Wsus Diagnostics Issues Solved Final Final 3p2616
This document was ed by and they confirmed that they have the permission to share it. If you are author or own the copyright of this book, please report to us by using this report form. Report l4457
Overview 6h3y3j
& View Wsus Diagnostics Issues Solved Final Final as PDF for free.
More details h6z72
- Words: 4,005
- Pages: 15
Top 5 WSUS Diagnostics Issues Solved! Lawrence Garvin, WSUS MVP Bonus! Common Windows Error Codes Explained
Follow SolarWinds:
Table of Contents Top 5 WSUS Diagnostics Issues Solved!.................................................................................................................3 Clients Not Showing Up in WSUS?.........................................................................................................................4 WSUS Simply Not Working?..................................................................................................................................6 WSUS Causing High U Utilization?...................................................................................................................10 Duplicate SUSClientIDs?.......................................................................................................................................12 Long-Running or Failed s?...................................................................................................................13 Common Windows Update Agent Error Codes...................................................................................................14
Follow SolarWinds:
Top 5 WSUS Diagnostics Issues Solved! Summary Are you using Microsoft’s free patch management tool, Windows Sever Update Services or WSUS for patch management? If so, chances are you have some unresolved issues that you just haven’t had time to fix. For example, do you have a few machines that won’t report to WSUS? Are you wondering why some updates won’t ? Or why WSUS has high U utilization? In this whitepaper, written by Microsoft MVP and WSUS Expert, Lawrence Garvin, you’ll learn how to diagnose and solve the top 5 WSUS performance and configuration issues. Top 5 WSUS Diagnostics Issues Solved •
Machines not reporting to WSUS? Use the Client Diagnostics Tool
•
WSUS not working well? Use the Windows Update Log to identify & repair errors
•
WSUS causing high U utilization? Determine the cause and fix it
•
Duplicate SUSClientIDs in WSUS? Fix them and prevent them
•
Excessive WSUS time or failed s? Diagnose and repair
•
Bonus: Recent Windows Update Agent Version Numbers
•
Bonus: Common Windows Update Agent Error Codes
About the Author: Lawrence Garvin, M.S., MVP, MCITP, has been working with Microsoft® Windows Server Update Services (WSUS) and Software Update Services (SUS) since the release of SUS SP1 in 2003, and update management, generally, since the creation of Windows Update in 1998. Prior to ing EminentWare (now part of SolarWinds) in 2009, he offered Windows Server Update Services expertise, as Principal/CTO of Onsite Technology Solutions to companies worldwide including deployment, implementation, and troubleshooting advice. Lawrence is also an independent WSUS evangelist and is a frequent contributor to WSUS forums and other online community sites.
SolarWinds Patch Manager gives you the ability to patch 3rd party applications using Microsoft WSUS and SCCM… automatically receive ready-to-deploy patches.
Learn More »
Follow SolarWinds:
Try It FREE »
3
Clients not showing up in WSUS? Use the WSUS Client Diagnostics Tool to test that a client has the necessary functionality to talk to a WSUS Server The WSUS Client Diagnostics Tool has been designed to aid the WSUS in troubleshooting the client machines that are failing to report back to the WSUS Server. The tool will do a few preliminary checks and test the communication between the WSUS Server and the client machine. Once the tool has completed the tests, it will display the results in the console window. You also have the option to have the results logged to a file in addition to being displayed on the console. NOTE: The WSUS Client Diagnostic Tool has some limitations as it is only available in 32-bit. It was written before there was a 64-bit WSUS. Specifically, it was written for
Live Webcast: SCCM 2012 Insider’s Look Hierarchy Simplification
the WSUS Version 2 environment and has not been updated regularly. It is still a very
June 20th, 2012, 1pm CST
useful tool, but because it is not aware of WSUS Version 3, some of the results can be
NOW »
misleading. Before you start, be aware that the Client Diagnostics Tool checks for the correct istrative rights to run this tool, so you must run it from an with local istrative permissions. The Client Diagnostics Tool tests four areas to that a client has the necessary functionality to talk to a WSUS server: •
Issues about the machine state
•
Verifies some automatic update settings
•
Looks at the proxy configuration for the client
•
Attempts to connect to the WSUS server that is configured in the policy
Follow SolarWinds:
4
the Machine State: In this function, the Client Diagnostics Tool will •
Check if the current logged on running the tool has istrative access as this is required in order to obtain the information required to successfully complete the diagnosis of the machine.
