MattMerry Posted July 23, 2021 Posted July 23, 2021 Hi one and all,So after many weeks of trying to figure out this issue of why my Window 10 Clients are picking up the updates from my WSUS, I have had no further luck. I have created all the membership groups for my place of work, I can see the updates in the updates section of WSUS console, I can approve them and I can see them being downloaded where it starts xxxx mb of xxxx mb downloaded, yet when I click on Check for updates on my Win10 Client machines, it says I'm up to date.I'm really struggling on this one so any help whatsoever would be fantastic.Regards
Koldov Posted July 23, 2021 Posted July 23, 2021 (edited) First thoughts as you haven't mentioned them... On your clients do you see *Some settings are managed by your Organisation Do you see your clients in the WSUS console (if so are you using GPO - that's what I use so I don't know how the other option works)? I'm also presuming you have a GPO to tell your clients where to find the updates? EDIT: Also are you sure your clients aren't actually 'up to date'? Edited July 23, 2021 by Koldov
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 (edited) Hi there, Thank you for your reply Koldov, That's right at the top I do see *some setting are managed by your organisation'. Yup, GPO has been pushed out to the clients so when i run rsop.msc and under 'Administrative Template' I have the following GPO's enabled: - Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates - Configure Automatic Updates - Specify intranet Microsoft Update service location - No auto-restart with logged on users for scheduled automatic update installations - Re-prompt for restart with scheduled installations My GPO name is called WSUS. And well I tested to see if they were up-to-date by approving another update from the WSUS console, to see if the client would pick it up and it didn't? Edited July 23, 2021 by MattMerry
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 Yup, I see the computers in WSUS. I even set them in groups resembling the different buildings we have here.
Koldov Posted July 23, 2021 Posted July 23, 2021 Do your computers show any updated information (IP, Failed, Needed, Installed, Not Applicable) - mainly Last Status and Last Contact? Did you manually add them in WSUS into their computer groups or did you use client-side targeting in the GPO (I use this so that's where my knowledge ends)? Can you check the registry on a client for the following: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate UpdateServiceURLAlternative WUServer WUStatusServer They should reflect your settings in the GPO - Specify intranet Microsoft Update service location.
1an Posted July 23, 2021 Posted July 23, 2021 Do your computers use a proxy server for internet connection? In the past I had to add an exception for the WSUS server in internet settings on the client computers. http://wsusserver:8530 or https://wsusserver:8531
Koldov Posted July 23, 2021 Posted July 23, 2021 If not then on a client in CMD as admin type: Type wuauclt.exe /detectnow and then press ENTER Also wuauclt /reportnow and then press ENTER
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 I believe they were discovered through AD. Checking the Registry: WUServer = http://sga-05:8530 (SGA-05 is the WSUS) WUStatusServer = http://sga-05 Don't see an option for UpdateServiceURLAlternative, I just have the two mentioned above and (Default) with a value not set. We don't use a proxy server here, however, the default ports are set to 8530 and 80. Nothing happens when I run both those commands in CMD. Regards,
3s-gtech Posted July 23, 2021 Posted July 23, 2021 wuauclt no longer works - Windows 10 has superceded it with usoclient. Which is part broken - some of the switches don’t work IME.
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 Oh really? That would make sense why nothing happened then! Does usoclient do the same thing then?
