kennysarmy

Update. We're still getting issues affecting random PC's around the school. Our advice is always to try a reboot which invariably fixes the issue. I'm no closer to understanding what causes the issue on these random PC's. It's an annoyance and affects the users because they are not signed in to Office 365 automatically as the PC believes there is no internet connection! We run this reg. tweak to all new builds: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet] "ActiveDnsProbeContent"="131.107.255.255" "ActiveDnsProbeContentV6"="fd3e:4f5a:5b81::1" "ActiveDnsProbeHost"="dns.msftncsi.com" "ActiveDnsProbeHostV6"="dns.msftncsi.com" "ActiveWebProbeContent"="Microsoft Connect Test" "ActiveWebProbeContentV6"="Microsoft Connect Test" "ActiveWebProbeHost"="www.msftconnecttest.com" "ActiveWebProbeHostV6"="ipv6.msftconnecttest.com" "ActiveWebProbePath"="connecttest.txt" "ActiveWebProbePathV6"="connecttest.txt" "EnableActiveProbing"=dword:00000001 "PassivePollPeriod"=dword:0000000f "StaleThreshold"=dword:0000001e "WebTimeout"=dword:00000023 "MinimumInternetHopCount"=dword:00000001 And we also set the following to Enabled via Group Policy: Do not show the "local access only" network icon Turn off Windows Network Connectivity Status Indicator active tests If anyone has any further insights I'd be grateful. We were rolling out Windows 10 1903 EDU and have just started rolling out Windows 10 1909 EDU - not sure if MS added any fixes in to 1909 to address the problem but I'll continue with the REG tweak and policy changes.

So only testing for those who have been identified as a close contact of someone who has tested positive.

1909 Works fine.

I'm going to download the ISO for 1909 instead and go through the process with that base image to see if it's something specific to 20H2

So deployment fails again with the error as above and still... All appears to be working: Running action : Install Operating System - 100% Then: Applying unattend.xml with DISM.EXE Then fails. This is with a new task sequence with no changes to the unattend.xml - just the basic one that's created when you create the task sequence. This is the answer file if anyone can spot the obvious error! OnError 0 1 .\Operating Systems\Windows10Edu20H2\Sources\install.wim /IMAGE/INDEX 1 OnError true en-US 0409:00000409 en-US en-US en-US true Balcarras School Balcarras School true Pacific Standard Time about:blank EnableAdmin 1 cmd /c net user Administrator /active:yes UnfilterAdministratorToken 2 cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v FilterAdministratorToken /t REG_DWORD /d 0 /f disable user account page 3 reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Setup\OOBE /v UnattendCreatedUser /t REG_DWORD /d 1 /f disable async RunOnce 4 reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer /v AsyncRunOnce /t REG_DWORD /d 0 /f 0409:00000409 en-US en-US en-US 0 "" 1 9 9 1 "" "" "" Default 1 l4244728 true true Administrator . l4244728 true 999 wscript.exe %SystemDrive%\LTIBootstrap.vbs Lite Touch new OS 1 true Work 1 true true true Balcarras School Balcarras School 0409:00000409 en-US en-US en-US \Drivers

Good shout. Currently though I can't even get it to work with a standard task sequence and unedited answer file. More testing today.

Hi, No - just from 1903 EDU to 20H2 - all 64 bit.

Possibly but I double checked my answer file and of course it's pointing at the previous image - doh. Will update answer file file and try again - looks like PC imaged - but it's going through the parts of the setup that my answer file would normally manage. I'm getting there - and it is Friday!

Spoke to soon

Sorted it Updated the deployment share. Then opened Windows System Image Manager. Updated the Windows Image that it was pointing to - opened the old answer file - asked me if it needed to update then resaved to the new MDT location. Imaging a PC now and seems to be working OK.

I'm guessing I need to create a new Answer file from scratch or can I copy that too?

I've got a task sequence which installs our Windows 10 image. I want to tinker with this to create a new task sequence that has a newer version of windows as the base WIM. I'd rather not edit the original so thought it would be relatively easy to take a copy - but can't see how to do it through the GUI :/ Any ideas?

