locked
Why are my definitions updating when I'm sure they should not!? RRS feed

  • Question

  • I've got Forefront Client Security Console on one server and WSUS on a different server. I've set WSUS to automatically approve definitions for Forefront, which is working fine. However I don't understand why these definitions are being installed on the clients, when the GPO for the OUs is set to use the WSUS server for Windows updates, but only for '2 - notify for download and notify for install'.  So my question is... why are these definitions being pushed out to the clients?

    I've checked the policy on the Forefront Console and in the advanced tab I've unticked all 3 options for 'Check for updates' and re-distributed the policy. I've checked with RSoP on the clients in question and the keys for signature update interval  is 0.

    Help.. I'm going mad!
    Thursday, January 15, 2009 3:44 PM

All replies

  • nope you are not going mad :-)

    I'm a little curious as to why you DON'T want the definition updates distributed immediately? That is a desired behavior in my opinion.

    Anyway, If you look in your WSUS policy i bet you have the "allow immediate update installation" policy setting enabled. This is why the definitions are distributed automatically regardless of your scheduling setting. The definition updates are taged with ZSI flag (zero service interrupt) this means that the update will not disturb any services nor need a reboot. Definitions are the only updates taged with ZSI flag

    /Johan
    MCSE, forefront spec | www.msforefront.com
    Thursday, January 15, 2009 9:57 PM
  • Hi Johan,

    Thanks for the reply. I'm just trying to find out what they're being distributed immediately.. I want to ensure I can be in full control of all elements, so I am able to diagnose any problems.

    When you say 'WSUS Policy' do you mean the GPO that applied to the OU where the client machines are located? There are only 4 options set in Computer Configuration\Admin Tenmplates\Windows Components\Windows Update, these are -

    'Do not adjust default option to install updates and shutdown in shutdown windows dialog box' which is enabled.
    'Configure automatic updates' , which is set to 2- notify for download and notify for install
    'Specify intranet Microsoft update service location', which points to the WSUS server.
    'No auto-restart with logged on users for scheduled automatic updates installations' which is enabled

    On one of the machines that is being auto updated I've ran an RSoP and the option 'Allow automatic updates immediate installation' is not in there. I assume leaving this setting in the GPO as 'Not configured' should be OK.. or should I force to disable?

    Thanks again

    Mike

    Friday, January 16, 2009 9:17 AM
  • Hi Mike

    The definitions should only deploy if either the "Allow immediate update installation" option is enabled or if you have set "download and schedule for install at a specific time"  or if the users have been installing the updates after they have been downloaded and a notification has come up.

    I agree that the desired configuration is to have the definitions deploy automatically.   However to help you out with understanding how it functions in your enviroment  I will try to assist.

    Is it possible to past the last 50 or so lines of the C:\windows\windowsupdate.log file so I can see what the windows updates are doing as your options in your post above running the Rsop dont match what is happening on your network.

    Regards

    Robert

    Monday, January 19, 2009 7:38 AM
  • Hi

    I've just checked one of the clients (Windows 2003 server). The RSoP has all the settings mentioned above. According to the event log on that server the definitions were updated to 1.49.2165.0 at 00:32:04 on 19/1/09.

    See below for the update log from the server. NAT-PMS-XXX-V01 is the name of the WSUS server.

    Thanks again for your help.

