WSUS 3 - Client connection problems

[Aeropars]

Hi guys,

 

first post so i'm hoping you can help me out on this!

 

I'm deploying a wsus infrastucture but it has been set up previously, although it seems incorrectly. I have set up 3 servers where each one will serve a different location.

 

Upon setting it up i noticed that there was hardly any computers being detected by the wsus consol and when I ran the WSUCLIentDiagnostic tool i got the following response

 

WSUS Client Diagnostics Tool

 

Checking Machine State

Checking for admin rights to run tool . . . . . . . . . PASS

Automatic Updates Service is running. . . . . . . . . . PASS

Background Intelligent Transfer Service is running. . . PASS

Wuaueng.dll version 7.0.6000.381. . . . . . . . . . . . PASS

This version is WSUS 2.0

 

Checking AU Settings

AU Option is 4: Scheduled Install . . . . . . . . . . . PASS

Option is from Policy settings

 

Checking Proxy Configuration

Checking for winhttp local machine Proxy settings . . . PASS

Winhttp local machine access type

Winhttp local machine Proxy. . . . . . . . . . NONE

Winhttp local machine ProxyBypass. . . . . . . NONE

Checking User IE Proxy settings . . . . . . . . . . . . PASS

User IE Proxy

proxy.lafarge.com:8090

User IE ProxyByPass

*.gb.aggregates.lafarge.com;10.172.*;*.lafargecement.co.uk;*.laf

arge.com;

User IE AutoConfig URL Proxy . . . . . . . . . NONE

User IE AutoDetect

AutoDetect not in use

 

Checking Connection to WSUS/SUS Server

WUServer = http://sysgbcwus01

WUStatusServer = http://sysgbcwus01

UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS

 

VerifyWUServerURL() failed with hr=0x801901f7

 

No Error description could be found

 

We can ping the server, telnet to it on port 80 and remotely manage it so I'm certain the server isnt having a problem. DNS is working correctly for the clients as they can pint the server. Nothing is blocking traffic on port 80 either. The tool is also confirming group policy is being pushed out correctly.

 

Does anyone have any ideas on what the problem here could be?

 

Any help, greatly apreciated.

 

Lee

[Dos_Box]

That is becuase the clients are still looking for the old WSUS server. What you will have to do is either run the following command on the clients:

 

wuauclt.exe /detectnow

 

If that does not do it follow the instructions from this thread.

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&t=12055&highlight=wsus

[Aeropars]

I've just tried this on a computer next to me and then ran the diagnostics again but its still giving the same error. I've also ran the /resetauthorization switch to no avail.

 

Any mother ideas??

[Diello]

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=135977

 

?

[Aeropars]

That link points back to this thread?? Even though the Id is different?

 

Am I missing something?

[Michael]

Try running this script:

 

@echo off
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stop the wuauserv service
Echo 2.    Delete the AccountDomainSid registry key (if it exists)
Echo 3.    Delete the PingID registry key (if it exists)
Echo 4.    Delete the SusClientId registry key (if it exists)
Echo 5.    Restart the wuauserv service
Echo 6.    Resets the Authorization Cookie

Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

[Aeropars]

I was hoping that script might work as its slightly different form another I ran.

 

It still didnt work though.

 

Incidentally, I've just built a VMware machine and it happens on brand new clients so I'm not so sure it could be the registry keys lingering around.

 

Could there be something wrong on my IIS install or perhaps a permission that needs looking at?

 

Thanks for your help so far.

[Michael]

Are you using Group Policy to tell your workstations which WSUS server to look at? And are the workstations in the correct OU to pick up this policy?

 

The fact you mentioned IIS, you're probably using WSUS 2.0. Have you looked at WSUS 3.0? It's slightly different, but achieves the same thing. It works from the MMC and no longer IIS.

 

The only system requirement is that you need to be using Windows Server 2003. It won't install on Windows 2000 Server.

[Aeropars]

Sorry to disagree but version 3 does need IIS installed to function. The update client uses an internet type url to connect to the service but in version 3 the admin consol is MMC based, although there is still need for IIS.

[Michael]

@Aeropars - You may be right looking at it. I still have IIS running because I upgraded from WSUS 2.0 to 3.0 a while ago and never thought about uninstalling IIS.

 

It still has an entry in Application Pools, but it does use MMC and no longer opens in IE.

[Diello]

That link points back to this thread?? Even though the Id is different?

 

Am I missing something?

 

No... Just my inability to C&P properly!!!

 

http://www.edugeek.net/index.php?name=Forums&file=viewtopic&p=12258

[Aeropars]

I've tried all of that but to no avail.

 

One thing worth mentioning is that I cannot telnet to the web server on port 8530. I can only get in on port 80. I did use the default website during the installation as reccomended.

[Michael]

Could you confirm what version of WSUS you're running on which Server OS?

 

Reading your original post again, and reading further down the replies it could well be WSUS isn't setup correctly if new machines are not being detected correctly.

 

You say you have three WSUS servers, but why is this? One modern server is capable of serving hundreds and hundreds of clients unless the locations are physically different?

 

If you see workstations appearing then disappearing, it'll be to do with identical SIDs, but the script I provided should fix that for you.

 

The only other thing I can think of, is your network an RM network? WSUS isn't supported on RM networks officially.

[Aeropars]

Whats an RM Network?

 

Dont worry about the 3 locations, that only temporary to see if all sites will have the same problem. This will be part of a UK wide WAN so downstream servers will be needed.

 

Its WSUS 3 on Windows 2003 Server which is hosted on a VMware box.

 

The install of WSUS has been done exactly as per the documentation on the MS technet site. The only thing I havent added is that this domain was recentl migrated from NT4 to a new domain. User and computer accounts were migrated with SID history but this shouldnt have created duplicate SIDs. Either way, the script was run but it had no effect on the problem.

 

Workstations dont appear at all apart from the odd 2 or 3 which makes it a really odd scenario.

[Michael]

RM network = Research Machines

 

I can't see why migrating from NT4 Server to 2003 Server would be creating you this specific problem as presumably everything else is working ok?

 

Without sounding patronising, do you know that WSUS only supports Windows 2000 Service Pack 3 or later? If you were running 95, 98 or ME with NT4 Server these OS's do not work with WSUS.

 

The fact you're running WSUS 3.0 it should work with 2000 SP3 or later, XP (any Service Pack) and Vista out the box.

 

Have you double checked your Group Policy settings to ensure clients are looking at the right place? The more I think about it, the more it seems likely it's a server end issue.

[Aeropars]

Yes, group policy has been checked and the WUS diagnostics tool shows that the settings are being applied to the workstations.

 

we're on a standard ethernet network.

 

Yes, I'm aware of the service packs needed and we are up to XP service pack 2 on most while 200 is sp4.

 

Could well be a server side problem but i'm stumped as to what it could be! I was wondering whetehr setting up another server with a different website (other than the default one) so see if its something wrong with IIS but not sure if this would be worth doing.