none
Some PCs not connecting to WSUS

    Question

  • I have a LAN with 113 PCs attached. Servers are running Win 2008 and PCs running Windows XP + SP3 etc.

    I have 5 identical PCs that do not seem to be registering themselves in the WSUS database, every other PC has registered and is getting updates correctly.

    On the 5 I have run clientdiag.exe and all results are correct. Ihave also emptied the key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSClientID restared the update service an then run:

    wuauclt.exe /resetauthorization
    wuauclt.exe /reportnow
    wuauclt.exe /detectnow

    all to no avail.

    The relevant part of the WindowsUpdate.log follows:-

    ------------------------------

    2010-12-01 14:25:43:103 1064 978 PT WARNING: Cached cookie has expired or new PID is available
    2010-12-01 14:25:43:103 1064 978 PT Initializing simple targeting cookie, clientId = , target group = , DNS name = idesk05.xxxxx.ixxxxxx.org
    2010-12-01 14:25:43:103 1064 978 PT   Server URL = http://xxxxxxxx:8530/SimpleAuthWebService/SimpleAuth.asmx
    2010-12-01 14:25:43:119 1064 978 PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
    2010-12-01 14:25:43:119 1064 978 PT WARNING: SOAP Fault: 0x000190
    2010-12-01 14:25:43:119 1064 978 PT WARNING:     faultstring:Fault occurred
    2010-12-01 14:25:43:119 1064 978 PT WARNING:     ErrorCode:InternalServerError(5)
    2010-12-01 14:25:43:119 1064 978 PT WARNING:     Message:(null)
    2010-12-01 14:25:43:119 1064 978 PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
    2010-12-01 14:25:43:119 1064 978 PT WARNING:     ID:5f4aa352-693b-406d-950b-8de2312b3660
    2010-12-01 14:25:43:119 1064 978 PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
    2010-12-01 14:25:43:119 1064 978 PT WARNING: PopulateAuthCookies failed: 0x8024400e
    2010-12-01 14:25:43:119 1064 978 PT WARNING: RefreshCookie failed: 0x8024400e
    2010-12-01 14:25:43:119 1064 978 PT WARNING: RefreshPTState failed: 0x8024400e
    2010-12-01 14:25:43:119 1064 978 PT WARNING: PTError: 0x8024400e
    2010-12-01 14:25:43:119 1064 978 Report WARNING: Reporter failed to upload events with hr = 8024400e.
    2010-12-01 14:25:43:119 1064 978 Report WARNING: Discarding a batch of 1 events because they have expired.
    2010-12-01 14:25:43:182 1064 978 PT WARNING: Cached cookie has expired or new PID is available
    2010-12-01 14:25:43:182 1064 978 PT Initializing simple targeting cookie, clientId = , target group = , DNS name = idesk05.xxxxx.xxxxxxx.org
    2010-12-01 14:25:43:182 1064 978 PT   Server URL = http://xxxxxxxx:8530/SimpleAuthWebService/SimpleAuth.asmx
    2010-12-01 14:25:43:182 1064 978 PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
    2010-12-01 14:25:43:182 1064 978 PT WARNING: SOAP Fault: 0x000190
    2010-12-01 14:25:43:182 1064 978 PT WARNING:     faultstring:Fault occurred
    2010-12-01 14:25:43:182 1064 978 PT WARNING:     ErrorCode:InternalServerError(5)
    2010-12-01 14:25:43:182 1064 978 PT WARNING:     Message:(null)
    2010-12-01 14:25:43:182 1064 978 PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
    2010-12-01 14:25:43:182 1064 978 PT WARNING:     ID:db161aeb-cd15-4b0c-8a12-8ab1f02568a8
    2010-12-01 14:25:43:182 1064 978 PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
    2010-12-01 14:25:43:182 1064 978 PT WARNING: PopulateAuthCookies failed: 0x8024400e
    2010-12-01 14:25:43:182 1064 978 PT WARNING: RefreshCookie failed: 0x8024400e
    2010-12-01 14:25:43:182 1064 978 PT WARNING: RefreshPTState failed: 0x8024400e
    2010-12-01 14:25:43:182 1064 978 PT WARNING: PTError: 0x8024400e
    2010-12-01 14:25:43:182 1064 978 Report WARNING: Reporter failed to upload events with hr = 8024400e.
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: Cached cookie has expired or new PID is available
    2010-12-01 14:48:24:667 1064 a6c PT Initializing simple targeting cookie, clientId = , target group = , DNS name = idesk05.ixxxxx.xxxxx.org
    2010-12-01 14:48:24:667 1064 a6c PT   Server URL = http://xxxxxxxx:8530/SimpleAuthWebService/SimpleAuth.asmx
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: SOAP Fault: 0x000190
