SCCM SUP + ISA = Deployment issues

[itinerant]

I've recently been given the task of starting up a standalone ConfigMgr site where I work. We have just over 900 systems here, and everything up to this point has gone reasonably smoothly.

 

One of the last roles that I've configured is the Software Update Point. I've installed WSUS and the ConfigMgr role, and been able to synchronise updates. The only problem I'm now facing is actually deploying these updates.

 

So far, I've been able to get the ConfigMgr client installed on ~720 of our machines, but when I look through the All Software Updates section, barely any of these machines are reporting that they need these updates, or that they are installed. To test, I deployed a set of Windows Defender updates, and only about 15 machines have reported back as compliant. The othes just sit in the "Client check passed/Active" section.

 

After doing a little bit of research, it would seem that the issue is being caused by ISA. We currently use ISA 2006 here, and from what I can understand, the WPAD file generated by that changes all entries into lower-case. While the name of the server I created isn't in all caps, the SMS Provider name for the ConfigMgr server is. I've read that it's possible to go into the SQL tables and change some entries from upper-case to lower-case. It's not that I'm not comfortable doing something like that, just more whether or not that is actually advisable.

 

Does anybody know if there's another way to resolve something like this? Or is fiddling with SQL table entries the only way? If so, does anybody know whereabouts the entries are that I would need to change?

Edited June 16, 2015 by itinerant

[Steve21]

You sure that is the actual problem? Only reason I ask is that we have ISA WPAD and SCCM and have never made any changes to it to resolve that.

 

Depending on your settings things like compliance etc might just be set to check/deploy really slowly depending on how new a setup this is, and things like compliance etc shouldn't be going via your proxy if you have a bypass in place for local servers (or don't you?)

 

Steve

[itinerant]

The reason I'm thinking it's ISA is from the errors that I've been seeing in the WUAHandler.log files.

 

OnSearchComplete - Failed to end search job. Error = 0x80244021. WUAHandler 16/06/2015 15:06:48 4972 (0x136C)

Scan failed with error = 0x80244021. WUAHandler 16/06/2015 15:06:48 4972 (0x136C)

 

Here's what I get from running an error lookup:

 

Same as HTTP status 502 - the server, while acting as a gateway or proxy, received an invalid response from the upstream server it accessed in attempting to fulfill the request.

 

Source: Windows Update Agent

 

From what I could find about this, it seems to be a proxy-related problem, and I've seen a few threads elsewhere that have mentioned changing entries from upper-case to lower-case.

 

Are there any other log files that I can check out?

[Steve21]

What I mean though is if you have the proxy bypass set on the clients, it shouldn't even be touching the ISA server while looking for updates. Or aren't there any bypasses for it?

 

Steve

[itinerant]

Yea, they're all set to bypass.

 

It looks like it's the way that the WPAD is configured. To be honest, it's an area that I'm not overly familiar with, someone else here looks after ISA. ISA will be going very soon, so I may just come back to this at a later date.