    mike


    2009-01-19 00:27:33:793 8492 27c0 COMAPI -------------
    2009-01-19 00:27:33:793 8492 27c0 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:27:33:793 8492 27c0 COMAPI ---------
    2009-01-19 00:27:33:793 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:27:33:793 1808 21c4 Agent *************
    2009-01-19 00:27:33:793 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:27:33:793 1808 21c4 Agent *********
    2009-01-19 00:27:33:793 1808 21c4 Agent   * Online = Yes; Ignore download priority = No
    2009-01-19 00:27:33:793 1808 21c4 Agent   * Criteria = "IsInstalled=0 AND CategoryIDs CONTAINS 'E0789628-CE08-4437-BE74-2495B842F43B' AND CategoryIDs CONTAINS '0A487050-8B0F-4F81-B401-BE4CEACD61CD'"
    2009-01-19 00:27:33:793 1808 21c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000}
    2009-01-19 00:27:37:652 1808 21c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2009-01-19 00:27:37:652 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:27:37:808 1808 21c4 PT WARNING: Cached cookie has expired or new PID is available
    2009-01-19 00:27:37:808 1808 21c4 PT Initializing simple targeting cookie, clientId = ad12bdc1-c167-4e33-a139-6a2a9b8d19ef, target group = , DNS name = dev-cit-v03-s01.nhsp.local
    2009-01-19 00:27:37:808 1808 21c4 PT   Server URL = http://NAT-PMS-XXX-V01:8530/SimpleAuthWebService/SimpleAuth.asmx
    2009-01-19 00:27:43:715 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:28:12:746 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:28:16:215 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:28:22:418 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:28:29:668 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:28:55:886 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:28:57:105 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:29:07:043 1808 21c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2009-01-19 00:29:07:043 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:29:10:183 1808 45c AU Triggering Offline detection (non-interactive)
    2009-01-19 00:29:10:183 1808 45c AU #############
    2009-01-19 00:29:10:183 1808 45c AU ## START ##  AU: Search for updates
    2009-01-19 00:29:10:183 1808 45c AU #########
    2009-01-19 00:29:10:183 1808 45c AU <<## SUBMITTED ## AU: Search for updates [CallId = {F379BF86-B15B-4AF1-9BD1-5A40EF23B3D6}]
    2009-01-19 00:29:10:183 1808 21c4 Agent Update {2B12D41E-DE66-4D8C-A041-D3CE20A75759}.100 is pruned out due to potential supersedence
    2009-01-19 00:29:10:183 1808 21c4 Agent   * Added update {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100 to search result
    2009-01-19 00:29:10:183 1808 21c4 Agent   * Found 1 updates and 45 categories in search; evaluated appl. rules of 707 out of 1067 deployed entities
    2009-01-19 00:29:10:293 1808 21c4 Agent *********
    2009-01-19 00:29:10:293 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:29:10:293 1808 21c4 Agent *************
    2009-01-19 00:29:10:324 1808 21c4 Agent *************
    2009-01-19 00:29:10:324 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 00:29:10:324 1808 21c4 Agent *********
    2009-01-19 00:29:10:324 1808 21c4 Agent   * Online = No; Ignore download priority = No
    2009-01-19 00:29:10:324 1808 21c4 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    2009-01-19 00:29:10:324 1808 21c4 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 00:29:10:340 8492 2050 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:29:10:355 8492 2050 COMAPI   - Updates found = 1
    2009-01-19 00:29:10:355 8492 2050 COMAPI ---------
    2009-01-19 00:29:10:355 8492 2050 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:29:10:355 8492 2050 COMAPI -------------
    2009-01-19 00:29:10:371 8492 27c0 COMAPI -------------
    2009-01-19 00:29:10:371 8492 27c0 COMAPI -- START --  COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:29:10:371 8492 27c0 COMAPI ---------
    2009-01-19 00:29:10:371 8492 27c0 COMAPI   - Forced: No; Download priority: 3
    2009-01-19 00:29:10:371 8492 27c0 COMAPI   - Updates in request: 1