Koldov Posted July 23, 2021 Posted July 23, 2021 (edited) Our registry (because that's what's in the GPO) defines the FQDN of the server - http://HTTP://SERVER.DOMAIN.COM:8530 (not sure if it matters). No, unfortunately running those commands doesn't give you any feedback. What do you see in the WSUS console in the columns I mentioned: IP, Failed, Needed, Installed, Not Applicable - mainly Last Status and Last Contact? Other things to check are the server firewall (although I presume it opens the ports when you install the WSUS role. 'Discovered through AD' I'm not sure how that works as I use the GPO (Item Level Targetting). Might be worth a read (not sure what guide you are following) to see if you've missed any steps: https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus Some other CMD commands (but a bit nuclear - I use it on clients that stop responding (only after deleting them and running GPUPDATE /FORCE or restarting to see if they appear): net stop bits net stop wuauserv reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f rd /s /q "C:\WINDOWS\SoftwareDistribution" net start bits net start wuauserv wuauclt /resetauthorization /detectnow wuauclt /reportnow Also a handy PS command to give them a kick in the A$$ to report when I need it: Run: powershell -executionpolicy bypass Then: $updateSession = new-object -com "Microsoft.Update.Session"; $updates=$updateSession.CreateupdateSearcher().Search($criteria).Updates Then: wuauclt /reportnow Edited July 23, 2021 by Koldov
Koldov Posted July 23, 2021 Posted July 23, 2021 wuauclt no longer works - Windows 10 has superceded it with usoclient. Which is part broken - some of the switches don’t work IME. Seems to work here...? But usually I run the PS command in my previous post and then wuauclt /reportnow it will absolutely change the status in the console.
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 So in WSUS underneath those headings there is, (please let me know if these are appear wrong): Failed - Nothing Needed - Last Status: 22/07/2021 Installed - Nothing Again I feel that's not fully what you're asking for, so apologies if that is wrong. According to my network manager the firewall is operating as it should. I began to follow that guide but then found a set of YouTube videos documenting the process from scratch. Thanks for the CMD commands!!
Koldov Posted July 23, 2021 Posted July 23, 2021 As far as how the computers got into WSUS, could you just look at this setting and tell me which is selected?
3s-gtech Posted July 23, 2021 Posted July 23, 2021 Seems to work here...? But usually I run the PS command in my previous post and then wuauclt /reportnow it will absolutely change the status in the console. Which version of Windows 10 are you using? I’m not sure it was deprecated entirely in one go, but on 1903 and now 20H2 I don’t get anything from the command.
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 Okay, so my option is ticked as Use the Update Services console?..
jthompson Posted July 23, 2021 Posted July 23, 2021 My [rhetorical] money is on DNS. That's usually a safe bet and always worth discounting. On the clients, using nslookup to see whether they're resolving the server's IP address correctly when querying just the hostname or the FQDN might help identify an issue. Configuring the clients to use the server's FQDN rather than just its hostname can't hurt.
Koldov Posted July 23, 2021 Posted July 23, 2021 You may not have all the columns you need enabled, you can right-click them and you should get the option to add some useful ones. Don't forget to apply it to all views...
Koldov Posted July 23, 2021 Posted July 23, 2021 Which version of Windows 10 are you using? I’m not sure it was deprecated entirely in one go, but on 1903 and now 20H2 I don’t get anything from the command. Ooooooh no.... not quite at those versions.... I'm with the 'Dark Side'....
Koldov Posted July 23, 2021 Posted July 23, 2021 Interesting they seem to show a 'Last Status' date... Okay, so my option is ticked as Use the Update Services console?.. Well, that's where I have to leave you my friend... I'm not sure how that works really, I like the GPO (Item Level Targeting). Naughty misbehaving computers just get deleted from the WSUS console and they find their way back with a restart or GPUPDATE /FORCE (usually with a much better attitude)...
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 Okay so for the PC I am testing this on, my following criteria is: Failed Count: 0 Needed Count: 2 Installed Count: 14 Not Applicable Count: 14,206 Hmmm, I'm quite glad that it is not just me that is stumped on this. Thanks for all your help!
Koldov Posted July 23, 2021 Posted July 23, 2021 (edited) That's positive news though, as it means the server and client have actually talked to each other at some point... What are the 2 updates it needs? I presume you approved them to the correct OU (or 'All Computers')? If you can add the 'No Status' column as well, it will show you what hasn't been discussed between them... Edited July 23, 2021 by Koldov
MattMerry Posted July 23, 2021 Author Posted July 23, 2021 That's where my problem lies haha! It seems as though the server and client machines are talking, which as you say is the good news. I just can't get the clients to download said updates from the server haha! Back to the drawing board I think!
Koldov Posted July 23, 2021 Posted July 23, 2021 Needed - Last Status: 22/07/2021 Well, at least they were...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now