locked
Some FCS Clients always getting full definitions from WSUS RRS feed

  • Question

  • Hello everybody,

    in i´ve startet to depoy FCS at 12th May. Since then one of our branch offices WAN connection is taking the hole bandwith when the people begin to work. I´ve identified the FCS Client as the reason. Some clients ars downloading the full definitions from the WSUS server (located at the Headquarter). BITS is limited now to throttle the WSUS bandwith, but im not happy with this, because it takes a while now to get new definitions. These Clients have also some errors in the WindowsUpdate.log. I´m not sure which is pointing to the real issue but i´m sure you will have some helpful advices for me ;)

    So here is the part of the WindowsUpdate.log:



    06:31:41:426   c8 AU #############
    06:31:41:426   c8 AU ## START ##  AU: Search for updates
    06:31:41:426   c8 AU #########
    06:31:41:435  8c4 DnldMgr Contacting regulation server for 2 updates.
    06:31:41:493   c8 AU <<## SUBMITTED ## AU: Search for updates [CallId = {6A3BB24A-F8E5-4B40-A272-E43EE12B76C8}]
    06:31:41:695  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    06:31:50:615  8c4 Misc  Microsoft signed: Yes
    06:31:52:770  8c4 PT WARNING: Cached cookie has expired or new PID is available
    06:31:53:415  8c4 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    06:31:57:293   c8 AU AU received policy change subscription event
    06:31:58:823   c8 AU Sus server changed through policy.
    06:31:59:083   c8 AU Target group changed through policy.
    06:31:59:217   c8 AU AU Refresh required....
    06:32:00:738   c8 AU AU setting next detection timeout to  04:32:00
    06:32:00:738   c8 AU AU setting next sqm report timeout to  04:32:00
    06:32:02:845   c8 AU AU setting next featured software notification timeout to  04:32:02
    06:32:02:845   c8 AU Triggering Online detection (non-interactive)
    06:32:03:422   c8 AU #############
    06:32:03:480   c8 AU ## START ##  AU: Search for updates
    06:32:03:480   c8 AU #########
    06:32:03:576   c8 AU <<## SUBMITTED ## AU: Search for updates [CallId = {0FB2B6BB-478C-4BAE-9FDD-ACDC0ECC1BC7}]
    06:32:20:916  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:32:20:945  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:32:21:041  8c4 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    06:32:21:041  8c4 PT   + Caller provided credentials = No
    06:32:21:041  8c4 PT   + Impersonate flags = 0
    06:32:21:041  8c4 PT   + Possible authorization schemes used =
    06:32:21:041  8c4 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    06:32:21:060  8c4 PT WARNING: PTError: 0x80072efd
    06:32:21:080  8c4 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    06:32:21:137  8c4 PT WARNING: RefreshCookie failed: 0x80072efd
    06:32:21:147  8c4 PT WARNING: RefreshPTState failed: 0x80072efd
    06:32:21:147  8c4 PT WARNING: PTError: 0x80072efd
    06:32:23:678  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    06:32:24:929  8c4 Misc  Microsoft signed: Yes
    06:32:26:622  8c4 PT WARNING: Cached cookie has expired or new PID is available
    06:32:26:622  8c4 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    06:32:47:185  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:32:47:262  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:32:47:378  8c4 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    06:32:47:378  8c4 PT   + Caller provided credentials = No
    06:32:47:378  8c4 PT   + Impersonate flags = 0
    06:32:47:378  8c4 PT   + Possible authorization schemes used =
    06:32:47:378  8c4 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    06:32:47:378  8c4 PT WARNING: PTError: 0x80072efd
    06:32:47:406  8c4 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    06:32:47:406  8c4 PT WARNING: RefreshCookie failed: 0x80072efd
    06:32:47:406  8c4 PT WARNING: RefreshPTState failed: 0x80072efd
    06:32:47:406  8c4 PT WARNING: PTError: 0x80072efd
    06:32:50:553  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    06:32:51:101  8c4 Misc  Microsoft signed: Yes
    06:32:52:198  8c4 PT WARNING: Cached cookie has expired or new PID is available
    06:32:52:198  8c4 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    06:33:12:742  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:33:13:166  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:33:13:416  8c4 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    06:33:13:416  8c4 PT   + Caller provided credentials = No
    06:33:13:416  8c4 PT   + Impersonate flags = 0
    06:33:13:425  8c4 PT   + Possible authorization schemes used =
    06:33:13:425  8c4 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    06:33:13:474  8c4 PT WARNING: PTError: 0x80072efd
    06:33:13:474  8c4 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    06:33:13:493  8c4 PT WARNING: RefreshCookie failed: 0x80072efd
    06:33:13:493  8c4 PT WARNING: RefreshPTState failed: 0x80072efd
    06:33:13:493  8c4 PT WARNING: PTError: 0x80072efd
    06:33:13:560  8c4 DnldMgr WARNING: Server call failed, using default regulation.
    06:33:13:608  8c4 DnldMgr   * Regulation call complete. 0x80072efd
    06:33:14:599  8c4 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    06:33:14:599  8c4 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:33:14:599  8c4 DnldMgr   * Update is not allowed to download due to regulation.
    06:33:14:599  8c4 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:33:58:237  e18 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    06:34:20:272  8c4 PT WARNING: Cached cookie has expired or new PID is available
    06:34:20:272  8c4 PT Initializing simple targeting cookie, clientId = 08bf749e-685e-4698-b6d2-e26d79a82f8e, target group =  KH III, DNS name = CLIENT
    06:34:20:282  8c4 PT   Server URL = http://WSUS/SimpleAuthWebService/SimpleAuth.asmx
    06:34:20:744  8c4 Report Uploading 4 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    06:34:20:792  8c4 Report Reporter successfully uploaded 4 events.
    06:34:20:878  8c4 Report REPORT EVENT: {D332BCD2-528A-400B-BC9A-C018744C94FF}  06:31:30:831+0200 1 202 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Reboot completed.
    06:34:20:965  8c4 Agent *************
    06:34:20:965  8c4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:34:20:975  8c4 Agent *********
    06:34:20:975  8c4 Agent   * Online = No; Ignore download priority = No
    06:34:20:975  8c4 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    06:34:20:975  8c4 Agent   * ServiceID = {9482F4B4-E343-43B6-B170-9A65BC822C77} Windows Update
    06:34:20:975  8c4 Agent   * Search Scope = {Machine}
    06:34:57:809  f6c Misc ===========  Logging initialized (build: 7.4.7600.226, tz: +0200)  ===========
    06:34:57:809  f6c Misc   = Process: c:\Programme\Microsoft Forefront\Client Security\Client\SSA\FcsSas.exe
    06:34:57:809  f6c Misc   = Module: C:\WINDOWS\system32\wuapi.dll
    06:34:57:723  f6c COMAPI -------------
    06:34:57:809  f6c COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:34:57:809  f6c COMAPI ---------
    06:34:59:955  f6c COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:36:14:554  8c4 Agent   * Added update {C4191CC8-31FF-4AF5-8DF6-7ED16FE0E5AA}.100 to search result
    06:36:14:914  8c4 Agent   * Added update {37DD5CBC-6257-4291-96A9-333FE0AAC9E5}.100 to search result
    06:36:14:914  8c4 Agent   * Found 2 updates and 13 categories in search; evaluated appl. rules of 197 out of 648 deployed entities
    06:36:23:056  8c4 Agent *********
    06:36:23:056  8c4 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:36:23:056  8c4 Agent *************
    06:36:23:186  8c4 Agent *************
    06:36:23:186  8c4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:36:23:186  8c4 Agent *********
    06:36:23:186  8c4 Agent   * Online = Yes; Ignore download priority = No
    06:36:23:186  8c4 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    06:36:23:226  8c4 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    06:36:23:226  8c4 Agent   * Search Scope = {Machine}
    06:36:23:256  3a8 Agent WARNING: WU client fails to call back to search call {6A3BB24A-F8E5-4B40-A272-E43EE12B76C8} with error 0x8024000c
    06:36:23:707  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    06:36:27:893  8c4 Misc  Microsoft signed: Yes
    06:36:28:774  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    06:36:28:774  8c4 Misc  Microsoft signed: Yes
    06:36:29:235  8c4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.cab:
    06:36:29:245  8c4 Misc  Microsoft signed: Yes
    06:36:29:395  8c4 Setup ***********  Setup: Checking whether self-update is required  ***********
    06:36:29:395  8c4 Setup   * Inf file: C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf
    --- I´VE REMOVED THE OTHER  SELFUPDATELINE HERE ---
    06:36:31:738  8c4 Setup   * IsUpdateRequired = No
    06:36:59:248  8c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    06:36:59:268  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:38:01:767  8c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    06:38:01:797  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:38:31:650  8c4 Agent Update {49DAA6BF-929C-494D-8DCF-070CC0F28172}.100 is pruned out due to potential supersedence
    06:38:31:680  8c4 Agent   * Added update {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100 to search result
    06:38:31:680  8c4 Agent   * Found 1 updates and 50 categories in search; evaluated appl. rules of 464 out of 820 deployed entities
    06:38:35:415  8c4 Agent *********
    06:38:35:415  8c4 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:38:35:415  8c4 Agent *************
    06:38:35:465  8c4 Agent *************
    06:38:35:465  8c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:35:465  8c4 Agent *********
    06:38:35:465  8c4 Agent   * Online = Yes; Ignore download priority = No
    06:38:35:465  8c4 Agent   * Criteria = "IsInstalled=0 AND CategoryIDs CONTAINS 'E0789628-CE08-4437-BE74-2495B842F43B' AND CategoryIDs CONTAINS '0A487050-8B0F-4F81-B401-BE4CEACD61CD'"
    06:38:35:465  8c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
    06:38:35:465  8c4 Agent   * Search Scope = {Machine}
    06:38:35:746  3a8 AU >>##  RESUMED  ## AU: Search for updates [CallId = {0FB2B6BB-478C-4BAE-9FDD-ACDC0ECC1BC7}]
    06:38:35:766  3a8 AU   # 1 updates detected
    06:38:36:086  3a8 AU #########
    06:38:36:086  3a8 AU ##  END  ##  AU: Search for updates [CallId = {0FB2B6BB-478C-4BAE-9FDD-ACDC0ECC1BC7}]
    06:38:36:086  3a8 AU #############
    06:38:36:386  3a8 AU Featured notifications is disabled.
    06:38:36:416  3a8 AU AU setting next detection timeout to  05:33:29
    06:38:36:497  3a8 AU Auto-approving update for download, updateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=1
    06:38:36:497  3a8 AU Auto-approved 1 update(s) for download (NOT for Ux)
    06:38:36:497  3a8 AU #############
    06:38:36:497  3a8 AU ## START ##  AU: Download updates
    06:38:36:497  3a8 AU #########
    06:38:36:497  3a8 AU   # Approved updates = 1
    06:38:36:747  3a8 AU AU initiated download, updateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100, callId = {2EB2D5E8-B357-4249-8AAB-DB4AD900E65F}