    2009-01-19 00:29:10:371 8492 27c0 COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 00:29:10:402 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:29:14:621 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:29:41:043 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:29:44:715 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:29:50:386 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:29:57:621 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:30:23:465 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:30:24:715 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:30:29:918 1808 21c4 Agent Update {2B12D41E-DE66-4D8C-A041-D3CE20A75759}.100 is pruned out due to potential supersedence
    2009-01-19 00:30:29:918 1808 21c4 Agent   * Added update {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100 to search result
    2009-01-19 00:30:29:918 1808 21c4 Agent   * Found 1 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 00:30:29:949 1808 21c4 Agent *********
    2009-01-19 00:30:29:949 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 00:30:29:949 1808 21c4 Agent *************
    2009-01-19 00:30:29:965 1808 2010 AU >>##  RESUMED  ## AU: Search for updates [CallId = {F379BF86-B15B-4AF1-9BD1-5A40EF23B3D6}]
    2009-01-19 00:30:29:965 1808 2010 AU   # 1 updates detected
    2009-01-19 00:30:29:965 1808 2010 AU #########
    2009-01-19 00:30:29:965 1808 2010 AU ##  END  ##  AU: Search for updates [CallId = {F379BF86-B15B-4AF1-9BD1-5A40EF23B3D6}]
    2009-01-19 00:30:29:965 1808 2010 AU #############
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr *************
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr *********
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr   * Call ID = {7DDEF5BB-F9BD-4208-96C7-084F6C0CE310}
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr   * Priority = 3, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr   * Updates to download = 1
    2009-01-19 00:30:29:996 1808 21c4 Agent   *   Title = Definition Update for Microsoft Forefront Client Security (Antimalware 1.49.2165.0)
    2009-01-19 00:30:29:996 1808 21c4 Agent   *   UpdateId = {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100
    2009-01-19 00:30:29:996 1808 21c4 Agent   *     Bundles 1 updates:
    2009-01-19 00:30:29:996 1808 21c4 Agent   *       {C3109CE0-7F98-4B31-8EA4-2D1E0969A1C3}.100
    2009-01-19 00:30:29:996 1808 21c4 DnldMgr ***********  DnldMgr: New download job [UpdateId = {C3109CE0-7F98-4B31-8EA4-2D1E0969A1C3}.100]  ***********
    2009-01-19 00:30:30:043 1808 21c4 DnldMgr   * BITS job initialized, JobId = {5A705DE4-C423-43DD-9217-037C9D796C9A}
    2009-01-19 00:30:30:043 1808 21c4 DnldMgr   * Downloading from http://nat-pms-xxx-v01:8530/Content/DF/079D8B5DD6676B219FA684714141EC129DABC3DF.exe to C:\WINDOWS\SoftwareDistribution\Download\dc61ff258623119c107261c75e90cd82\079d8b5dd6676b219fa684714141ec129dabc3df (full file).
    2009-01-19 00:30:30:058 1808 21c4 Agent *********
    2009-01-19 00:30:30:058 1808 21c4 Agent **  END  **  Agent: Downloading updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:058 1808 21c4 Agent *************
    2009-01-19 00:30:30:058 1808 21c4 Report REPORT EVENT: {35951661-10EC-4EF2-A00B-12B36074A79F} 2009-01-19 00:29:10:293-0000 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 1 updates.
    2009-01-19 00:30:30:058 1808 21c4 Report REPORT EVENT: {1A3987F6-7F78-4644-B000-413831CB856D} 2009-01-19 00:29:10:293-0000 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Pre-Deployment Check Reporting client status.
    2009-01-19 00:30:30:527 1808 11c4 DnldMgr BITS job {5A705DE4-C423-43DD-9217-037C9D796C9A} completed successfully
    2009-01-19 00:30:30:683 1808 11c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\Download\dc61ff258623119c107261c75e90cd82\079d8b5dd6676b219fa684714141ec129dabc3df:
    2009-01-19 00:30:30:715 1808 11c4 Misc  Microsoft signed: Yes
    2009-01-19 00:30:30:715 1808 11c4 DnldMgr   Download job bytes total = 3283336, bytes transferred = 3283336
    2009-01-19 00:30:30:715 1808 11c4 DnldMgr ***********  DnldMgr: New download job [UpdateId = {C3109CE0-7F98-4B31-8EA4-2D1E0969A1C3}.100]  ***********
    2009-01-19 00:30:30:871 1808 11c4 DnldMgr   * All files for update were already downloaded and are valid.
    2009-01-19 00:30:30:886 8492 124c COMAPI >>--  RESUMED  -- COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:886 8492 124c COMAPI   - Download call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
    2009-01-19 00:30:30:886 8492 124c COMAPI ---------
    2009-01-19 00:30:30:886 8492 124c COMAPI --  END  --  COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:886 8492 124c COMAPI -------------
    2009-01-19 00:30:30:886 8492 27c0 COMAPI -------------
