WSUS Role failed on Windows server 2012/2016 with error “the operation cannot be completed because the server that you specified requires a restart

 Thank to: https://eskonr.com/

I was trying to setup new Configuration Manager 2012 SP1 build on Windows server 2012 with SQL Server 2012 SP1 installed .Everything went fine except Windows server update services .It keeps saying error with restart needed.Here is what i got every time when i install WSUS after restart the server.

Update: You can also refer the solution posted here : http://blogs.technet.com/b/heyscriptingguy/archive/2013/04/15/installing-wsus-on-windows-server-2012.aspx

The request to add or remove features on the specified server failed. the operation cannot be completed because the server that you specified requires a restart.

 

Why does it fail every time though server is restarted several times after the error appear in the above screen ?

How do we troubleshoot this ?

Go to event viewer ,windows logs->system ,you see below error message:

The MSSQL$MICROSOFT##WID service was unable to log on as NT SERVICE\MSSQL$MICROSOFT##WID with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.
Service: MSSQL$MICROSOFT##WID
Domain and account: NT SERVICE\MSSQL$MICROSOFT##WID
This service account does not have the required user right "Log on as a service."

User Action
Assign "Log on as a service" to the service account on this computer. You can use Local Security Settings (Secpol.msc) to do this. If this computer is a node in a cluster, check that this user right is assigned to the Cluster service account on all nodes in the cluster.
If you have already assigned this user right to the service account, and the user right appears to be removed, check with your domain administrator to find out if a Group Policy object associated with this node might be removing the right.

How do i fix this ?

There are 2 possible solutions to fix this issue :

1. By adding the account (NT SERVICE\MSSQL$MICROSOFT##WID) to log on as service using gpedit.msc 2)  implement the same solution using GPO.

1.Add account NT SERVICE\MSSQL$MICROSOFT##WID as log on as service using GPEDIT.MSC on local server

Open gpedit.msc using administrator account ,Computer Configuration—>Windows Settings—>Security Settings—>Local Policies—>User Rights Assignment

Go to properties of Logon as Service,click on Add user or Group,Enter NT SERVICE\MSSQL$MICROSOFT##WID ,click ok.

Restart the server and start installing WSUS role .

2) Implementing using GPO :

Go to your group policy management console,edit default domain policy

Computer Configuration—>Policies—>Windows Settings—>Security Settings—>Local Policies—>User Rights Assignment

Note: It is not mandatory to edit the default domain Policy to enable this setting.You can also create new GPO and ensure to have Enforced (running on Server 2012) option is selected which can not be overwritten by Default Domain Controller.

Go to properties of Logon as Service,click on Add user or Group,Enter NT SERVICE\ALL SERVICES ,click ok.

Now move onto the server,open command prompt and type gpupdate /Force to apply the GPO settings.

To check if the settings are applied or not,you can run rsop.msc from the run command and see the changes applied or not.

Once you confirmed the settings are applied,Start the installation of WSUS role again,this time It should be okay.

Hope it Helps!