SUS Server not updating Clients

[linmatt]

Hi All

We have the MS SUS server installed, the policies are in place, and it updates from the MS web site perfectly. All updates are approved, and the approval log reflects this. The only problem is that it's not updating the clients. We have the policies at OU level, but looking at the SUS logs shows no access to wutrack.bin. Running MSBA or GFI Languard shows none of the patches are applied. Speaking to a number of people who are running it, they've had no issues and a comparrison of thier settings and ours shows no difference. And no-one I've spoken to has had to modify any client registry settings. I find the MS documentation very confusing on that issue - do you or don't you?

Can anyone offer any advice cos I'm getting very frustrated with it.

Many thanks

Matt

 

[jmjaszewski]

Has the SUS client been installed on the client machines?

http://www.microsoft.com/windows2000/downloads/recommended/susclient/default.asp

"This new Automatic Update, which can be installed on Windows 2000 and Window XP, is necessary for you to use Microsoft Software Update Services (SUS)."

Sorry if this is a dumb question, but you didn't mention it in your post.

 

[OdedShafran]

I have the same problem, but only with a few XP pros with SP1.. the patch you gave is for win xp pro (without sp1).
what can be the problem?

Oded Shafran,
Network Administrator

 

[ljCharlie]

I also have a similar problem. The client computer somehow never installs the patches. It shows in the system event log ID 18 as it's downloaded and ready to be install...but never did. On another machine, both Win2k Pro, it's not even contacting the SUS server. By looking at the client registry, it looks like the client computer has detected new updates, but never installs. And help is appreciated!

ljCharlie

 

[philote]

Look at the 'Automatic Updates' section at:

http://snakefoot.fateback.com/tweak/winnt/service_details/service_details_abc.html

It shows the registry keys that conrol Automatic Updates and gives an explanation of each. You can check these keys to make sure your Group Policy was applied correctly to the workstations.

Kevin
A+, Network+, MCP

 

[ljCharlie]

This is what I have:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="

http://suf"

"WUStatusServer"="

http://suf"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:0000000a
"UseWUServer"=dword:00000001
"RescheduleWaitTime"=dword:00000005

And it is still not working. What's wrong with the above settings?

ljCharlie

 

[philote]

That "ScheduledInstallTime doesn't look like a valid value. It should be a number from 0 to 23, denoting the hour which it should install. Check your group policy again and make sure this setting is set correctly.

Kevin
A+, Network+, MCP

 

[ljCharlie]

Thanks for the response. For the "ScheduledInstallTime"=dword:0000000a with "a" is stand for "10" in hex. So I'm guessing it's not that. I can change that to a "5" and still not working.

ljCharlie

 

[jrbmcse1]

We have a problem with our SUS SP1, my clients stll attempt to download from the external Microsoft Servers, i have configured my registry via admin template in GPOs and these have applied but apparently fail to effect the attempted download location.
I noted that under vroot on the server the iuident.txt inside iuident.cab still defines the external Windows update servers so quite rightly my clients r still looking in the same place. Having ammended the iuident.txt file and created a new cab my client download this new cab file but query the digital signature, throw it out and attempt to download a new cab file from the internet. Surely i don't have to manually configure this file!? any ideas?

 

[philote]

ljCharlie... sorry, I wasn't thinking in hex. It does look like the group policy is working since the client machines have the correct settings. I can only guess that the clients aren't connecting to the server correctly. Can you access the SUSAdmin web site on the server (

http://suf/SUSAdmin)

from the client computers?

Kevin
A+, Network+, MCP

 

[pierceit]

I'm in the same boat folks. The only other place I know to look for clues is the Windows Update.log file in the root of %windir% on the client.

On the ONE client (of 3 test machines) I apparently got this to work on, I show in the above mentioned log file that the iuident.cab file is being downloaded from my SUS server everytime it goes to check for updates. The other 2 clients in the test group are not working, and do not show this event in their logs.

Perhaps these additional, cryptic bits of information jog someone's brain out there?

 

[philote]

Pierceit, you've checked the registry keys I refered to above and they're set correctly? And you can get to your SUSAdmin web page fine? And is the Automatic Updates service running on the clients?
If you answered yes to all these then I'm baffled.

Also, what OS are the clients and are you using GPO or editing the registry for the clients' SUS settings?

Kevin
A+, Network+, MCP

 

[CCNI]

Here is a very good tutorial from Microsoft on setting up SUS. If you haven't seen it I highly recommend it.

http://www.microsoft.com/windowsserver2003/evaluation/demos/sims/sus/viewer.htm

Mike Jones, A+ MCSE
Systems Engineer/Owner
CCNI

http://www.ccni.com