    2010-12-01 14:48:24:667 1064 a6c PT WARNING:     faultstring:Fault occurred
    2010-12-01 14:48:24:667 1064 a6c PT WARNING:     ErrorCode:InternalServerError(5)
    2010-12-01 14:48:24:667 1064 a6c PT WARNING:     Message:(null)
    2010-12-01 14:48:24:667 1064 a6c PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
    2010-12-01 14:48:24:667 1064 a6c PT WARNING:     ID:89cbf15f-5bf2-4508-9ccd-0c8d1413f737
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: PopulateAuthCookies failed: 0x8024400e
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: RefreshCookie failed: 0x8024400e
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: RefreshPTState failed: 0x8024400e
    2010-12-01 14:48:24:667 1064 a6c PT WARNING: PTError: 0x8024400e
    2010-12-01 14:48:24:667 1064 a6c Report WARNING: Reporter failed to upload events with hr = 8024400e.
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: Cached cookie has expired or new PID is available
    2010-12-01 15:15:24:267 1064 b98 PT Initializing simple targeting cookie, clientId = , target group = , DNS name = idesk05.xxxxx.xxxxxx.org
    2010-12-01 15:15:24:267 1064 b98 PT   Server URL = http://xxxxxxxx:8530/SimpleAuthWebService/SimpleAuth.asmx
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: SOAP Fault: 0x000190
    2010-12-01 15:15:24:267 1064 b98 PT WARNING:     faultstring:Fault occurred
    2010-12-01 15:15:24:267 1064 b98 PT WARNING:     ErrorCode:InternalServerError(5)
    2010-12-01 15:15:24:267 1064 b98 PT WARNING:     Message:(null)
    2010-12-01 15:15:24:267 1064 b98 PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
    2010-12-01 15:15:24:267 1064 b98 PT WARNING:     ID:07d29dd9-5b89-44a4-8532-37b12cc471db
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: PopulateAuthCookies failed: 0x8024400e
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: RefreshCookie failed: 0x8024400e
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: RefreshPTState failed: 0x8024400e
    2010-12-01 15:15:24:267 1064 b98 PT WARNING: PTError: 0x8024400e
    2010-12-01 15:15:24:267 1064 b98 Report WARNING: Reporter failed to upload events with hr = 8024400e.
    2010-12-01 15:34:14:330 1064 85c PT WARNING: Cached cookie has expired or new PID is available
    2010-12-01 15:34:14:330 1064 85c PT Initializing simple targeting cookie, clientId = , target group = , DNS name = idesk05.xxxxx.xxxxx.org
    2010-12-01 15:34:14:330 1064 85c PT   Server URL = http://xxxxxxxx:8530/SimpleAuthWebService/SimpleAuth.asmx
    2010-12-01 15:34:14:330 1064 85c PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200
    2010-12-01 15:34:14:330 1064 85c PT WARNING: SOAP Fault: 0x000190
    2010-12-01 15:34:14:330 1064 85c PT WARNING:     faultstring:Fault occurred
    2010-12-01 15:34:14:330 1064 85c PT WARNING:     ErrorCode:InternalServerError(5)
    2010-12-01 15:34:14:330 1064 85c PT WARNING:     Message:(null)
    2010-12-01 15:34:14:330 1064 85c PT WARNING:     Method:"http://www.microsoft.com/SoftwareDistribution/Server/SimpleAuthWebService/GetAuthorizationCookie"
    2010-12-01 15:34:14:330 1064 85c PT WARNING:     ID:e1aeefaf-0719-4388-b94e-17ebc392ce7c
    2010-12-01 15:34:14:330 1064 85c PT WARNING: Failed to initialize Simple Targeting Cookie: 0x8024400e
    2010-12-01 15:34:14:330 1064 85c PT WARNING: PopulateAuthCookies failed: 0x8024400e
    2010-12-01 15:34:14:330 1064 85c PT WARNING: RefreshCookie failed: 0x8024400e
    2010-12-01 15:34:14:330 1064 85c PT WARNING: RefreshPTState failed: 0x8024400e
    2010-12-01 15:34:14:330 1064 85c PT WARNING: PTError: 0x8024400e
    2010-12-01 15:34:14:330 1064 85c Report WARNING: Reporter failed to upload events with hr = 8024400e.
    -------------------------------

    The key error seems to be the warning about the cookie:-

    WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200

    If I load IE8 and go to the WindowsUpdate site the PCs will happily sacn and retrieve updates from the MS website. It's just that they don't register with WSUS.

    This is important as the PCs on this LAN are tightly controlled with MS Policies and the hardware Firewall blocks downloads of .exe .bin .com files etc to workstations.

    Any suggestions greatly appreciated.

