Client checking in causes a memory spike

Question

I'm not sure if this is a patchmanager issue or if it falls under a WSUS issue, but I figured they're enough knowledgeable people on here to ask anyway. We recently upgraded or WSUS server from Server 2008 (the WSUS piece was giving us issues) to Server 2012 R2. We still have our downstream servers 2008 R2 and have no plans to change them any time soon. It took a little time to get the switch completed, but we finally have it running and we're able to push updates using patch manager. One issue we did run into and I'm not sure if it has anything to do with upgrading the WSUS server, but now we are getting complaints from client machines that they have been acting sluggish at certain times during the day. After a bit of investigation we were able to determine that when the client checks in to it's WSUS server the memory spikes up to almost 2gb and causes the stations to lock up. They currently only have two GB of ram and they're windows 7 machines. I've read up on some articles online and this seems to be a big problem recently. My question is did upgrading the WSUS server to 2012 cause this? We didn't have any complaints before we did this. Once we stop the wuauserv service the memory goes back down and the station is usable again so it's got to be the check in process. I know the obvious answer would be upgrade the memory to 4gb, but we're talking about 3500+ machines so that's a big expense. As of right now we have had to disable the service through policy and start it only when we push updates which is quite a chore itself.

I'm wondering if anyone might have found a solution or work around for this? It seems everything I read is that Microsoft is ignoring the issues.

Any thoughts or ideas would be greatly appreciated.

Thanks,

Paul

frgpugs · Answer

You can try to reset the WUA in patch manager go to a PC that is having problems and either on the right pane go to windows update agent maintenance and repair or in computer explorer go to the same thing and select delete catroot and catroot2 directories, reset authorization, reset windows update agent sus id, and delete software distribution folders.  Then run the detect now again and see.  If that doesnt work then im out of ideas sorry.

pmaldonato · Answer

We did test and when we ran the wuauclt /detectnow the memory in task manager rose from about 700mb up to the 2gb limit. From that point doing anything on the machine is near impossible. We even tested with the services window open and ran the detect got the spike and then stopped the service and the memory went right back down to where it started.

frgpugs · Answer

I would test one PC to see if its the check in.  Go to one PC or RDP to one and run wuauclt /detectnow.  Wait a few minutes to let it finish and then run wuauclt /reportnow.  If it locks up the PC doing that you know theres a problem with the check in and if not the problem is elsewhere.

I have not personally seen any problems with this other than network congestion when running these as a task on a lot of machines at once.