windows 10, Azure AD, Microsoft Intune, RMS, Hyper-V etc...

    Find more about me on:
  • googleplus
  • twitter
  • facebook
  • linkedin
  • youtube
Posted in: ConfigMgr (SCCM), Configmgr2012, Console, Patching

One Comment

  1. Joris says:

    Hi,

    I hope you found the solution a long time ago, but for those who are still stuck with this problem and arrived on this page while seeking a solution :

    DISABLE UAC !

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
    “EnableLUA”=dword:00000000

    And reboot

Leave a Comment and Contact Anoop