     

     


    I.T. Manager International House London
    Wednesday, December 01, 2010 4:30 PM

Answers

  • On the 5 I have run clientdiag.exe and all results are correct. I have also emptied the key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSClientID restarted the update service and then run:

    Posting the results of the Client Diagnostic Tool and the Registry Key would be helpful. While I don't disbelieve you, there are ample examples of posters who have claimed they were correct and they weren't, causing a lot of time to be invested in troubleshooting based on false assumptions. I've learned to verify all assumptions. :-)

    Deleting the SusClientID, by itself, is insufficient to resolve any issues related to duplicate SusClientIDs. The correct procedure is documented in KB903262 and also requires the deletion of the SusClientValidationID key.
    wuauclt.exe /resetauthorization
    wuauclt.exe /reportnow
    wuauclt.exe /detectnow

    Two of these three commands are invalid, which is probably contributing to your continued issues. The last command is the only valid syntax of the three. Please perform the following steps on one of those five systems, so that we can get sufficient diagnostic information to evaluate the situation:

    1. Record the system time
    2. Restart the AU service
    3. Run this command: wuauclt /resetauthorization /detectnow (which is the correct syntax).
    4. Wait 30 minutes.
    5. Post ALL of the entries (unedited!) from the WindowsUpdate.log starting at the time recorded in Step #1.

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2010)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    • Marked as answer by Maurice_Reed Thursday, December 02, 2010 9:11 AM
    Wednesday, December 01, 2010 4:56 PM
    Moderator

All replies

  • Am 01.12.2010 schrieb Maurice_Reed:

    I have 5 identical PCs that do not seem to be registering themselves in the WSUS database, every other PC has registered and is getting updates correctly.

    On the 5 I have run clientdiag.exe and all results are correct. Ihave also emptied the key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSClientID restared the update service an then run:

    You must delete all keys you find in this KB:
    http://support.microsoft.com/kb/903262 If you only delete the Content
    from SUSClientID, the error you find will ome up.

    2010-12-01 14:25:43:119 1064 978 PT WARNING: GetAuthorizationCookie failure, error = 0x8024400E, soap client error = 7, soap error code = 400, HTTP status code = 200

    Winfried


    http://www.microsoft.com/germany/windowsserver2003/technologien/updateservices/default.mspx
    http://www.wsuswiki.com/Home

    Wednesday, December 01, 2010 4:52 PM
  • On the 5 I have run clientdiag.exe and all results are correct. I have also emptied the key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSClientID restarted the update service and then run:

    Posting the results of the Client Diagnostic Tool and the Registry Key would be helpful. While I don't disbelieve you, there are ample examples of posters who have claimed they were correct and they weren't, causing a lot of time to be invested in troubleshooting based on false assumptions. I've learned to verify all assumptions. :-)

    Deleting the SusClientID, by itself, is insufficient to resolve any issues related to duplicate SusClientIDs. The correct procedure is documented in KB903262 and also requires the deletion of the SusClientValidationID key.
    wuauclt.exe /resetauthorization
    wuauclt.exe /reportnow
    wuauclt.exe /detectnow

    Two of these three commands are invalid, which is probably contributing to your continued issues. The last command is the only valid syntax of the three. Please perform the following steps on one of those five systems, so that we can get sufficient diagnostic information to evaluate the situation:

    1. Record the system time
    2. Restart the AU service
    3. Run this command: wuauclt /resetauthorization /detectnow (which is the correct syntax).
    4. Wait 30 minutes.
    5. Post ALL of the entries (unedited!) from the WindowsUpdate.log starting at the time recorded in Step #1.

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2010)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    • Marked as answer by Maurice_Reed Thursday, December 02, 2010 9:11 AM
    Wednesday, December 01, 2010 4:56 PM
    Moderator
  • Thanks guys that fixed it.

    Previously I had been deleting the contents of the registry keys. As per the KB article I deleted the keys themselves and then once the service was restarted and then - wuauclt /resetauthorization /detectnow and within a minute some updates were waiting to be installed.

    A couple of things:

    1. these PCs aren't clones although they are identical hardware and setup exactly the same i.e. they've never been ghosted but many others on this LAN are ghosted using Norton ghost.exe but there has never been a problem with registering in WSUS.
    2. the registry keys - PingID & AccountDomainSid are not present on any PC although it doesn't seem to make a difference.

    Thanks again.


    I.T. Manager International House London
    Thursday, December 02, 2010 9:11 AM
  • 2. the registry keys - PingID & AccountDomainSid are not present on any PC although it doesn't seem to make a difference.
    These are legacy keys only applicable to the WUAgent v5.8 installations used with WSUS v2 and WU/MU prior to Spring 2007.
    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2010)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Thursday, December 02, 2010 10:42 PM
    Moderator