locked
wuauclt commands to force reporting of status? RRS feed

 > 

  • Question

  • Question
    Sign in to vote
    1
    Sign in to vote

    It seems that wuauclt /reportnow does not really seem to be doing anything even though it is supposed to make the clients report their status.  Is there anything that can be done to force an immediate status report?

    I also notice that wuauclt does not seem to display errors.  I can type wuauclt /detttecknow or wuauclt /klsdjlkfjds and it won't display an error.

    Tuesday, June 26, 2012 3:14 PM

Answers

  • Question
    Sign in to vote
    10
    Sign in to vote

    I have tried the wuauclt /reportnow command before and it does not seem to be doing anything that actually speeds up client reporting.

    It looks like they still report whenever they get around to reporting and running the command doesn't make it faster.

    The /reportnow function is a very tricky beast, and it somewhat requires an understanding of the natural behaviors of the WUAgent.

    When the WUAgent performs activities, it queues up all of those completed activities as 'events'. When the WUAgent quits working, an idle timer is engaged, and when the WUAgent has been idle for ~20 minutes, it invokes a call to the ReportingWebService. You can see these calls in the WindowsUpdate.log and compare their timestamps with the entries just previous.

    If the /reportnow action is invoked after the WUAgent becomes idle and before the regular call to the ReportingWebService, an immediate call to the ReportingWebService will be invoked. You can also see this in the WindowsUpdate.log.

    However, the call to the ReportingWebService is not the end of the line. Those events reported in that call are loaded into a buffer, and the WSUS server then processes those events asynchronously. If the WSUS server is also busy doing other things or other clients are also reporting at the same time, there will be an additional delay until the results are visible in the WSUS console.

    The real thing to remember is that, at best, the /reportnow task isn't going to save you much more than 20-30 minutes, so usually just waiting is the more efficient approach to the whole thing.

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Product Manager, SolarWinds
    Microsoft MVP - Software Distribution (2005-2012)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

    Tuesday, July 3, 2012 11:40 PM
  • Question
    Sign in to vote
    3
    Sign in to vote

    Hi,


    There is no functionality inside the WSUS to force an immediate status report.The wuauclt /reportnow command is only useful when an actual event has occurred and the reporting of that event is currently pending (e.g. there are reporting events in the queue waiting to be uploaded to the WSUS server).

    As for how to use the wuauclt Utility: http://technet.microsoft.com/en-us/library/cc720477(v=ws.10).aspx


    Regards,

    Clarence

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Thursday, June 28, 2012 7:19 AM

All replies

  • Question
    Sign in to vote
    3
    Sign in to vote

    Hi,


    There is no functionality inside the WSUS to force an immediate status report.The wuauclt /reportnow command is only useful when an actual event has occurred and the reporting of that event is currently pending (e.g. there are reporting events in the queue waiting to be uploaded to the WSUS server).

    As for how to use the wuauclt Utility: http://technet.microsoft.com/en-us/library/cc720477(v=ws.10).aspx


    Regards,

    Clarence

    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

    Thursday, June 28, 2012 7:19 AM
  • Question
    Sign in to vote
    3
    Sign in to vote

    Is there anything that can be done to force an immediate status report?

    Run wuauclt /detectnow

    Review the WindowsUpdate.log to confirm the detection event has completed.

    Run wuauclt /reportnow

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Product Manager, SolarWinds
    Microsoft MVP - Software Distribution (2005-2012)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

    • Proposed as answer by Olugbengar Friday, April 21, 2017 11:47 AM
    Sunday, July 1, 2012 9:22 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I have tried the wuauclt /reportnow command before and it does not seem to be doing anything that actually speeds up client reporting.

    It looks like they still report whenever they get around to reporting and running the command doesn't make it faster.

    Tuesday, July 3, 2012 12:22 AM
  • Question
    Sign in to vote
    10
    Sign in to vote

    I have tried the wuauclt /reportnow command before and it does not seem to be doing anything that actually speeds up client reporting.

    It looks like they still report whenever they get around to reporting and running the command doesn't make it faster.

    The /reportnow function is a very tricky beast, and it somewhat requires an understanding of the natural behaviors of the WUAgent.

    When the WUAgent performs activities, it queues up all of those completed activities as 'events'. When the WUAgent quits working, an idle timer is engaged, and when the WUAgent has been idle for ~20 minutes, it invokes a call to the ReportingWebService. You can see these calls in the WindowsUpdate.log and compare their timestamps with the entries just previous.

    If the /reportnow action is invoked after the WUAgent becomes idle and before the regular call to the ReportingWebService, an immediate call to the ReportingWebService will be invoked. You can also see this in the WindowsUpdate.log.

    However, the call to the ReportingWebService is not the end of the line. Those events reported in that call are loaded into a buffer, and the WSUS server then processes those events asynchronously. If the WSUS server is also busy doing other things or other clients are also reporting at the same time, there will be an additional delay until the results are visible in the WSUS console.

