| Area | Current limit |
|---|---|
| Native Windows dialogue | An empty scan is verified on one Windows 10 Pro 22H2 x64 build. It is not proof of a full update cycle. |
| Catalogue | The imported Microsoft metadata subset is experimental. Completeness is not established. |
| Approvals | Local decisions and reasons are recorded. Native distribution readiness remains pending. |
| Several Windows profiles | Separate imports and approvals are available. Native session routing between profiles is not qualified. |
| Office | MSI and Click-to-Run content families can be selected. Automatic Office catalogue discovery, repository layout and installation are not provided. |
| Reporting | No per-computer installation or patch-compliance report. |
| Storage limit | Controls new content caching. Does not cap database growth or automatically remove files. |
Check the left status widget, observed listening address and desired/applied revision.
A saved configuration can still fail to start.
The service error is shown in the dashboard.
Wait for matching revisions before testing the client endpoint.
| Symptom | Checks |
|---|---|
| Non-loopback TCP cannot start | Select a valid certificate from the certificate centre. Check that it includes a matching private key. |
| Unix listener is active but clients cannot connect | Confirm that the HTTPS reverse proxy exists and forwards the root paths to the fixed Unix socket. |
| Reverse proxy reports an upstream error after switching from TCP | Reopen the listener settings and save Unix mode. The console clears internal TLS so the Unix upstream speaks HTTP. |
| Client receives an access refusal | Check its CIDR. Behind a local reverse proxy, enable trusted client IP handling and overwrite X-Real-IP. |
| No profile or no catalogue data | Select and configure a Windows profile before synchronization. A server preset alone does not prove catalogue coverage. |
| Synchronization fails | Check DNS, Microsoft HTTPS reachability and the outgoing proxy settings. Do not expect a failed proxy connection to fall back silently to direct access. |
| Content request fails | Check approval, product selection, expected SHA256, size and source URL expiration. |
| Source traffic continues after the cache is full | This is expected relay behaviour for missing files. |
| Statistics unavailable | Enable the listener first. Durable counters remain stored while the service is disabled. |
| Client still uses another update service | Inspect the effective GPO or MDM policy and scan source rules. Check DNS and certificate trust before changing policies again. |
Get-Service wuauserv
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate' `
-ErrorAction SilentlyContinue | Select-Object WUServer, WUStatusServer
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU' `
-ErrorAction SilentlyContinue | Select-Object UseWUServer, NoAutoUpdate
Get-WinEvent -LogName 'Microsoft-Windows-WindowsUpdateClient/Operational' `
-MaxEvents 20 | Select-Object TimeCreated, Id, MessageDo not delete the Windows Update databases or cached files as a first troubleshooting step.
Preserve the error, profile, source URL expiry and service revisions for diagnosis.
Use the pilot rollback procedure before returning a test computer to its normal update policy.