locked
Issues with WSUS 2016 RRS feed

  • Question

  • Hi,

    I am new to WSUS and attempted to install WSUS 2016 on Windows Server 2016. After installation and doing some configuration and cleanup, clients are starting to report into the console and all looks well. Our environment consists of Windows 7 and Windows 10 clients and some of them are reporting in while some just does not appear in the console at all. Had observed the followings and need some help on it.

    - Some of the Windows 7 clients are not reporting in or showing up on the console at all. Had gpupdate /force on their machines and seen the WSUS GPO being pushed to them. Had also ran wuauclt /resetauthorization /detectnow /update now command, remove the "softwaredistribution" folder and still nothing works. Had confirmed that these machines can ping and rdp to the WSUS server and hence, I do not know what went wrong. I had copied one entry of windowsupdate.log file from one machine below.

    ===========================

    2018-09-20 11:29:01:596 940 1060 AU AU received policy change subscription event
    2018-09-20 11:51:00:171 940 1060 AU #############
    2018-09-20 11:51:00:171 940 1060 AU ## START ##  AU: Search for updates
    2018-09-20 11:51:00:171 940 1060 AU #########
    2018-09-20 11:51:00:172 940 1060 AU <<## SUBMITTED ## AU: Search for updates [CallId = {F03531B9-B022-4B5A-A60E-27F77ADF6759}]
    2018-09-20 11:51:00:172 940 1228 Agent *************
    2018-09-20 11:51:00:173 940 1228 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2018-09-20 11:51:00:173 940 1228 Agent *********
    2018-09-20 11:51:00:173 940 1228 Agent   * Online = Yes; Ignore download priority = No
    2018-09-20 11:51:00:173 940 1228 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2018-09-20 11:51:00:173 940 1228 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2018-09-20 11:51:00:173 940 1228 Agent   * Search Scope = {Machine}
    2018-09-20 11:51:00:227 940 1228 Setup Checking for agent SelfUpdate
    2018-09-20 11:51:00:227 940 1228 Setup Client version: Core: 7.6.7601.23806  Aux: 7.6.7601.23806
    2018-09-20 11:51:00:251 940 1228 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:
    2018-09-20 11:51:00:261 940 1228 Misc Microsoft signed: NA
    2018-09-20 11:51:00:264 940 1228 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\TMPFC6F.tmp with dwProvFlags 0x00000080:
    2018-09-20 11:51:00:273 940 1228 Misc Microsoft signed: NA
    2018-09-20 11:51:00:277 940 1228 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2018-09-20 11:51:00:286 940 1228 Misc Microsoft signed: NA
    2018-09-20 11:51:00:293 940 1228 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080:
    2018-09-20 11:51:00:302 940 1228 Misc Microsoft signed: NA
    2018-09-20 11:51:00:323 940 1228 Setup Determining whether a new setup handler needs to be downloaded
    2018-09-20 11:51:00:323 940 1228 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe with dwProvFlags 0x00000080:
    2018-09-20 11:51:00:333 940 1228 Misc Microsoft signed: NA
    2018-09-20 11:51:00:333 940 1228 Setup SelfUpdate handler update NOT required: Current version: 7.6.7600.320, required version: 7.6.7600.320
    2018-09-20 11:51:00:334 940 1228 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320"
    2018-09-20 11:51:00:971 940 1228 Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~x86~~7.6.7600.320" is already installed.
    2018-09-20 11:51:00:971 940 1228 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2018-09-20 11:51:00:986 940 1228 Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is already installed.
    2018-09-20 11:51:00:987 940 1228 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320"
    2018-09-20 11:51:01:010 940 1228 Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~x86~~7.6.7600.320" is already installed.
    2018-09-20 11:51:01:010 940 1228 Setup SelfUpdate check completed.  SelfUpdate is NOT required.
    2018-09-20 11:51:03:550 940 1228 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    2018-09-20 11:51:03:550 940 1228 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://aljwsus.ahtc.tc:8530/ClientWebService/client.asmx
    2018-09-20 11:51:03:683 940 1228 PT WARNING: Cached cookie has expired or new PID is available
    2018-09-20 11:51:03:683 940 1228 PT Initializing simple targeting cookie, clientId = 10eb06d8-3cf8-4765-a2f3-5edc97120de8, target group = , DNS name = hgn28.ahtc.tc
    2018-09-20 11:51:03:683 940 1228 PT   Server URL = http://aljwsus.ahtc.tc:8530/SimpleAuthWebService/SimpleAuth.asmx
    2018-09-20 11:52:26:544 940 1228 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    2018-09-20 11:52:26:544 940 1228 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://aljwsus.ahtc.tc:8530/ClientWebService/client.asmx
    2018-09-20 11:52:26:988 940 1228 Agent   * Found 0 updates and 83 categories in search; evaluated appl. rules of 4606 out of 6794 deployed entities
    2018-09-20 11:52:27:002 940 1228 Agent *********
    2018-09-20 11:52:27:003 940 1228 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2018-09-20 11:52:27:003 940 1228 Agent *************
    2018-09-20 11:52:27:009 940 6e4 AU >>##  RESUMED  ## AU: Search for updates [CallId = {F03531B9-B022-4B5A-A60E-27F77ADF6759}]
    2018-09-20 11:52:27:009 940 6e4 AU   # 0 updates detected
    2018-09-20 11:52:27:010 940 6e4 AU #########
    2018-09-20 11:52:27:010 940 6e4 AU ##  END  ##  AU: Search for updates [CallId = {F03531B9-B022-4B5A-A60E-27F77ADF6759}]
    2018-09-20 11:52:27:010 940 6e4 AU #############
    2018-09-20 11:52:27:010 940 6e4 AU Successfully wrote event for AU health state:0
    2018-09-20 11:52:27:010 940 6e4 AU Featured notifications is disabled.
    2018-09-20 11:52:27:011 940 6e4 AU AU setting next detection timeout to 2018-09-20 04:52:13
    2018-09-20 11:52:27:011 940 6e4 AU Setting AU scheduled install time to 2018-09-25 09:00:00
    2018-09-20 11:52:27:012 940 6e4 AU Successfully wrote event for AU health state:0
    2018-09-20 11:52:27:014 940 6e4 AU Successfully wrote event for AU health state:0
    2018-09-20 11:52:32:001 940 1228 Report REPORT EVENT: {6B29ECBD-015E-4839-AEE9-85911E603929} 2018-09-20 11:52:27:000+0800 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 0 updates.
    2018-09-20 11:52:32:001 940 1228 Report REPORT EVENT: {4A73B49A-9816-4925-A5C5-2EF9B5C82EA6} 2018-09-20 11:52:27:002+0800 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
    2018-09-20 12:00:34:135 940 1228 Report Uploading 2 events using cached cookie, reporting URL = http://aljwsus.ahtc.tc:8530/ReportingWebService/ReportingWebService.asmx
    2018-09-20 12:00:34:288 940 1228 Report Reporter successfully uploaded 2 events.
    2018-09-20 12:17:54:211 940 1060 AU AU received policy change subscription event
    2018-09-20 12:52:12:983 940 1060 AU #############
    2018-09-20 12:52:12:983 940 1060 AU ## START ##  AU: Search for updates
    2018-09-20 12:52:12:983 940 1060 AU #########
    2018-09-20 12:52:13:022 940 1060 AU <<## SUBMITTED ## AU: Search for updates [CallId = {1BFC4FBE-2B5F-4788-96D1-3E5384DF870F}]
    2018-09-20 12:52:13:022 940 498 Agent *************
    2018-09-20 12:52:13:022 940 498 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    2018-09-20 12:52:13:022 940 498 Agent *********
    2018-09-20 12:52:13:022 940 498 Agent   * Online = Yes; Ignore download priority = No
    2018-09-20 12:52:13:022 940 498 Agent   * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
    2018-09-20 12:52:13:022 940 498 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    2018-09-20 12:52:13:022 940 498 Agent   * Search Scope = {Machine}
    2018-09-20 12:52:13:546 940 498 Setup Checking for agent SelfUpdate
    2018-09-20 12:52:13:616 940 498 Setup Client version: Core: 7.6.7601.23806  Aux: 7.6.7601.23806
    2018-09-20 12:52:13:673 940 498 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080:

    =========================================================

    - For a few of the Windows 7 clients, I had observed that they will show up on the console and disappear after that. Its like a "now you see it, later you don't" situation. This only happens to a few specific Win 7 PCs and how can I find out what is causing this behaviour from the WSUS server?

    Many thanks for your help in advance!

    Tan

    ==================Many th
    Thursday, September 20, 2018 9:31 AM

All replies

  • Hi,

    This issue occurs because the imaged clients may have a duplicate SusClientID value in the registry.

    Please try resetting SusClientID on the computers that do not show up in the WSUS console:
    1. Open cmd, stope the server with net stop wuauserv
    2. Open registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate,
    delete the value of SusClientId and SusClientIdValidation
    3. In cmd, enter net start wuauserv; then enter wuauclt /resetauthorization /detectnow

    Then the computers could show up and report to the WSUS server after a period of time.

    Best regards,
    Johnson
    =====================
    Please remember to mark the replies as answers if they help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
    Friday, September 21, 2018 2:03 AM
  • Yep, the symptoms are totally the duplication of the SusClientId from a cloned machine. Run the following script from an Administrative Command Prompt on every affected machine (7 or 10 and ignore any errors the script produces).

    net stop bits
    net stop wuauserv
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
    reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientIDValidation /f
    rd /s /q "C:\Windows\SoftwareDistribution"
    net start bits
    net start wuauserv
    wuauclt /resetauthorization /detectnow
    PowerShell.exe (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()
    Then you will want to edit your master image and remove the registry entries above if they exist before deploying any more systems. Sysprep does NOT touch these keys.


    Adam Marshall, MCSE: Security
    https://www.ajtek.ca
    Microsoft MVP - Windows and Devices for IT

    Saturday, September 22, 2018 4:10 AM