Wanted: WSUS help

Ric · September 25, 2012, 02:27:55 PM

Can someone recommend a tech that can answer some Windows Server Update Services - WSUS -questions and help me update a few things? AIS technology / The Olivers installed our server but they do not do WSUS as they have their own product.

We've been successfully and happily using WSUS for years on our Windows 2003 server and workstations.

Dell "helped" us set up WSUS and it has helped us quite a bit during that time but it seems we need to do some tweaking.

I would be grateful for help even if we have to spend my boss' money to get things done

Thank you.

Ric

Mark · September 25, 2012, 02:31:15 PM

Ric,

I still use WSUS and would be more than happy to discuss here or on the phone. Discussions here may benefit many, however some things are much easier over the phone.

Your choice, my friend. I'm always willing to help ya out!

Charlie Charbonneau · September 25, 2012, 02:31:41 PM

What tweaking are you looking to do? I don't have someone to suggest, but you may be able to D-I-Y...

Ben Thoele · September 25, 2012, 02:34:08 PM

I can try.

We run WSUS.

Ben

Ric · September 25, 2012, 02:46:47 PM

Quote from: Mark on September 25, 2012, 02:31:15 PM
Ric,

I still use WSUS and would be more than happy to discuss here or on the phone. Discussions here may benefit many, however some things are much easier over the phone.

Your choice, my friend. I'm always willing to help ya out!

Holy cow! I got three offers to help before I could respond to the first one!

Based on the WSUS:Update Status Summary it states we have several computers that need updates and some that have errors.

Perhaps a phone call would be best and maybe a showmypc.com remote session and then I would be happy to report back here with the results after things are fixed.

My number is 856-451-9531

Thanx!

Ric

Bloody Jack Kidd · September 25, 2012, 03:22:17 PM

Quote from: Ric on September 25, 2012, 02:46:47 PM
Holy cow! I got three offers to help before I could respond to the first one!

That's how we roll.

+1 to the first responders

Ben Thoele · September 25, 2012, 05:51:22 PM

Handy WSUS commands for problematic endpoints.

Start, run, then wuauclt.exe /detectnow

If you have a computer that won't update.

Stop the Automatic Update in services.
Delete the C:\WINDOWS\SoftwareDistribution folder
Restart automatic Update.

Run wuauclt.exe /detectnow /resetauthorization

Jeff Zylstra · September 26, 2012, 09:13:25 AM

It is also occasionally necessary to clear the cache of downloaded updates because of a corrupted update. You sometimes need to clear out the cache of the WSUS server and also the machine that is affected. I'd try the affected machine first. You'll need to stop the WCAULT service first in order to do that. I had that issue with an SQL service pack update that haunted me forever.

Also, installing the updates in proper order makes a difference as well. I usually install the old updates, and then immediately install the superseding updates right after that. I guess what I'm saying is that it pays to read the descriptions of the updates, what they are, what they fix, whether they supersede other updates, whether they will reboot the machines, etc.... It also pays not to get behind in your updates, because sometimes they're dependent on the next version.

I usually set my deadlines about an hour after closing time so that the nightly shutdown constitutes a reboot. I think that there's a slicker way to do that, but I haven't studied up on that. If anyone knows, I'd be interested...

Ric · September 26, 2012, 10:56:27 AM

Quote from: Bloody Jack Kidd on September 25, 2012, 03:22:17 PM
Quote from: Ric on September 25, 2012, 02:46:47 PM
Holy cow! I got three offers to help before I could respond to the first one!

That's how we roll.

+1 to the first responders

+1 to you all! trying out the suggestions...
@ Ben. I did the stop, delete directory, restart thing... how long would you think it might take for things to happen?

hours? overnight? after a reboot?

Workstation has been stuck at 99% for weeks.

Thank you all!

Ric

Mark · September 26, 2012, 11:07:03 AM

Mine are always 99%. Don't think I've ever seen 100% and am guessing it is related to what updates I'm using WSUS for (drivers, etc) vs. what I've approved.

Ric · September 26, 2012, 11:32:29 AM

Quote from: Mark on September 26, 2012, 11:07:03 AM
Mine are always 99%. Don't think I've ever seen 100% and am guessing it is related to what updates I'm using WSUS for (drivers, etc) vs. what I've approved.

Nice to have company Mark and thank you for your help!

As I mentioned to you I do recall our server being at 100% recently but have not seen it there in a couple of weeks.

Mark · September 26, 2012, 12:14:58 PM

Yep, just throwing it out there on the thread.

Jeff Golas · September 26, 2012, 03:44:37 PM

Ive seen 100%. One thing to keep in mind is that if you have updates that weren't approved, they count against that. So lets say your workstations have EVERY update you approved, but there's 2 updates that you haven't approved (or specifically declined), they will be at 99% (or something other than 100%) until you approve (and they install) that update, or you decline that update.

In addition to that...the same will happen if a computer needs an update that you didn't approve for that computer's group. So again, if there's an update that applies to Windows 7 and Windows Server 2003, and you approved it only for your Servers group, that computer will never see 100% since it needs that update. To find this just click on the computer in question and see what it says as far as outstanding updates, then click on that update right in the report to look at its approval settings.

Ric · September 27, 2012, 11:46:41 AM

Quote from: Jeff Golas on September 26, 2012, 03:44:37 PM
Ive seen 100%. One thing to keep in mind is that if you have updates that weren't approved, they count against that. So lets say your workstations have EVERY update you approved, but there's 2 updates that you haven't approved (or specifically declined), they will be at 99% (or something other than 100%) until you approve (and they install) that update, or you decline that update.

In addition to that...the same will happen if a computer needs an update that you didn't approve for that computer's group. So again, if there's an update that applies to Windows 7 and Windows Server 2003, and you approved it only for your Servers group, that computer will never see 100% since it needs that update. To find this just click on the computer in question and see what it says as far as outstanding updates, then click on that update right in the report to look at its approval settings.

Jeff,

Are you certain about "(or specifically declined)? In my non-Micro$oft mind, logic would have declined updates removed from the equation (math thing).

Case in point is we do not use Windows Defender (Symantec End Point here) and decline all Windows Defender updates including definitions.

Wouldn't declining updates remove them from the percentage calculations?

Thanx for your input and information!

Ric

Jeff Golas · October 01, 2012, 11:19:03 AM

If it says Windows defender is needed though, realize that its incorporated in to the OS to some degree...see which computers "need" it to tell why they need it.

Ric · October 04, 2012, 03:46:10 PM

Quote from: Jeff Golas on October 01, 2012, 11:19:03 AM
If it says Windows defender is needed though, realize that its incorporated in to the OS to some degree...see which computers "need" it to tell why they need it.

Thanx Jeff and everyone.

Been away for a few days...trying to get caught up so I cand dive back into this.

much appreciated.

Ric