Credentials Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)Microsoft Certified: Azure Solutions Architect Expert (AZ-305)PMI Project Management Professional (PMP) 28 certifications · see all Verify on Credly
Omer EltayebMicrosoft 365
LinkedIn
  1. Home
  2. Articles
  3. Configuration Manager
Configuration ManagerTroubleshooting

Software update point sync failing in Configuration Manager: wsyncmgr.log and WCM.log

Trace a failed software update point sync from wsyncmgr.log to WCM.log and WSUS, fix the proxy, port, IIS and Microsoft Update causes, and prove the next sync succeeds.

Omer Eltayeb 5 min read Checked against Microsoft Learn

When software update synchronization fails in Configuration Manager (the product many admins still call SCCM), new updates never reach the console, automatic deployment rules have nothing to deploy and child sites fall behind. The cause is nearly always written in two site server logs, wsyncmgr.log and WCM.log. In this post I'll show how to read them, fix each common failure and prove the fix.

Errors this guide fixes

  • Sync failed: WSUS server not configured. Please refer to WCM.log for configuration error details.. Source: CWSyncMgr::DoSyncwsyncmgr.log
  • Sync failed. Will retry in 60 minuteswsyncmgr.log
  • System.Net.WebException: The request failed with HTTP status 502WCM.log
  • System.Net.WebException: The request failed with HTTP status 407WCM.log
  • System.Net.WebException: The request failed with HTTP status 503WCM.log
  • No connection could be made because the target machine actively refused itWCM.log
  • 0x80072EFE - The connection with the server was terminated abnormallyWSUS sync with Microsoft Update
Jump to the fix Browse the Configuration Manager error library
How this guide is organized: Symptoms → Why it happens → How to fix it → Verify the fix → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. Why it happens. 3. How to fix it (6 steps: Find the first failing link; Match the WCM.log error to a cause; Make sure WSUS is up on the SUP; Check the path from the site server to a remote SUP; Fix proxy and Microsoft Update access at the top-level site; Deal with license terms and timeouts). 4. Verify the fix. 5. Prevent it next time. Toolbox: 0x80072EFE, wsyncmgr.log, WCM.log, Start-WebAppPool, ApiRemoting30 › Edit Permissions.1Symptoms2Why it happens3How to fix it4Verify the fix5Prevent it nexttime1Find the firstfailing link2Match theWCM.log erro…3Make sureWSUS is up o…4Check the pathfrom the site…5Fix proxy andMicrosoft Up…6Deal withlicense terms…TOOLBOX0x80072EFEwsyncmgr.logWCM.logStart-WebAppPoolApiRemoting30 › Edit PermissionsHow this guide is organized: Symptoms → Why it happens → How to fix it → Verify the fix → Prevent it next timeFlow diagram of the article's sections in reading order: 1. Symptoms. 2. Why it happens. 3. How to fix it (6 steps: Find the first failing link; Match the WCM.log error to a cause; Make sure WSUS is up on the SUP; Check the path from the site server to a remote SUP; Fix proxy and Microsoft Update access at the top-level site; Deal with license terms and timeouts). 4. Verify the fix. 5. Prevent it next time. Toolbox: 0x80072EFE, wsyncmgr.log, WCM.log, Start-WebAppPool, ApiRemoting30 › Edit Permissions.1Symptoms2Why it happens3How to fix it1Find the first failing link2Match the WCM.log error to a cause3Make sure WSUS is up on the SUP4Check the path from the site server to a remoteSUP5Fix proxy and Microsoft Update access at thetop-level site6Deal with license terms and timeouts4Verify the fix5Prevent it next timeTOOLBOX0x80072EFEwsyncmgr.logWCM.logStart-WebAppPoolApiRemoting30 › Edit Permissions
At a glance: how this guide is organized · 6 fix steps · 5 key tools

Symptoms#

  • Monitoring › Software Update Point Synchronization Status shows a failed or stale synchronization for one or more software update points (SUPs).
  • Patch Tuesday updates don't appear under Software Library › Software Updates › All Software Updates.
  • wsyncmgr.log in <ConfigMgr install path>\Logs on the site server ends each attempt like this:
Text
Sync failed: WSUS server not configured. Please refer to WCM.log for configuration error details.. Source: CWSyncMgr::DoSync
Sync failed. Will retry in 60 minutes
  • WCM.log shows the underlying problem:
Text
System.Net.WebException: The request failed with HTTP status 502
System.Net.WebException: The request failed with HTTP status 407
System.Net.WebException: The request failed with HTTP status 503
No connection could be made because the target machine actively refused it
  • At the top-level site, WSUS can't sync with Microsoft Update: 0x80072EFE - The connection with the server was terminated abnormally or a connection timeout.

