ArchersIT

By default, autoupdates is not set to check on sartup, but is instead set to check every 20 hours (with up to 20% random difference to stop all machines checking at once). Ref: Best Practices with Windows Server Update Services Note - this is not the time when updates are applied - that is on a fixed time schedule - this is when each machine is checking. This time is meant to be random so that not all machine check at the same time and kill your WSUS server. FYI your home machines work the same schedules, but with contact the public windows update servers. You indicate that these machines are in deep freeze. For normal macines, the check time will gradually drift for each machine as the random time take effect. However, if your machines were frozen needing a check, then this may explain what you are seeing. I do not know which key will store this information, sorry. Please note that while you can change this check time with group policy, it can have unexpected consequences. A machine does not re-check for patches at the 3am apply time, so if it has not detected a patch is required, then no patch will be applied. HTH Jonathan

Any helpful messages in erorr logs? On the client or the server? Forcing it with ipconfig/registerdns should give you some entries if there is a failure. I would not have expected you to need to disable the firewalls. Jonathan

Yup - that looks local to me. Can you go to the Reverse DNS zone and double check what PTR records are there? What I mean by this is are they all missing? Is it just a subset of machines? Or is it all machines from DHCP? This may all help narrow it down. I would then check to see what DNS server is setup in the DHCP settings (from the console) and what is being received by the client (from ipconfig/all). Do these match? Is it correct? Is it the same as the DNS server you are running nslookup against? I have had a problem in the past where replication had been blocked and the DNS was being registered in one DNS and I was querying against a second. I have also had a problem where I typed in the wrong IP addres for the DNS server. Because it would still broadcast to the subnet it could name resolve most things, and the proxy server handled most of the rest so that one took a while to spot! Jonathan

Hmmm - can you do some screenshots or text file copies of what you are seeing when you run your NSLOOKUP and IPCONFIG commands? I know some people are worried about names and IP addresses, so please feel free to edit if you need to. I would investgate the following (with results from my test network) C:\Users\jonathan>nslookup Default Server: jon-dc01.jonathan.local Address: 192.168.101.1 Any timeouts or failed lookups here should be investigated Then type in the name of the machine (FQDN if the DNS suffixes are not in place) > jon-win8 Server: jon-dc01.jonathan.local Address: 192.168.101.1 Name: jon-win8.jonathan.local Address: 192.168.101.17 The first line shows you the dns server resolving it and the second the resolved name You should then be able to put in the IP address as follows: > 192.168.101.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 Name: jon-win8.jonathan.local Address: 192.168.101.17 If you do not have a reverse DNS zone setup, then you get the following (note the change to the IP address I am looking up) > 192.168.10.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 *** jon-dc01.jonathan.local can't find 192.168.10.17: Non-existent domain But you will also get this message if the DNS zone is setup but the IP address is not registered. To help with deciding this, I would turn debug mode on so you can see where the response is coming from: > set debug If there is no reverse DNS zone then it will look as follows > 192.168.10.17 Server: jon-dc01.jonathan.local Address: 192.168.101.1 ------------ Got answer: HEADER: opcode = QUERY, id = 7, rcode = NXDOMAIN header flags: response, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: 17.10.168.192.in-addr.arpa, type = PTR, class = IN AUTHORITY RECORDS: -> 168.192.in-addr.arpa ttl = 749 (12 mins 29 secs) primary name server = prisoner.iana.org responsible mail addr = hostmaster.root-servers.org serial = 1 refresh = 604800 (7 days) retry = 60 (1 min) expire = 604800 (7 days) default TTL = 604800 (7 days) ------------ *** jon-dc01.jonathan.local can't find 192.168.10.17: Non-existent domain As you can see, it has looked out onto the internet in an attempt to resolve it. If the DNS record is just not being registered, you will see the following: > 192.168.101.99 Server: jon-dc01.jonathan.local Address: 192.168.101.1 ------------ Got answer: HEADER: opcode = QUERY, id = 9, rcode = NXDOMAIN header flags: response, auth. answer, want recursion, recursion avail. questions = 1, answers = 0, authority records = 1, additional = 0 QUESTIONS: 99.101.168.192.in-addr.arpa, type = PTR, class = IN AUTHORITY RECORDS: -> 101.168.192.in-addr.arpa ttl = 3600 (1 hour) primary name server = jon-dc01.jonathan.local responsible mail addr = hostmaster.jonathan.local serial = 26 refresh = 900 (15 mins) retry = 600 (10 mins) expire = 86400 (1 day) default TTL = 3600 (1 hour) ------------ *** jon-dc01.jonathan.local can't find 192.168.101.99: Non-existent domain Here, you can see it is still being resolved locally, but not finding anything. If the results are similar to the second one, then you need to look at the DNS settings on the client to see where it thinks it should be trying to register it. You can also force it by ipconfig/registerdns (on the client) Jonathan

One thing I notice that keeps getting missed is the need to setup a reverse dns zone for a new subnet. Are the clients on a different subnet to the servers? Is there a reverse zone setup for it? I will edit this post in a minute and add an image of my test dns setup so you can see what I mean. You need one of these reverse zones for each relevant subnet, and this is where the pointer records are stored. I only have one for this test environment, but a production environment will have more. As the ptr records for the servers exist and the clients don't then if the subnets are different, this could be causing the problem HTH Jonathan

As I said - I remember reading something about this causing problems - but I still cannot find where I read it - sorry. Glad you have been able to move forward Jonathan

Looks like that might be a red herring as I cannot find any references to it causing any problems. However, it does mention that it needs SQL 2005 SP1 - have you patched SQL 2005? Jonathan