Definitely the Sept. updates played a part - so was good to force us I guess to use SSL for WSUS - not sure the proxy was at play. If I check the system proxy on some servers it's "Direct" and others it's the IE imported ones - both variants now seem to be updating. But I also have still got a couple of servers giving errors when they check for updates. 80072EF3 errors and 0x80244022 If I just get those sorted I'm happy! I've copied the SSL certificate to the servers and checked the new group policy has taken to point the updates to the FQDN of the WSUS server. Also tried these commands: net stop bits net stop wuauserv reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v AccountDomainSid /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v PingID /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientId /f reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v SusClientIDValidation /f rd /s /q "C:\WINDOWS\SoftwareDistribution" net start bits net start wuauserv wuauclt /resetauthorization /detectnow PowerShell.exe (New-Object -ComObject Microsoft.Update.AutoUpdate).DetectNow()

PC's are starting to appear in WSUS !!!!!!!!!!!!!!!!!!

My original GPO to set the "Specify intranet Microsoft update service location" was using the IP address of the WSUS server. Now I'm using SSL I had to change it to the FQDN.

If I tick the Require option then the WSUS Server Node won't open at all

Unsure what should be ticked in the red area?

SSL seems to be working - but errors still remain in the Clients WindowsUpdateLog 2020/12/10 08:55:05.6559266 8232 11312 Agent *FAILED* [8024043D] GetIsInventoryRequired 2020/12/10 08:55:06.3298123 8232 11312 Misc Got WSUS Client/Server URL: https://10.107.93.9:8531/ClientWebService/client.asmx"" 2020/12/10 08:55:06.3367767 8232 11312 Driver Skipping printer driver 8 due to incomplete info or mismatched environment - HWID[(null)] Provider[Adobe] MfgName[Adobe] Name[Adobe PDF Converter] pEnvironment[Windows x64] LocalPrintServerEnv[Windows x64] 2020/12/10 08:55:06.3367811 8232 11312 Driver Skipping printer driver 9 due to incomplete info or mismatched environment - HWID[microsoftmicrosoft_musd] Provider[Microsoft] MfgName[Microsoft] Name[Microsoft enhanced Point and Print compatibility driver] pEnvironment[Windows NT x86] LocalPrintServerEnv[Windows x64] 2020/12/10 08:55:06.5878658 8232 11312 ProtocolTalker ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = [url]https://10.107.93.9:8531/ClientWebService/client.asmx[/url] 2020/12/10 08:55:06.5886273 8232 11312 ProtocolTalker PT: Calling GetConfig on server 2020/12/10 08:55:06.5886406 8232 11312 IdleTimer WU operation (CAgentProtocolTalker::GetConfig_WithRecovery) started; operation # 7; does use network; is at background priority 2020/12/10 08:55:06.5886791 8232 11312 WebServices Auto proxy settings for this web service call. 2020/12/10 08:55:06.6969981 8232 11312 WebServices WS error: Error string with resource id '0xB7' is not found for the language id '0x809'. 2020/12/10 08:55:06.6969993 8232 11312 WebServices WS error: Error string with resource id '0x800B010F' is not found for the language id '0x809'. 2020/12/10 08:55:06.6973378 8232 11312 WebServices *FAILED* [800B010F] Web service call 2020/12/10 08:55:06.6973391 8232 11312 WebServices Current service auth scheme=0. 2020/12/10 08:55:06.6973399 8232 11312 WebServices Current Proxy auth scheme=0. 2020/12/10 08:55:06.6973456 8232 11312 IdleTimer WU operation (CAgentProtocolTalker::GetConfig_WithRecovery, operation # 7) stopped; does use network; is at background priority 2020/12/10 08:55:06.6973540 8232 11312 ProtocolTalker *FAILED* [800B010F] GetConfig_WithRecovery failed 2020/12/10 08:55:06.6973580 8232 11312 ProtocolTalker *FAILED* [800B010F] RefreshConfig failed 2020/12/10 08:55:06.6973594 8232 11312 ProtocolTalker *FAILED* [800B010F] RefreshPTState failed 2020/12/10 08:55:06.6973780 8232 11312 ProtocolTalker SyncUpdates round trips: 0 2020/12/10 08:55:06.6973789 8232 11312 ProtocolTalker *FAILED* [800B010F] Sync of Updates 2020/12/10 08:55:06.6973859 8232 11312 ProtocolTalker *FAILED* [800B010F] SyncServerUpdatesInternal failed 2020/12/10 08:55:06.7045731 8232 11312 Agent *FAILED* [800B010F] Synchronize 2020/12/10 08:55:06.7249656 8232 11312 Agent * END * Finding updates CallerId = <>: PowerShell_ISE.exe, Id = 2, Exit code = 0x800B010F (cV = 0W8Tanbdsk+WBpUX.1.0.0.2) 2020/12/10 08:55:06.7275641 8232 11312 IdleTimer WU operation (CSearchCall::Init ID 2, operation # 6) stopped; does use network; is not at background priority 2020/12/10 08:55:06.7311060 8804 6776 ComApi *RESUMED* Search ClientId = <>: PowerShell_ISE.exe, ServiceId = 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7 (cV = 0W8Tanbdsk+WBpUX.1.0.0) 2020/12/10 08:55:06.7347599 8804 6776 ComApi Exit code = 0x00000000, Result code = 0x800B010F (cV = 0W8Tanbdsk+WBpUX.1.0.0) 2020/12/10 08:55:06.7347634 8804 6776 ComApi * END * Search ClientId = <>: PowerShell_ISE.exe, Updates found = 0, ServiceId = 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7 (cV = 0W8Tanbdsk+WBpUX.1.0.0) 2020/12/10 08:55:06.7350129 8804 12744 ComApi * END * All federated searches have completed. Jobs = 1, Succeeded = 0, ClientId = <>: PowerShell_ISE.exe (cV = 0W8Tanbdsk+WBpUX.1.1) 2020/12/10 08:55:54.3681666 8232 2040 Shared UninitializeSUS 2020/12/10 08:55:54.3681718 8232 2040 Misc CSusClientGlobal::DoServicePreShutdown 2020/12/10 08:55:54.3681730 8232 2040 IdleTimer Idle timer disabled in preparation for service shutdown 2020/12/10 08:55:54.3681779 8232 2040 Misc WUTaskManager uninit 2020/12/10 08:55:54.3681804 8232 2040 Agent Earliest future timer found: 2020/12/10 08:55:54.3681872 8232 2040 Agent Timer: 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2020-12-10 14:50:20, not idle-only, not network-only 2020/12/10 08:55:54.3808141 8232 2040 Misc CreateSessionStateChangeTrigger, TYPE:2, Enable:No 2020/12/10 08:55:54.3808251 8232 2040 Misc CreateSessionStateChangeTrigger, TYPE:4, Enable:No 2020/12/10 08:55:54.3844995 8232 2040 Misc Agent uninit 2020/12/10 08:55:54.3856173 8232 2040 Misc Reporter uninit 2020/12/10 08:55:54.3877106 8232 2040 Misc network cost manager uninit 2020/12/10 08:55:54.3877289 8232 2040 Misc Eventer uninit 2020/12/10 08:55:54.3915140 8232 2040 Misc ServiceManager uninit 2020/12/10 08:55:54.3915295 8232 2040 Misc PersistentTimeoutScheduler uninit 2020/12/10 08:55:54.3915314 8232 2040 Misc datastore uninit 2020/12/10 08:55:54.4419945 8232 2040 Misc setting cache uninit 2020/12/10 08:55:54.4419969 8232 2040 Misc security checker uninit 2020/12/10 08:55:54.4420008 8232 2040 Misc Test Hook uninit 2020/12/10 08:55:54.4420015 8232 2040 Misc IdleTimer uninit 2020/12/10 08:55:54.4433696 8232 2040 Shared * END * Service exit Exit code = 0x240001

