KK20

Sure. It is very simplistic - I have a few "one run scripts" for various pieces of odd software; I have a simple flag system in the program files dir that keeps track of what I need. Simply increment the file number when you need to deploy a new .xml (I don't delete so I have a record but feel free to have a del if you wish). This is run as a computer start script, name it what you want, mine happens to be called FileAssoc_W10.batand has wmi filtering set to W10 only (we have no 8 or 8.1 machines) @echo off REM **** check for our script flags folder, if it isnt there then create it **** if not exist "%PROGRAMFILES%\scriptflags" mkdir "%PROGRAMFILES%\scriptflags" if exist "%PROGRAMFILES%\scriptflags\SAFA_V001.dat" goto ENDOF REM **** no flag so run our DISM **** Dism /online /Import-DefaultAppAssociations:\\NETWORK_PATH_TO_YOUR_GPO_XML\fileassociations.xml echo "\\NETWORK_PATH_TO_YOUR_GPO_XML\fileassociations.xml" > "%PROGRAMFILES%\scriptflags\SAFA_V001.dat" :ENDOF REM **** on with the show! ****

try what I did. On the PC that is causing the issue (or at least one of them) run dism /online /Import-DefaultAppAssociations with the same XML file you use for the GPO. It has cured it on all my PCs so far (I created a one shot script that ran on startup). It is due to the defaultuser default settings on the machine conflicting with the freshly created profile. Once you update the defaultuser settings then the issue goes away. My fear is that if I install new software I will need to rerun the script on machines again (if the software changes core file associations.)

Solved. It isn't enough to just use the GPO. As well as the GPO on each PC the dism /online /Import-DefaultAppAssociations must be run. This sets the defaultappassociations for the defaultuser on the PC. since the user was fresh and had no profile, the defaults were copied from the machine. These defaults conflicted with what applications were set. On the second login the GPO was applied to the profile proper. I suspect this is tied to the current issue with 1607 and temporary/cached profiles not working as expected (whether a profile is fresh or not, the GPOs SHOULD apply but in this case are clearly not - you can go into the app defaults as see that the GPO settings had not taken effect!) In anycase I have solved it for my own purposes.

I have tried setting a GPO in Administrative Templates\Windows Components\File Explorer\Set a default associations configuration file using an xml from Dism /Online /Export-DefaultAppAssociations:xxxxx.xml This works but only on the SECOND login for a new users. If a profile doesn't exist for a user then I get the "error message" (it isn't a real "error" I know) and the defaults are not set for that session. If the user logs out and back in again then the GPO works just fine, the defaults are set according to my XML preferences and no "error message". It does seem that it is just the first login (domain, roaming profile, no .V6 profile as first windows 10 login).

Windows 10 1607 enterprise; I have only just started testing windows 10. I have the image mostly working now except this (which has me stumped). When a user logs in for the first time on a PC the following error appears: "An app default was reset. An app caused a problem with the default app setting for xxxx so it was reset to yyyyy". Most commonly .pdf, .htm, .html to edge (I have removed a lot - almost all - of provisioned apps). I don't want edge playing with pdfs or htms or any of my other defaults being played with. worst still, the default app page pops up (I don't want users messing as they will only screw their profiles up, or some enterprising student will set everything to open with notepad etc). I saw this Fix for "An App Default was Reset" Windows 10 Resetting File Associations (Registry Fixes) and its registry settings (as both a preference and a login script) but they didn't work - the user still gets pestered. Does anyone know of a GPO that basically says "Do not let default apps check for default" or "leave default app settings alone"? Thanks

Partial user error for me in the end - the security group was a member of "domain guests". However, add any user to domain guests and you get the error (I assume because domain guests are forced to have a temporary profile so that will throw the error)

The fix posted above didn't work for me and we had the same problem. The workaround for me involves removing the users from a global security group! Each of our yeargroups have a global security group (i.e. year7 year8 year9 etc) in addition to a distribution email group (pupils) and the usual default user group. If I remove the user from the security group then the error goes away. It is reproducible. Im off home now but will check tomorrow if I can change the group to a different sort and see if it is an issue with our legacy group types! there are no GPOs associated with being in the security group - it was purely there for administrative purposes when moving students at the end of each year.

