Windows Server Update Services (WSUS 3.2) running on up-to-date Windows Server 2008R2 machine are failing to download Windows 10 Anniversary Update.

WSUS Console Overview page shows download status progressing up to 100% (4,844.37 MB of 4,844.37 MB), but then it just gets stuck and never changes.

Looking through Application Logs reveals a bit more info:

Event ID: 10032
Source: Windows Server Update Services
Description: The server is failing to download some Updates.

Event ID: 364
Source: Windows Server Update Services
Description: Content file download failed. Reason: File cert verification failure. Source File: /c/upgr/2016/08/14393.0.160715-1616.rsl_release_clientpro_ret_x86fre_en-gb_ead36c37fb56b67211b582d0697db36e473ee757.esd Destination File: E:\DATA\WSUS\WsusContent\57
\EAD36C37FB56B67211B582D0697DB36E473EE757.esd.

After looking through a handful of recent Microsoft Support forum threads it seems that there currently is no fix for this if your WSUS is running on Windows Server 2008R2. For example, in this Technet support thread Microsoft representative (Steve Henry) replied: “This is by design. WSUS 3.2 cannot sync or distribute ESDs…” So it looks like the issue is related to the fact that Windows 10 Anniversary Update is distributed as an ESD package… 
If you are running WSUS 3.2 Windows Server 2012, you are in luck as according to the same Technet Forum post installing KB3095113 and KB3159706 should allow WSUS 3.2 to distribute ESDs.

Personally I didn’t try the fix for 2012/R2 as my WSUS runs on 2008R2 and only Windows 10 machines in my domain are there for testing purposes. Instead I updated them manually using Windows 10 Upgrade Assistant.

August 2016
WSUS 3.2
Windows Server 2008R2