•
Check the current state of the Automatic Updates & Background Intelligent Transfer Service (BITS).
•
Determine which version of the Windows Update Agent (wuaueng.dll binary) is currently installed.
If you or FAIL the above tests, you will receive a report similar to Diagram 1, below:
WSUS Client Diagnostics Tool, Diagram 1. AU Settings After ing that the machine may continue running the tool, the Client Diagnostics Tool will check the Automatic Update (AU) settings, including the AUOptions setting in the registry. This will that the settings match and determine whether the AUOption is being set from policy or from the control . This will that your Windows Update Agent policies are being applied correctly. If you receive a , you will see an image similar to Diagram 2.
WSUS Client Diagnostics Tool, Diagram 2 Proxy Configurations: In this function, the Client Diagnostics Tool will obtain and display the proxy configuration settings for both the Local System (Win HTTP) and the current Internet Explorer settings. This check is applicable to WSUS environments if the clients need to go through a proxy server to access the WSUS server, or the WSUS server is
Follow SolarWinds:
5
configured so the clients the update files from the Microsoft Update service. Unfortunately, it does not provide advice on whether these settings are correct, it simply reports the information. So, if you have a proxy client configuration, the settings here.
WSUS Client Diagnostics Tool, Diagram 3 Test Connection to the WSUS Server: For this function, the WSUS Client Diagnostics Tool connects to the WSUS server that is configured via policy. In this section, there are three items that you should check in order to identify problems: •
Ensure that the Wver and the WUStatusServer values are identical. They must be identical in order for the Window Update Agent to work.
•
Ensure that the “UseWver” registry value is set to “true.” This enables the Agent to use WSUS instead of using Automatic Updates from Microsoft.com.
•
Connect to the server, and then that the self-update tree or folder is present on the server. If it is not, you’ll need to add it.
The issues above are some of the most common causes of connection problems, so if the WSUS Client Diagnostics Tool has any issues connecting to the server, it will most likely be detected here and error codes will be displayed.
WSUS simply not working? Use the “Windows Update Log” to diagnose WSUS issues and identify errors The Windows Update Log is a useful WSUS diagnostics tool that is a rolling log file. It generally contains about 30 days of entries or 2 MB of data, so be aware of these limitations. The Windows Update Log is located in the Windows Directory. The Windows Update Log provides many functions, but in this paper, we’ll discuss five features of the
Follow SolarWinds:
6
Windows Update Log that provide useful WSUS diagnostics. These features will help you identify whether WSUS is configured and working correctly, whether there are errors, and ensure that all of your WSUS clients are successfully executing detection.
Windows Update Log, Diagram 1 Items Identified at Service Startup You can find the service startup section by the banner in the log file that says “Service Startup.” At Service Startup, several items are logged which can be used to identify the particular machine and to that settings are correct. The items are: •
The build number of the Windows Update Agent (WUA)
•
The time zone at which the entry was logged. All of the text entries in the Windows Update Log are recorded in GMT. The timestamps on the left-hand side are in the machine’s local time, but the log entries themselves are in GMT.
•
The proxy configuration for the client and the network state. The Windows Update Agent is aware whether the machine is connected to the network or not. If a detection event is initiated during a disconnected time, the WUA will reschedule the detection to occur when the machine is reconnected to the network.
This is particularly useful for notebook machines that are not always connected to the network.
Follow SolarWinds:
7
•
Configuration parameters for the agent including the Wver value and the WUStatusServer values
•
The target group hip(s) of the machine when client-side targeting is being used.
•
The value of the setting for “WindowsUpdateAccessDisabled” which is “yes” or “no.” This policy value can be used to block the ’s ability to access any Windows Update (WU) or Microsoft Update (MU) functionality.
•
The WSUS Server URL, the detection frequency, how the updates are being installed, when scheduled events occur, and the next scheduled installation time.
•
Inventory information including the operating system version, build number, the computer hardware that it is configured on, and language information
Self-Update In this section, the machine looks at the current version of the client, looks at the version of the client that’s available from the WSUS server, and then ensures that the client has the latest available version. See Diagram 2 for an example.
Windows Update Log, Diagram 2
Detection Process This process involves four steps. If any of these four steps encounter an issue, the Windows Update Agent will log an error message. •
Call the client web service.
•
Initialize the targeting cookie and a call to the “simpleauth” web service.