I'll turn SSL on anyway - nothing to lose

I'll turn SSL on anyway - nothing to lose

Thanks for the heads up. Do you mean if the PC's are using a proxy to contact the WSUS server? OR just using a proxy in general for Internet access - we have a smoothwall filtering device so all web traffic goes through that. The PC's don't need a proxy to access the WSUS server however as it's just one of our on-prem servers.

On checking the Server Event Logs for Windows Server Update Service Back in October! Self-update is not working. The Reporting Web Service is not working. The API Remoting Web Service is not working. The Server Synchronization Web Service is not working. The Client Web Service is not working. The SimpleAuth Web Service is not working. The DSS Authentication Web Service is not working. The WSUS content directory is not accessible. System.Net.WebException: The remote server returned an error: (503) Server Unavailable. at System.Net.HttpWebRequest.GetResponse() at Microsoft.UpdateServices.Internal.HealthMonitoring.HmtWebServices.CheckContentDirWebAccess(EventLoggingType type, HealthEventLogger logger) Things seemed to have gone downhill since that point!

I've uploaded a clients update log here: https://we.tl/t-FWuDyCT8gG If any experts can decipher it - great

Good shout but I'm not sure we're using a certificate currently, so don't think there is an expiry issue - unless I'm looking in the wrong place. Afraid I did n't set this WSUS up so....

Everything looks correct on the clients, those that are not appearing at all, those that are appearing but are in unassigned and those that are going in the correct group Rebuild time I think. WSUS is flaky as the best of times....