    06:38:36:757  3a8 AU AU setting pending client directive to 'Download Progress'
    06:38:36:937  3a8 AU   # Pending download calls = 1
    06:38:36:937  3a8 AU <<## SUBMITTED ## AU: Download updates
    06:38:39:190  8c4 PT +++++++++++  PT: Starting category scan  +++++++++++
    06:38:39:190  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:38:39:591  8c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    06:38:39:591  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:38:40:322  8c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    06:38:40:322  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:38:40:532  8c4 Agent Update {49DAA6BF-929C-494D-8DCF-070CC0F28172}.100 is pruned out due to potential supersedence
    06:38:40:532  8c4 Agent   * Added update {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100 to search result
    06:38:40:532  8c4 Agent   * Found 1 updates and 4 categories in search; evaluated appl. rules of 59 out of 77 deployed entities
    06:38:41:854  8c4 Agent *********
    06:38:41:854  8c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:41:854  8c4 Agent *************
    06:38:41:894  8c4 DnldMgr *************
    06:38:41:894  8c4 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = AutomaticUpdates]
    06:38:41:894  8c4 DnldMgr *********
    06:38:41:894  8c4 DnldMgr   * Call ID = {2EB2D5E8-B357-4249-8AAB-DB4AD900E65F}
    06:38:41:894  8c4 DnldMgr   * Priority = 2, Interactive = 0, Owner is system = 1, Explicit proxy = 0, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    06:38:41:894  8c4 DnldMgr   * Updates to download = 1
    06:38:41:894  8c4 Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.115.0)
    06:38:41:924  8c4 Agent   *   UpdateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100
    06:38:41:924  8c4 Agent   *     Bundles 1 updates:
    06:38:41:924  8c4 Agent   *       {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100
    06:38:42:105  8c4 DnldMgr ***********  DnldMgr: New download job [UpdateId = {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100]  ***********
    06:38:43:236  5a0 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:43:346  8c4 DnldMgr   * BITS job initialized, JobId = {B7BB0FB1-57D6-4C54-9EA0-8CD732479C2A}
    06:38:43:677  5a0 COMAPI   - Updates found = 1
    06:38:43:677  5a0 COMAPI ---------
    06:38:43:677  5a0 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:43:677  5a0 COMAPI -------------
    06:38:43:847  8c4 DnldMgr   * Downloading from http://WSUS/Content/95/1CFFFEC69EFC24AA6CF92D2BB19663B15E6AF795.exe to C:\WINDOWS\SoftwareDistribution\Download\f1d8133709b91af7fe83e8804069850d\1cfffec69efc24aa6cf92d2bb19663b15e6af795 (full file).
    06:38:43:977  3a8 AU AU checked download status and it changed: Downloading is paused
    06:38:43:977  8c4 Agent *********
    06:38:43:977  8c4 Agent **  END  **  Agent: Downloading updates [CallerId = AutomaticUpdates]
    06:38:43:977  8c4 Agent *************
    06:38:43:987  8c4 Report REPORT EVENT: {FDDFC7D5-A694-4E0F-96F0-FE45C11FAFA1}  06:38:35:135+0200 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 1 updates.
    06:38:43:987  8c4 Report REPORT EVENT: {48E87CBC-19DE-4E4A-A5A0-65AEAFB09BA6}  06:38:35:385+0200 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
    06:38:44:047  f6c COMAPI -------------
    06:38:44:047  f6c COMAPI -- START --  COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:44:047  f6c COMAPI ---------
    06:38:44:047  f6c COMAPI   - Forced: No; Download priority: 3
    06:38:44:047  f6c COMAPI   - Updates in request: 1
    06:38:44:047  f6c COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    06:38:44:158  8c4 DnldMgr *************
    06:38:44:158  8c4 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:44:158  8c4 DnldMgr *********
    06:38:44:158  8c4 DnldMgr   * Call ID = {8E557DD4-5BDF-49F5-9D71-3AB623B8BA2B}
    06:38:44:158  8c4 DnldMgr   * Priority = 3, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    06:38:44:158  8c4 DnldMgr   * Updates to download = 1
    06:38:44:158  8c4 Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.115.0)
    06:38:44:158  8c4 Agent   *   UpdateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100
    06:38:44:158  8c4 Agent   *     Bundles 1 updates:
    06:38:44:158  8c4 Agent   *       {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100
    06:38:44:398  3a8 AU AU checked download status and it changed: Downloading is not paused
    06:38:44:398  3a8 AU AU setting pending client directive to 'Download Progress'
    06:38:44:398  f6c COMAPI <<-- SUBMITTED -- COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:45:670  8c4 Agent *********
    06:38:45:670  8c4 Agent **  END  **  Agent: Downloading updates [CallerId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:45:670  8c4 Agent *************
    06:38:46:861  8c4 Report REPORT EVENT: {9624AEFC-969A-4F04-A823-15B430692A25}  06:38:41:854+0200 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 1 updates.
    06:38:49:685  958 DnldMgr BITS job {B7BB0FB1-57D6-4C54-9EA0-8CD732479C2A} completed successfully
    06:38:49:766  958 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\Download\f1d8133709b91af7fe83e8804069850d\1cfffec69efc24aa6cf92d2bb19663b15e6af795:
    06:38:50:627  958 Misc  Microsoft signed: Yes
    06:38:50:687  958 DnldMgr   Download job bytes total = 843664, bytes transferred = 843664
    06:38:51:097  958 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    06:38:51:097  958 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:38:51:097  958 DnldMgr   * Update is not allowed to download due to regulation.
    06:38:51:097  958 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:38:51:097  958 DnldMgr ***********  DnldMgr: New download job [UpdateId = {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100]  ***********
    06:38:51:107  958 DnldMgr   * All files for update were already downloaded and are valid.
    06:38:51:298  958 DnldMgr ***********  DnldMgr: New download job [UpdateId = {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100]  ***********
    06:38:51:308  958 DnldMgr   * All files for update were already downloaded and are valid.
    06:38:52:179   c8 AU WARNING: AU found no suitable session to launch client in
    06:38:52:209  3a8 AU >>##  RESUMED  ## AU: Download update [UpdateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}, succeeded]
    06:38:52:279  3a8 AU #########
    06:38:52:289  3a8 AU ##  END  ##  AU: Download updates
    06:38:52:289  3a8 AU #############
    06:38:52:289  3a8 AU Auto-approving update for install, updateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=1
    06:38:52:289  3a8 AU Auto-approved 1 update(s) for install (NOT for Ux), installType=2
    06:38:52:289  3a8 AU #############
    06:38:52:289  3a8 AU ## START ##  AU: Install updates
    06:38:52:289  3a8 AU #########
    06:38:52:289  3a8 AU   # Initiating minor updates install
    06:38:52:289  3a8 AU   # Approved updates = 1
    06:38:52:289  3a8 AU <<## SUBMITTED ## AU: Install updates / installing updates [CallId = {5B26D004-50F1-4A3C-B3B7-2F7BC8FD2E5E}]
    06:38:52:289  a4c Agent *************
    06:38:52:289  a4c Agent ** START **  Agent: Installing updates [CallerId = AutomaticUpdates]
    06:38:52:289  a4c Agent *********
    06:38:52:289  a4c Agent   * Updates to install = 1
    06:38:52:419  a4c Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.115.0)
    06:38:52:419  a4c Agent   *   UpdateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}.100
    06:38:52:419  a4c Agent   *     Bundles 1 updates:
    06:38:52:419  a4c Agent   *       {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100
    06:38:52:429  5a0 COMAPI >>--  RESUMED  -- COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:52:429  5a0 COMAPI   - Download call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
    06:38:52:429  5a0 COMAPI ---------
    06:38:52:429  5a0 COMAPI --  END  --  COMAPI: Download [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:52:429  5a0 COMAPI -------------
    06:38:52:429  f6c COMAPI -------------
    06:38:52:429  f6c COMAPI -- START --  COMAPI: Install [ClientId = Microsoft Forefront Client Security State Assessment Service v1.0.1725.0]
    06:38:52:429  f6c COMAPI ---------
    06:38:52:429  f6c COMAPI   - Allow source prompts: No; Forced: No; Force quiet: No
    06:38:52:429  f6c COMAPI   - Updates in request: 1
    06:38:52:429  f6c COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    06:38:52:479  f6c COMAPI WARNING: ISusInternal::BeginInstallUpdates3 failed, hr=80240016
    06:38:52:479  f6c COMAPI   - WARNING: Exit code = 0x80240016
    06:38:52:479  f6c COMAPI ---------
    06:38:52:479  f6c COMAPI --  END  --  COMAPI: Install [ClientId = <NULL>]
    06:38:52:479  f6c COMAPI -------------
    06:38:52:479  f6c COMAPI FATAL: Unable to perform synchronous installation successfully. (hr=80240016)
    06:38:57:036  8c4 Report REPORT EVENT: {62499100-DA4E-4B74-B885-B55F889566F4}  06:38:52:029+0200 1 162 101 {D348262E-D0E0-4481-A795-B4F4C9F435F8} 100 0 Microsoft Forefront Client Secu Success Content Download Download succeeded.
    06:38:57:046  8c4 Report REPORT EVENT: {F28CCB9A-59B3-419C-AED1-C52E9105B7ED}  06:38:52:289+0200 1 189 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. To install the updates, an administrator should log on to this computer and Windows will prompt with further instructions:  - Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.115.0)
    06:39:43:192  af4 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    06:40:12:954  a4c DnldMgr Preparing update for install, updateId = {DFA0BE23-6658-4CE7-9372-09DDCD484D5D}.100.
    06:40:14:046  ad8 Misc ===========  Logging initialized (build: 7.4.7600.226, tz: +0200)  ===========
    06:40:14:046  ad8 Misc   = Process: C:\WINDOWS\system32\wuauclt.exe
    06:40:14:046  ad8 Misc   = Module: C:\WINDOWS\system32\wuaueng.dll
    06:40:14:046  ad8 Handler :::::::::::::
    06:40:14:046  ad8 Handler :: START ::  Handler: Command Line Install
    06:40:14:046  ad8 Handler :::::::::
    06:40:14:046  ad8 Handler   : Updates to install = 1
    06:40:29:839  f6c COMAPI -------------
    06:40:29:839  f6c COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:40:29:839  f6c COMAPI ---------
    06:40:30:179  f6c COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:40:30:189  8c4 Agent *************
    06:40:30:189  8c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:40:30:189  8c4 Agent *********
    06:40:30:189  8c4 Agent   * Include potentially superseded updates
    06:40:30:199  8c4 Agent   * Online = Yes; Ignore download priority = No
    06:40:30:199  8c4 Agent   * Criteria = "Type='Software'"
    06:40:30:199  8c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
    06:40:30:199  8c4 Agent   * Search Scope = {Machine}
    06:40:54:013  8c4 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    06:40:54:033  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:41:33:440  8c4 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    06:41:33:440  8c4 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    06:41:59:087  8c4 Agent   * Added update {54173D00-6670-4E5C-A601-70AE316AA295}.101 to search result