    2009-01-19 00:30:30:886 8492 27c0 COMAPI -- START --  COMAPI: Install [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:886 8492 27c0 COMAPI ---------
    2009-01-19 00:30:30:886 8492 27c0 COMAPI   - Allow source prompts: No; Forced: No; Force quiet: No
    2009-01-19 00:30:30:886 8492 27c0 COMAPI   - Updates in request: 1
    2009-01-19 00:30:30:886 8492 27c0 COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 00:30:30:902 8492 27c0 COMAPI   - Updates to install = 1
    2009-01-19 00:30:30:902 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:902 1808 1238 Agent *************
    2009-01-19 00:30:30:902 1808 1238 Agent ** START **  Agent: Installing updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:30:30:902 1808 1238 Agent *********
    2009-01-19 00:30:30:902 1808 1238 Agent   * Updates to install = 1
    2009-01-19 00:30:30:902 1808 1238 Agent   *   Title = Definition Update for Microsoft Forefront Client Security (Antimalware 1.49.2165.0)
    2009-01-19 00:30:30:902 1808 1238 Agent   *   UpdateId = {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100
    2009-01-19 00:30:30:902 1808 1238 Agent   *     Bundles 1 updates:
    2009-01-19 00:30:30:902 1808 1238 Agent   *       {C3109CE0-7F98-4B31-8EA4-2D1E0969A1C3}.100
    2009-01-19 00:30:35:840 1808 1238 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:30:35:871 1808 21c4 Report REPORT EVENT: {5B06A2AB-A71A-49BA-9CE5-031C00325316} 2009-01-19 00:30:30:871-0000 1 162 101 {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A} 100 0 Microsoft Forefront Client Secu Success Content Download Download succeeded.
    2009-01-19 00:31:03:121 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:31:06:777 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:31:12:199 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:31:19:308 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:31:43:871 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:31:44:949 1808 1238 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:31:48:855 1808 1238 Agent WARNING: LoadLibrary failed for srclient.dll with hr:8007007e
    2009-01-19 00:31:49:293 1808 1238 DnldMgr Preparing update for install, updateId = {C3109CE0-7F98-4B31-8EA4-2D1E0969A1C3}.100.
    2009-01-19 00:31:49:558 8760 19f4 Misc ===========  Logging initialized (build: 7.1.6001.65, tz: -0000)  ===========
    2009-01-19 00:31:49:558 8760 19f4 Misc   = Process: C:\WINDOWS\system32\wuauclt.exe
    2009-01-19 00:31:49:558 8760 19f4 Misc   = Module: C:\WINDOWS\system32\wuaueng.dll
    2009-01-19 00:31:49:558 8760 19f4 Handler :::::::::::::
    2009-01-19 00:31:49:558 8760 19f4 Handler :: START ::  Handler: Command Line Install
    2009-01-19 00:31:49:558 8760 19f4 Handler :::::::::
    2009-01-19 00:31:49:558 8760 19f4 Handler   : Updates to install = 1
    2009-01-19 00:32:05:277 8760 19f4 Handler   : Command line install completed. Return code = 0x00000000, Result = Succeeded, Reboot required = false
    2009-01-19 00:32:05:277 8760 19f4 Handler :::::::::
    2009-01-19 00:32:05:277 8760 19f4 Handler ::  END  ::  Handler: Command Line Install
    2009-01-19 00:32:05:277 8760 19f4 Handler :::::::::::::
    2009-01-19 00:32:06:074 1808 1238 Agent *********
    2009-01-19 00:32:06:074 1808 45c AU Triggering Offline detection (non-interactive)
    2009-01-19 00:32:06:074 1808 1238 Agent **  END  **  Agent: Installing updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:32:06:074 8492 1b0c COMAPI >>--  RESUMED  -- COMAPI: Install [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:32:06:074 1808 1238 Agent *************
    2009-01-19 00:32:06:074 1808 45c AU #############
    2009-01-19 00:32:06:074 8492 1b0c COMAPI   - Install call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
    2009-01-19 00:32:06:090 1808 45c AU ## START ##  AU: Search for updates
    2009-01-19 00:32:06:090 8492 1b0c COMAPI   - Reboot required = No
    2009-01-19 00:32:06:090 1808 45c AU #########
    2009-01-19 00:32:06:090 8492 1b0c COMAPI ---------
    2009-01-19 00:32:06:105 1808 45c AU <<## SUBMITTED ## AU: Search for updates [CallId = {D4CD091D-83FC-4F28-A569-78A35852AB6C}]
    2009-01-19 00:32:06:105 8492 1b0c COMAPI --  END  --  COMAPI: Install [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:32:06:105 8492 1b0c COMAPI -------------
    2009-01-19 00:32:06:105 1808 21c4 Agent *************
