now time for a WSUS question!

Butters · 4 Jul 2007 at 11:48

I'm full of them today...questions that is!

I've got WSUS set up, it can see my client machines and shows all the updates that they need. I've told WSUS not to allow the option of 'Install and Shutdown' when a user logs off and have (I think) told each machine to install at 10pm each night.

I've also told WSUS to automatically approve updates so that they can be installed.

So whats the problem I hear you ask?

Over the past 4 nights, none of the clients have installed any updates.

I've missesd something obvious. What though?

.walls · 4 Jul 2007 at 13:21

1. Have you configured the clients to get their updates from the sus server?
2. Is the IIS service running on the sus server?
3. Are there any updates waiting to be pushed out?

Sorry if I'm teaching you to suck eggs... but your post was a bit thin on facts.

Butters · 4 Jul 2007 at 13:32

=walls= said:
1. Have you configured the clients to get their updates from the sus server?
2. Is the IIS service running on the sus server?
3. Are there any updates waiting to be pushed out?

Sorry if I'm teaching you to suck eggs... but your post was a bit thin on facts.

1. Yes
2. Yes, but if you view it from a client (http://myserver:8530), I get a 403 Forbidden error, most likely cause, the website requires you to log on, although I can browse happily to all folders on the server under WSUS directory from any client.
3. How do I know? WSUS console says there are updates, and that 6 PCs are needing updates, all updates have been approved.

.walls · 4 Jul 2007 at 14:02

IIRC a 403: forbidden error is due to a proxy or firewall blocking it. If it's permissions on the server, it would be a 401 and if the page is not found, it would be a 404.

Try disabling the proxy on one of the clients to see if you can access the sus page (you should get a "page under construction" message, as there are no browser friendly elements).

Also, have you tried the client diagnostics tool and had a look at the sus logs: C:\Windows\WindowsUpdate.log? They may be able to shed some light.

csmager · 4 Jul 2007 at 14:04

For what it's worth, 403 forbidden shows up when there's no index.html/default.html page in the folder, and directory browsing is disabled.

Doesn't mean there's a problem - I have it on one of my IIS servers before I enable browsing.

Uhtred · 4 Jul 2007 at 14:06

Have you actually synced the server and downloaded all the updates needed on the wsus server? Maybe post a few screenshots?

Butters · 4 Jul 2007 at 14:17

Yup, it syncs every night at 10pm

Uhtred · 4 Jul 2007 at 14:30

Silly question but the clients aren't already up to date are they?

Butters · 4 Jul 2007 at 14:57

well, the WSUS service says that these computers need the updates.

I only ran each PC through Windows Update before connecting them to WSUS. Most of the updates it has are for Office 2003 (which is on each machine).

In fact, even the server says it has one update, and its been like this for over a week!

Rob7865 · 4 Jul 2007 at 16:45

Hi Butters

Download and run the WSUS Client Diag tool from here LINK
Save this to your client PC C:\ and then run it from a CMD prompt.

Post the results back here

As a side note, please confirm that the PC are still on at 10PM??

ttfn

Rob :cool:

JonnyT · 4 Jul 2007 at 16:53

If you're using WSUS 3.0 then you won't get anything at http://server:8530/ as they changed it between 2.0 and 3.0 so that the admin web page is no more - you have to use the MMC snap in instead

a couple of useful sites:

http://www.wsuswiki.com/

http://www.wsus.info/

Butters · 4 Jul 2007 at 18:16

Rob7865 said:
Hi Butters

Download and run the WSUS Client Diag tool from here LINK
Save this to your client PC C:\ and then run it from a CMD prompt.

Post the results back here

As a side note, please confirm that the PC are still on at 10PM??

ttfn

Rob

Thanks Rob, here you go (and yes, the PCs are on all the time)

Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
WSUS Client Diagnostics Tool

Checking Machine State
Checking for admin rights to run tool . . . . . . . . . PASS
Automatic Updates Service is running. . . . . . . . . . PASS
Background Intelligent Transfer Service is not running. PASS
Wuaueng.dll version 7.0.6000.374. . . . . . . . . . . . PASS
This version is WSUS 2.0

Checking AU Settings
AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
Option is from Policy settings

Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy. . . . . . . . . . . . . . . . . NONE
User IE ProxyByPass. . . . . . . . . . . . . . NONE
User IE AutoConfig URL Proxy . . . . . . . . . NONE
User IE AutoDetect
AutoDetect not in use

Checking Connection to WSUS/SUS Server
WUServer = http://ELITESERVER:8530
WUStatusServer = http://ELITESERVER:8530
UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS

Rob7865 · 4 Jul 2007 at 19:06

Butter

For your client OU Group Policy you need option 4 (Auto download and schedule the install)

Your current setting is 3 - Notify for install
"Checking AU Settings
AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
Option is from Policy settings"

ttfn

Rob :cool:

Butters · 4 Jul 2007 at 19:19

Rob7865 said:
Butter

For your client OU Group Policy you need option 4 (Auto download and schedule the install)

Your current setting is 3 - Notify for install
"Checking AU Settings
AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
Option is from Policy settings"

ttfn

Rob

Ok, done, I'll keep you posted, thanks