WSUS Airgapped Issue

[jdeas2000]

Issue Summary:
Third-party patches from PatchMyPC install successfully on Windows 10 but encounter an error ("Some update files aren't signed correctly, Error: 0x800b0109") on all editions of Windows Server.

Background:
The environment is airgapped, utilizing WSUS Standalone, with both WSUS and PatchMyPC on a source system connected to the internet. A self-signed certificate generated from the source WSUS is distributed to the airgapped environment through Group Policy. The same certificate is applied via the same GPO to both Windows 10 and Windows Server 2016/2019, residing in Trusted Root CA and Trusted Publishers on all operating systems.

Possible Cause:
The issue may stem from a missing supporting certificate. Attempts to resolve the problem by copying certificates from VeriSign and GlobalTrust from working Windows 10 machines, to the servers have been unsuccessful.

Do you guys know specifically what certificates are required or what might my problem be?

[Ben Reader (Patch My PC)]

Hey there,

If the WSUS code-signing certificate is indeed self-signed, there should be no supporting certificates required, as there should be no certificate chain to follow.

As a first step, I would suggest reviewing our KB article that covers this specific scenario.

https://patchmypc.com/third-party-updates-fail-to-install-with-error-0x800b0109-in-sccm#:~:text=The%20most%20common%20reason%20error,and%20Trusted%20Publishers%20certificate%20store.

If after following the guide you still have no resolution, let us know - we will need pmpc (and wsus) server-side logs &  pmpc logs from one  of the affected client devices

Thanks,

Ben

[jdeas2000]

Thank you.

The situation was resolved by the "Allow signed updates for an intranet Microsoft update service location" policy.
Did not realize our GPO was issued to Desktops but not Servers for the above.

[Ben Reader (Patch My PC)]

Great to hear that the issue was resolved!