    2009-01-19 00:32:06:105 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 00:32:06:105 1808 21c4 Agent *********
    2009-01-19 00:32:06:105 1808 21c4 Agent   * Online = No; Ignore download priority = No
    2009-01-19 00:32:06:105 1808 21c4 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    2009-01-19 00:32:06:105 1808 21c4 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 00:32:06:136 8492 27c0 COMAPI -------------
    2009-01-19 00:32:06:136 8492 27c0 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:32:06:136 8492 27c0 COMAPI ---------
    2009-01-19 00:32:06:168 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:32:12:215 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:32:41:293 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:32:44:590 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:32:50:371 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:32:57:183 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:33:22:293 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:33:23:590 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:33:28:652 1808 21c4 Agent   * Found 0 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 00:33:28:652 1808 21c4 Agent *********
    2009-01-19 00:33:28:652 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 00:33:28:652 1808 21c4 Agent *************
    2009-01-19 00:33:28:683 1808 21c4 Agent *************
    2009-01-19 00:33:28:683 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:33:28:683 1808 21c4 Agent *********
    2009-01-19 00:33:28:683 1808 21c4 Agent   * Online = Yes; Ignore download priority = No
    2009-01-19 00:33:28:683 1808 21c4 Agent   * Criteria = "IsInstalled=0 AND CategoryIDs CONTAINS 'E0789628-CE08-4437-BE74-2495B842F43B' AND CategoryIDs CONTAINS '0A487050-8B0F-4F81-B401-BE4CEACD61CD'"
    2009-01-19 00:33:28:683 1808 21c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000}
    2009-01-19 00:33:28:715 1808 2010 AU >>##  RESUMED  ## AU: Search for updates [CallId = {D4CD091D-83FC-4F28-A569-78A35852AB6C}]
    2009-01-19 00:33:28:715 1808 2010 AU   # 0 updates detected
    2009-01-19 00:33:28:730 1808 2010 AU #########
    2009-01-19 00:33:28:730 1808 2010 AU ##  END  ##  AU: Search for updates [CallId = {D4CD091D-83FC-4F28-A569-78A35852AB6C}]
    2009-01-19 00:33:28:730 1808 2010 AU #############
    2009-01-19 00:33:30:136 1808 21c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2009-01-19 00:33:30:136 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:33:33:574 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:34:00:855 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:34:04:105 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:34:09:058 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:34:15:918 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:34:40:558 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:34:41:652 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:34:45:965 1808 21c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2009-01-19 00:34:45:965 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:34:47:340 1808 21c4 Agent   * Found 0 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 00:34:47:340 1808 21c4 Agent *********
    2009-01-19 00:34:47:355 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:34:47:355 1808 21c4 Agent *************
    2009-01-19 00:34:47:371 1808 21c4 Report REPORT EVENT: {BE416BEE-98F8-4760-B9C1-8999E47A8DA9} 2009-01-19 00:32:05:277-0000 1 183 101 {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A} 100 0 Microsoft Forefront Client Secu Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Forefront Client Security (Antimalware 1.49.2165.0)
    2009-01-19 00:34:47:386 8492 1234 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:34:47:386 8492 1234 COMAPI   - Updates found = 0
    2009-01-19 00:34:47:386 8492 1234 COMAPI ---------
    2009-01-19 00:34:47:386 8492 1234 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1703.0]
    2009-01-19 00:34:47:386 8492 1234 COMAPI -------------
    2009-01-19 00:34:47:746 8492 27c0 COMAPI -------------
    2009-01-19 00:34:47:746 8492 27c0 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:34:47:746 8492 27c0 COMAPI ---------
    2009-01-19 00:34:47:746 1808 21c4 Agent *************
    2009-01-19 00:34:47:746 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:34:47:746 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    2009-01-19 00:34:47:746 1808 21c4 Agent *********
