none
Yellow Exclamation's for every computer in group

    Question

  • I have wsus 3.2.7600.226, on  a windows server 2008 r2 enterprise server 64bit and in wsus console under computers\allcomputers\unassisgned = all the computers have a yellow triangle with a exclamation point associated with them. All the machines "installed/not app" % is above 90%. I need help with this and need for this to work as i'm new to this company and updates are not working.

     

    Thank you,

    Saturday, July 09, 2011 3:13 PM

Answers

  • Hi,

     

    You can link multiple WSUS GPOs to several organizational units (OUs), which will enable you to apply different WSUS policy settings to different types of computers. For your inquiry on “How can i make an exception…”, you can use Security filter or move these computer to an OU and create a new GPO to configure Windows Update policy settings as you want.

     

    Typically, when you configure WSUS through Group Policy, you set up your client computers to connect to a WSUS server and download updates once a day. By default, this is every 22 hours (minus a random time offset) at which time the approval actions you specified for the new updates (for example, installation, detection, or removal) run on the client computer.

     

    For more information, please refer to the following links:

     

    Configure Automatic Updates by Using Group Policy

    http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx

     

    Best Practices with Windows Server Update Services

    http://technet.microsoft.com/en-us/library/cc708536(WS.10).aspx

     

    Thanks.

    Nina
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by chicojrman Thursday, July 21, 2011 4:43 PM
    Wednesday, July 13, 2011 6:44 AM
    Moderator

All replies

  • The yellow triangle is there exactly because "all the machines Instaleld/NotApplicable is [ONLY] above 90%". When it reaches 100% the yellow triangle will go away.

    To do that you need to identify the updates on those machines that are NotInstalled, and decide whether you want to install them. If you do, you need to approve the updates; if not, then either Declne the update (if you will NEVER need the update) or accept that some machines will never be 100%.


    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Saturday, July 09, 2011 11:00 PM
    Moderator
  • Okay, i understand now. Thank you,

     

    Could you point me in the right direction on another question please.

    How can i tell if there is a gpo setup for wsus.

    How can i tell when wsus is automaticaly pushing out updates to machines.

    How can i make an exception for say a "server" group under computers to only download updates so that we can manually update instead of wsus pushing out updates to servers and auto rebooting them.

     

    Thanks,

    Sunday, July 10, 2011 7:47 PM
  • How can i tell if there is a gpo setup for wsus.
    There are probably a dozen different ways to do this. But none of them will be conclusive; you sort of have to have an awareness of how your AD/GPO environment is set up. Ideally there's a GPO configured that has a name readily identifying it as a WSUS GPO and it would be as simple as loading up the Group Policy Management Console and reviewing the list of existing GPOs.
    How can i tell when wsus is automaticaly pushing out updates to machines.

    You cannot, because WSUS does not push out updates to machines.

    However, if machines are GETTING updates from a WSUS server, then that information will be readily reflected in the console.

    How can i make an exception for say a "server" group under computers to only download updates so that we can manually update instead of wsus pushing out updates to servers and auto rebooting them.
    This is covered in the WSUS Deployment Guide in the section on configuring clients to use WSUS. Based on these three questions, I would suggest you set aside several hours to review an Active Directory/Group Policy administration guide, as well as the WSUS Deployment Guide and WSUS Operations Guide.
    Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
    Principal/CTO, Onsite Technology Solutions, Houston, Texas
    Microsoft MVP - Software Distribution (2005-2011)
    My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
    My Blog: http://onsitechsolutions.spaces.live.com
    Monday, July 11, 2011 1:09 AM
    Moderator
  • Hi,

     

    You can link multiple WSUS GPOs to several organizational units (OUs), which will enable you to apply different WSUS policy settings to different types of computers. For your inquiry on “How can i make an exception…”, you can use Security filter or move these computer to an OU and create a new GPO to configure Windows Update policy settings as you want.

     

    Typically, when you configure WSUS through Group Policy, you set up your client computers to connect to a WSUS server and download updates once a day. By default, this is every 22 hours (minus a random time offset) at which time the approval actions you specified for the new updates (for example, installation, detection, or removal) run on the client computer.

     

    For more information, please refer to the following links:

     

    Configure Automatic Updates by Using Group Policy

    http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx

     

    Best Practices with Windows Server Update Services

    http://technet.microsoft.com/en-us/library/cc708536(WS.10).aspx

     

    Thanks.

    Nina
    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
    • Marked as answer by chicojrman Thursday, July 21, 2011 4:43 PM
    Wednesday, July 13, 2011 6:44 AM
    Moderator