none
Updates approved and needed but client machine shows as up to date

    Question

  • First of all thanks in advance to anyone helping me out on this issue. 

    I am having a bunch of updates maked as approved but not installing on the client machines.  These are new updates and not once superceded.  They show approved and needed on the report on a system but the system reports as upto date. 

    Below is the log from windows update on one of the client machines.  I had to remove the links to my wsus server and reporting server as the forum would not let me post them until my accoutn is verifiied?

    2013-06-13 12:50:57:203 1288 1f44 Misc ===========  Logging initialized (build: 7.6.7600.256, tz: -0400)  ===========
    2013-06-13 12:50:57:203 1288 1f44 Misc   = Process: C:\Windows\system32\svchost.exe
    2013-06-13 12:50:57:203 1288 1f44 Misc   = Module: c:\windows\system32\wuaueng.dll
    2013-06-13 12:50:57:203 1288 1f44 Service *************
    2013-06-13 12:50:57:203 1288 1f44 Service ** START **  Service: Service startup
    2013-06-13 12:50:57:203 1288 1f44 Service *********
    2013-06-13 12:50:57:203 1288 1f44 Agent   * WU client version 7.6.7600.256
    2013-06-13 12:50:57:203 1288 1f44 Agent   * Base directory: C:\Windows\SoftwareDistribution
    2013-06-13 12:50:57:203 1288 1f44 Agent   * Access type: No proxy
    2013-06-13 12:50:57:203 1288 1f44 Agent   * Network state: Connected
    2013-06-13 12:51:04:052 1288 1830 Report CWERReporter::Init succeeded
    2013-06-13 12:51:04:052 1288 1830 Agent ***********  Agent: Initializing Windows Update Agent  ***********
    2013-06-13 12:51:04:052 1288 1830 Agent ***********  Agent: Initializing global settings cache  ***********
    2013-06-13 12:51:04:052 1288 1830 Agent   * WSUS server: links not allowed
    2013-06-13 12:51:04:052 1288 1830 Agent   * WSUS status server: links not allowed