Why it happens#

Why software update synchronization failsDoes wsyncmgr.log say WSUS server not configured? if Yes: Which error does WCM.log show? if 401 or 403: Fix the connecting account's access (Connection account and ApiRemoting30 permissions.); if 407 or 502: Fix or bypass the proxy (Bypass it for site server to SUP traffic.); if Refused, 500, 503: Start WSUS and WsusPool on the SUP (Then check the port in the SUP properties.); if No: Does the top-level SUP fail to reach Microsoft Update (0x80072EFE)? if Yes: Fix the proxy and firewall path (Check the site system's proxy, that the SUP role uses it, and the firewall.); if No: Check license terms and SUSDB (Missing EULA files: wsusutil reset. Timeouts: reindex SUSDB.)Does wsyncmgr.log say WSUSserver not configured?Which error does WCM.logshow?FIXFix theconnectingaccount's accessConnection accountand ApiRemoting30permissions.401 or 403FIXFix or bypass theproxyBypass it for siteserver to SUP traffic.407 or 502FIXStart WSUS andWsusPool on theSUPThen check the portin the SUPproperties.Refused, 500, 503YesDoes the top-level SUP fail toreach Microsoft Update(0x80072EFE)?FIXFix the proxy andfirewall pathCheck the sitesystem's proxy, thatthe SUP role uses it,and the firewall.YesFIXCheck licenseterms and SUSDBMissing EULA files:wsusutil reset.Timeouts: reindexSUSDB.NoNoWhy software update synchronization failsDoes wsyncmgr.log say WSUS server not configured? if Yes: Which error does WCM.log show? if 401 or 403: Fix the connecting account's access (Connection account and ApiRemoting30 permissions.); if 407 or 502: Fix or bypass the proxy (Bypass it for site server to SUP traffic.); if Refused, 500, 503: Start WSUS and WsusPool on the SUP (Then check the port in the SUP properties.); if No: Does the top-level SUP fail to reach Microsoft Update (0x80072EFE)? if Yes: Fix the proxy and firewall path (Check the site system's proxy, that the SUP role uses it, and the firewall.); if No: Check license terms and SUSDB (Missing EULA files: wsusutil reset. Timeouts: reindex SUSDB.)Does wsyncmgr.log say WSUS server notconfigured?YesWhich error does WCM.log show?401 or 403FIXFix the connecting account's accessConnection account and ApiRemoting30permissions.407 or 502FIXFix or bypass the proxyBypass it for site server to SUP traffic.Refused, 500, 503FIXStart WSUS and WsusPool on the SUPThen check the port in the SUP properties.NoDoes the top-level SUP fail to reachMicrosoft Update (0x80072EFE)?YesFIXFix the proxy and firewall pathCheck the site system's proxy, that the SUP roleuses it, and the firewall.NoFIXCheck license terms and SUSDBMissing EULA files: wsusutil reset. Timeouts:reindex SUSDB.
Figure 1 · Decision tree Why software update synchronization fails. Start with the newest Sync failed line in wsyncmgr.log. When it points to WCM.log, the WebException there names the cause.

Synchronization is a chain. The SUP at the top-level site (a central administration site or a standalone primary) pulls update metadata from Microsoft Update or an upstream WSUS server, the site imports it into the site database, then child sites get a synchronization request and their SUPs sync from their upstream SUP. Each link has its own component and log:

ComponentRuns onLogJob
WSUS Configuration Manager (WCM)Site serverWCM.logApplies the console settings (upstream source, proxy, products, classifications, languages) to WSUS once an hour
WSUS Synchronization ManagerSite serverwsyncmgr.logStarts each sync and imports the metadata into the site database
WSUS Control ManagerSUPWSUSCtrl.logChecks that the WSUS components are healthy
WSUSSUPSoftwareDistribution.logDownloads metadata and license terms from its upstream source

If WCM can't configure WSUS, every sync stops with WSUS server not configured. Usual reasons: the site server can't reach the WSUS API on the SUP (name, port, SSL or firewall), a proxy is in the way, the connecting account lacks rights, or the WSUS service or its WsusPool application pool is down. At the top-level site, blocked access to Microsoft Update breaks the very first link.

How to fix it#

Start in Monitoring › Software Update Point Synchronization Status. If only a child site fails, check its link to the parent SUP; if the top-level site fails, start there. Read the newest Sync failed line in that site server's wsyncmgr.log; when it points to WCM.log, search that for WebException. For history, use Monitoring › System Status › Component Status and show the messages for SMS_WSUS_SYNC_MANAGER and SMS_WSUS_CONFIGURATION_MANAGER.

