## TL;DR
WSUS sync failing with 0x80190193 means the upstream Microsoft Update endpoint returned 403 Forbidden. In practice that is a proxy demanding authentication WSUS does not provide, a firewall TLS-inspection rule blocking the sync URLs, or the WSUS server configured with wrong proxy credentials. Test the endpoints from the server in a browser, fix the proxy configuration in WSUS options, and sync again.

```text
wsus synchronization failed error 0x80190193
```

## Use this when
- WSUS synchronization history shows Failed with 0x80190193.
- No new updates have arrived since a network or proxy change.
- The error appears immediately, not after a long download.

## Not for this skill when
- Sync downloads updates but clients cannot detect them. That is a client-facing problem, not upstream sync.
- Sync fails with a timeout code instead. Work connectivity and bandwidth, not 403 handling.

## Steps
1. From the WSUS server, browse to the Microsoft Update service endpoints listed in Microsoft documentation and note any proxy sign-in page or 403. Verify: you can see whether the proxy intercepts the request
2. Open WSUS Options, Proxy Server, and confirm the proxy address, port, and whether credentials are required and current. Verify: the settings match the network team current proxy configuration
3. If the proxy requires authentication, supply a service account allowed through the proxy, or have the proxy allow-list the WSUS server IP for the Microsoft Update domains. Verify: a test browse from the server returns content, not a block page
4. Restart the WSUS service and run a manual synchronization. Verify: sync progresses past catalog download instead of failing instantly
5. Check synchronization history after completion. Verify: the sync result is Successful with new updates listed

## Variant phrasings
### wsus sync 403 forbidden upstream
The HTTP-first phrasing.
### wsus synchronization failed proxy authentication
The proxy root-cause phrasing.
### no new updates wsus sync error 0x80190193
The symptom phrasing admins search when the catalog goes stale.

Compatibility: Compatibility: WSUS on Server 2016 and later synchronizing directly with Microsoft Update.

## Why it happens
WSUS sync is an HTTPS conversation with Microsoft Update. A 403 means the request was understood and refused, which almost always happens at an intermediary: authenticating proxies refuse unauthenticated service traffic, and TLS inspection appliances refuse hosts or user agents they do not allow. The fast failure, before any catalog data moves, is the tell.

## Edge cases / pitfalls
- WSUS upstream-of-upstream hierarchies return this code when the upstream server refuses the downstream one; check which tier actually faces the internet.
- Proxy credentials saved in WSUS do not follow password rotation; a changed service account password silently breaks sync weeks later.
- If the server was recently moved behind a new egress IP, the allow-list may key on the old address.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xHW2SA3EcRG8xctm1roYeg