wsus synchronization failed error 0x80190193
Fixes WSUS synchronization failure 0x80190193, an HTTP 403 forbidden response from Microsoft Update during catalog sync, usually a proxy or firewall authentication problem or a changed upstream endpoint. Use when manual and scheduled WSUS syncs fail with this code. Not for client detection failures.
TL;DR
WSUS sync failing with 0x80190193 means the upstream Microsoft Update endpoint returned 403 Forbidden. In practice that is a proxy demanding authentication WSUS does not provide, a firewall TLS-inspection rule blocking the sync URLs, or the WSUS server configured with wrong proxy credentials. Test the endpoints from the server in a browser, fix the proxy configuration in WSUS options, and sync again.
wsus synchronization failed error 0x80190193Use this when
- WSUS synchronization history shows Failed with 0x80190193.
- No new updates have arrived since a network or proxy change.
- The error appears immediately, not after a long download.
Not for this skill when
- Sync downloads updates but clients cannot detect them. That is a client-facing problem, not upstream sync.
- Sync fails with a timeout code instead. Work connectivity and bandwidth, not 403 handling.
Steps
- From the WSUS server, browse to the Microsoft Update service endpoints listed in Microsoft documentation and note any proxy sign-in page or 403. Verify: you can see whether the proxy intercepts the request
- Open WSUS Options, Proxy Server, and confirm the proxy address, port, and whether credentials are required and current. Verify: the settings match the network team current proxy configuration
- If the proxy requires authentication, supply a service account allowed through the proxy, or have the proxy allow-list the WSUS server IP for the Microsoft Update domains. Verify: a test browse from the server returns content, not a block page
- Restart the WSUS service and run a manual synchronization. Verify: sync progresses past catalog download instead of failing instantly
- Check synchronization history after completion. Verify: the sync result is Successful with new updates listed
Variant phrasings
wsus sync 403 forbidden upstream
The HTTP-first phrasing.
wsus synchronization failed proxy authentication
The proxy root-cause phrasing.
no new updates wsus sync error 0x80190193
The symptom phrasing admins search when the catalog goes stale.
Compatibility: Compatibility: WSUS on Server 2016 and later synchronizing directly with Microsoft Update.
Why it happens
WSUS sync is an HTTPS conversation with Microsoft Update. A 403 means the request was understood and refused, which almost always happens at an intermediary: authenticating proxies refuse unauthenticated service traffic, and TLS inspection appliances refuse hosts or user agents they do not allow. The fast failure, before any catalog data moves, is the tell.
Edge cases / pitfalls
- WSUS upstream-of-upstream hierarchies return this code when the upstream server refuses the downstream one; check which tier actually faces the internet.
- Proxy credentials saved in WSUS do not follow password rotation; a changed service account password silently breaks sync weeks later.
- If the server was recently moved behind a new egress IP, the allow-list may key on the old address.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_xHW2SA3EcRG8xctm1roYeg