WSUS Question

[Newton]

Is it a good wroth putting

 

wuauctl /detectnow

 

as a startup script for all the computers in my domain, I have a large number that never seam to want to connect to the WSUS server dispite clientdiag reporting all ok?

[FatBoy]

There are probably better people in this forum to answer this question but here's my 2 pence worth

 

I wouldn't leave wuauctl /detectnow in the login script for any amount of time as I don't know what the inplications would be (Alrhough I can't see why it would do anything but slow the machines down very slighly at startup) but it mite be worth putting it in for a day or 2, then after every machine has rebooted and started up take it out. Once a PC has reported to the WSUS server for the first time it should be ok and update... well I have found this to be the case on my domain anyway!

 

Anyone else got any thoughts on this?

[Newton]

Cheers

that pritty much matchs my thoughs.

[greatone]

I don't believe that it should be necessary to hve that in a logon script

 

The only problem I have had with machines not showing up in WSUS was when using a Ghost image, especially if it was an image from a machine that had already registered from WSUS.

 

To overcome this we now run a small VB script after re-imaging that resets the WSUS SID on the machine and froces it to contact the WSUS server

[FatBoy]

Or you can just sysprep your machine before taking the image and that should stop the imaging problem

[greatone]

You may be right!

 

I haven't actually checked to see if sysprep resets the WSUS SID on the computer as well as the machine SID

[FatBoy]

tbh I though resetting the SID would be enough as it's the machine unique identifier, I could be wrong!

[greatone]

Apparently not.

 

There is a SUSClientID registry entry:

 

HKLM\software\microsoft\windows\currentversion\windowsupdate

 

This is not reset by SysPrep and is used by the WSUS server as part of the process of identifying the machine.

 

This will only be a problem if the machine that you are taking the image from has contacted the WSUS server befor you take the image.

[FatBoy]

Ohhhh thanks nice one that will in the future save me lots of time and issues I have only had WSUS on for 2 months and not create an image since then!! I bet you when the summer machines come in I would have WSUS them and then taken a image Thanks given for saving me a future headache!

[timzim]

This page gives you more info:

 

A Windows 2000-based or Windows XP-based computer that was set up by using a Windows 2000 or Windows XP image does not appear in the Windows Server Update Services (WSUS) console

[greatone]

Thanks - I had been looking for that but couldn't find it!

 

Here is the script to reset those keys for those that are interested:

 

Set oShell = CreateObject("WScript.Shell")

 

sRegKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"

 

' suppress error in case values does not exist

On Error Resume Next

 

' check for marker

sIDDeleted = oShell.RegRead( sRegKey & "\IDDeleted")

 

' to be sure values is only deleted once, test on marker

If sIDDeleted <> "yes" Then

' delete values

oShell.RegDelete sRegKey & "\AccountDomainSid"

oShell.RegDelete sRegKey & "\PingID"

oShell.RegDelete sRegKey & "\SusClientId"

 

' Stop and start the Automatic updates service

oShell.Run "%SystemRoot%\system32\net.exe stop wuauserv", 0, True

oShell.Run "%SystemRoot%\system32\net.exe start wuauserv", 0, True

 

' Run wuauclt.exe with resetauthorization

sCmd = "%SystemRoot%\system32\wuauclt.exe /resetauthorization /detectnow"

oShell.Run sCmd, 0, True

 

' create marker

oShell.RegWrite sRegKey & "\IDDeleted", "yes"

End If

 

Copy the script into notepad

 

Save as text file then rename to .vbs

 

Double click the file and it will reset the WSUS SID etc.

NB It can only be run once on each machine as it sets a marker to say that it has been run.

[FatBoy]

Thanks that could come in handy in the future....well hopefully not but I think I will save it just in case

[Newton]

Brill - I think you have gotten to the bottom of the problems with my missing PCs.

 

Cheers

[Michael]

I've used WSUS for years and have never needed to put wuauclt.exe /detectnow in any script and I wouldn't recommend it either. If your WSUS server and GPOs are configured correctly, your workstations should automatically detect new updates on the schedule you specify.

 

I can confirm sysprep doesn't reset the WSUS SID only the Windows SID. I use this script to manually reset the WSUS SID (if required):

 

@echo off
TITLE Logistix WSUS Reset Authorisation
Echo Save the batch file "AU_Clean_SID.cmd". This batch file will do the following:
Echo 1.    Stops the wuauserv service
Echo 2.    Deletes the AccountDomainSid registry key (if it exists)
Echo 3.    Deletes the PingID registry key (if it exists)
Echo 4.    Deletes the SusClientId registry key (if it exists)
Echo 5.    Restarts the wuauserv service
Echo 6.    Resets the Authorization Cookie
Echo 6.    More information on http://msmvps.com/Athif
Pause
@echo on
net stop wuauserv
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f
net start wuauserv
wuauclt /resetauthorization /detectnow
Pause

[FN-GM]

Thanks - I had been looking for that but couldn't find it!