Follow SolarWinds:
8
•
Call against the client web service to get the extended update information.
•
Produce a log entry showing how many updates were detected, how many product categories were searched, and how many updates were tested.
See Diagram 3 for an example.
Windows Update Log, Diagram 3 ing: ing creates simple log entries. The initiates then the agent hands the off to the Background Intelligent Transfer Service (BITS). Two items are logged in the Windows Update Log. The first is the title of the update (this is the only place that the actual title of the update is logged.) Secondly, the log tracks where the update is being ed from, where it’s being ed to, and the actual file name on the WSUS server that is being transferred. If there are any issues ing, you’ll see it in the Windows Update Log. See Diagram 4 for an example.
Windows Update Log, Diagram 4 Reporting Reporting also creates simple log entries. WSUS tracks reporting calls to the ReportingWebService. At a minimum, this executes an event that will always two events. See Diagram 5, for an example. If there are any issues executing the call, you’ll see an error in the Windows Update Log
Follow SolarWinds:
9
Windows Update Log, Diagram 5
WSUS causing high U utilization? Check for high U utilization on the servicehost.exe process The Window Update Client runs on the svchost.exe process. If you notice high U utilization caused by this process, there are several common issues that may be the cause. Here is a list of questions that will help you diagnose the issue: Are you running WSUS Version 2? If yes and you are experiencing high U utilization issues, then the best fix is to WSUS 3 or the most recent version of WSUS. Are you using Outlook 2003 with Office XP? If yes and you are experiencing svchost.exe performance issues, the best resolution is to upgrade Office XP to a newer version of Office. This issue primary occurs in SBS 2003 environments where Outlook 2003 may have been deployed on older Windows XP/Office XP machines. Are you using Office 2003 with a large number of updates already applied on the client? The svchost.exe process may run slowly because the Windows Installer folder has a large number of packages. The client must scan these updates each time to inventory what is on the machine. The recommended fix is to uninstall Office 2003, which will clear out that folder, reinstall Office 2003, and apply Service Pack 3 directly to the machine. This will minimize the number of files contained in the installer folder. Do you have superseded updates on the WSUS server that have not been declined? If so, and you are experiencing high U utilization, are you also using the v7.1 client? There were known performance issues in the v7.1 client with large volumes of updates being scanned. To fix this issue, you need to do two things: •
Mark the superseded updates as “declined.”
•
the latest client. This can be done by upgrading to WSUS 3 Service Pack 2 which has a new build of the Windows Update Agent (v7.4) which will fix the issue. You can also browse to Windows Update or Microsoft Update, or the Windows Update Agent 3.0 installer.
Do you have a Group Policy conflict with Windows Update Agent v7.4? If you have updated the WUAgent to v7.4, there is a known conflict with the WUAgent v7.4 client and a particular Group Policy setting shown to the right. To eliminate the conflict, that the Group Policy setting “ missing COM components” is Disabled or Not Configured. You will find this setting in Computer Configuration\istrative Templates\System.
Follow SolarWinds:
10
Try disabling the Group Policy Setting “ missing COM components”
Duplicate SUSClientIDs? Clean up and prevent them to keep WSUS running well Duplicate SUSClientIDs are caused when a machine is cloned from a master image that already has a SusClientID stored in the registry. It is an issue that becomes more complicated to fix over time, so it’s in your best interest to solve this as soon as you realize it’s an issue. The Duplicate SUSClientID can cause two problems •
First, your WSUS console will only show a percentage of the machines in your environment. While the names of the machines change, the physical number of machines in the list is fixed. This number shown by WSUS is the number of unique SusClientIDs in the environment, but not the actual number of client systems. If you have 1000 machines, WSUS could show as little as one machine if every machine in the environment has been incorrectly cloned from a single master image.
•
Secondly, certain error codes can be directly traced to duplicate SusClientIDs. If you’re seeing any of these error codes, duplicate SusClientIDs are most likely the reason. (See Page 9 for a description of common WSUS error codes.)
How to fix duplicate SUSClientIDs In older versions of WSUS, prior to version 3, the problem automatically resolved itself by comparing the machine SIDS and the Windows Update Agent Version 5 client registry
Follow SolarWinds:
11
value called DomainSID. If they didn’t match, the Windows Update Agent would automatically generate a new SUSClientID. However, if you’re using WSUS 3 which installs the Windows Update Agent Version 7 release, the DomainSID value was removed from the registry. So there is nothing to tell the Windows Update Agent that it should generate a new SusClientID. To fix the problem, you must delete the SUSClientID from the registry. Then the Windows Update Agent sees that the ID is missing and will generate a new one. There are two places to find the SUSClientID: •
In the registry in the CurrentVersion\WindowsUpdate key.
