Servers (only appears to be DCs) not automaticly installing updates.

[jamesfed]

Hi all,

 

We've recently started to use WSUS to its full extent and are assigning updates to all our Windows Client PCs/Servers from it.

Updates go through a testing program (usually inside VMs) before deployment to the clients/servers to make sure we have no problems.

 

All the XP/7 Desktops/Notebooks are working great however our Windows 2008 DCs (at least this only appears to be affecting DCs) don't install updates on the programed schedule.

 

Looking in the event log of a server (non DC (also R2 not R1)) that is installing updates correctlyI see the message-

Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on ‎11 ‎November ‎2010 at 03:00: 
- Windows Malicious Software Removal Tool x64 - November 2010 (KB890830)

 

Looking in the event log of a DC that is not installing updates automatically I see the message-

Installation Ready: The following updates are downloaded and ready for installation. To install the updates, an administrator should log on to this computer and Windows will prompt with further instructions: 
- Windows Malicious Software Removal Tool x64 - November 2010 (KB890830)

 

Both servers are a member of the same OU with the same GPO applied to them to install all updates on every Friday at 3AM, the only thing that I can figure out that is different is those that aren’t installing are 2008 R1 with AD installed and those that are are running R2 and don’t have AD installed.

 

Any clues on what to do next would be greatly received

[jamesfed]

Do compleatly ignore my request above - noticed the one fatal flaw - I can't control when the servers reboot (the accual problem was that they wen't in the same OU (DCs being the DC OU)).

[oxide54]

technically dc's isn't an ou is it? its a container. subtle difference but you can't apply gpos/

[jamesfed]

technically dc's isn't an ou is it? its a container. subtle difference but you can't apply gpos/

 

Thats even more to the point - twas a silly idea anyway

[sted]

technically dc's isn't an ou is it? its a container. subtle difference but you can't apply gpos/

 

it is an ou as default domain controllers policy is applied to it as standard and i apply a server wsus one to it but only set to download and only install when i tell it

[oxide54]

is it an OU, i honestly can't remember. it must be computers that isn't then

[chrisbrown]

From memory, the following are containers, not OUs. I've probably missed some though

Builtin, Computers, System, Users, LostAndFound, Microsoft Exchange System Objects, Managed Service Accounts.. I think there's more to do with NTDS and such, but I can't recall them right now.

[oxide54]

i know mate, i was being thick at the time it was computers i was thinking of.

[chrisbrown]

i know mate, i was being thick at the time it was computers i was thinking of.

 

Wasn't meant to be snide, I was just putting it there for information's sake. Perhaps someone browsing may find the information useful.