    --- I´VE REMOVED THE OTHER 124 UPDATESLINE HERE ---
    06:41:59:227  8c4 Agent   * Found 125 updates and 50 categories in search; evaluated appl. rules of 464 out of 820 deployed entities
    06:42:07:329  8c4 Agent *********
    06:42:07:329  8c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:42:07:329  8c4 Agent *************
    06:42:07:749  8c4 Report Uploading 4 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    06:42:07:920  8c4 Report Reporter successfully uploaded 4 events.
    06:42:08:050  8c4 Report REPORT EVENT: {B2258CD5-BFC0-497B-A6F4-DFD5DDF99479}  06:42:07:078+0200 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 125 updates.
    06:42:08:050  8c4 Report REPORT EVENT: {CFDD1FDA-FF90-4C8E-A050-096431404E8B}  06:42:07:209+0200 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Pre-Deployment Check Reporting client status.
    06:42:09:612  cac COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:11:154  cac COMAPI   - Updates found = 125
    06:42:11:154  cac COMAPI ---------
    06:42:11:154  cac COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:11:154  cac COMAPI -------------
    06:42:14:890  f6c COMAPI -------------
    06:42:14:890  f6c COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:14:890  f6c COMAPI ---------
    06:42:14:900  8c4 Agent *************
    06:42:14:900  8c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:42:14:900  8c4 Agent *********
    06:42:14:900  8c4 Agent   * Include potentially superseded updates
    06:42:14:900  8c4 Agent   * Online = No; Ignore download priority = No
    06:42:14:900  8c4 Agent   * Criteria = "Type='Software'"
    06:42:14:900  8c4 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
    06:42:14:900  8c4 Agent   * Search Scope = {Machine}
    06:42:14:900  f6c COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:35:599  8c4 Agent   * Added update {54173D00-6670-4E5C-A601-70AE316AA295}.101 to search result
    --- I´VE REMOVED THE OTHER 124 UPDATESLINE HERE ---
    06:42:35:870  8c4 Agent   * Found 125 updates and 50 categories in search; evaluated appl. rules of 374 out of 820 deployed entities
    06:42:35:960  8c4 Agent *********
    06:42:35:960  8c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:42:35:960  8c4 Agent *************
    06:42:35:980  cac COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:36:270  cac COMAPI   - Updates found = 125
    06:42:36:270  cac COMAPI ---------
    06:42:36:270  cac COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:36:270  cac COMAPI -------------
    06:42:44:012  f6c COMAPI -------------
    06:42:44:012  f6c COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:42:44:012  f6c COMAPI ---------
    06:42:44:012  8c4 Agent *************
    06:42:44:012  8c4 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:42:44:012  8c4 Agent *********
    06:42:44:012  8c4 Agent   * Include potentially superseded updates
    06:42:44:012  8c4 Agent   * Online = Yes; Ignore download priority = No
    06:42:44:012  8c4 Agent   * Criteria = "Type='Software'"
    06:42:44:012  8c4 Agent   * ServiceID = {7971F918-A847-4430-9279-4A52D1EFE18D} Third party service
    06:42:44:012  8c4 Agent   * Search Scope = {Machine}
    06:42:44:012  f6c COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:43:30:619  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:43:31:099  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:43:31:249  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:43:31:550  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:43:31:550  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:43:31:550  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:43:34:624  ad8 Handler   : WARNING: Command line install completed. Return code = 0x800705b4, Result = Failed, Reboot required = false
    06:43:35:125  ad8 Handler   : WARNING: Exit code = 0x8024200B
    06:43:35:125  ad8 Handler :::::::::
    06:43:35:125  ad8 Handler ::  END  ::  Handler: Command Line Install
    06:43:35:125  ad8 Handler :::::::::::::
    06:43:35:395  3a8 AU >>##  RESUMED  ## AU: Installing update [UpdateId = {D348262E-D0E0-4481-A795-B4F4C9F435F8}]
    06:43:35:415  3a8 AU   # WARNING: Install failed, error = 0x80070643 / 0x800705B4
    06:43:37:749  a4c DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    06:43:37:769  a4c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:43:37:769  a4c DnldMgr   * Update is not allowed to download due to regulation.
    06:43:37:769  a4c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:43:43:507  a4c Agent *********
    06:43:43:507  a4c Agent **  END  **  Agent: Installing updates [CallerId = AutomaticUpdates]
    06:43:43:507  a4c Agent *************
    06:43:43:507  3a8 AU Install call completed.
    06:43:43:537  3a8 AU   # WARNING: Install call completed, reboot required = No, error = 0x00000000
    06:43:43:537  3a8 AU #########
    06:43:43:537  3a8 AU ##  END  ##  AU: Installing updates [CallId = {5B26D004-50F1-4A3C-B3B7-2F7BC8FD2E5E}]
    06:43:43:537  3a8 AU #############
    06:43:43:818  3a8 AU Install complete for all calls, reboot NOT needed
    06:43:44:519  3a8 AU Triggering Offline detection (non-interactive)
    06:43:44:549   c8 AU #############
    06:43:44:569   c8 AU ## START ##  AU: Search for updates
    06:43:44:579   c8 AU #########
    06:43:44:859   c8 AU <<## SUBMITTED ## AU: Search for updates [CallId = {7F9D7A55-2802-44FC-AA72-C07EDF32345D}]
    06:44:16:735  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:44:17:256  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:44:17:456  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:44:18:007  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:44:18:007  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:44:18:007  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:44:29:734  9b8 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    06:45:01:810  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:45:01:850  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:45:01:850  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:45:01:930  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:45:01:930  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:45:01:930  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:45:44:241  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:45:44:621  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:45:44:721  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:45:45:112  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:45:45:112  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:45:45:112  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:45:45:162  8c4 Misc WARNING: DownloadFileInternal failed for http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab: error 0x80072efd
    06:46:29:796  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:46:29:796  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:46:29:796  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:46:29:796  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:46:29:796  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:46:29:796  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:47:11:757  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:47:11:757  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:47:11:757  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:47:11:757  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:47:11:757  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:47:11:757  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:47:53:816  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:47:53:816  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:47:53:816  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:47:53:816  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:47:53:816  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:47:53:816  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:48:35:775  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:48:35:775  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:48:35:775  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://download.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:48:35:775  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:48:35:775  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:48:35:775  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:48:35:775  8c4 Misc WARNING: DownloadFileInternal failed for http://download.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab: error 0x80072efd
    06:48:56:804  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:48:56:804  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:48:56:804  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://www.update.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:48:56:804  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:48:56:804  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:48:56:804  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:49:17:734  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:49:17:734  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:49:17:744  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://www.update.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:49:17:744  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:49:17:744  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:49:17:744  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:49:38:763  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:49:38:763  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:49:38:763  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://www.update.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:49:38:763  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:49:38:763  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:49:38:763  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:49:59:793  8c4 Misc WARNING: Send failed with hr = 80072efd.
    06:49:59:793  8c4 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    06:49:59:793  8c4 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <http://www.update.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab>. error 0x80072efd
    06:49:59:793  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x80072efd
    06:49:59:793  8c4 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x80072efd
    06:49:59:793  8c4 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x80072efd
    06:49:59:803  8c4 Misc WARNING: DownloadFileInternal failed for http://www.update.microsoft.com/v9/windowsupdate/redir/muv4wuredir.cab: error 0x80072efd
    06:49:59:853  8c4 Agent WARNING: Failed to obtain the authorization cab URLs, hr=0x80072efd
    06:49:59:893  8c4 Agent   * WARNING: Online service registration/service ID resolution failed, hr=0x80072EFD
    06:50:05:451  8c4 Agent   * WARNING: Exit code = 0x80072EFD
    06:50:05:451  8c4 Agent *********
    06:50:05:451  8c4 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    06:50:05:451  8c4 Agent *************

