kennysarmy Posted December 9, 2020 Posted December 9, 2020 Finally got round to checking WSUS this term and after running the cleanup wizard I find that only 1/5th of my PC's have been checking in in the last 30 days. 36 of 1000 are showing as unassigned I'm using group policy to put the PC's in the correct folders in WSUS - one group is only showing 3 computers when it should be showing around 360! I have checked a couple of clients and everything seems in order. They can download the file from : http://server.domain.local:8530/selfupdate/iuident.cab gpresult /h gpo.htm - shows the GPO settings applying successfully. I can ping the wsus.domain.local The registry key : HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\WindowsUpdate\AU\UseWUServer is set to 1. Powershell script : $(New-Object -ComObject "Microsoft.Update.ServiceManager").Services | Select-Object Name, IsDefaultAUService - returns TRUE for Windows Server Update Service Previously when I've had WSUS issues it was the odd client. This seems to be more of an issue with WSUS itself. Are there any tricks to giving the WSUS a kick up it's butt.
cullingsh Posted December 9, 2020 Posted December 9, 2020 Have you tried turning it off and on again?
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Have you tried turning it off and on again? Restarted the WSUS Server yesterday
Koldov Posted December 9, 2020 Posted December 9, 2020 (edited) I only ever have the odd client machine give me issues and then I run through the following (it gets more involved the further down you get)... This is all on the client machine. Check the registry for WSUS server Navigate to the following key. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ The WSUS name can be found next to WUServer. To force client to report if it can: powershell -executionpolicy bypass $updateSession = new-object -com "Microsoft.Update.Session"; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates once that has finished wuauclt /reportnow If nothing appears after a few /reportnow attempts: a. Stop the WSUS service (net stop BITS & net stop WUAUSERV) b. Delete the SUSclientID reg key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSclientID c. Restart the services d. Run wuauclt /resetauthorization /detectnow e. Run wuauclt /reportnow Then if nothing happens after a while: Administrator CMD prompt net stop bits net stop wuauserv reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f rd /s /q "C:\WINDOWS\SoftwareDistribution" net start bits net start wuauserv wuauclt /resetauthorization /detectnow YMMV and UAYOR, maybe try it on one first? I can't help you with running this en masse as we are a small school, I just run through it manually for the odd one when I need to. Just a thought but do you have both the 'Last Status Report' and 'Last Contact' headers showing? When you ran the 'clean-up' wizard, did it delete any computers that haven't reported in, or are they still in the console? Occasionally I'll delete the computer from the WSUS console and run a GPupdate /force on the machine and then manually check for updates to see if that makes it reappear. Edited December 9, 2020 by Koldov
StevieM Posted December 9, 2020 Posted December 9, 2020 (edited) Have the computers been deployed from an image? If so, make a note of the computers that are connected and check over the next few days whether the same ones show in WSUS. I had an issue a couple of years ago when cloned computers had the same SUSID. EDIT: @Koldov posted the solution to my problem while I was typing my reply. Edited December 9, 2020 by StevieM
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Could be time for an uninstall and reinstall if I can't get to the bottom of it. Quite a few errors in Event Viewer
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Have the computers been deployed from an image? If so, make a note of the computers that are connected and check over the next few days whether the same ones show in WSUS. I had an issue a couple of years ago when cloned computers had the same SUSID. EDIT: @Koldov posted the solution to my problem while I was typing my reply. What's really odd is a room we've re-imaged recently with 30 computers in it: 24 are now in unassigned. (Last contact back in mid November!) 6 are in the correct container and have today's date as last contact They were all re-imaged exactly the same.
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 I only ever have the odd client machine give me issues and then I run through the following (it gets more involved the further down you get)... This is all on the client machine. Check the registry for WSUS server Navigate to the following key. HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ The WSUS name can be found next to WUServer. To force client to report if it can: powershell -executionpolicy bypass $updateSession = new-object -com "Microsoft.Update.Session"; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates once that has finished wuauclt /reportnow If nothing appears after a few /reportnow attempts: a. Stop the WSUS service (net stop BITS & net stop WUAUSERV) b. Delete the SUSclientID reg key HKLM\Software\Microsoft\Windows\CurrentVersion\WindowsUpdate\SUSclientID c. Restart the services d. Run wuauclt /resetauthorization /detectnow e. Run wuauclt /reportnow Then if nothing happens after a while: Administrator CMD prompt net stop bits net stop wuauserv reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f rd /s /q "C:\WINDOWS\SoftwareDistribution" net start bits net start wuauserv wuauclt /resetauthorization /detectnow YMMV and UAYOR, maybe try it on one first? I can't help you with running this en masse as we are a small school, I just run through it manually for the odd one when I need to. Just a thought but do you have both the 'Last Status Report' and 'Last Contact' headers showing? When you ran the 'clean-up' wizard, did it delete any computers that haven't reported in, or are they still in the console? Occasionally I'll delete the computer from the WSUS console and run a GPupdate /force on the machine and then manually check for updates to see if that makes it reappear. >>>When you ran the 'clean-up' wizard, did it delete any computers that haven't reported in, or are they still in the console? Exactly that - and it looks like if I ran it again today it might delete a few more! I would say I've only got around 70 out of 1000 devices now checking in correctly. Frustrating.
Koldov Posted December 9, 2020 Posted December 9, 2020 Are you using GPO client-side targeting to place the computers into the correct group and using the GP setting in WSUS?
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Are you using GPO client-side targeting to place the computers into the correct group and using the GP setting in WSUS? Yes, some that are appearing are in the right group, others are in unassigned. I can't see any differences with clients exhibiting both behaviours - they both run the relevant Group Policy Object and the settings are being taken.
