Patches for Windows version issue

Usage and Config Platform
1

Hello All,

Our environment is not getting any new monthly security patches for any of the OS’s. This is because we have older version for Patches for Windows (see image). The latest one is 4665 but ours is 4653. To upgrade its version, we clicked on that Gather button and also restarted all our services. Along with that, we checked the health of our DB servers as well which is good. But still this version is not upgrading and we cannot see the latest patches under Fixlets and Tasks.

Also, Upon checking GatherDB log, I found that there was patch applied on the DB server and after that, we cannot see the latest version. The log server suggest the below.

Wed, 07 Jan 2026 18:58:57 +0000 -- Database Error: [Microsoft][ODBC Driver 17 for SQL Server][SQL Server]Unable to access availability database 'BFEnterprise' because the database replica is not in the PRIMARY or SECONDARY role. Connections to an availability database is permitted only when the database replica is in the PRIMARY or SECONDARY role. Try the operation again later. (37000: 983)

But, according to DB team, this error is normal when patch is applied to the DB server and also currently DB servers are completely healthy and BFEnterprise database reports to Primary Server. I have also cleared the BigFix Console cache from Preferences. But it still shows the older version.

Please advice what can be done as we're not able to patch our devices.

image
image835×281 25.4 KB

2

I recommend opening a support case for further investigation.

3

I agree that Support may be able to help, but from this message it is pretty clearly an issue with SQL Always-On Availability Group, so you should be sure to loop in your SQL team as well. It is likely that the SQL server you are connecting is not in PRIMARY or SECONDARY role - which leaves RESOLVING or READONLY.

The error message is not a BigFix message, but a message from the Microsoft ODBC Driver.

A good place to start troubleshooting is Troubleshoot failover of Always On Availability Groups - SQL Server | Microsoft Learn

Another thing to check is in your ODBC connections, checking that you are configured to use the Availability Group Listener name/address as the server name, and not the name of an individual SQL instance. Check with your DBA team if you're not sure which to use. Also check to be sure your system's HOSTS file has not been misconfigured, I've seen instances of misconfiguration or testing by adding a cluster name in the HOSTS file pointing to the IP address of an individual node in the cluster, so be sure that hasn't happened on your root as well.

2 Likes