    thx

    Thursday, May 20, 2010 10:14 AM

Answers

  • Hi there,

    Just as a short info, the FCS can be installed via WSUS if you prepared the prerequisites. In your case yes. The updates will also come from the WSUS but the first one is quite big. The delta definitions are a few kilobytes (100-200)

    Can you check http://support.microsoft.com/kb/836941 ?

    It seems that you have this error code at 08:53:26:539.

    Probably you got the error if you stopped the transfer of updates from the wsus to the client.

    Regards,

    Victor


    Please Vote me as Helpful if i did helped you in any way.
    Thursday, May 20, 2010 6:52 PM

All replies

  • here is the rest, sorry :)

    06:50:05:451  8c4 Agent WARNING: WU client failed Searching for update with error 0x80072efd
    06:50:05:451  8c4 Agent *************
    06:50:05:451  8c4 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:50:05:451  8c4 Agent *********
    06:50:05:451  8c4 Agent   * Online = No; Ignore download priority = No
    06:50:05:451  8c4 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    06:50:05:461  8c4 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    06:50:05:461  8c4 Agent   * Search Scope = {Machine}
    06:50:06:623  938 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:50:06:683  938 COMAPI   - Updates found = 0
    06:50:06:683  938 COMAPI   - WARNING: Exit code = 0x00000000, Result code = 0x80072EFD
    06:50:06:683  938 COMAPI ---------
    06:50:06:683  938 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    06:50:06:683  938 COMAPI -------------
    06:50:06:743  f6c COMAPI WARNING: Operation failed due to earlier error, hr=80072EFD
    06:50:06:743  f6c COMAPI FATAL: Unable to perform synchronous search. (hr=80072EFD)
    06:50:58:265  8c4 Agent   * Found 0 updates and 50 categories in search; evaluated appl. rules of 362 out of 820 deployed entities
    06:50:58:846  8c4 Agent *********
    06:50:58:846  8c4 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    06:50:58:846  8c4 Agent *************
    06:51:02:371  8c4 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    06:51:02:381  8c4 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:51:02:391  8c4 DnldMgr   * Update is not allowed to download due to regulation.
    06:51:02:391  8c4 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    06:51:05:656  8c4 Report REPORT EVENT: {D039A747-4221-4E94-8372-A158EC631062}  06:43:38:280+0200 1 182 101 {D348262E-D0E0-4481-A795-B4F4C9F435F8} 100 80070643 AutomaticUpdates Failure Content Install Installation Failure: Windows failed to install the following update with error 0x80070643: Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.115.0).
    06:51:05:796  8c4 Report REPORT EVENT: {577E976B-C674-4947-A308-D09E28EE95BC}  06:50:05:421+0200 1 148 101 {00000000-0000-0000-0000-000000000000} 0 80072efd Microsoft Forefront Client Secu Failure Software Synchronization Windows Update Client failed to detect with error 0x80072efd.
    06:51:05:776  3a8 AU >>##  RESUMED  ## AU: Search for updates [CallId = {7F9D7A55-2802-44FC-AA72-C07EDF32345D}]
    06:51:05:816  3a8 AU   # 0 updates detected
    06:51:05:826  3a8 AU #########
    06:51:05:826  3a8 AU ##  END  ##  AU: Search for updates [CallId = {7F9D7A55-2802-44FC-AA72-C07EDF32345D}]
    06:51:05:826  3a8 AU #############
    06:51:05:826  3a8 AU Featured notifications is disabled.
    06:51:06:216  8c4 Report Uploading 2 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    06:51:06:447  8c4 Report Reporter successfully uploaded 2 events.
    06:51:57:829  c14 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    06:53:41:858  8c4 Report Uploading 2 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    06:53:41:898  8c4 Report Reporter successfully uploaded 2 events.
    07:12:43:083  660 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    07:33:28:305  6b4 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.

