ArchersIT

By default, autoupdates is not set to check on sartup, but is instead set to check every 20 hours (with up to 20% random difference to stop all machines checking at once). Ref: Best Practices with Windows Server Update Services Note - this is not the time when updates are applied - that is on a fixed time schedule - this is when each machine is checking. This time is meant to be random so that not all machine check at the same time and kill your WSUS server. FYI your home machines work the same schedules, but with contact the public windows update servers. You indicate that these machines are in deep freeze. For normal macines, the check time will gradually drift for each machine as the random time take effect. However, if your machines were frozen needing a check, then this may explain what you are seeing. I do not know which key will store this information, sorry. Please note that while you can change this check time with group policy, it can have unexpected consequences. A machine does not re-check for patches at the 3am apply time, so if it has not detected a patch is required, then no patch will be applied. HTH Jonathan

Any helpful messages in erorr logs? On the client or the server? Forcing it with ipconfig/registerdns should give you some entries if there is a failure. I would not have expected you to need to disable the firewalls. Jonathan

Yup - that looks local to me. Can you go to the Reverse DNS zone and double check what PTR records are there? What I mean by this is are they all missing? Is it just a subset of machines? Or is it all machines from DHCP? This may all help narrow it down. I would then check to see what DNS server is setup in the DHCP settings (from the console) and what is being received by the client (from ipconfig/all). Do these match? Is it correct? Is it the same as the DNS server you are running nslookup against? I have had a problem in the past where replication had been blocked and the DNS was being registered in one DNS and I was querying against a second. I have also had a problem where I typed in the wrong IP addres for the DNS server. Because it would still broadcast to the subnet it could name resolve most things, and the proxy server handled most of the rest so that one took a while to spot! Jonathan

Hmmm - can you do some screenshots or text file copies of what you are seeing when you run your NSLOOKUP and IPCONFIG commands? I know some people are worried about names and IP addresses, so please feel free to edit if you need to. I would investgate the following (with results from my test network) C:\Users\jonathan>nslookup Default Server: jon-dc01.jonathan.local Address: 192.168.101.1 Any timeouts or failed lookups here should be investigated Then type in the name of the machine (FQDN if the DNS suffixes are not in place) > jon-win8 Server: jon-dc01.jonathan.local Address: 192.168.101.1 Name: jon-win8.jonathan.local Address: 192.168.101.17 The first line shows you the dns server resolving it and the second the resolved name You should then be able to put in the IP address as follows: > 192.168.101.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 Name: jon-win8.jonathan.local Address: 192.168.101.17 If you do not have a reverse DNS zone setup, then you get the following (note the change to the IP address I am looking up) > 192.168.10.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 *** jon-dc01.jonathan.local can't find 192.168.10.17: Non-existent domain But you will also get this message if the DNS zone is setup but the IP address is not registered. To help with deciding this, I would turn debug mode on so you can see where the response is coming from: > set debug If there is no reverse DNS zone then it will look as follows > 192.168.10.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 ------------ Got answer: HEADER: opcode = QUERY, id = 7, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: 17.10.168.192.in-addr.arpa, type = PTR, class = IN AUTHORITY RECORDS: -> 168.192.in-addr.arpa ttl = 749 (12 mins 29 secs) primary name server = prisoner.iana.org responsible mail addr = hostmaster.root-servers.org serial = 1 refresh = 604800 (7 days) retry = 60 (1 min) expire = 604800 (7 days) default TTL = 604800 (7 days) ------------ *** jon-dc01.jonathan.local can't find 192.168.10.17: Non-existent domain As you can see, it has looked out onto the internet in an attempt to resolve it. If the DNS record is just not being registered, you will see the following: > 192.168.101.99 Server: jon-dc01.jonathan.local Address: 192.168.101.1 ------------ Got answer: HEADER: opcode = QUERY, id = 9, rcode = NXDOMAIN header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: 99.101.168.192.in-addr.arpa, type = PTR, class = IN AUTHORITY RECORDS: -> 101.168.192.in-addr.arpa ttl = 3600 (1 hour) primary name server = jon-dc01.jonathan.local responsible mail addr = hostmaster.jonathan.local serial = 26 refresh = 900 (15 mins) retry = 600 (10 mins) expire = 86400 (1 day) default TTL = 3600 (1 hour) ------------ *** jon-dc01.jonathan.local can't find 192.168.101.99: Non-existent domain Here, you can see it is still being resolved locally, but not finding anything. If the results are similar to the second one, then you need to look at the DNS settings on the client to see where it thinks it should be trying to register it. You can also force it by ipconfig/registerdns (on the client) Jonathan