I wonder if your problem is to do with the SQL server being 32bit on the 64bit OS. I know that some application do not like this setup and I wonder if WSUS is refusing to see it because the keys are in the "wrong" part of the registry. Just a thought - will go off and google a bit now. Jonathan

First thoughts - are you pinging the Fully Qualified name? If not try that. If that works then you should look at the DNS suffix on the network card. Jonathan

Do any of your group policies specify that certain people should be members of the power users group? This will override any local settings and reset them back to the group policy specified ones. Jonathan

I know you seem to have fixed it, but when we had this problem, it was only in one template. This was the school headed notepaper that one of the office staff had created. When I investigated further, all the images (and there were about 7 or 8 of them) were full size and then displayed at 10% (or similar) Once these were shrunk down before inserting the lag disappeared, so I always assumed that the lag was due to word redrawing these images. HTH Jonathan

Actually, you are not. To quote from ERA Licences and Catch up Television and similar video on-demand services Jonathan

I'm in if they are still on offer Jonathan

It sounds like we have a similar setup and we have been having odd problems since around half term (15th Feb). For us this is mainly affecting the older access points and we had several short power cuts durign half term so we have been wondering if the APs had been fried. You mentioning updates made me realise that we did the February patches around that time... perhaps one of them could be the culprit. I dont have a solution yet, but maybe we are having the same problem.... Jonathan

Have to say - the new root certificate is working fine for us. I have checked that it is auto updating on XP as follows (running on a student low privalege login): 1. Checked that the only relevant trusted root certificate is the old one 2. Access the secure site. The server has the new certificate and the new intermediate CA and the new root CA in the relevant places. 3. Client machine seems to realise that it may need to update the certificates and initiates a connection to microsoft. These are logged in the event log by crypt32. The messages are as follows: Successful auto update retrieval of third-party root list sequence number from: Successful auto update retrieval of third-party root list cab from: and then 14 seconds later: Successful auto update retrieval of third-party root certificate from: Successful auto update of third-party root certificate:: Subject: Sha1 thumbprint: <3C71D70E35A5DAA8B2E3812DC3677417F5990DF3> 4. Page displayes fine with no warnings 5. New root certificate is now in the store with the old one. Now, The site makes some reference to this process only working if you use IE and not Firefox, and indeed I suspect that if it cannot get a connection to the microsoft site at that moment it will fail but it has worked fine for us on all machines so far. Do your machines attempt to make this link out to Microsoft? You should be able to see either a success or failure in the event log. Hope this helps Jonathan

Old Certificate failed correctly on the 28th December. You can get this working again by trusting the out of date signing certificate if you need to. New one installed fine, but does not seem to auto update on servers. Has auto updated on home machines and school machines (XP SP3, IE8). Jonathan

We dont do this, but we do something similar from time to time. For that we simply use Microsoft's Log Parser tool Download details: Log Parser 2.2. This allows you to run SQL like queries against the event logs which may speed up your processing. Hope that helps Jonathan

There are no words for just how bad that is. Although... Pieces of Eight, Pieces of Eight, Pieces of Seven Parroty Error! Jonathan

Yes, this is the kind of thing that it normally is. We always restrict our reports to "this person accessed this site at this time" kind of reports. If they want us to manually estimate the duration, we will do, but this is done manually and with several caveats. If the person has been asked to only access those sites at certain times (e.g. only at lunch or after school) then the duration is fairly irrelevant anyway. If the person has been told that they can only do it for a certain length of time then it is much more difficult. Jonathan

I do not beleive that it is possible to be certain as to duration from ISA logs (and indeed, most other proxy servers I am aware of). I would strongly suspect that no proxy server could work out how much time the browser was open on a site and minimised for it. The issue comes when there is a page request at 12:10 and a second request at 12:15. Did they take 5 minutes to read the page or did they minimise it imbetween? Even if there is a request every minute, is this an auto refresh script on the page rather than an action? When we have had similar issues with people needing to be investigated and it is a very difficult area to be certain about so I would be very cautious about making the kind of absoloute claims you seem to be wanting to do. Jonathan

If it has been slowing down recently I would strongly recommend looking at the widgets. The KB article that has sorted it for us is KB89941. This adds an index to the temporary tables which has restored performance back to what it should be HTH Jonathan

Ok - thanks for the replies - I have now got CHAP authentication working. I have a horrible suspicion that I must have put the wrong password in one end or other as the proecures detailed here seem to be the same as what I was doing before. However, it has good to have the method confirmed as being correct so it was clear I was just mis-typing something. Many thanks for your assistance. Cheers Jonathan

Thanks for this - unfortunately this is what I think I have done and I still get the same error. Jonathan

Hi there, I am playing with my 7110 and am looking to add Chap Authentication to our iSCSI LUNs. However, I am obviously doing something silly as I am getting an authentication failure. Could someone who has it working pop in with some advice? I am using Microsoft's iSCSI initiator and have done the following 1. Set a Mutual Chap Secret in the Windows Machine (Secret number 1) 2. Set a target CHAP name and target Chap Secret on the 7110 (Secret number 2) (BTW - does the name have to be anything specific here?) 3. Setup an initiator on the 7110 for the windows machine. Entered the IQN for the chap name (Does this have to be anything specific?) Entered Secret Number 1 for the Chap Secret. 4. Used the Advanced tab to connect to the LUN. Checked the boxes for Chap Login information and Mutual authentication. Put Secret Number 2 in as the target secret. I am hoping that I just have the wrong name or secret in somewhere but would be glad of any advice/help. Cheers Jonathan

It all works here for our 7110 going through our ISA 2004 server and onwards to our E2BN proxy. Phone home - support bundles the lot. No authentication setup - just a rule to let it talk out. Jonathan