    08:24:31:751   c8 AU #############
    08:24:31:751   c8 AU ## START ##  AU: Search for updates
    08:24:31:751   c8 AU #########
    08:24:31:761   c8 AU <<## SUBMITTED ## AU: Search for updates [CallId = {53E9C574-74DC-49CE-8E57-016A3D222268}]
    08:24:31:761  ad0 Agent *************
    08:24:31:761  ad0 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    08:24:31:761  ad0 Agent *********
    08:24:31:761  ad0 Agent   * Online = Yes; Ignore download priority = No
    08:24:31:761  ad0 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    08:24:31:761  ad0 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    08:24:31:761  ad0 Agent   * Search Scope = {Machine}
    08:24:32:532  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    08:24:32:612  ad0 Misc  Microsoft signed: Yes
    08:24:32:702  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
    08:24:32:712  ad0 Misc  Microsoft signed: Yes
    08:24:32:933  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.cab:
    08:24:32:933  ad0 Misc  Microsoft signed: Yes
    08:24:32:963  ad0 Setup ***********  Setup: Checking whether self-update is required  ***********
    08:24:32:963  ad0 Setup   * Inf file: C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf
    --- I´VE REMOVED THE OTHER  SELFUPDATELINE HERE ---
    08:24:33:113  ad0 Setup   * IsUpdateRequired = No
    08:24:39:292  ad0 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    08:24:39:292  ad0 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    08:24:58:770  ad0 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    08:24:58:770  ad0 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    08:25:07:883  ad0 Agent   * Added update {4267F84C-4407-445B-B09F-86CA23320BB5}.100 to search result
    08:25:07:883  ad0 Agent   * Found 1 updates and 50 categories in search; evaluated appl. rules of 458 out of 820 deployed entities
    08:25:08:484  ad0 Agent *********
    08:25:08:484  ad0 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    08:25:08:484  ad0 Agent *************
    08:25:08:514  a58 AU >>##  RESUMED  ## AU: Search for updates [CallId = {53E9C574-74DC-49CE-8E57-016A3D222268}]
    08:25:08:514  a58 AU   # 1 updates detected
    08:25:08:564  a58 AU #########
    08:25:08:564  a58 AU ##  END  ##  AU: Search for updates [CallId = {53E9C574-74DC-49CE-8E57-016A3D222268}]
    08:25:08:564  a58 AU #############
    08:25:08:564  a58 AU Featured notifications is disabled.
    08:25:08:564  a58 AU AU setting next detection timeout to  07:24:00
    08:25:08:584  a58 AU Auto-approving update for download, updateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=1
    08:25:08:584  a58 AU Auto-approved 1 update(s) for download (NOT for Ux)
    08:25:08:584  a58 AU #############
    08:25:08:584  a58 AU ## START ##  AU: Download updates
    08:25:08:584  a58 AU #########
    08:25:08:584  a58 AU   # Approved updates = 1
    08:25:08:614  a58 AU AU initiated download, updateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100, callId = {BF2E1ECA-2851-4FBA-B313-B837AE04A54A}
    08:25:08:614  a58 AU AU setting pending client directive to 'Download Progress'
    08:25:08:634  a58 AU   # Pending download calls = 1
    08:25:08:634  a58 AU <<## SUBMITTED ## AU: Download updates
    08:25:08:654  ad0 DnldMgr *************
    08:25:08:654  ad0 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = AutomaticUpdates]
    08:25:08:664  ad0 DnldMgr *********
    08:25:08:664  ad0 DnldMgr   * Call ID = {BF2E1ECA-2851-4FBA-B313-B837AE04A54A}
    08:25:08:664  ad0 DnldMgr   * Priority = 2, Interactive = 0, Owner is system = 1, Explicit proxy = 0, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    08:25:08:664  ad0 DnldMgr   * Updates to download = 1
    08:25:08:664  ad0 Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.135.0)
    08:25:08:674  ad0 Agent   *   UpdateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100
    08:25:08:674  ad0 Agent   *     Bundles 1 updates:
    08:25:08:674  ad0 Agent   *       {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100
    08:25:08:674  ad0 DnldMgr ***********  DnldMgr: New download job [UpdateId = {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100]  ***********
    08:25:09:025  ad0 DnldMgr   * BITS job initialized, JobId = {C0463CAF-2023-4F7A-BE41-0C011390CD07}
    08:25:09:115  ad0 DnldMgr   * Downloading from http://WSUS/Content/50/A1705B0A5D8AD5C0FFA8B5772184FEC67B0B9150.exe to C:\WINDOWS\SoftwareDistribution\Download\9fbd65a6d62174d7185de2c4d7a91cf3\a1705b0a5d8ad5c0ffa8b5772184fec67b0b9150 (full file).
    08:25:09:225  ad0 Agent *********
    08:25:09:225  ad0 Agent **  END  **  Agent: Downloading updates [CallerId = AutomaticUpdates]
    08:25:09:225  ad0 Agent *************
    08:25:13:511  ad0 Report REPORT EVENT: {0B755865-2830-4481-9B98-6C39BE5609E1}  08:25:08:464+0200 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 1 updates.
    08:25:13:511  ad0 Report REPORT EVENT: {591E8A8F-D666-4A94-851F-E0F8A68DD0E0}  08:25:08:484+0200 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
    08:25:23:656   c8 AU WARNING: AU found no suitable session to launch client in
    08:27:49:766  ad0 Report Uploading 2 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    08:27:49:866  ad0 Report Reporter successfully uploaded 2 events.
    08:33:13:611  ad0 DnldMgr ***********  DnldMgr: Regulation Refresh [Svc: {9482F4B4-E343-43B6-B170-9A65BC822C77}]  ***********
    08:33:13:611  ad0 DnldMgr Contacting regulation server for 2 updates.
    08:33:14:582  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    08:33:14:702  ad0 Misc  Microsoft signed: Yes
    08:33:14:833  ad0 PT WARNING: Cached cookie has expired or new PID is available
    08:33:14:833  ad0 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    08:33:36:761  ad0 Misc WARNING: Send failed with hr = 80072efd.
    08:33:36:761  ad0 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    08:33:36:761  ad0 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    08:33:36:761  ad0 PT   + Caller provided credentials = No
    08:33:36:761  ad0 PT   + Impersonate flags = 0
    08:33:36:761  ad0 PT   + Possible authorization schemes used =
    08:33:36:761  ad0 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    08:33:36:761  ad0 PT WARNING: PTError: 0x80072efd
    08:33:36:761  ad0 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    08:33:36:761  ad0 PT WARNING: RefreshCookie failed: 0x80072efd
    08:33:36:761  ad0 PT WARNING: RefreshPTState failed: 0x80072efd
    08:33:36:761  ad0 PT WARNING: PTError: 0x80072efd
    08:33:38:774  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    08:33:38:784  ad0 Misc  Microsoft signed: Yes
    08:33:38:784  ad0 PT WARNING: Cached cookie has expired or new PID is available
    08:33:38:784  ad0 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    08:33:59:791  ad0 Misc WARNING: Send failed with hr = 80072efd.
    08:33:59:791  ad0 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    08:33:59:791  ad0 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    08:33:59:791  ad0 PT   + Caller provided credentials = No
    08:33:59:791  ad0 PT   + Impersonate flags = 0
    08:33:59:791  ad0 PT   + Possible authorization schemes used =
    08:33:59:791  ad0 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    08:33:59:791  ad0 PT WARNING: PTError: 0x80072efd
    08:33:59:791  ad0 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    08:33:59:791  ad0 PT WARNING: RefreshCookie failed: 0x80072efd
    08:33:59:791  ad0 PT WARNING: RefreshPTState failed: 0x80072efd
    08:33:59:791  ad0 PT WARNING: PTError: 0x80072efd
    08:34:01:794  ad0 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab:
    08:34:01:794  ad0 Misc  Microsoft signed: Yes
    08:34:01:804  ad0 PT WARNING: Cached cookie has expired or new PID is available
    08:34:01:804  ad0 PT WARNING: PTWarn: Anonymous plug-in skipped for WU
    08:34:22:821  ad0 Misc WARNING: Send failed with hr = 80072efd.
    08:34:22:821  ad0 Misc WARNING: SendRequest failed with hr = 80072efd. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <>
    08:34:22:821  ad0 PT   + Last proxy send request failed with hr = 0x80072EFD, HTTP status code = 0
    08:34:22:821  ad0 PT   + Caller provided credentials = No
    08:34:22:821  ad0 PT   + Impersonate flags = 0
    08:34:22:821  ad0 PT   + Possible authorization schemes used =
    08:34:22:821  ad0 PT WARNING: GetCookie failure, error = 0x80072EFD, soap client error = 5, soap error code = 0, HTTP status code = 200
    08:34:22:821  ad0 PT WARNING: PTError: 0x80072efd
    08:34:22:821  ad0 PT WARNING: GetCookie_WithRecovery failed : 0x80072efd
    08:34:22:821  ad0 PT WARNING: RefreshCookie failed: 0x80072efd
    08:34:22:821  ad0 PT WARNING: RefreshPTState failed: 0x80072efd
    08:34:22:821  ad0 PT WARNING: PTError: 0x80072efd
    08:34:22:821  ad0 DnldMgr WARNING: Server call failed, using default regulation.
    08:34:22:821  ad0 DnldMgr   * Regulation call complete. 0x80072efd
    08:34:32:904  ad0 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    08:34:32:904  ad0 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:34:32:904  ad0 DnldMgr   * Update is not allowed to download due to regulation.
    08:34:32:904  ad0 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:34:32:904  a58 AU AU checked download status and it changed: Downloading is paused
    08:35:14:954  b74 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    08:35:14:974  a58 AU AU checked download status and it changed: Downloading is not paused
    08:35:14:974  a58 AU AU setting pending client directive to 'Download Progress'
    08:35:29:986   c8 AU WARNING: AU found no suitable session to launch client in