 

Here is the script to reset those keys for those that are interested:

 

Set oShell = CreateObject("WScript.Shell")

 

sRegKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"

 

' suppress error in case values does not exist

On Error Resume Next

 

' check for marker

sIDDeleted = oShell.RegRead( sRegKey & "\IDDeleted")

 

' to be sure values is only deleted once, test on marker

If sIDDeleted <> "yes" Then

' delete values

oShell.RegDelete sRegKey & "\AccountDomainSid"

oShell.RegDelete sRegKey & "\PingID"

oShell.RegDelete sRegKey & "\SusClientId"

 

' Stop and start the Automatic updates service

oShell.Run "%SystemRoot%\system32\net.exe stop wuauserv", 0, True

oShell.Run "%SystemRoot%\system32\net.exe start wuauserv", 0, True

 

' Run wuauclt.exe with resetauthorization

sCmd = "%SystemRoot%\system32\wuauclt.exe /resetauthorization /detectnow"

oShell.Run sCmd, 0, True

 

' create marker

oShell.RegWrite sRegKey & "\IDDeleted", "yes"

End If

 

Copy the script into notepad

 

Save as text file then rename to .vbs

 

Double click the file and it will reset the WSUS SID etc.

NB It can only be run once on each machine as it sets a marker to say that it has been run.

 

Thaks but it doesn't seem to work

[greatone]

Doesn't work in what way?

 

It doesn't generate any visual output but it does reset the WSUSSID on the machine and force the machine to contact the WSUS server

[Osprey]

This page gives you more info:

 

A Windows 2000-based or Windows XP-based computer that was set up by using a Windows 2000 or Windows XP image does not appear in the Windows Server Update Services (WSUS) console

 

The article says "This symptom only occurs if the image was not created by Sysprep or other unique SID-generating technology"

 

We have regularly made images which we have used to re-image workstations using either sysprep or Ghostwalker and the machines appear in WSUS without problem. We did once, accidentally not do this and at that point only one workstation appeared in the WSUS console. We used newsid on them and they started to appear in the console.

[greatone]

That article was written before Microsoft started playing with the WSUS client but it does describe the problem.

 

Sysprep will not reset the WSUS client ID.

 

Just Google 'sysprep wsus3'

 

We are now working on using wsus to update our images and then deleting the WSUS registry keys before using sysprep.

 

Hopefully it will ease our summer re-imaging marathon!

[pete]

Doesn't work in what way?

 

It doesn't generate any visual output but it does reset the WSUSSID on the machine and force the machine to contact the WSUS server

 

I suspect it's the typo in the reg key, you have a space between i and n:

 

sRegKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"

 

Edit: (or rather, the board displays a space, despite there not being one in the line I typed above)

[FN-GM]

Doesn't work in what way?

 

It doesn't generate any visual output but it does reset the WSUSSID on the machine and force the machine to contact the WSUS server

 

I have but an echo in so I know the script has finished but the clients I run it on have still not reported back to wsus.

[FN-GM]

Thanks - I had been looking for that but couldn't find it!

 

Here is the script to reset those keys for those that are interested:

 

Set oShell = CreateObject("WScript.Shell")

 

sRegKey = "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"

 

' suppress error in case values does not exist

On Error Resume Next

 

' check for marker

sIDDeleted = oShell.RegRead( sRegKey & "\IDDeleted")

 

' to be sure values is only deleted once, test on marker

If sIDDeleted <> "yes" Then

' delete values

oShell.RegDelete sRegKey & "\AccountDomainSid"

oShell.RegDelete sRegKey & "\PingID"

oShell.RegDelete sRegKey & "\SusClientId"

 

' Stop and start the Automatic updates service

oShell.Run "%SystemRoot%\system32\net.exe stop wuauserv", 0, True

oShell.Run "%SystemRoot%\system32\net.exe start wuauserv", 0, True

 

' Run wuauclt.exe with resetauthorization

sCmd = "%SystemRoot%\system32\wuauclt.exe /resetauthorization /detectnow"

oShell.Run sCmd, 0, True

 

' create marker

oShell.RegWrite sRegKey & "\IDDeleted", "yes"

End If

 

Copy the script into notepad

 

Save as text file then rename to .vbs

 

Double click the file and it will reset the WSUS SID etc.

NB It can only be run once on each machine as it sets a marker to say that it has been run.

 

Sorry to pester & drag up the old post, the script did work just a typo. If needed how would i remove that marker please?

 

Thanks

 

Z

[FN-GM]

Hi there

 

i have found the marker but what is the purpose of it please?

 

thanks

[Teth]

The author seems to have written the script with the intention that it might be put in a user logon or workstation logon script. The marker is to prevent the SID being regenerated every time the mahcine restarts.

 

ie. If the mahcine already has the marker SID wont be regenerated the script will just finish without making changes.