    2013-06-13 12:51:04:052 1288 1830 Agent   * Target group: (Unassigned Computers)
    2013-06-13 12:51:04:052 1288 1830 Agent   * Windows Update access disabled: No
    2013-06-13 12:51:04:052 1288 1830 DnldMgr Download manager restoring 0 downloads
    2013-06-13 12:51:04:052 1288 1830 AU ###########  AU: Initializing Automatic Updates  ###########
    2013-06-13 12:51:04:052 1288 1830 AU   # WSUS server: links not allowed
    2013-06-13 12:51:04:052 1288 1830 AU   # Detection frequency: 1
    2013-06-13 12:51:04:052 1288 1830 AU   # Approval type: Pre-install notify (Policy)
    2013-06-13 12:51:04:052 1288 1830 AU   # Auto-install minor updates: Yes (Policy)
    2013-06-13 12:51:04:052 1288 1830 AU   # Will interact with non-admins (Non-admins are elevated (Policy))
    2013-06-13 12:51:12:444 1288 1f44 Report ***********  Report: Initializing static reporting data  ***********
    2013-06-13 12:51:12:444 1288 1f44 Report   * OS Version = 6.1.7601.1.0.65792
    2013-06-13 12:51:12:444 1288 1f44 Report   * OS Product Type = 0x00000030
    2013-06-13 12:51:12:460 1288 1f44 Report   * Computer Brand = System manufacturer
    2013-06-13 12:51:12:460 1288 1f44 Report   * Computer Model = System Product Name
    2013-06-13 12:51:12:460 1288 1f44 Report   * Bios Revision = 1602  
    2013-06-13 12:51:12:460 1288 1f44 Report   * Bios Name = BIOS Date: 12/16/10 09:57:42 Ver: 08.00.15
    2013-06-13 12:51:12:460 1288 1f44 Report   * Bios Release Date = 2010-12-16T00:00:00
    2013-06-13 12:51:12:460 1288 1f44 Report   * Locale ID = 1033
    2013-06-13 12:51:12:460 1288 1830 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:12:460 1288 1830 AU Initializing featured updates
    2013-06-13 12:51:12:460 1288 1830 AU Found 0 cached featured updates
    2013-06-13 12:51:12:460 1288 1830 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:12:460 1288 1830 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:12:476 1288 1830 AU AU finished delayed initialization
    2013-06-13 12:51:12:476 1288 1830 AU Triggering AU detection through DetectNow API
    2013-06-13 12:51:12:476 1288 1830 AU Triggering Online detection (non-interactive)
    2013-06-13 12:51:12:476 1288 1f44 AU #############
    2013-06-13 12:51:12:476 1288 1f44 AU ## START ##  AU: Search for updates
    2013-06-13 12:51:12:476 1288 1f44 AU #########
    2013-06-13 12:51:12:476 1288 1f44 AU <<## SUBMITTED ## AU: Search for updates [CallId = {286B2A52-D3BB-43EF-965B-7365643AB9D1}]
    2013-06-13 12:51:12:476 1288 1710 Agent *************
    2013-06-13 12:51:12:476 1288 1710 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2013-06-13 12:51:12:476 1288 1710 Agent *********
    2013-06-13 12:51:12:476 1288 1710 Agent   * Online = Yes; Ignore download priority = No
    2013-06-13 12:51:12:476 1288 1710 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2013-06-13 12:51:12:476 1288 1710 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2013-06-13 12:51:12:476 1288 1710 Agent   * Search Scope = {Machine}
    2013-06-13 12:51:12:476 1288 1710 Setup Checking for agent SelfUpdate
    2013-06-13 12:51:12:476 1288 1710 Setup Client version: Core: 7.6.7600.256  Aux: 7.6.7600.256
    2013-06-13 12:51:12:476 1288 1710 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
    2013-06-13 12:51:12:491 1288 1710 Misc  Microsoft signed: Yes
    2013-06-13 12:51:14:925 1288 1710 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
    2013-06-13 12:51:14:925 1288 1710 Misc  Microsoft signed: Yes
    2013-06-13 12:51:14:940 1288 1710 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
    2013-06-13 12:51:14:940 1288 1710 Misc  Microsoft signed: Yes
    2013-06-13 12:51:14:940 1288 1710 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
    2013-06-13 12:51:14:956 1288 1710 Misc  Microsoft signed: Yes
    2013-06-13 12:51:14:972 1288 1710 Setup Determining whether a new setup handler needs to be downloaded
    2013-06-13 12:51:14:972 1288 1710 Setup SelfUpdate handler is not found.  It will be downloaded
    2013-06-13 12:51:14:972 1288 1710 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256"
    2013-06-13 12:51:14:972 1288 1710 Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
    2013-06-13 12:51:14:972 1288 1710 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
    2013-06-13 12:51:14:987 1288 1710 Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
    2013-06-13 12:51:14:987 1288 1710 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
    2013-06-13 12:51:15:018 1288 1710 Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
    2013-06-13 12:51:15:018 1288 1710 Setup SelfUpdate check completed.  SelfUpdate is NOT required.
    2013-06-13 12:51:15:642 1288 1710 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2013-06-13 12:51:15:642 1288 1710 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = links not allowed
    2013-06-13 12:51:19:464 1288 1710 Agent WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
    2013-06-13 12:51:21:555 1288 1710 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2013-06-13 12:51:21:555 1288 1710 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = links not allowed
    2013-06-13 12:51:22:428 1288 1710 Agent   * Found 0 updates and 74 categories in search; evaluated appl. rules of 1740 out of 3342 deployed entities
    2013-06-13 12:51:22:428 1288 1710 Agent *********
    2013-06-13 12:51:22:428 1288 1710 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2013-06-13 12:51:22:428 1288 1710 Agent *************
    2013-06-13 12:51:22:460 1288 1ed4 AU >>##  RESUMED  ## AU: Search for updates [CallId = {286B2A52-D3BB-43EF-965B-7365643AB9D1}]
    2013-06-13 12:51:22:460 1288 1ed4 AU   # 0 updates detected
    2013-06-13 12:51:22:460 1288 1ed4 AU #########
    2013-06-13 12:51:22:460 1288 1ed4 AU ##  END  ##  AU: Search for updates [CallId = {286B2A52-D3BB-43EF-965B-7365643AB9D1}]
    2013-06-13 12:51:22:460 1288 1ed4 AU #############
    2013-06-13 12:51:22:460 1288 1ed4 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:22:460 1288 1ed4 AU Featured notifications is disabled.
    2013-06-13 12:51:22:460 1288 1ed4 AU AU setting next detection timeout to 2013-06-13 17:50:18
    2013-06-13 12:51:22:460 1288 1ed4 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:22:460 1288 1ed4 AU Successfully wrote event for AU health state:0
    2013-06-13 12:51:22:460 1288 1710 Report CWERReporter finishing event handling. (00000000)
    2013-06-13 12:51:27:436 1288 1710 Report REPORT EVENT: {48A1D9D3-14A7-4EE8-ACA1-E20A3AD81E1F} 2013-06-13 12:51:22:428-0400 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 0 updates.
    2013-06-13 12:51:27:436 1288 1710 Report REPORT EVENT: {48F6E9E7-977C-480B-A9C9-7B740B78C709} 2013-06-13 12:51:22:428-0400 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
    2013-06-13 12:51:27:436 1288 1710 Report CWERReporter finishing event handling. (00000000)
    2013-06-13 12:58:35:972 1288 1710 Report Uploading 4 events using cached cookie, reporting URL = links not allowed
    2013-06-13 12:58:35:988 1288 1710 Report Reporter successfully uploaded 4 events.