    08:46:10:326  b44 Misc ===========  Logging initialized (build: 7.4.7600.226, tz: +0200)  ===========
    08:46:10:326  b44 Misc   = Process: c:\Programme\Microsoft Forefront\Client Security\Client\Antimalware\MpCmdRun.exe
    08:46:10:326  b44 Misc   = Module: C:\WINDOWS\system32\wuapi.dll
    08:46:10:326  b44 COMAPI -------------
    08:46:10:326  b44 COMAPI -- START --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    08:46:10:326  b44 COMAPI ---------
    08:46:10:356  ad0 Agent *************
    08:46:10:356  ad0 Agent ** START **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    08:46:10:356  ad0 Agent *********
    08:46:10:356  ad0 Agent   * Online = Yes; Ignore download priority = No
    08:46:10:356  ad0 Agent   * Criteria = "(IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains 'e0789628-ce08-4437-be74-2495b842f43b' and CategoryIDs contains '0a487050-8b0f-4f81-b401-be4ceacd61cd') or (IsInstalled = 0 and IsHidden = 0 and CategoryIDs contains 'e0789628-ce08-4437-be74-2495b842f43b' and CategoryIDs contains '8c3fcc84-7410-4a95-8b89-a166a0190486')"
    08:46:10:356  ad0 Agent   * ServiceID = {00000000-0000-0000-0000-000000000000} Third party service
    08:46:10:356  ad0 Agent   * Search Scope = {Machine}
    08:46:10:356  b44 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    08:46:11:668  ad0 PT WARNING: Cached cookie has expired or new PID is available
    08:46:11:668  ad0 PT Initializing simple targeting cookie, clientId = 08bf749e-685e-4698-b6d2-e26d79a82f8e, target group =  KH III, DNS name = CLIENT
    08:46:11:668  ad0 PT   Server URL = http://WSUS/SimpleAuthWebService/SimpleAuth.asmx
    08:46:12:419  ad0 PT +++++++++++  PT: Starting category scan  +++++++++++
    08:46:12:419  ad0 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    08:46:14:102  ad0 PT +++++++++++  PT: Synchronizing server updates  +++++++++++
    08:46:14:102  ad0 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    08:46:14:723  ad0 PT +++++++++++  PT: Synchronizing extended update info  +++++++++++
    08:46:14:723  ad0 PT   + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WSUS/ClientWebService/client.asmx
    08:46:15:914  ad0 Agent   * Added update {4267F84C-4407-445B-B09F-86CA23320BB5}.100 to search result
    08:46:15:914  ad0 Agent   * Found 1 updates and 4 categories in search; evaluated appl. rules of 53 out of 77 deployed entities
    08:46:16:545  ad0 Agent *********
    08:46:16:545  ad0 Agent **  END  **  Agent: Finding updates [CallerId = Microsoft Forefront Client Security]
    08:46:16:545  ad0 Agent *************
    08:46:16:565  9c8 COMAPI >>--  RESUMED  -- COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    08:46:16:575  9c8 COMAPI   - Updates found = 1
    08:46:16:575  9c8 COMAPI ---------
    08:46:16:575  9c8 COMAPI --  END  --  COMAPI: Search [ClientId = Microsoft Forefront Client Security]
    08:46:16:575  9c8 COMAPI -------------
    08:46:16:645  558 COMAPI -------------
    08:46:16:645  558 COMAPI -- START --  COMAPI: Download [ClientId = Microsoft Forefront Client Security]
    08:46:16:645  558 COMAPI ---------
    08:46:16:645  558 COMAPI   - Forced: No; Download priority: 3
    08:46:16:645  558 COMAPI   - Updates in request: 1
    08:46:16:645  558 COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    08:46:16:675  558 COMAPI <<-- SUBMITTED -- COMAPI: Download [ClientId = Microsoft Forefront Client Security]
    08:46:17:216  ad0 DnldMgr *************
    08:46:17:216  ad0 DnldMgr ** START **  DnldMgr: Downloading updates [CallerId = Microsoft Forefront Client Security]
    08:46:17:216  ad0 DnldMgr *********
    08:46:17:216  ad0 DnldMgr   * Call ID = {7809DDAD-FE43-42FA-AEB6-184A02B913BC}
    08:46:17:216  ad0 DnldMgr   * Priority = 3, Interactive = 1, Owner is system = 1, Explicit proxy = 1, Proxy session id = -1, ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
    08:46:17:216  ad0 DnldMgr   * Updates to download = 1
    08:46:17:216  ad0 Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.135.0)
    08:46:17:216  ad0 Agent   *   UpdateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100
    08:46:17:216  ad0 Agent   *     Bundles 1 updates:
    08:46:17:216  ad0 Agent   *       {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100
    08:46:17:447  ad0 Agent *********
    08:46:17:447  ad0 Agent **  END  **  Agent: Downloading updates [CallerId = Microsoft Forefront Client Security]
    08:46:17:447  ad0 Agent *************
    08:46:21:562  ad0 Report REPORT EVENT: {681C3B10-5215-492C-943D-E9AE6B5E6557}  08:46:16:535+0200 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Microsoft Forefront Client Secu Success Software Synchronization Windows Update Client successfully detected 1 updates.
    08:48:56:709  ad0 Report Uploading 1 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    08:48:56:809  ad0 Report Reporter successfully uploaded 1 events.
    08:49:19:891  b88 DnldMgr BITS job {C0463CAF-2023-4F7A-BE41-0C011390CD07} completed successfully
    08:49:21:683  b88 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\Download\9fbd65a6d62174d7185de2c4d7a91cf3\a1705b0a5d8ad5c0ffa8b5772184fec67b0b9150:
    08:49:22:134  b88 Misc  Microsoft signed: Yes
    08:49:22:134  b88 DnldMgr   Download job bytes total = 53408656, bytes transferred = 53408656
    08:49:22:214  b88 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    08:49:22:214  b88 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:49:22:214  b88 DnldMgr   * Update is not allowed to download due to regulation.
    08:49:22:214  b88 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:49:22:214  b88 DnldMgr ***********  DnldMgr: New download job [UpdateId = {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100]  ***********
    08:49:22:845  b88 DnldMgr   * All files for update were already downloaded and are valid.
    08:49:22:895  b88 DnldMgr ***********  DnldMgr: New download job [UpdateId = {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100]  ***********
    08:49:23:436  b88 DnldMgr   * All files for update were already downloaded and are valid.
    08:49:23:977  a58 AU >>##  RESUMED  ## AU: Download update [UpdateId = {4267F84C-4407-445B-B09F-86CA23320BB5}, succeeded]
    08:49:23:977  a58 AU #########
    08:49:23:977  a58 AU ##  END  ##  AU: Download updates
    08:49:23:977  a58 AU #############
    08:49:23:977  a58 AU Auto-approving update for install, updateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100, ForUx=0, IsOwnerUx=0, HasDeadline=0, IsMinor=1
    08:49:23:977  a58 AU Auto-approved 1 update(s) for install (NOT for Ux), installType=2
    08:49:23:997  a58 AU #############
    08:49:23:997  a58 AU ## START ##  AU: Install updates
    08:49:23:997  a58 AU #########
    08:49:23:997  a58 AU   # Initiating minor updates install
    08:49:23:997  a58 AU   # Approved updates = 1
    08:49:24:007  a58 AU <<## SUBMITTED ## AU: Install updates / installing updates [CallId = {D8628379-6BB8-4002-9BDA-4E3FB5123012}]
    08:49:24:007  e24 Agent *************
    08:49:24:007  e24 Agent ** START **  Agent: Installing updates [CallerId = AutomaticUpdates]
    08:49:24:007  e24 Agent *********
    08:49:24:007  e24 Agent   * Updates to install = 1
    08:49:24:147  e24 Agent   *   Title = Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.135.0)
    08:49:24:147  e24 Agent   *   UpdateId = {4267F84C-4407-445B-B09F-86CA23320BB5}.100
    08:49:24:147  e24 Agent   *     Bundles 1 updates:
    08:49:24:147  e24 Agent   *       {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100