I think i'll have to do that. Betternet uses amazon so that will be fun :-)

to our chagrin we run programming courses that generate .exe of their own. In the past we could control it when it was just gamemaker but now the 6th formers (and advanced 5th formers) are compiling .NET. I tried to experiment with the compilers running under a different user (and that user only having rights to write to folders) but you get into issues when that app has to read/write to "my documents" etc the obvious answer is discipline of course but if someone had experimented in Linux then I'd be happy to borrow your notes.

Diladele here. You will need Linux knowledge so the trade off in cost (£500pa) is met by you needing to do some work manually (therefore not an appliance)

Our delightful cherubs are using portable browsers with VPN over HTTPS plugins. The obvious boasters are caught easily, however the clever ones are sneaking under the radar by being quiet. We already MitM with a domain CA cert for HTTPS filtering (diladele/squid filtering), yes our policies have the MitM (for students, we don't MitM for staff) explained and we have a proxy bypass policy too - disciplining is only possible when you catch them. Is there a way of DPI/ALI dropping anything other than true web traffic? I assume the initial https handshake will be legit followed by VPN encrypted traffic afterwards? I can get my hands on a sonicwall 2400 device but am loathe to pay for the annual app control license (if that is what is needed). Our firewall is good old iptables on our Linux gateway so nothing fancy (but being Linux I can install software as appropriate). I have never attempted DPI/ALI on Linux before (I miss our old ISA 2006 box, why did you stop it MS!)

VOSE has always meant "server" OSE in MS terms when looking at 1POSE 2VOSE or 1+1 in 2008 days (or buy one get 4 free in the old days etc) - I added an edit2 to explain my reasoning. Any other OS is licensed outside of the scope as required; A windows 2k12 license would not cover you for a windows 7 or 8.1 VM for example (that would be done via VDI) - ironically it was this path that led me to question our MS licensing resellers (I wanted to VM a windows 7 machine for a specific piece of software - turned out it was a very expensive proposition due to VDI). Hyper-V core edition can load up on Linux VMs without paying a single penny to MS. Likewise, hyper-v core plus a desktop OS paired with VDI wont involve any serverlicensing. CALS on the other-hand are another matter, Linux servers may be using elements of AD (from a correctly licensed windows server) in which case anything using those Linux servers will need CALS (don't forget external connectors too) - you cant get around desktop CALS by presenting clients the Linux server (which is using windows server resources) for example. (EDIT: you posted after I started the reply so there might be some overlap with VDI etc - the main confusion is MS terms of VM, server and OSE.) EDIT2: I should have put my own google-fu up. The 2012r2 licensing guide from MS points to VOSE "product terms" hyperlink. This details that the VOSE are linked to the server running instances - therefore if your host is a running instance of server 2012R2 (and the license is a 2012R2 standard) then you are allowed another pair of VOSE 2k12R2 running instances. The agreement also allows you to downgrade the running instance to a previous version hence why you can use a VM server 2008 OS on a 2k12 license. Windows 7 is not on the downgrade rights for 2k12R2 so cannot be used within the 2012R2 VOSE running instance "allowance" and would need to be licensed separately (VDI in this case). Linux is not on the downgrade rights for 2012R2 therefore would need to be licensed separately (and Linux needs no licensing so you are clear).

Pugh didn't seem to think so. Linux has no licensing requirements on hyper-v from any of the people I have spoken too. Who did you speak too? The server licensing is quite specific - VOSE is windows server only (not even Windows desktop). Centos, Ubuntu, Redhat is not windows server and is not on the downgrade rights either so a 2K12R2 license would not cover Linux anyway.