One thing I notice that keeps getting missed is the need to setup a reverse dns zone for a new subnet. Are the clients on a different subnet to the servers? Is there a reverse zone setup for it? I will edit this post in a minute and add an image of my test dns setup so you can see what I mean. You need one of these reverse zones for each relevant subnet, and this is where the pointer records are stored. I only have one for this test environment, but a production environment will have more. As the ptr records for the servers exist and the clients don't then if the subnets are different, this could be causing the problem HTH Jonathan

As I said - I remember reading something about this causing problems - but I still cannot find where I read it - sorry. Glad you have been able to move forward Jonathan

Looks like that might be a red herring as I cannot find any references to it causing any problems. However, it does mention that it needs SQL 2005 SP1 - have you patched SQL 2005? Jonathan

I wonder if your problem is to do with the SQL server being 32bit on the 64bit OS. I know that some application do not like this setup and I wonder if WSUS is refusing to see it because the keys are in the "wrong" part of the registry. Just a thought - will go off and google a bit now. Jonathan

First thoughts - are you pinging the Fully Qualified name? If not try that. If that works then you should look at the DNS suffix on the network card. Jonathan

Do any of your group policies specify that certain people should be members of the power users group? This will override any local settings and reset them back to the group policy specified ones. Jonathan

I know you seem to have fixed it, but when we had this problem, it was only in one template. This was the school headed notepaper that one of the office staff had created. When I investigated further, all the images (and there were about 7 or 8 of them) were full size and then displayed at 10% (or similar) Once these were shrunk down before inserting the lag disappeared, so I always assumed that the lag was due to word redrawing these images. HTH Jonathan

Actually, you are not. To quote from ERA Licences and Catch up Television and similar video on-demand services Jonathan

I'm in if they are still on offer Jonathan

It sounds like we have a similar setup and we have been having odd problems since around half term (15th Feb). For us this is mainly affecting the older access points and we had several short power cuts durign half term so we have been wondering if the APs had been fried. You mentioning updates made me realise that we did the February patches around that time... perhaps one of them could be the culprit. I dont have a solution yet, but maybe we are having the same problem.... Jonathan

Have to say - the new root certificate is working fine for us. I have checked that it is auto updating on XP as follows (running on a student low privalege login): 1. Checked that the only relevant trusted root certificate is the old one 2. Access the secure site. The server has the new certificate and the new intermediate CA and the new root CA in the relevant places. 3. Client machine seems to realise that it may need to update the certificates and initiates a connection to microsoft. These are logged in the event log by crypt32. The messages are as follows: Successful auto update retrieval of third-party root list sequence number from: Successful auto update retrieval of third-party root list cab from: and then 14 seconds later: Successful auto update retrieval of third-party root certificate from: Successful auto update of third-party root certificate:: Subject: Sha1 thumbprint: <3C71D70E35A5DAA8B2E3812DC3677417F5990DF3> 4. Page displayes fine with no warnings 5. New root certificate is now in the store with the old one. Now, The site makes some reference to this process only working if you use IE and not Firefox, and indeed I suspect that if it cannot get a connection to the microsoft site at that moment it will fail but it has worked fine for us on all machines so far. Do your machines attempt to make this link out to Microsoft? You should be able to see either a success or failure in the event log. Hope this helps Jonathan