    2009-01-19 00:34:47:746 1808 21c4 Agent   * Include potentially superseded updates
    2009-01-19 00:34:47:746 1808 21c4 Agent   * Online = Yes; Ignore download priority = No
    2009-01-19 00:34:47:746 1808 21c4 Agent   * Criteria = "Type='Software'"
    2009-01-19 00:34:47:746 1808 21c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000}
    2009-01-19 00:34:48:746 1808 21c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2009-01-19 00:34:48:746 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:34:52:168 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:35:17:855 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:35:21:058 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:35:26:074 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:35:32:918 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:35:57:590 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:35:58:746 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:36:02:996 1808 21c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2009-01-19 00:36:02:996 1808 21c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 00:36:05:027 1808 21c4 Agent   * Added update {F5556F0C-5273-11DC-B863-001372A63EA0}.102 to search result
    2009-01-19 00:36:05:027 1808 21c4 Agent   * Added update {1710041B-9D04-11DB-AD43-0011430C73A4}.100 to search result
    2009-01-19 00:36:05:027 1808 21c4 Agent   * Added update {F900A83E-5E84-11DD-B245-001372A63EA0}.101 to search result
    2009-01-19 00:36:05:027 1808 21c4 Agent   * Added update {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100 to search result
    2009-01-19 00:36:05:027 1808 21c4 Agent   * Found 4 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 00:36:05:027 1808 21c4 Agent *********
    2009-01-19 00:36:05:027 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:027 1808 21c4 Agent *************
    2009-01-19 00:36:05:043 1808 21c4 Report REPORT EVENT: {D95A6ADF-921E-4646-B274-6BF7DF24D606} 2009-01-19 00:34:47:340-0000 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 0 updates.
    2009-01-19 00:36:05:058 1808 21c4 Report REPORT EVENT: {496A70AA-3D43-4C0E-9E47-B77C0EC9C99B} 2009-01-19 00:34:47:340-0000 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Pre-Deployment Check Reporting client status.
    2009-01-19 00:36:05:074 8492 22d4 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:074 8492 22d4 COMAPI   - Updates found = 4
    2009-01-19 00:36:05:074 8492 22d4 COMAPI ---------
    2009-01-19 00:36:05:074 8492 22d4 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:074 8492 22d4 COMAPI -------------
    2009-01-19 00:36:05:136 8492 27c0 COMAPI -------------
    2009-01-19 00:36:05:136 8492 27c0 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:136 8492 27c0 COMAPI ---------
    2009-01-19 00:36:05:136 1808 21c4 Agent *************
    2009-01-19 00:36:05:136 1808 21c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:136 1808 21c4 Agent *********
    2009-01-19 00:36:05:136 8492 27c0 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:36:05:152 1808 21c4 Agent   * Include potentially superseded updates
    2009-01-19 00:36:05:152 1808 21c4 Agent   * Online = No; Ignore download priority = No
    2009-01-19 00:36:05:152 1808 21c4 Agent   * Criteria = "Type='Software'"
    2009-01-19 00:36:05:152 1808 21c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000}
    2009-01-19 00:36:09:433 1808 21c4 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 00:36:35:402 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 00:36:38:730 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 00:36:43:840 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 00:36:50:699 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 00:37:16:011 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 00:37:17:152 1808 21c4 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 00:37:22:293 1808 21c4 Agent   * Added update {F5556F0C-5273-11DC-B863-001372A63EA0}.102 to search result
    2009-01-19 00:37:22:293 1808 21c4 Agent   * Added update {1710041B-9D04-11DB-AD43-0011430C73A4}.100 to search result
    2009-01-19 00:37:22:293 1808 21c4 Agent   * Added update {F900A83E-5E84-11DD-B245-001372A63EA0}.101 to search result
    2009-01-19 00:37:22:293 1808 21c4 Agent   * Added update {CAEB36A8-AAB9-42A9-A51A-6794BB7F812A}.100 to search result