This is the issue I found when looking at licensing a desktop machine virtually. There is no scope with a std license to virtualise the OS, I will need to look into VDI licensing for a desktop OS virtualised.

cost. EES license is £30 per std license but datacenter is £180. £360 vs £180 (looking at the cluster licenses only). Sure I could have the option of running more VMs if I wish but for the foreseeable future I wont need more MS VMs (there are more Linux VMs running on the clusters)

normal deployment no VDI. It is our desktop OS golden image. I was thinking of moving it off the desktop we use and putting it on our cluster as a VM if only to simplify things. It will never be activated and will be in audit mode permanently. It isn't a "test" as such, it is our pre-generalised image. Currently this is how we work with our physical desktop golden sample: 1) desktop windows 8.1 with 2x hard drives of identical capacity. 2) runs in audit mode on HDD1, not activated 3) changes made to OS (updates run, new software added to image etc) 4) machine is shutdown to startup in auditmode (NOT generalised or set) drive is CLONED to HDD2 5) HDD1 is generalised and shutdown in sysprep to boot into client mode. 6) HDD1 is uploaded to FOG ready to deploy to clients 7) HDD2 cloned back to HDD1 ready for the next change in the future. If I could virtualise the machine then I could speed up the process (not that we update the primary image too often)

it isn't always cheaper for datacentre, I find this site with diagrams useful Virtualisation Licensing for WS2012 & WS2012 R2 | Aidan Finn, IT Pro . We have a 2 host cluster (2x 8 core CPUs in each cluster host) and a standalone quad core single CPU DC too. We have 6 windows server guest VMs (VOSE as MS calls them) and the cluster hosts do nothing other than host and backups. We need (in total) 13 MS licenses (12x VMs due to cluster pair and 1x standalone) all my servers have no more than 2 physical CPUs so a single license covers this aspect. However, for VMs each server license allows 2x VOSE so taking my physical standalone server out of the equation I now only need 12/2 or 6 server licenses. In total I need 7 licenses. I cannot use datacentre otherwise I would need 2x datacentre and 1x std as the licenses are bound to hardware (with a single migration allowed in 90 days) so I cannot use a single datacentre to license the lot as there are 3 pieces of physical hardware that need licensing. the way you license also counts, you might only need to declare your changes upon renewal - it depends on what you are doing and what model you are using (this might make speculative licensing obsolete for you). Another caveat is that your hosts should be doing nothing other than things essential to hosting. The hosts cannot be DCs (!) or email/print/file sharing servers (!!!) as this would necessitate the hosts being licensed independently too. I believe datacentre gets round this though (don't quote me on that, and as to WHY you would want the host to do something else is beyond me)

How would licensing a golden sample as a virtual machine work? We are a school with EES, Hyper-V cluster on 2k12R2. I once looked into licensing a windows 8.1 machine in hyper-v and it was basically a nightmare (and cheaper for us under EES to use a server OS instead and scrap the idea of a virtual 8.1 machine). Currently our golden sample is hosted on a licensed dell desktop before generalising and going into FOG. If I was to virtualise the golden sample would this be another nightmare of licensing or is there some sort of licensing dispensation for "image"/golden sample/non activated/audit mode only guests?

Scrapped the PC. Yup, I couldn't get this PC to work with WSUS, no idea why. A same-model-pc-from-spares was reinstated using the SAME image (I swapped MAC addresses in FOG and redeployed, so the same PC name, same image etc) and the replacement worked. Go figure. The PSU found a new home in another PC, the RAM & CPU has gone into the spare pile and i've stickered up the motherboard as a "only use in emergency"