•
It is also logged in the “Initializing Simple Targeting Cookie” log entry in the Windows Update Log.
The Solution The preferred fix would be to remove the applicable registry key from your master image before cloning. If you are unable to do this, you must remove the duplicate ID from each of the cloned machines and then restart the Automatic Updates service, which will generate a new unique value and replace the old one. Luckily, the Windows Update Agent v7.4 has been enhanced to auto-detect and remediate duplicate SusClientIDs. Therefore, the duplicate SUSClientID issue should cease to exist in the future for environments running WSUS v3 SP2 and the WUAgent v7.4!,
Long-running or failed s? Use WSUS Server-Side Diagnostics to analyze and repair If a is taking a very long time, first determine how many approved updates you have waiting. If you have 50 or more updates, simply put, you have a lot of content to be ed. Numerous waiting updates makes BITS run slowly. This service runs based upon available bandwidth. If s are actually failing, you will need to check for errors in the Application Event Log on the WSUS server. There are two common error codes that will show reasons for a failure: HTTP v1.1 Range Protocol Header The failure is caused by a firewall, proxy server, or other network appliance between the WSUS Server and Microsoft that is not properly configured or that is not capable of ing the HTTP Version 1.1 Range Protocol Header that is being used in the
Follow SolarWinds:
12
instance. The solution: There are some third-party firewall and proxy server appliances that either do not or have not been configured to the WSUS range protocol header. This behavior has also been observed to be caused by some web filtering appliances. If you see an Application Event Log entry that says something about Range Protocol Headers, the most likely cause is a device that is sitting between you and the Internet. This is a very common issue with SonicWall appliances. A fix is available on SonicWall’s website, or visit the website of the appliance in question for advice. Permissions on the non-SYSVOL volume If content is being stored on a volume other than the system volume, most likely, access is being denied on that other volume. You will often see this as “access denied” for drive D or drive E, etc. The solution: This is actually a defect in the .NET Framework. Unfortunately, .NET does not automatically give the Network Service read access to the ROOT of non-SYSVOL drives. So when WSUS is configured to write to those drives, the Network Service cannot read the ROOT of the drive and find the path to write. To fix this issue, you must add the Network Service to the ROOT drive and give it “read” permissions. Simply select the drive, go to the security tab, add the Network Service , and add “read” permissions.
Recent Windows Update Agents: Details •
Version 7.6 is an upgrade available for Windows 7 SP1 and Windows Server 2008 R2 SP1 systems to fix a defect in the 7.5 agent.
•
Version 7.5 shipped in the Service Pack 1 upgrade for Windows Server 2008 R2.
•
Version 7.4 is the current primary production release. It shipped with WSUS Version 3 Service Pack 2
•
Version 7.3 shipped in Windows 7 and Windows Server 2008 R2
•
Version 7.2 was released in Summer, 2008, to Windows Update and Microsoft Update clients
•
Version 7.1 comes from WSUS Version 3 Service Pack 1
•
Version 7.0 client comes from WSUS Version 3, the release version from 2007
•
Finally, there are the older version 5 clients, which are relevant to WSUS Version 2 and Software Update Services-
Follow SolarWinds:
13
Common Windows Update Agent Error Codes HTTP 401 error codes (0x80190191 or 0x80244017) These are access issues and are typically caused because the virtual server, the default website, the WSUS istration website, or one or more of the virtual directories don’t have the correct IIS permissions – and anonymous access has been removed. This may be caused where permissions have been set on the IIS web server before WSUS installed. HTTP 403 error codes (0x80190193 or 0x80244018) Commonly caused when the proxy client configuration for Win HTTP is not correct or when the proxy server is interfering. These may also occur on the server side if the Options|Proxy Configuration setting for the WSUS server is improperly set and the Internet firewall or proxy server is interfering. You may also see these on Windows Server 2008 systems or down level systems if the firewall has been enabled and the proper ingress filters for the web service ports are not enabled. (By default, a WSUS server needs to have port 80 open to basic content. If you’re using the WSUS istration alternate site, you’ll need 8530, if you’re using SSL, you’ll also need 443 or 8531.) HTTP 404 errors (0x80190194 or 0x80244019) This typically occurs after WSUS 3 Service Pack 1 has been applied. It may also occur when content has been inadvertently deleted from the WSUS content folder, and the WUA tries to the missing file. This may happen after using the Server Cleanup Wizard while the client is still trying to content that that was previously approved or because the files have actually been removed from the folder tree. Use the wsusutil reset command to have the WSUS server identify any content that should be there and it again. 0x80072EE5 is an invalid URL error code Typical cause: there are trailing slashes in the URL in the policy definition, resulting in a double-slash when the rest of the path name is appended for a file . The trailing slash should not be in the URL name and should be removed. 0x80072EE6 error, identified as an unrecognized scheme This is a URL problem. A URL may have missing or invalid characters; URLs have backslashes instead of forward slashes, the URLs are missing the prefix entirely, or the URLs have been defined with a UNC machine name rather than a URL. To fix, check all URLs to ensure that they are correct.