     
    Thursday, June 13, 2013 5:14 PM

Answers

  • I am having a bunch of updates marked as approved but not installing on the client machines. These are new updates and not once superceded. They show approved and needed on the report on a system but the system reports as up to date.

    This question is asked and answered almost monthly of late, so a scan through the threads of the past few weeks is surely to turn up a full explanation. The first point to note here is one of interpretation ... the client is not reporting that it is up to date, it is reporting that there are no updates available and those are two very different states of being.

    2013-06-13 12:51:04:052 1288 1830 Agent   * Target group: (Unassigned Computers)
    2013-06-13 12:51:04:052 1288 1830 AU   # Detection frequency: 1

    Something that may or may not be contributing .. these two configurations (server-side targeting) and a one hour Detection Frequency are incompatible. Please reconfigure the Detection Frequency to no less than 2 hoursThe client targeting cookie has a 60 minute expiration. With a 1-hour detection, this cookie never expires. One of the things cached in this cookie is the client's target group assignments. if the cookie never expires, the client never knows it has been reassigned from "Unassigned Computers" to a real target group. It continues to check "Unassigned Computers", but typically there are no updates approved for that target group, so the client sees "no updates available" (i.e. "0 updates detected")

    2013-06-13 12:51:22:428 1288 1710 Agent   * Found 0 updates and 74 categories in search; evaluated appl. rules of 1740 out of 3342 deployed entities
    2013-06-13 12:51:22:460 1288 1ed4 AU   # 0 updates detected

    But the second part of this is understanding the correct interpretation of this (arguably inadequate) log entry. The key word missing from both of these entries is the word "available". Consider these two entries rewritten as:

    Found 0 updates available and 74 categories in search...

    0 updates detected as available

    Availability of an update to a client is driven by two independent factors:

    • The update is approved for a target group of which the client system is a member
    • The installation file for the approved update is downloaded to the WSUS server (and thus actually available to the client to be downloaded and installed)

    It's this latter condition that most often causes these challenges. If you look at the Home Page of the WSUS Administration Console, in the lower left corner of the Details Pane ... what is displayed as the Download Status for this WSUS server? If there are updates still downloading, then almost certainly this is the cause of the apparent disparity.