    The real thing to remember is that, at best, the /reportnow task isn't going to save you much more than 20-30 minutes, so usually just waiting is the more efficient approach to the whole thing.

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Product Manager, SolarWinds
    Microsoft MVP - Software Distribution (2005-2012)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

    Tuesday, July 3, 2012 11:40 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Do you know if there are any plans to make WSUS able to be more real time in the future?
    Friday, April 26, 2013 5:32 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Do you know if there are any plans to make WSUS able to be more real time in the future?
    One must learn patience when using WSUS. The detection inverval is ~22 hours + or - 4 hours.
    Tuesday, April 30, 2013 12:40 PM
  • Question
    Sign in to vote
    1
    Sign in to vote
    Do you know if there are any plans to make WSUS able to be more real time in the future?

    For an event that only occurs once a month for most organizations (Patch Tuesday), what "real time" capabilities are you looking for.

    There already exists methodologies to make a WSUS client do almost anything near instantaneously, and there are third-party products that will literally give you the ability to do anything with WSUS absolutely instantaneously if that's what you really need.

    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    SolarWinds Head Geek
    Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2013)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    http://www.solarwinds.com/gotmicrosoft
    The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

    Wednesday, May 29, 2013 8:53 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    It has been awhile and I have learned to do most everything I need, (thanks in great part to you Lawrence:) It would be great to see a list of the "methodologies to make a WSUS client do almost anything near instantaneously".

    Also, some of the "third-party products that will literally give you the ability to do anything with WSUS absolutely instantaneously".

    Corey Carmickle

    Thursday, March 12, 2015 5:11 PM
  • Question
    Sign in to vote
    1
    Sign in to vote

    Hi Corey,

    there are some open-source projects and scripts on codeplex that might be of interest. One paid product is Patch Manager by SolarWinds, this can make WMI calls out to the WU Agents on the remote machines to push out updates on demand etc (full disclosure, I work at SolarWinds)

    If you find the answer of assistance please "Vote as Helpful"and/or "Mark as Answer" where applicable. This helps others to find solutions for there issues, and recognises contributions made to the community :)

    Thursday, March 12, 2015 8:32 PM
  • Question
    Sign in to vote
    0
    Sign in to vote

    I for one call BS. I need to know what servers still need patches before I can send an email and go to bed. /Reportnow is not instantaneous. For something that is only needed once per month why would it work well? 

    I dont know why I would expect ReportNOW to report its approved updates VS its installed updates to WSUS so I can run the computer status report. I guess IM not getting it right??

    Sunday, May 3, 2015 4:30 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    I think the problem here is, it is NOT only needed once per month. Patch Tuesday can continue throughout the month. I know Microsoft tries to get them all done on Patch Tuesday, but the reality is, they rarely do. 

    That being said the closest i can come to 'real time' is the suggestion Lawrence gave earlier:

    Run wuauclt /detectnow

    Review the WindowsUpdate.log to confirm the detection event has completed.

    Run wuauclt /reportnow

    I do not review the .log, but I run both commands from an administrative console session (C:\Windows\system32>) twice, sometimes more. This works probably 80% It is sometimes necessary to 'check for updates' to create an event to report, and in extreme conditions a power-cycle may do the trick. This is as close as I can get to real time. Bottom line for me is; Keeping 275+- computers and 30+- servers up-to-date is not my only duty, so I would very much appreciate real time interaction between WSUS and the clients.

     

    Corey Carmickle


    Monday, May 4, 2015 4:09 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    If you are looking for "real-time" reporting from the WSUS server, you have the ability through Group Policy to change the default client check-in time from 22 hours to something more useful, say like 2 hours.
    Thursday, July 16, 2015 9:33 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    Solution is spot on, run both commands with a bit of interval between both to enable background processes run and a report to wsus is completed.
    Friday, April 21, 2017 11:49 AM
  • Question
    Sign in to vote
    1
    Sign in to vote

    I wholeheartedly agree with you...especially when we are dealing with zero-day attacks.

    I, for one, stayed up all night last night to make sure we are covered for WannaCry.

    I am sick and tired of Microsoft products where you enter a command and it finishes executing the command whenever it feels like it...

    I am also sick and tired of WSUS telling me that there are 36 updates for a computer, but when I run the script provided by Rob Dunn (thank you for the valuable script, https://community.spiceworks.com/scripts/show/82-windows-update-agent-force-script-email-results-version-2-7), it says it's up to date.

    I even cleaned up "SoftwareDistribution" folder before running the script...doesn't help...

    How can we guarantee our IT security when the report is not accurate?



    Saturday, May 13, 2017 5:51 PM
  • Question
    Sign in to vote
    0
    Sign in to vote
    indows Update logs are now generated using ETW (Event Tracing for Windows).
    Please run the Get-WindowsUpdateLog PowerShell command to convert ETW traces into a readable WindowsUpdate.log.


    For more information, please visit https://go.microsoft.com/fwlink/?LinkId=518345
    Thursday, February 13, 2020 3:28 PM