WSUS 3.0

[frognet1970]

Hi

 

I have just installed WSUS 3.0 on our Windows 2003 box, and the install has gone well, the server is available functioning and syncing quite happily with Microsoft Update.

 

I have followed the deployment instructions by linking a new GPO object to the domain and have checked that the clients are receiving the correct GPO when logging on. If I check the local registry it tells me that the clients are pointed to our WSUS server to receive updates.

 

However I cannot see any client computers in the WSUS computer group on the server, so it reports its got nothing to push the updates to.

 

Thanks in advance

 

 

 

 

Kevin

[Messa]

If you have literally only just set this up, they will take some time to synchronize, there may also be an 'add in from active directory?'

[kmount]

Hi Kevin,

 

It takes a little while for them to turn up fella, often a day or so.

 

I found that sitting there running "wuauclt /detectnow" on the client workstation a couple of times with reboots sped the process up. (Or it felt like it did!)

[powdarrmonkey]

Give it a couple of days, then see. WSUS is notorius for just needing to take its time over things, they'll show up soon

[powdarrmonkey]

there may also be an 'add in from active directory?'

 

No, they just appear once they start to sync.

[plexer]

You could force a sync from the client.

 

How to really force WSUS client to sync with WSUS server - Weblog

 

Ben

[Messa]

No, they just appear once they start to sync.

 

Fair enough, been ages since I set ours up ;P

[spall]

If you have literally only just set this up, they will take some time to synchronize, there may also be an 'add in from active directory?'

 

addin from active directory? tell me more!

[powdarrmonkey]

addin from active directory? tell me more!

 

See above, it doesn't exist.

[Messa]

addin from active directory? tell me more!

 

My Bad!!, Stop bullying me

[FN-GM]

Have all your clients been syspreped?

[Crispin]

Have all your clients been syspreped?

 

This is a good point to make. A few of our images must have had GPO's applied to them, so when deploying, they all had the same wsus ID.

If you have used computer groups for the different rooms, and are finding that only 1 PC is showing up or none at all, try deleting the windows update registry entry.

From memory I think it's: localmachine/software/microsoft/windows/windowsupdate

 

Then you can use: "wuauclt.exe /detectnow /resetauthorization" in the run box.

 

This will give all your machines new IDs. Worked a treat for me.

[RabbieBurns]

When I set up wsus, the clients had a bad dns setup, and were unable to resolve the WSUS server by name. As soon as I sorted that, they all started appearing.

 

Make sure you can resolve the WSUS server, ping it by name etc.

[FN-GM]

This is a good point to make. A few of our images must have had GPO's applied to them, so when deploying, they all had the same wsus ID.

If you have used computer groups for the different rooms, and are finding that only 1 PC is showing up or none at all, try deleting the windows update registry entry.

From memory I think it's: localmachine/software/microsoft/windows/windowsupdate

 

Then you can use: "wuauclt.exe /detectnow /resetauthorization" in the run box.

 

This will give all your machines new IDs. Worked a treat for me.

 

To sort that problem out put this into a batch file and run it on the machines

 

reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate /v AccountDomainSid /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate /v PingID /f
reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Win dowsUpdate /v SusClientId /f
cls
@echo Triggering detection after resetting WSUS client identity
net stop wuauserv
net start wuauserv
wuauclt /resetauthorization /detectnow

[Michael]

However I cannot see any client computers in the WSUS computer group on the server, so it reports its got nothing to push the updates to.

 

As already mentioned, it can take considerable time to download WSUS updates depending on what product(s) you specified, but also what types of updates you specified too.

 

So long as you've configured your GPOs correctly, clients should start appearing in the next day or so. If you see clients appearing then disappearing, this is a typical symptom of machines using the same WSUS SID. The Windows and WSUS SIDs are two separate entries for your reference.

 

As for 'add in from active directory?' this isn't as daft as it sounds. You did have to upload a WSUS ADM template on Windows 2000 Server all those years ago. Thankfully Windows Server 2003/2008 is much more up-to-date.

[srochford]

However I cannot see any client computers in the WSUS computer group on the server, so it reports its got nothing to push the updates to.

 

Good to see you've got it working. Just one small point - WSUS doesn't push anything - it's a completely "pull" technology. The server pulls updates from the MS web site and stores them. Clients then "pull" a list of updates from the WSUS server, check for what they need, pull those updates and then notify the server of what they've done.

 

the point about sysprepping is a bit of a red herring; you do need to sysprep machines before imaging but that doesn't fix the WSUS ID (although there's nothing to stop you adding the commands that @fn-gm has posted to cmdlines.txt in sysprep so that it gets cleaned up)