Follow SolarWinds:
14
HTTP 401 error codes (0x80190191 or 0x80244017) These are access issues and are typically caused because the virtual server, the default website, the WSUS istration website, or one or more of the virtual directories don’t have the correct IIS permissions – and anonymous access has been removed. This may be caused where permissions have been set on the IIS web server before WSUS installed. HTTP 403 error codes (0x80190193 or 0x80244018) Commonly caused when the proxy client configuration for Win HTTP is not correct or when the proxy server is interfering. These may also occur on the server side if the Options|Proxy Configuration setting for the WSUS server is improperly set and the Internet firewall or proxy server is interfering. You may also see these on Windows Server 2008 systems or down level systems if the firewall has been enabled and the proper ingress filters for the web service ports are not enabled. (By default, a WSUS server needs to have port 80 open to basic content. If you’re using the WSUS istration alternate site, you’ll need 8530, if you’re using SSL, you’ll also need 443 or 8531.) HTTP 404 errors (0x80190194 or 0x80244019) This typically occurs after WSUS 3 Service Pack 1 has been applied. It may also occur when content has been inadvertently deleted from the WSUS content folder, and the WUA tries to the missing file. This may happen after using the Server Cleanup Wizard while the client is still trying to content that that was previously approved or because the files have actually been removed from the folder tree. Use the wsusutil reset command to have the WSUS server identify any content that should be there and it again. 0x80072EE5 is an invalid URL error code Typical cause: there are trailing slashes in the URL in the policy definition, resulting in a double-slash when the rest of the path name is appended for a file . The trailing slash should not be in the URL name and should be removed. 0x80072EE6 error, identified as an unrecognized scheme This is a URL problem. A URL may have missing or invalid characters; URLs have backslashes instead of forward slashes, the URLs are missing the prefix entirely, or the URLs have been defined with a UNC machine name rather than a URL. To fix, check all URLs to ensure that they are correct.
Follow SolarWinds:
15
Follow SolarWinds:
Table of Contents Top 5 WSUS Diagnostics Issues Solved!.................................................................................................................3 Clients Not Showing Up in WSUS?.........................................................................................................................4 WSUS Simply Not Working?..................................................................................................................................6 WSUS Causing High U Utilization?...................................................................................................................10 Duplicate SUSClientIDs?.......................................................................................................................................12 Long-Running or Failed s?...................................................................................................................13 Common Windows Update Agent Error Codes...................................................................................................14
Follow SolarWinds:
Top 5 WSUS Diagnostics Issues Solved! Summary Are you using Microsoft’s free patch management tool, Windows Sever Update Services or WSUS for patch management? If so, chances are you have some unresolved issues that you just haven’t had time to fix. For example, do you have a few machines that won’t report to WSUS? Are you wondering why some updates won’t ? Or why WSUS has high U utilization? In this whitepaper, written by Microsoft MVP and WSUS Expert, Lawrence Garvin, you’ll learn how to diagnose and solve the top 5 WSUS performance and configuration issues. Top 5 WSUS Diagnostics Issues Solved •
Machines not reporting to WSUS? Use the Client Diagnostics Tool
•
WSUS not working well? Use the Windows Update Log to identify & repair errors
•
WSUS causing high U utilization? Determine the cause and fix it
•
Duplicate SUSClientIDs in WSUS? Fix them and prevent them
•
Excessive WSUS time or failed s? Diagnose and repair
•
Bonus: Recent Windows Update Agent Version Numbers
•
Bonus: Common Windows Update Agent Error Codes
About the Author: Lawrence Garvin, M.S., MVP, MCITP, has been working with Microsoft® Windows Server Update Services (WSUS) and Software Update Services (SUS) since the release of SUS SP1 in 2003, and update management, generally, since the creation of Windows Update in 1998. Prior to ing EminentWare (now part of SolarWinds) in 2009, he offered Windows Server Update Services expertise, as Principal/CTO of Onsite Technology Solutions to companies worldwide including deployment, implementation, and troubleshooting advice. Lawrence is also an independent WSUS evangelist and is a frequent contributor to WSUS forums and other online community sites.