I assume you might want OLD emails to trickle in under the old name for a while? Look at the accepted domains in organisation hub transport. We have a "not publicised but still used" .net email address that is accepted by our mail servers but is NOT the primary address under our SMTP either. You will then want to set an email policy with the new address as the primary SMTP. This is again under hub transport in organisation/email address policy. Add the new address and set it to primary reply (feel free to leave the old one for legacy email). I cant remember if this is a LIVE change or you need to right click and apply (I think it is a live change). It is up to you whether you change/care about your EHLO or not. As for your OWA, that is up to your web settings externally. You don't have to have the OWA external address matching your internal server names, ours doesn't - just match up the DNS vs any changes to your firewall for directing traffic to the web server. OWA is a separate web server in reality, it takes a logon and directs the user to a mailbox as appropriate. If things internally are being updated piecemeal, then just update your internal DNS with the old zone pointing mail.olddomain (or whatever you used) to the new server etc. don't forget "autodiscover" adds its own complications too. Use the Microsoft exchange analyser to check out the new domain when you are finished, I found it invaluable as a tool. EDIT: obviously your MX will need to change but don't forget to update your SPF, if that isn't updated then you will probably get caught by other spam filters.

just a note, we have an old "legacy" .local internal domain, exchange is quite happy to use our external domain + cert (not a trace of the .local on our cert). Our websites using SSL also have their addresses as alternate domain names too.

this error is usually brought about when you copy the .admx into the policydefinitions but forget to copy the .adml into the en-us folder. Obviously copying the WHOLE policydefinitions will also copy the en-us folder (so will "fix" the error). It shouldn't matter what DCs you have as they will run to whatever level you set your domain at. Since you are dealing with the SYSVOL folder then the DCs will replicate changes as necessary between them.

I (rather shamelessly) went back to scripts for the majority of our rooms. I do have a couple of GPP for our windows 10 machines and I too delete all first then create - it wouldn't matter where your print server is then.

forgot to mention that I tried that. I couldn't get windows (online) update to work when I deleted softwareupdate though, I left it overnight and it was still "updating" (i.e. getting the initial list of what it needs), I left if for a good half day afterwards before giving up caring. However, if I ran "online" update after imaging then it would update but not do anything with WSUS; always the same 0x80244016 soap 400 error. Whilst we DO have a proxy on site this is irrelevant for local web traffic (and has been this way before these PCs were first built years ago) so im happy for WSUS traffic to go DIRECT. I am leaning towards some sort of corruption in the WSUS database as there is nothing on a client that should stop WSUS working (on a proven working fresh image). I think i'll put a different NIC in there (for the MAC and system ID hash), delete it from AD and rejoin under a different name - if only to help my sanity. The irony is, I don't actually know if this machine was working with WSUS *before* I changed the HDD, it could have always had an issue (I doubt it as you tend to notice 0% entries in WSUS). I put this in W2k12 as WSUS is installed on W2K12, no idea if it is the client or server though....