    2009-01-19 00:37:22:293 1808 21c4 Agent   * Found 4 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 00:37:22:293 1808 21c4 Agent *********
    2009-01-19 00:37:22:293 1808 21c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    2009-01-19 00:37:22:293 1808 21c4 Agent *************
    2009-01-19 00:37:22:308 1808 21c4 Report REPORT EVENT: {256571D2-7FCD-452C-9EEF-6A49063EEBF1} 2009-01-19 00:36:05:027-0000 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 4 updates.
    2009-01-19 00:37:22:308 1808 21c4 Report REPORT EVENT: {EBA1824D-E3F9-4E80-96D2-A3730CC1895A} 2009-01-19 00:36:05:027-0000 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Pre-Deployment Check Reporting client status.
    2009-01-19 00:37:22:324 8492 12f8 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:37:22:324 8492 12f8 COMAPI   - Updates found = 4
    2009-01-19 00:37:22:324 8492 12f8 COMAPI ---------
    2009-01-19 00:37:22:324 8492 12f8 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:37:22:324 8492 12f8 COMAPI -------------
    2009-01-19 00:37:22:418 8492 27c0 COMAPI -------------
    2009-01-19 00:37:22:418 8492 27c0 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    2009-01-19 00:37:22:418 8492 27c0 COMAPI ---------
    2009-01-19 00:37:22:433 1808 68c Agent WARNING: WU client fails CClientCallRecorder::BeginFindUpdatesEx from Microsoft Forefront Client Security with error 0x8024002e
    2009-01-19 00:37:22:433 8492 27c0 COMAPI WARNING: ISusInternal::BeginFindUpdatesEx failed, hr=8024002E
    2009-01-19 00:37:22:433 8492 27c0 COMAPI   - WARNING: Exit code = 0x8024002E
    2009-01-19 00:37:22:433 8492 27c0 COMAPI ---------
    2009-01-19 00:37:22:433 8492 27c0 COMAPI --  END  --  COMAPI: Search [ClientId = <NULL>]
    2009-01-19 00:37:22:433 8492 27c0 COMAPI -------------
    2009-01-19 00:37:22:433 8492 27c0 COMAPI FATAL: Unable to perform synchronous search. (hr=8024002E)
    2009-01-19 00:37:35:261 1808 21c4 Report Uploading 8 events using cached cookie, reporting URL = http://NAT-PMS-XXX-V01:8530/ReportingWebService/ReportingWebService.asmx
    2009-01-19 00:37:35:418 1808 21c4 Report Reporter successfully uploaded 8 events.
    2009-01-19 04:53:55:683 1808 45c AU #############
    2009-01-19 04:53:55:683 1808 45c AU ## START ##  AU: Search for updates
    2009-01-19 04:53:55:683 1808 45c AU #########
    2009-01-19 04:53:55:683 1808 45c AU <<## SUBMITTED ## AU: Search for updates [CallId = {F3D2B638-1329-40F2-8BD2-A187A20FBE66}]
    2009-01-19 04:53:55:683 1808 2244 Agent *************
    2009-01-19 04:53:55:683 1808 2244 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 04:53:55:683 1808 2244 Agent *********
    2009-01-19 04:53:55:683 1808 2244 Agent   * Online = Yes; Ignore download priority = No
    2009-01-19 04:53:55:683 1808 2244 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    2009-01-19 04:53:55:683 1808 2244 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    2009-01-19 04:53:55:683 1808 2244 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    2009-01-19 04:53:55:683 1808 2244 Misc  Microsoft signed: Yes
    2009-01-19 04:53:58:230 1808 2244 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    2009-01-19 04:53:58:230 1808 2244 Misc  Microsoft signed: Yes
    2009-01-19 04:53:58:277 1808 2244 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.cab:
    2009-01-19 04:53:58:277 1808 2244 Misc  Microsoft signed: Yes
    2009-01-19 04:53:58:293 1808 2244 Setup ***********  Setup: Checking whether self-update is required  ***********
    2009-01-19 04:53:58:293 1808 2244 Setup   * Inf file: C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf
    2009-01-19 04:53:58:355 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\cdm.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:433 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuapi.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:449 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:480 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuauclt.exe: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:543 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:558 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:558 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuaueng.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:574 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:621 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wucltui.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:636 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:668 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wups.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:699 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wups2.dll: target version = 7.1.6001.65, required version = 7.1.6001.65