SolarWinds Patch Manager gives you the ability to patch 3rd party applications using Microsoft WSUS and SCCM… automatically receive ready-to-deploy patches.
Learn More »
Follow SolarWinds:
Try It FREE »
3
Clients not showing up in WSUS? Use the WSUS Client Diagnostics Tool to test that a client has the necessary functionality to talk to a WSUS Server The WSUS Client Diagnostics Tool has been designed to aid the WSUS in troubleshooting the client machines that are failing to report back to the WSUS Server. The tool will do a few preliminary checks and test the communication between the WSUS Server and the client machine. Once the tool has completed the tests, it will display the results in the console window. You also have the option to have the results logged to a file in addition to being displayed on the console. NOTE: The WSUS Client Diagnostic Tool has some limitations as it is only available in 32-bit. It was written before there was a 64-bit WSUS. Specifically, it was written for
Live Webcast: SCCM 2012 Insider’s Look Hierarchy Simplification
the WSUS Version 2 environment and has not been updated regularly. It is still a very
June 20th, 2012, 1pm CST
useful tool, but because it is not aware of WSUS Version 3, some of the results can be
NOW »
misleading. Before you start, be aware that the Client Diagnostics Tool checks for the correct istrative rights to run this tool, so you must run it from an with local istrative permissions. The Client Diagnostics Tool tests four areas to that a client has the necessary functionality to talk to a WSUS server: •
Issues about the machine state
•
Verifies some automatic update settings
•
Looks at the proxy configuration for the client
•
Attempts to connect to the WSUS server that is configured in the policy
Follow SolarWinds:
4
the Machine State: In this function, the Client Diagnostics Tool will •
Check if the current logged on running the tool has istrative access as this is required in order to obtain the information required to successfully complete the diagnosis of the machine.
•
Check the current state of the Automatic Updates & Background Intelligent Transfer Service (BITS).
•
Determine which version of the Windows Update Agent (wuaueng.dll binary) is currently installed.
If you or FAIL the above tests, you will receive a report similar to Diagram 1, below:
WSUS Client Diagnostics Tool, Diagram 1. AU Settings After ing that the machine may continue running the tool, the Client Diagnostics Tool will check the Automatic Update (AU) settings, including the AUOptions setting in the registry. This will that the settings match and determine whether the AUOption is being set from policy or from the control . This will that your Windows Update Agent policies are being applied correctly. If you receive a , you will see an image similar to Diagram 2.
WSUS Client Diagnostics Tool, Diagram 2 Proxy Configurations: In this function, the Client Diagnostics Tool will obtain and display the proxy configuration settings for both the Local System (Win HTTP) and the current Internet Explorer settings. This check is applicable to WSUS environments if the clients need to go through a proxy server to access the WSUS server, or the WSUS server is
Follow SolarWinds:
5
configured so the clients the update files from the Microsoft Update service. Unfortunately, it does not provide advice on whether these settings are correct, it simply reports the information. So, if you have a proxy client configuration, the settings here.
WSUS Client Diagnostics Tool, Diagram 3 Test Connection to the WSUS Server: For this function, the WSUS Client Diagnostics Tool connects to the WSUS server that is configured via policy. In this section, there are three items that you should check in order to identify problems: •
Ensure that the Wver and the WUStatusServer values are identical. They must be identical in order for the Window Update Agent to work.
•
Ensure that the “UseWver” registry value is set to “true.” This enables the Agent to use WSUS instead of using Automatic Updates from Microsoft.com.
•
Connect to the server, and then that the self-update tree or folder is present on the server. If it is not, you’ll need to add it.
The issues above are some of the most common causes of connection problems, so if the WSUS Client Diagnostics Tool has any issues connecting to the server, it will most likely be detected here and error codes will be displayed.