now I *DO* expect 0x80244010 errors after deleting softwaredistribution so I usually manually run updates until they go away - there are about 7000 updates and I know there is a limit as to how much it can pull back in one go - usually 2 or 3 manual updates gets rid of the 0x80244010 errors whilst softwaredistribution fills up. Sounds good? WSUS picks up the computer name again, I move it to the correct updates group and run windows update manually. It churns away, software distribution fills up to about a gigabyte aaaaaand the same error as before appears "WARNING: SyncUpdates failure, error = 0x80244016, soap client error = 10, soap error code = 0, HTTP status code = 400" no updates actually install. Now I think. Stuff it, i'll reimage - something must have gone wrong. Remove PC from WSUS, remove from AD and set to reimaging. Cutting a long story short, SAME THING happens again. I begin to get worried, have I messed up my golden image doing an update? do I have backups before the last update? Don't panic, try reimaging the PC next to it (identical model, BIOS, bought at same time etc), so I do (after deleting the PC from AD and WSUS for a fair comparison). Guess what happens to that one when I look in the windowsupdate.log : 2016-02-22 08:27:01:989 112 af4 Misc =========== Logging initialized (build: 7.6.7600.320, tz: -0000) =========== 2016-02-22 08:27:01:989 112 af4 Misc = Process: C:\Windows\system32\svchost.exe 2016-02-22 08:27:01:989 112 af4 Misc = Module: c:\windows\system32\wuaueng.dll 2016-02-22 08:27:01:989 112 af4 Service ************* 2016-02-22 08:27:01:989 112 af4 Service ** START ** Service: Service startup 2016-02-22 08:27:01:989 112 af4 Service ********* 2016-02-22 08:27:02:067 112 af4 Agent * WU client version 7.6.7600.320 2016-02-22 08:27:02:067 112 af4 Agent * Base directory: C:\Windows\SoftwareDistribution 2016-02-22 08:27:02:067 112 af4 Agent * Access type: No proxy 2016-02-22 08:27:02:083 112 af4 Agent * Network state: Connected 2016-02-22 08:27:47:924 112 af4 Report CWERReporter::Init succeeded 2016-02-22 08:27:47:924 112 af4 Agent *********** Agent: Initializing Windows Update Agent *********** 2016-02-22 08:27:47:924 112 af4 Agent * Prerequisite roots succeeded. 2016-02-22 08:27:47:924 112 af4 Agent *********** Agent: Initializing global settings cache *********** 2016-02-22 08:27:47:924 112 af4 Agent * WSUS server: http://NEP_UP03:8530 2016-02-22 08:27:47:924 112 af4 Agent * WSUS status server: http://NEP_UP03:8530 2016-02-22 08:27:47:924 112 af4 Agent * Target group: C5Updates 2016-02-22 08:27:47:924 112 af4 Agent * Windows Update access disabled: No 2016-02-22 08:27:47:924 112 af4 DnldMgr Download manager restoring 0 downloads 2016-02-22 08:27:47:940 112 af4 AU ########### AU: Initializing Automatic Updates ########### 2016-02-22 08:27:47:940 112 af4 AU AU setting next detection timeout to 2016-02-22 08:27:47 2016-02-22 08:27:47:940 112 af4 AU # WSUS server: http://NEP_UP03:8530 2016-02-22 08:27:47:940 112 af4 AU # Detection frequency: 21 2016-02-22 08:27:47:940 112 af4 AU # Target group: C5Updates 2016-02-22 08:27:47:940 112 af4 AU # Approval type: Scheduled (Policy) 2016-02-22 08:27:47:940 112 af4 AU # Scheduled install day/time: Every day at 16:00 2016-02-22 08:27:47:940 112 af4 AU # Auto-install minor updates: No (Policy) 2016-02-22 08:27:47:940 112 af4 AU # Will interact with non-admins (Non-admins are elevated (User preference)) 2016-02-22 08:27:47:940 112 af4 AU Setting AU scheduled install time to 2016-02-22 16:00:00 2016-02-22 08:27:48:034 112 af4 Report *********** Report: Initializing static reporting data *********** 2016-02-22 08:27:48:034 112 af4 Report * OS Version = 6.1.7601.1.0.65792 2016-02-22 08:27:48:034 112 af4 Report * OS Product Type = 0x00000030 2016-02-22 08:27:48:049 112 af4 Report * Computer Brand = Gigabyte Technology Co., Ltd. 2016-02-22 08:27:48:049 112 af4 Report * Computer Model = G41MT-S2P 2016-02-22 08:27:48:049 