question

@Adino-9402
Thanks for your posting on Q&A.

In order to help me research further, please be kind to share the WSUS_PostInstall_20220420T203754.log on this forum. I believe it will be helpful for me to troubleshoot.

In addition, I found a related case. It seems that the issue is due to the missing the value of ContentDirectory in the UpdateServices-Services.xml. The UpdateServices-Services.xml are located in I found it in **Windows\System32\ServerManager\ComponentConfiguration**.
Reference link:
https://social.technet.microsoft.com/Forums/windowsserver/en-US/e1003863-e331-46da-8803-e8625bb6324b/server-2012-wsus-postdeployment-configuration-fails-comprehending-the-log-file

Hope the above will be helpful. Have a great day.

Best regards,
Rita

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

2022-04-21 10:44:33 Postinstall started
2022-04-21 10:44:33 Detected role services: Api, UI, WidDatabase, Services
2022-04-21 10:44:33 Start: LoadSettingsFromParameters
2022-04-21 10:44:33 Content local is: True
2022-04-21 10:44:33 Content directory is: D:\WSUS
2022-04-21 10:44:33 SQL instname is:
2022-04-21 10:44:33 End: LoadSettingsFromParameters
2022-04-21 10:44:33 Start: Run
2022-04-21 10:44:33 Fetching WsusAdministratorsSid from registry store
2022-04-21 10:44:33 Value is (null)
2022-04-21 10:44:33 Configuring content directory...
2022-04-21 10:44:33 Configuring groups...
2022-04-21 10:44:33 Starting group configuration for WSUS Administrators...
2022-04-21 10:44:33 Group does not already exist in the registry
2022-04-21 10:44:33 Searching for existing group...
2022-04-21 10:44:33 Group was not fount attempt to create it...
2022-04-21 10:44:33 Writing group to registry...
2022-04-21 10:44:33 Finished group creation
2022-04-21 10:44:33 Starting group configuration for WSUS Reporters...
2022-04-21 10:44:33 Group does not already exist in the registry
2022-04-21 10:44:33 Searching for existing group...
2022-04-21 10:44:33 Group was not fount attempt to create it...
2022-04-21 10:44:33 Writing group to registry...
2022-04-21 10:44:33 Finished group creation
2022-04-21 10:44:33 Configuring permissions...
2022-04-21 10:44:33 Fetching content directory...
2022-04-21 10:44:33 Fetching ContentDir from registry store
2022-04-21 10:44:33 Value is D:\WSUS
2022-04-21 10:44:33 Fetching group SIDs...
2022-04-21 10:44:33 Fetching WsusAdministratorsSid from registry store
2022-04-21 10:44:33 Value is xxxxxxxxxxx
2022-04-21 10:44:33 Fetching WsusReportersSid from registry store
2022-04-21 10:44:33 Value is xxxxxxxxxxxxxx
2022-04-21 10:44:33 Creating group principals...
2022-04-21 10:44:35 Granting directory permissions...
2022-04-21 10:44:35 Granting permissions on content directory...
2022-04-21 10:44:35 Granting registry permissions...
2022-04-21 10:44:35 System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
at System.Security.AccessControl.Win32.GetSecurityInfo(ResourceType resourceType, String name, SafeHandle handle, AccessControlSections accessControlSections, RawSecurityDescriptor& resultSd)
at System.Security.AccessControl.NativeObjectSecurity.CreateInternal(ResourceType resourceType, Boolean isContainer, String name, SafeHandle handle, AccessControlSections includeSections, Boolean createByName, ExceptionFromErrorCode exceptionFromErrorCode, Object exceptionContext)
at System.Security.AccessControl.NativeObjectSecurity..ctor(Boolean isContainer, ResourceType resourceType, SafeHandle handle, AccessControlSections includeSections, ExceptionFromErrorCode exceptionFromErrorCode, Object exceptionContext)
at System.Security.AccessControl.RegistrySecurity..ctor(SafeRegistryHandle hKey, String name, AccessControlSections includeSections)
at Microsoft.Win32.RegistryKey.GetAccessControl(AccessControlSections includeSections)
at Microsoft.UpdateServices.Administration.ConfigurePermissions.GrantRegistryPermissions(IdentityReference identity, RegistryRights registryRights)
at Microsoft.UpdateServices.Administration.ConfigurePermissions.GrantRegistryPermissions()
at Microsoft.UpdateServices.Administration.PostInstall.Run()
at Microsoft.UpdateServices.Administration.PostInstall.Execute(String[] arguments)

Looks this may be the fix from: https://docs.microsoft.com/en-us/answers/questions/556051/wsus-reinstallation-and-post-install-configuration.html

In short:

To solve this access issue we have given full permission and change the ownership to installation account but didn't work then we checked the group policy on local system and came to know that the "Manage Auditing and Security Log" under "Computer Configuration\Windows Settings\Security Settings\Local Policies\" is only configured for two specific users and managed thru default domain policy. however default configuration should be for Local Administrators group.
to solve this issue we have changed the group policy from specific user to Local administrators group and after that it worked and we were able to complete the WSUS post installation and configuration by following below steps and now it is working fine.

8) Verify IIS is installed and working without errors
9) Open Server Manager MMC and select Add Roles & features to install WSUS
10) Once WSUS installation has completed, run PowerShell using Admin rights and change the current working directory to %programfiles%\Update Services\Tools and run the following post-installation commands. in our case we used SQL DB and ran first command
To use a SQL DB:
.\wsusutil.exe postinstall SQL_INSTANCE_NAME=”SERVER\Instance” CONTENT_DIR=”<drive>:\WSUS”
To use WID:
.\wsusutil.exe postinstall CONTENT_DIR=”<drive>:\WSUS”
11) Wait for the command to complete successfully.
12) Open the WSUS console from Server Manager console => Tool => Windows Server Update Services
and configure as per your requirement and wait for initial sync to happen.

@ Adino-9402

Spot-On!! Thanks man! Ended up being the same problem in my case and your suggestion for the gpo setting guided me right to it.

Saved me some troubleshooting today : )

@Adino-9402
Thanks very much for your sharing on this forum. We're glad that the question is solved now. I believe it will be helpful for others who have same issue in the near feature. So I would like to write a short summary for the case. Here's a short summary for the problem , this will help other users to search for useful information more quickly.

Problem/Symptom:
Fail to finish WSUS post install. Fatal Error: Attempted to perform an unauthorized operation.

Solution/Workaround:
Grant Local Administrators group Manage Auditing and Security Log Group Policy permissions. The location of the group policy: Computer Configuration\Windows Settings\Security Settings\Local Policies\User Rights Assignment
Reference screenshot in my lab:

Best regards,
Rita

If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.