WSUS simply not working? Use the “Windows Update Log” to diagnose WSUS issues and identify errors The Windows Update Log is a useful WSUS diagnostics tool that is a rolling log file. It generally contains about 30 days of entries or 2 MB of data, so be aware of these limitations. The Windows Update Log is located in the Windows Directory. The Windows Update Log provides many functions, but in this paper, we’ll discuss five features of the
Follow SolarWinds:
6
Windows Update Log that provide useful WSUS diagnostics. These features will help you identify whether WSUS is configured and working correctly, whether there are errors, and ensure that all of your WSUS clients are successfully executing detection.
Windows Update Log, Diagram 1 Items Identified at Service Startup You can find the service startup section by the banner in the log file that says “Service Startup.” At Service Startup, several items are logged which can be used to identify the particular machine and to that settings are correct. The items are: •
The build number of the Windows Update Agent (WUA)
•
The time zone at which the entry was logged. All of the text entries in the Windows Update Log are recorded in GMT. The timestamps on the left-hand side are in the machine’s local time, but the log entries themselves are in GMT.
•
The proxy configuration for the client and the network state. The Windows Update Agent is aware whether the machine is connected to the network or not. If a detection event is initiated during a disconnected time, the WUA will reschedule the detection to occur when the machine is reconnected to the network.
This is particularly useful for notebook machines that are not always connected to the network.
Follow SolarWinds:
7
•
Configuration parameters for the agent including the Wver value and the WUStatusServer values
•
The target group hip(s) of the machine when client-side targeting is being used.
•
The value of the setting for “WindowsUpdateAccessDisabled” which is “yes” or “no.” This policy value can be used to block the ’s ability to access any Windows Update (WU) or Microsoft Update (MU) functionality.
•
The WSUS Server URL, the detection frequency, how the updates are being installed, when scheduled events occur, and the next scheduled installation time.
•
Inventory information including the operating system version, build number, the computer hardware that it is configured on, and language information
Self-Update In this section, the machine looks at the current version of the client, looks at the version of the client that’s available from the WSUS server, and then ensures that the client has the latest available version. See Diagram 2 for an example.
Windows Update Log, Diagram 2
Detection Process This process involves four steps. If any of these four steps encounter an issue, the Windows Update Agent will log an error message. •
Call the client web service.
•
Initialize the targeting cookie and a call to the “simpleauth” web service.
Follow SolarWinds:
8
•
Call against the client web service to get the extended update information.
•
Produce a log entry showing how many updates were detected, how many product categories were searched, and how many updates were tested.
See Diagram 3 for an example.
Windows Update Log, Diagram 3 ing: ing creates simple log entries. The initiates then the agent hands the off to the Background Intelligent Transfer Service (BITS). Two items are logged in the Windows Update Log. The first is the title of the update (this is the only place that the actual title of the update is logged.) Secondly, the log tracks where the update is being ed from, where it’s being ed to, and the actual file name on the WSUS server that is being transferred. If there are any issues ing, you’ll see it in the Windows Update Log. See Diagram 4 for an example.
Windows Update Log, Diagram 4 Reporting Reporting also creates simple log entries. WSUS tracks reporting calls to the ReportingWebService. At a minimum, this executes an event that will always two events. See Diagram 5, for an example. If there are any issues executing the call, you’ll see an error in the Windows Update Log
Follow SolarWinds:
9
Windows Update Log, Diagram 5
WSUS causing high U utilization? Check for high U utilization on the servicehost.exe process The Window Update Client runs on the svchost.exe process. If you notice high U utilization caused by this process, there are several common issues that may be the cause. Here is a list of questions that will help you diagnose the issue: Are you running WSUS Version 2? If yes and you are experiencing high U utilization issues, then the best fix is to WSUS 3 or the most recent version of WSUS. Are you using Outlook 2003 with Office XP? If yes and you are experiencing svchost.exe performance issues, the best resolution is to upgrade Office XP to a newer version of Office. This issue primary occurs in SBS 2003 environments where Outlook 2003 may have been deployed on older Windows XP/Office XP machines. Are you using Office 2003 with a large number of updates already applied on the client? The svchost.exe process may run slowly because the Windows Installer folder has a large number of packages. The client must scan these updates each time to inventory what is on the machine. The recommended fix is to uninstall Office 2003, which will clear out that folder, reinstall Office 2003, and apply Service Pack 3 directly to the machine. This will minimize the number of files contained in the installer folder. Do you have superseded updates on the WSUS server that have not been declined? If so, and you are experiencing high U utilization, are you also using the v7.1 client? There were known performance issues in the v7.1 client with large volumes of updates being scanned. To fix this issue, you need to do two things: •
Mark the superseded updates as “declined.”