Koldov Posted December 9, 2020 Posted December 9, 2020 Yes, some that are appearing are in the right group, others are in unassigned. Well, that means they are at least reporting to the WSUS server... Possibly somehow a mismatch between client-side and server-side targetting? Quick Google came up with this (it's about server-side targetting and manually moving the computers into their group but seems interesting). https://social.technet.microsoft.com/Forums/en-US/564ee1b5-d797-481c-8681-7cd3322866e5/computer-keep-going-back-to-unassigned-computer?forum=winserverwsus Have you checked the registry setting regarding the WSUS server on one of the affected machines? Also check that the GP is showing the correct client side targetting and WSUS is set to use that?
Koldov Posted December 9, 2020 Posted December 9, 2020 Sorry, just thought... probably trying to teach you to suck eggs.... But I've never had this problem, even ones that start failing to report never get to the point of ending up in 'Unassigned' (even when I delete them), so I presume these are the ones that got deleted by the 'Clean Up Wizard' and have now tried to report in but somehow haven't got the correct settings?
Akumos Posted December 9, 2020 Posted December 9, 2020 What's really odd is a room we've re-imaged recently with 30 computers in it: 24 are now in unassigned. (Last contact back in mid November!) 6 are in the correct container and have today's date as last contact They were all re-imaged exactly the same. How did they get in the correct group? Did you manually add them in WSUS?
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 How did they get in the correct group? Did you manually add them in WSUS? No, they are behaving as they should and using group policy to auto-move.
Koldov Posted December 9, 2020 Posted December 9, 2020 Can you check on one of those affected machines that these registry settings are correct for your set-up:
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Can you check on one of those affected machines that these registry settings are correct for your set-up: [ATTACH=CONFIG]60105[/ATTACH] All looks OK?
Koldov Posted December 9, 2020 Posted December 9, 2020 (edited) Hmmmm, well yes (not that I'm any sort of WSUS expert).... So, does this show correctly for your set-up in WSUS? and this on your Server GPO? and this from an RSOP on the client machine? If you've tried all the other stuff in my first post and all the above checks out, you could try deleting that 1 machine from the unassigned group and then running GPupdate /force and then try checking for updates to see if it appears back in the right place.... As I said I'm no expert, but I wonder if there is some sort of database corruption in WSUS? Maybe there was some sort of glitch as you say and a vast amount of machines stopped reporting or being able to contact the server for some reason and it is just taking WSUS a while to sort it out? Or the machines haven't done enough GPUpdating to get through. I know WSUS can be a beast and take a long time sorting through things sometimes... especially as you have so many computers trying to connect all at once. EDIT: Was it patch Tuesday yesterday (that won't help things)...? Edited December 9, 2020 by Koldov
Koldov Posted December 9, 2020 Posted December 9, 2020 Just another thought... If you don't have a vast amount of computers leaving the network regularly, it might be worth unticking the 'delete old computers' box on the clean-up wizard...
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 Hmmmm, well yes (not that I'm any sort of WSUS expert).... So, does this show correctly for your set-up in WSUS? [ATTACH=CONFIG]60107[/ATTACH] and this on your Server GPO? [ATTACH=CONFIG]60108[/ATTACH] and this from an RSOP on the client machine? [ATTACH=CONFIG]60109[/ATTACH] If you've tried all the other stuff in my first post and all the above checks out, you could try deleting that 1 machine from the unassigned group and then running GPupdate /force and then try checking for updates to see if it appears back in the right place.... As I said I'm no expert, but I wonder if there is some sort of database corruption in WSUS? Maybe there was some sort of glitch as you say and a vast amount of machines stopped reporting or being able to contact the server for some reason and it is just taking WSUS a while to sort it out? Or the machines haven't done enough GPUpdating to get through. I know WSUS can be a beast and take a long time sorting through things sometimes... especially as you have so many computers trying to connect all at once. EDIT: Was it patch Tuesday yesterday (that won't help things)...? Everything looks correct on the clients, those that are not appearing at all, those that are appearing but are in unassigned and those that are going in the correct group Rebuild time I think. WSUS is flaky as the best of times....
network41 Posted December 9, 2020 Posted December 9, 2020 I had a similar situation a while back . Turned out an expired certificate on the WSUS server 1
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 I had a similar situation a while back . Turned out an expired certificate on the WSUS server Good shout but I'm not sure we're using a certificate currently, so don't think there is an expiry issue - unless I'm looking in the wrong place. Afraid I did n't set this WSUS up so....
network41 Posted December 9, 2020 Posted December 9, 2020 It was a while ago but if I remember I just checked in the Trusted Root Certificates - Certificates and happened , by chance , to notice a self signed cert had expired. This may not be the case for yu but worth checking 1
Koldov Posted December 9, 2020 Posted December 9, 2020 (edited) I think it might be this....'Open IIS on the SCCM/WSUS server and click on your server name under Connections. ... Double-click on Server Certificates in the middle pane'. We don't use a certificate (that I know of). I'm guessing that might be only for managing clients connecting to the IIS website when out of the network? Edit: OK maybe not... should I be using a certificate for WSUS??? Edited December 9, 2020 by Koldov
Koldov Posted December 9, 2020 Posted December 9, 2020 Anything in the Event logs for the affected machines?
kennysarmy Posted December 9, 2020 Author Posted December 9, 2020 I've uploaded a clients update log here: https://we.tl/t-FWuDyCT8gG If any experts can decipher it - great
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now