    08:49:24:157  9c8 COMAPI >>--  RESUMED  -- COMAPI: Download [ClientId = Microsoft Forefront Client Security]
    08:49:24:157  9c8 COMAPI   - Download call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0)
    08:49:24:157  9c8 COMAPI ---------
    08:49:24:157  9c8 COMAPI --  END  --  COMAPI: Download [ClientId = Microsoft Forefront Client Security]
    08:49:24:157  9c8 COMAPI -------------
    08:49:24:157  adc COMAPI -------------
    08:49:24:157  adc COMAPI -- START --  COMAPI: Install [ClientId = Microsoft Forefront Client Security]
    08:49:24:157  adc COMAPI ---------
    08:49:24:157  adc COMAPI   - Allow source prompts: Yes; Forced: No; Force quiet: Yes
    08:49:24:157  adc COMAPI   - Updates in request: 1
    08:49:24:157  adc COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    08:49:24:207  adc COMAPI WARNING: ISusInternal::BeginInstallUpdates3 failed, hr=80240016
    08:49:24:217  adc COMAPI   - WARNING: Exit code = 0x80240016
    08:49:24:217  adc COMAPI ---------
    08:49:24:217  adc COMAPI --  END  --  COMAPI: Install [ClientId = <NULL>]
    08:49:24:217  adc COMAPI -------------
    08:49:24:217  adc COMAPI FATAL: Unable to initiate asynchronous installation successfully. (hr=80240016)
    08:49:29:004  ad0 Report REPORT EVENT: {89F330F0-F185-4A2B-85FF-63CD6CF2D758}  08:49:23:977+0200 1 162 101 {4267F84C-4407-445B-B09F-86CA23320BB5} 100 0 Microsoft Forefront Client Secu Success Content Download Download succeeded.
    08:49:29:004  ad0 Report REPORT EVENT: {3FFBA565-C22F-4765-8647-9170E8F2D250}  08:49:23:977+0200 1 189 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. To install the updates, an administrator should log on to this computer and Windows will prompt with further instructions:  - Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.135.0)
    08:49:29:234  adc COMAPI -------------
    08:49:29:234  adc COMAPI -- START --  COMAPI: Install [ClientId = Microsoft Forefront Client Security]
    08:49:29:234  adc COMAPI ---------
    08:49:29:234  adc COMAPI   - Allow source prompts: Yes; Forced: No; Force quiet: Yes
    08:49:29:234  adc COMAPI   - Updates in request: 1
    08:49:29:234  adc COMAPI   - ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    08:49:29:234  adc COMAPI WARNING: ISusInternal::BeginInstallUpdates3 failed, hr=80240016
    08:49:29:234  adc COMAPI   - WARNING: Exit code = 0x80240016
    08:49:29:234  adc COMAPI ---------
    08:49:29:234  adc COMAPI --  END  --  COMAPI: Install [ClientId = <NULL>]
    08:49:29:234  adc COMAPI -------------
    08:49:29:234  adc COMAPI FATAL: Unable to initiate asynchronous installation successfully. (hr=80240016)
    08:49:39:178  e24 DnldMgr Preparing update for install, updateId = {629907E3-AA6E-4F94-8353-A7FFCB3FAD1A}.100.
    08:50:13:525  a24 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    08:50:13:606  e2c Misc ===========  Logging initialized (build: 7.4.7600.226, tz: +0200)  ===========
    08:50:13:606  e2c Misc   = Process: C:\WINDOWS\system32\wuauclt.exe
    08:50:13:606  e2c Misc   = Module: C:\WINDOWS\system32\wuaueng.dll
    08:50:13:606  e2c Handler :::::::::::::
    08:50:13:606  e2c Handler :: START ::  Handler: Command Line Install
    08:50:13:606  e2c Handler :::::::::
    08:50:13:606  e2c Handler   : Updates to install = 1
    08:52:34:404  e2c Handler   : Command line install completed. Return code = 0x00000000, Result = Succeeded, Reboot required = false
    08:52:35:675  e2c Handler :::::::::
    08:52:35:675  e2c Handler ::  END  ::  Handler: Command Line Install
    08:52:35:675  e2c Handler :::::::::::::
    08:52:40:382  e24 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    08:52:40:402  e24 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:52:40:402  e24 DnldMgr   * Update is not allowed to download due to regulation.
    08:52:40:402  e24 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:52:40:943  a58 AU >>##  RESUMED  ## AU: Installing update [UpdateId = {4267F84C-4407-445B-B09F-86CA23320BB5}, succeeded]
    08:52:46:301  e24 Agent *********
    08:52:46:301  e24 Agent **  END  **  Agent: Installing updates [CallerId = AutomaticUpdates]
    08:52:46:301  e24 Agent *************
    08:52:46:301  a58 AU Install call completed.
    08:52:46:321  a58 AU   # WARNING: Install call completed, reboot required = No, error = 0x00000000
    08:52:46:321  a58 AU #########
    08:52:46:321  a58 AU ##  END  ##  AU: Installing updates [CallId = {D8628379-6BB8-4002-9BDA-4E3FB5123012}]
    08:52:46:321  a58 AU #############
    08:52:46:411  a58 AU Install complete for all calls, reboot NOT needed
    08:52:46:761  a58 AU Triggering Offline detection (non-interactive)
    08:52:46:761   c8 AU #############
    08:52:46:791   c8 AU ## START ##  AU: Search for updates
    08:52:46:791   c8 AU #########
    08:52:47:012   c8 AU <<## SUBMITTED ## AU: Search for updates [CallId = {3C65DD5F-22B7-47CC-B64D-52036D1DEC12}]
    08:52:54:002  ad0 Report WARNING: Reporter failed to upload events with hr = 8024000c.
    08:52:54:002  ad0 Agent *************
    08:52:54:002  ad0 Agent ** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
    08:52:54:002  ad0 Agent *********
    08:52:54:002  ad0 Agent   * Online = No; Ignore download priority = No
    08:52:54:002  ad0 Agent   * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
    08:52:54:002  ad0 Agent   * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
    08:52:54:002  ad0 Agent   * Search Scope = {Machine}
    08:53:26:539  680 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    08:53:47:078  ad0 Agent   * Found 0 updates and 50 categories in search; evaluated appl. rules of 362 out of 820 deployed entities
    08:53:48:240  ad0 Agent *********
    08:53:48:240  ad0 Agent **  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
    08:53:48:240  ad0 Agent *************
    08:53:48:931  ad0 DnldMgr ***********  DnldMgr: New download job [UpdateId = {9C307215-3DD8-40DA-8EA8-F490CC66AFA6}.100]  ***********
    08:53:48:931  ad0 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:53:48:931  ad0 DnldMgr   * Update is not allowed to download due to regulation.
    08:53:48:931  ad0 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update 9C307215-3DD8-40DA-8EA8-F490CC66AFA6 is "Defaults" regulated and can NOT download. Sequence 6190 vs AcceptRate 0.
    08:53:48:971  a58 AU >>##  RESUMED  ## AU: Search for updates [CallId = {3C65DD5F-22B7-47CC-B64D-52036D1DEC12}]
    08:53:48:971  a58 AU   # 0 updates detected
    08:53:49:021  a58 AU #########
    08:53:49:051  a58 AU ##  END  ##  AU: Search for updates [CallId = {3C65DD5F-22B7-47CC-B64D-52036D1DEC12}]
    08:53:49:051  a58 AU #############
    08:53:49:051  a58 AU Featured notifications is disabled.
    08:53:49:522  ad0 Report REPORT EVENT: {FB1EB704-4694-4BCD-BB3A-1B3BAFBF4F13}  08:52:41:404+0200 1 183 101 {4267F84C-4407-445B-B09F-86CA23320BB5} 100 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Definitionsupdate für Microsoft Forefront Client Security – KB977939 (Definition 1.83.135.0)
    08:53:53:768  ad0 Report Uploading 1 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    08:53:55:280  ad0 Report Reporter successfully uploaded 1 events.
    08:54:32:814  e08 DnldMgr Error 0x80072efd occurred while downloading update; notifying dependent calls.
    08:56:26:668  ad0 Report Uploading 1 events using cached cookie, reporting URL = http://WSUS/ReportingWebService/ReportingWebService.asmx
    08:56:26:708  ad0 Report Reporter successfully uploaded 1 events.