2. Match the WCM.log error to a cause#

Error in WCM.logUsual causeWhat to check
HTTP status 401 or 403The connecting account is refusedThe WSUS Server Connection Account (if set) and ApiRemoting30 permissions
HTTP status 407 or 502A proxy is in the path or needs authenticationProxy settings on the site system and SUP role; bypass the proxy for site server to SUP traffic
Target machine actively refused itWSUS service or website stopped, or the wrong portStep 3, then the port in the SUP properties
HTTP status 500 or 503The WSUS web service is failing, often WsusPool stopped or recyclingStep 3
Remote party closed the transport streamTLS handshake failureSteps 4 and 5 (SSL setup, certificate, proxy)

3. Make sure WSUS is up on the SUP#

PowerShell
Get-Service WsusService
Import-Module WebAdministration
Get-WebAppPoolState -Name WsusPool
Get-Website -Name 'WSUS Administration' | Select-Object Name, State   # or 'Default Web Site'
& "$env:ProgramFiles\Update Services\Tools\wsusutil.exe" checkhealth

checkhealth reports to the Application event log; read it there, along with WSUSCtrl.log on the SUP. Start a stopped pool with Start-WebAppPool -Name WsusPool. If it keeps stopping or answering 503 under load, raise its queue length and memory limits as described in Software update point and WSUS maintenance.

4. Check the path from the site server to a remote SUP#

  • The site server needs the WSUS administration console, which provides the APIs Configuration Manager uses. Test with it: Update Services › Connect to Server, using the SUP's FQDN and port.
  • The ports in the SUP properties must match the WSUS website bindings (8530/8531 when WSUS has its own website, 80/443 on the Default Web Site).
  • For HTTPS, the WSUS website certificate must match the SUP's FQDN and be in date, and WSUS must be configured for SSL.
  • The computer and administrator accounts need access to the ApiRemoting30 virtual directory: IIS Manager › Sites › WSUS website › ApiRemoting30 › Edit Permissions.
PowerShell
Test-NetConnection sup01.contoso.com -Port 8530

5. Fix proxy and Microsoft Update access at the top-level site#

A 407, 502 or 0x80072EFE at the top-level SUP points at the internet path. Under Administration › Site Configuration › Servers and Site System Roles, check the proxy server defined on the site system and that the software update point role is set to use it for synchronization. Then confirm the firewall lets the SUP reach Microsoft Update. In the WSUS console (Options › Update Source and Proxy Server), the top-level SUP should sync from Microsoft Update or your upstream WSUS server, and neither it nor a primary site's first SUP may be a replica. Make changes in the Configuration Manager console: WCM reapplies its settings every hour.

6. Deal with license terms and timeouts#

Sync also fails when license terms (EULA files) can't download. Search SoftwareDistribution.log (in %ProgramFiles%\Update Services\LogFiles) for .txt, fix the firewall or proxy, then have WSUS fetch the missing files again:

Command Prompt
"%ProgramFiles%\Update Services\Tools\wsusutil.exe" reset

Syncs that run for hours or time out often mean a bloated, fragmented SUSDB. Decline superseded updates, remove obsolete ones and reindex SUSDB.

Verify the fix#

  1. Start a sync at the top-level site: Software Library › Software Updates › All Software Updates › Synchronize Software Updates.
  2. Watch wsyncmgr.log: the run completes without a Sync failed line, and WCM.log logs no new WebException.
  3. In Monitoring › Software Update Point Synchronization Status, every SUP shows a completed sync with a current time, and child sites report the same catalog version as the top-level site.
  4. The latest updates appear in All Software Updates, and clients scan cleanly (see updates not installing: WUAHandler.log and UpdatesDeployment.log).

Prevent it next time#

  • Change SUP settings only in the Configuration Manager console; WCM overwrites manual WSUS changes.
  • Schedule WSUS maintenance, track WSUS certificate expiry and keep a proxy bypass for internal SUP traffic.
  • Check the synchronization status node after each Patch Tuesday sync, before your automatic deployment rules run.
  • Component status message IDs are listed in the site component status messages quick reference, and client scan codes in the software update error codes quick reference.

References#

TagsSoftware updatesWSUSwsyncmgr.logWCM.log

Written and checked against current Microsoft Learn documentation. Test changes with a pilot group before rolling them out to everyone, and if an admin center path has moved since, search for the setting name instead.

Spotted a mistake, or did this fix work differently for you? Email me or message me on LinkedIn — corrections are credited in the article.

Written by

Omer Eltayeb

Intune Subject Matter Expert in Cairo, Egypt, former Microsoft Cloud Solutions Architect, Microsoft Certified Trainer and Microsoft Innovative Educator Expert (2024–26) and Microsoft Elevate Educator Expert (2026–27). I share practical, step-by-step guides, study plans, scripts and toolkits for Microsoft Intune, Configuration Manager, Microsoft Entra ID, Microsoft Defender, Exchange and Microsoft 365 with the community.

Microsoft Certified Trainer (MCT) 2026Microsoft Innovative Educator Expert 2025–2026Microsoft Elevate Educator Expert 2026–2027ISC2 Certified Information Systems Security Professional (CISSP)Microsoft 365 Certified: Enterprise Administrator Expert (MS-102)
Connect on LinkedIn My community contributions More about me
Keep reading

More Configuration Manager articles

All Configuration Manager articles