112 af4 Report * Bios Revision = F1 2016-02-22 08:27:48:049 112 af4 Report * Bios Name = Award Modular BIOS v6.00PG 2016-02-22 08:27:48:049 112 af4 Report * Bios Release Date = 2010-12-31T00:00:00 2016-02-22 08:27:48:049 112 af4 Report * Locale ID = 2057 2016-02-22 08:27:48:049 112 af4 AU Successfully wrote event for AU health state:0 2016-02-22 08:27:48:049 112 af4 AU Initializing featured updates 2016-02-22 08:27:48:049 112 af4 AU Found 0 cached featured updates 2016-02-22 08:27:48:049 112 af4 AU Successfully wrote event for AU health state:0 2016-02-22 08:27:48:049 112 af4 AU Successfully wrote event for AU health state:0 2016-02-22 08:27:48:049 112 af4 AU AU finished delayed initialization 2016-02-22 08:27:48:049 112 af4 AU ############# 2016-02-22 08:27:48:049 112 af4 AU ## START ## AU: Search for updates 2016-02-22 08:27:48:049 112 af4 AU ######### 2016-02-22 08:27:48:065 112 af4 AU <<## SUBMITTED ## AU: Search for updates [CallId = {B1260DD0-7CBD-40FC-976E-31E3D5BE0EB2}] 2016-02-22 08:27:48:190 112 d08 Agent ************* 2016-02-22 08:27:48:190 112 d08 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates] 2016-02-22 08:27:48:190 112 d08 Agent ********* 2016-02-22 08:27:48:190 112 d08 Agent * Online = Yes; Ignore download priority = No 2016-02-22 08:27:48:190 112 d08 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation' or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1" 2016-02-22 08:27:48:190 112 d08 Agent * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed 2016-02-22 08:27:48:190 112 d08 Agent * Search Scope = {Machine} - - - Updated - - - 2016-02-22 08:27:48:190 112 d08 Setup Checking for agent SelfUpdate 2016-02-22 08:27:48:190 112 d08 Setup Client version: Core: 7.6.7600.320 Aux: 7.6.7600.320 2016-02-22 08:27:48:190 112 d08 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags 0x00000080: 2016-02-22 08:28:28:344 112 d08 Misc Microsoft signed: NA 2016-02-22 08:28:28:344 112 d08 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\TMPBC5B.tmp with dwProvFlags 0x00000080: 2016-02-22 08:28:58:421 112 d08 Misc Microsoft signed: NA 2016-02-22 08:28:58:421 112 d08 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080: 2016-02-22 08:29:23:497 112 d08 Misc Microsoft signed: NA 2016-02-22 08:29:23:513 112 d08 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab with dwProvFlags 0x00000080: 2016-02-22 08:29:23:513 112 d08 Misc Microsoft signed: NA 2016-02-22 08:29:23:544 112 d08 Setup Determining whether a new setup handler needs to be downloaded 2016-02-22 08:29:23:560 112 d08 Misc Validating signature for C:\Windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe with dwProvFlags 0x00000080: 2016-02-22 08:29:23:560 112 d08 Misc Microsoft signed: NA 2016-02-22 08:29:23:560 112 d08 Setup SelfUpdate handler update NOT required: Current version: 7.6.7600.320, required version: 7.6.7600.320 2016-02-22 08:29:23:560 112 d08 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.320" 2016-02-22 08:29:24:294 112 d08 Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.320" is already installed. 2016-02-22 08:29:24:294 112 d08 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.320" 2016-02-22 08:29:24:310 112 d08 Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.320" is already installed. 2016-02-22 08:29:24:310 112 d08 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.320" 2016-02-22 08:29:24:341 112 d08 Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.320" is already installed. 2016-02-22 08:29:24:341 112 d08 Setup SelfUpdate check completed. SelfUpdate is NOT required. 