    Thursday, May 20, 2010 10:15 AM
  • Hi there,

    Just as a short info, the FCS can be installed via WSUS if you prepared the prerequisites. In your case yes. The updates will also come from the WSUS but the first one is quite big. The delta definitions are a few kilobytes (100-200)

    Can you check http://support.microsoft.com/kb/836941 ?

    It seems that you have this error code at 08:53:26:539.

    Probably you got the error if you stopped the transfer of updates from the wsus to the client.

    Regards,

    Victor


    Please Vote me as Helpful if i did helped you in any way.
    Thursday, May 20, 2010 6:52 PM
  • Saw a similar case like this recently with a guy who had clients on trucks using some kind of spotty wireless connectivity and the trucks/pc's kept getting turned off/on.

    Gist of the story is the first signature update to go from 1.0.0.0 == 50-60Mb.

    FCS used WUA API to call into Automatic Updates to download it..

    AU calls into BITS and says create job # X to download this full package 50+ Mb and  BITS starts downloading.

    Unfortunatley due to the slowness/connectivity of the link it does not finish downloading that package before the next signature update call kicks in.

    So then you end up with BITS having Job#1 and Job#2 both going...and the vicious circle starts as you keep getting more and more 50mb+ jobs queued up

    So the way I would recommend trying to "fix" this is a couple of steps..

    Change your signature update intervals to something high for the clients until you know they are up to date.. ie 1x day update signatures.

    Run the cleanup wizard on the WSUS server.. this will delete older revisions out of the server forcing the BITS clients to also remove jobs referencing those package id's

    Let me know if that helps...


    CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response) Check out my blog http://blogs.technet.com/kfalde
    Friday, May 28, 2010 7:54 PM