    2009-01-19 04:53:58:730 1808 2244 Setup Update NOT required for C:\WINDOWS\system32\wuweb.dll: target version = 7.2.6001.788, required version = 7.1.6001.65
    2009-01-19 04:53:58:730 1808 2244 Setup   * IsUpdateRequired = No
    2009-01-19 04:54:03:058 1808 2244 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2009-01-19 04:54:03:058 1808 2244 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 04:54:03:340 1808 2244 PT WARNING: Cached cookie has expired or new PID is available
    2009-01-19 04:54:03:340 1808 2244 PT Initializing simple targeting cookie, clientId = ad12bdc1-c167-4e33-a139-6a2a9b8d19ef, target group = , DNS name = dev-cit-v03-s01.nhsp.local
    2009-01-19 04:54:03:340 1808 2244 PT   Server URL = http://NAT-PMS-XXX-V01:8530/SimpleAuthWebService/SimpleAuth.asmx
    2009-01-19 04:54:06:902 1808 2244 Agent WARNING: Failed to evaluate Installable rule, updateId = {BA8C6A04-DDCB-4D2C-9319-6838D263C18E}.101, hr = 80070003
    2009-01-19 04:54:34:277 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {1BBDCC34-B35E-46FA-9DE8-5E25DC67A982}.102, hr = 80070003
    2009-01-19 04:54:37:621 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {411A354B-F018-4A8A-8A7A-DF88BE57E39E}.102, hr = 80070003
    2009-01-19 04:54:42:902 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {B8819076-1C82-43C0-8AC1-340F7B9F7D36}.106, hr = 80070003
    2009-01-19 04:54:49:996 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {A3E7C2D2-BCB0-449B-8B32-1751832E2DFF}.103, hr = 80070003
    2009-01-19 04:55:14:402 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {C9D0DE81-05A4-4C4F-9E53-9CB3C6DD6DEC}.102, hr = 80070003
    2009-01-19 04:55:15:558 1808 2244 Agent WARNING: Failed to evaluate Installed rule, updateId = {AFD77D9E-F05A-431C-889A-34C23C9F9AF5}.102, hr = 80070003
    2009-01-19 04:55:19:715 1808 2244 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2009-01-19 04:55:19:715 1808 2244 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NAT-PMS-XXX-V01:8530/ClientWebService/client.asmx
    2009-01-19 04:55:25:902 1808 2244 Agent   * Found 0 updates and 45 categories in search; evaluated appl. rules of 701 out of 1067 deployed entities
    2009-01-19 04:55:25:949 1808 2244 Agent *********
    2009-01-19 04:55:25:949 1808 2244 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2009-01-19 04:55:25:949 1808 2244 Agent *************
    2009-01-19 04:55:25:965 1808 2344 AU >>##  RESUMED  ## AU: Search for updates [CallId = {F3D2B638-1329-40F2-8BD2-A187A20FBE66}]
    2009-01-19 04:55:25:965 1808 2344 AU   # 0 updates detected
    2009-01-19 04:55:25:965 1808 2344 AU #########
    2009-01-19 04:55:25:965 1808 2344 AU ##  END  ##  AU: Search for updates [CallId = {F3D2B638-1329-40F2-8BD2-A187A20FBE66}]
    2009-01-19 04:55:25:965 1808 2344 AU #############
    2009-01-19 04:55:25:965 1808 2344 AU AU setting next detection timeout to 2009-01-20 01:47:15
    2009-01-19 04:55:30:933 1808 2244 Report REPORT EVENT: {8109C43E-7A15-453E-843D-590C65FED1AB} 2009-01-19 04:55:25:933-0000 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 0 updates.
    2009-01-19 04:55:30:933 1808 2244 Report REPORT EVENT: {B3209949-46F1-4659-9079-8D0B59937187} 2009-01-19 04:55:25:949-0000 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
    2009-01-19 05:02:36:496 1808 2244 Report Uploading 2 events using cached cookie, reporting URL = http://NAT-PMS-XXX-V01:8530/ReportingWebService/ReportingWebService.asmx
    2009-01-19 05:02:36:496 1808 2244 Report Reporter successfully uploaded 2 events.
    Monday, January 19, 2009 10:04 AM
  • Hi

    I suspec this may be the Security State Assessment that's causing the problem.. having looked at my own logs in more depth!! I don't really know much about the feature.... will Security State Assessment do this? Seems a bit crazy to me, as you set the system up to use WSUS so it's nice and controlled and this Security State Assessment slips it and bypasses WSUS and just starts updating things!

    As I say, I'm no Security State Assessment expert..but is this what's happening here?

    Thanks

    Mike
    Monday, January 19, 2009 10:50 AM