    If there are =0= updates needing files ... then your 1-hour detection frequency is likely impacting the situation. In this case, after setting the detection frequency back to 2 hours (or greater), run the command wuauclt /resetauthorization /detectnow on the client to force the expiration of the targeting cookie and obtain the new target group assignment.

    Incidentally.... unless you're synchronizing your WSUS server several times per day, for example, to get and auto-approve Definition Updates for Forefront Client Security... there's no real value in setting the Detection Frequency to anything less than =6= hours.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2013)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Thursday, June 13, 2013 10:26 PM
    Moderator

All replies

  • I forgot to add that I backed up and restored the metadata and dowloaded images from another server that was beign decomsioned.  But many updates have approved and installed since then.
    Thursday, June 13, 2013 5:19 PM
  • try

    net stop "Windows Update"
    del c:\windows\SoftwareDistribution /q /s
    net start "Windows Update"
    gpupdate /force
    wuauclt /detectnow /resetautorization /reportnow

    Thursday, June 13, 2013 8:44 PM
  • I just did that as instructred and sof far no change... 9 updates needed and marked approved but not installed and the client says it needs no updates.  You did want me to perform that on the client right?
    Thursday, June 13, 2013 8:54 PM
  • I am having a bunch of updates marked as approved but not installing on the client machines. These are new updates and not once superceded. They show approved and needed on the report on a system but the system reports as up to date.

    This question is asked and answered almost monthly of late, so a scan through the threads of the past few weeks is surely to turn up a full explanation. The first point to note here is one of interpretation ... the client is not reporting that it is up to date, it is reporting that there are no updates available and those are two very different states of being.

    2013-06-13 12:51:04:052 1288 1830 Agent   * Target group: (Unassigned Computers)
    2013-06-13 12:51:04:052 1288 1830 AU   # Detection frequency: 1

    Something that may or may not be contributing .. these two configurations (server-side targeting) and a one hour Detection Frequency are incompatible. Please reconfigure the Detection Frequency to no less than 2 hoursThe client targeting cookie has a 60 minute expiration. With a 1-hour detection, this cookie never expires. One of the things cached in this cookie is the client's target group assignments. if the cookie never expires, the client never knows it has been reassigned from "Unassigned Computers" to a real target group. It continues to check "Unassigned Computers", but typically there are no updates approved for that target group, so the client sees "no updates available" (i.e. "0 updates detected")

    2013-06-13 12:51:22:428 1288 1710 Agent   * Found 0 updates and 74 categories in search; evaluated appl. rules of 1740 out of 3342 deployed entities
    2013-06-13 12:51:22:460 1288 1ed4 AU   # 0 updates detected

    But the second part of this is understanding the correct interpretation of this (arguably inadequate) log entry. The key word missing from both of these entries is the word "available". Consider these two entries rewritten as:

    Found 0 updates available and 74 categories in search...

    0 updates detected as available

    Availability of an update to a client is driven by two independent factors:

    • The update is approved for a target group of which the client system is a member
    • The installation file for the approved update is downloaded to the WSUS server (and thus actually available to the client to be downloaded and installed)

    It's this latter condition that most often causes these challenges. If you look at the Home Page of the WSUS Administration Console, in the lower left corner of the Details Pane ... what is displayed as the Download Status for this WSUS server? If there are updates still downloading, then almost certainly this is the cause of the apparent disparity.

    If there are =0= updates needing files ... then your 1-hour detection frequency is likely impacting the situation. In this case, after setting the detection frequency back to 2 hours (or greater), run the command wuauclt /resetauthorization /detectnow on the client to force the expiration of the targeting cookie and obtain the new target group assignment.

    Incidentally.... unless you're synchronizing your WSUS server several times per day, for example, to get and auto-approve Definition Updates for Forefront Client Security... there's no real value in setting the Detection Frequency to anything less than =6= hours.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2013)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Thursday, June 13, 2013 10:26 PM
    Moderator