2016-02-22 08:29:42:528 112 d08 PT +++++++++++ PT: Synchronizing server updates +++++++++++ 2016-02-22 08:29:42:528 112 d08 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NEP_UP03:8530/ClientWebService/client.asmx 2016-02-22 08:29:42:653 112 d08 PT WARNING: Cached cookie has expired or new PID is available 2016-02-22 08:29:42:653 112 d08 PT Initializing simple targeting cookie, clientId = b7a9ab59-8e5d-4f92-9a08-18ab350dbbb1, target group = C5Updates, DNS name = unit7114.austinfriars.cumbria.sch.uk.local 2016-02-22 08:29:42:653 112 d08 PT Server URL = http://NEP_UP03:8530/SimpleAuthWebService/SimpleAuth.asmx 2016-02-22 08:32:56:737 112 d08 PT +++++++++++ PT: Synchronizing extended update info +++++++++++ 2016-02-22 08:32:56:737 112 d08 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://NEP_UP03:8530/ClientWebService/client.asmx 2016-02-22 08:33:37:991 112 d08 Agent * Found 0 updates and 75 categories in search; evaluated appl. rules of 4406 out of 7525 deployed entities 2016-02-22 08:33:38:022 112 d08 Agent ********* 2016-02-22 08:33:38:022 112 d08 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates] 2016-02-22 08:33:38:022 112 d08 Agent ************* 2016-02-22 08:33:38:381 112 fe0 AU >>## RESUMED ## AU: Search for updates [CallId = {B1260DD0-7CBD-40FC-976E-31E3D5BE0EB2}] 2016-02-22 08:33:38:381 112 fe0 AU # 0 updates detected 2016-02-22 08:33:38:381 112 fe0 AU ######### 2016-02-22 08:33:38:381 112 fe0 AU ## END ## AU: Search for updates [CallId = {B1260DD0-7CBD-40FC-976E-31E3D5BE0EB2}] 2016-02-22 08:33:38:381 112 fe0 AU ############# 2016-02-22 08:33:38:459 112 fe0 AU Successfully wrote event for AU health state:0 2016-02-22 08:33:38:459 112 fe0 AU Featured notifications is disabled. 2016-02-22 08:33:38:459 112 fe0 AU AU setting next detection timeout to 2016-02-23 04:54:11 2016-02-22 08:33:38:475 112 fe0 AU Setting AU scheduled install time to 2016-02-22 16:00:00 2016-02-22 08:33:38:475 112 fe0 AU Successfully wrote event for AU health state:0 2016-02-22 08:33:38:475 112 fe0 AU Successfully wrote event for AU health state:0 2016-02-22 08:33:38:522 112 d08 Report CWERReporter finishing event handling. (00000000) 2016-02-22 08:33:43:033 112 d08 Report REPORT EVENT: {660D9DA0-4799-4264-B810-475564E4406B} 2016-02-22 08:33:38:007-0000 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows Update Client successfully detected 0 updates. 2016-02-22 08:33:43:033 112 d08 Report REPORT EVENT: {FEF4B900-D293-4BF5-9C5A-0FD6B9A7F143} 2016-02-22 08:33:38:022-0000 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status. 2016-02-22 08:33:43:048 112 d08 Report CWERReporter finishing event handling. (00000000) 2016-02-22 08:36:27:228 112 d08 Report Uploading 2 events using cached cookie, reporting URL = http://NEP_UP03:8530/ReportingWebService/ReportingWebService.asmx 2016-02-22 08:36:27:244 112 d08 Report Reporter successfully uploaded 2 events. "but that looks fine!" I hear you cry! Yes it does. And WSUS works with it, the PC reports back to WSUS and WSUS sees it, as do 10 other logs I randomly check throughout the building. It is just ONE machine that utterly refuses to work with WSUS. Yes, the golden image is generalised; I once remember screwing WSUS up in XP by them all having the same ID on cloning, I wont make that mistake again - but at least in XP you could fix that with a batch file rather than redoing your golden image (and THEN learning all about rearms before making your golden image again swearing not to make THAT mistake again). The client can ping the WSUS server (NetBIOS name), it can connect to \\NEP_UP03 and see a shared folder happily. I can even open up a browser and go to http://NEP_UP03:8530/SimpleAuthWebService/SimpleAuth.asmx and get the simpleauth screen. I have no more ideas, short of putting a different network card (so it has another mac address) and changing the PC name so that it appears to all and sundry as a new PC I have no ideas left. I must stress that as far as I know, this is the ONLY PC that doesn't work with WSUS (WSUS is reporting the correct amount of PCs and WSUS lists this PC as "not reported" although there IS 1gb of data in the software distribution folder and I did delete it). I'm thinking of scrapping the PC as i'm sure I can cannibalise the parts for a non working one somewhere....