WSUS 3.0 SP1

[EasyUp Web Hosting]

Hi Guys,

We got a new client and they are running Windows Server 2008 Ent on one of the servers. This server is does DNS, AD, WSUS, SQL and some file sharing... I know, poor server...

Anywho, I think the WSUS isn't configured correctly, cause all of the pc are still going to MS Site for updates. I have checked everything I can think of, but nothing is working.

There is a gpo configured to let the client pcs know about the WSUS server and I am using the FQDN. Client pcs are running XP and Vista.

Any help you guys can offer?

 

[NetSpike]

Are you sure the GPO is configured properly?

Have you done a Resultant Set on the Group Policy to ensure that those policies are being applied and not overwriten by another policy perhaphs?

You can also use the Server and Client Diagnostics tools at http://technet.microsoft.com/en-us/wsus/bb466192.aspx for WSUS.

 

[gregmcc]

If you run wsus do any of the machines report in the console.

Of one of the machines open regedit and go to HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate

If the entry for wsus server correct?

Also check the c:\windows\windowsupdate.log - it should tell you where it reports to and where its getting its updates from.

 

[Asha'man X]

Be careful with the port, as when you install WSUS you have the option either run on port 80 or on another port, usually 8530. If so, you'll need your clients to point at the FQDN:8530

Hope that helps a little

 

[EasyUp Web Hosting]

Hey guys, all helpfull things to check, thanx. I didn't do the installation of the WSUS, so I don't know what port it is using...

Will check all of these and get back to you...

 

[EasyUp Web Hosting]

Does this mean anything to you guys?

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Update Services\Server\Setup
	:
	Version:3
	VersionString:3.1.6001.65
	ConfigurationSource:0
	ServicePackLevel:1
	TargetDir:c:\Program Files\Update Services\
	InstallType:1
	EnableRemoting:1
	WsusAdministratorsSid:S-1-5-21-2017389487-3304030781-947445316-1234
	WSUSReportersSid:S-1-5-21-2017389487-3304030781-947445316-1233
	SqlServerName:DSAPDCSRV\MICROSOFT##SSEE
	SqlAuthenticationMode:WindowsAuthentication
	SqlDatabaseName:SUSDB
	SqlUserName:
	SqlEncryptedPassword:
	SqlInstanceIsRemote:0
	wYukonInstalled:1
	IISInstallRevision:3.1.6001.65
	IISPreviousInstallRevision:
	IISUninstallConfigFilePath:c:\Program Files\Update Services\setup\UninstallSettings.xml
	IISTargetWebSiteCreated:False
	IISTargetWebSiteIndex:1
	ContentDir:C:\WSUS
	SmtpUserPassword:
	ProxyPassword:
	PortNumber:80
	IIsDynamicCompression:-1
	EncryptionParam:System.Byte[]
	EncryptionKey:System.Byte[]

 

[EasyUp Web Hosting]

Found the problem, for some reason, my gpo are not applied to the pcs... The registry entry doesn't exist and the windowsupdate file shows that it is still pointing to the MS site...

Can someone give me the registry settings so that I can add it manually...

 

[gregmcc]

There's quite a few reg settings - see here:

http://technet.microsoft.com/en-us/library/cc708449(WS.10).aspx

Here's some sample reg value though:

http://www.faqshop.com/sus/default....sus/hotips/manip settings through reg.htm#Top

 

[EasyUp Web Hosting]

Thanx, is the registry settings the same for Vista pcs?

 

[Asha'man X]

GPO updates can take a while to filter though, they usually get updated when computers get restarted. It may be worth it to to do a gpuupdate /force on the target machines to give it a test. If not, then you'll need to check that something isn't blocking the application of the GPO to the OU where the computers are stored. If the PC's are in the default Computers container, you can't apply a GPO to them.

 

[EasyUp Web Hosting]

Thanx for your reply Asha'man X, I have done what you suggested, but it doesn't work. I have created a new OU and moved the PCs into that OU. Something else must be blocking the GPO, cause I see with other settings also sent to client PCs with GPO will work the one day and the next day, it won't...

I have changed the registry settings for a XP and Vista pc, so I am just giving it some time to see if it works.

I've done a lot of WSUS installs in the past, and never struggled like am now...

 

[EasyUp Web Hosting]

Okay, the 2 PCs I did the registry thing on are now showing in WSUS, but I can't change the membership of them... Any ideas?

 

[gregmcc]

If you can't change the membership it could be the groups names are being enforced by GPO's.

BTW Wsus 3.0 SP2 is out.

 

[EasyUp Web Hosting]

Yeah, was thinking of uninstalling wsus 3.0 sp1 and do it from scratch. Will load wsus 3.0 sp2 then.

 

[Asha'man X]

After upgrading to WSUS 3.0 SP2, I've noticed a nice speed boost when going through categories with tons of updates in them. Generating reports also seems quicker.