•
the latest client. This can be done by upgrading to WSUS 3 Service Pack 2 which has a new build of the Windows Update Agent (v7.4) which will fix the issue. You can also browse to Windows Update or Microsoft Update, or the Windows Update Agent 3.0 installer.
Do you have a Group Policy conflict with Windows Update Agent v7.4? If you have updated the WUAgent to v7.4, there is a known conflict with the WUAgent v7.4 client and a particular Group Policy setting shown to the right. To eliminate the conflict, that the Group Policy setting “ missing COM components” is Disabled or Not Configured. You will find this setting in Computer Configuration\istrative Templates\System.
Follow SolarWinds:
10
Try disabling the Group Policy Setting “ missing COM components”
Duplicate SUSClientIDs? Clean up and prevent them to keep WSUS running well Duplicate SUSClientIDs are caused when a machine is cloned from a master image that already has a SusClientID stored in the registry. It is an issue that becomes more complicated to fix over time, so it’s in your best interest to solve this as soon as you realize it’s an issue. The Duplicate SUSClientID can cause two problems •
First, your WSUS console will only show a percentage of the machines in your environment. While the names of the machines change, the physical number of machines in the list is fixed. This number shown by WSUS is the number of unique SusClientIDs in the environment, but not the actual number of client systems. If you have 1000 machines, WSUS could show as little as one machine if every machine in the environment has been incorrectly cloned from a single master image.
•
Secondly, certain error codes can be directly traced to duplicate SusClientIDs. If you’re seeing any of these error codes, duplicate SusClientIDs are most likely the reason. (See Page 9 for a description of common WSUS error codes.)
How to fix duplicate SUSClientIDs In older versions of WSUS, prior to version 3, the problem automatically resolved itself by comparing the machine SIDS and the Windows Update Agent Version 5 client registry
Follow SolarWinds:
11
value called DomainSID. If they didn’t match, the Windows Update Agent would automatically generate a new SUSClientID. However, if you’re using WSUS 3 which installs the Windows Update Agent Version 7 release, the DomainSID value was removed from the registry. So there is nothing to tell the Windows Update Agent that it should generate a new SusClientID. To fix the problem, you must delete the SUSClientID from the registry. Then the Windows Update Agent sees that the ID is missing and will generate a new one. There are two places to find the SUSClientID: •
In the registry in the CurrentVersion\WindowsUpdate key.
•
It is also logged in the “Initializing Simple Targeting Cookie” log entry in the Windows Update Log.
The Solution The preferred fix would be to remove the applicable registry key from your master image before cloning. If you are unable to do this, you must remove the duplicate ID from each of the cloned machines and then restart the Automatic Updates service, which will generate a new unique value and replace the old one. Luckily, the Windows Update Agent v7.4 has been enhanced to auto-detect and remediate duplicate SusClientIDs. Therefore, the duplicate SUSClientID issue should cease to exist in the future for environments running WSUS v3 SP2 and the WUAgent v7.4!,
Long-running or failed s? Use WSUS Server-Side Diagnostics to analyze and repair If a is taking a very long time, first determine how many approved updates you have waiting. If you have 50 or more updates, simply put, you have a lot of content to be ed. Numerous waiting updates makes BITS run slowly. This service runs based upon available bandwidth. If s are actually failing, you will need to check for errors in the Application Event Log on the WSUS server. There are two common error codes that will show reasons for a failure: HTTP v1.1 Range Protocol Header The failure is caused by a firewall, proxy server, or other network appliance between the WSUS Server and Microsoft that is not properly configured or that is not capable of ing the HTTP Version 1.1 Range Protocol Header that is being used in the
Follow SolarWinds:
12
instance. The solution: There are some third-party firewall and proxy server appliances that either do not or have not been configured to the WSUS range protocol header. This behavior has also been observed to be caused by some web filtering appliances. If you see an Application Event Log entry that says something about Range Protocol Headers, the most likely cause is a device that is sitting between you and the Internet. This is a very common issue with SonicWall appliances. A fix is available on SonicWall’s website, or visit the website of the appliance in question for advice. Permissions on the non-SYSVOL volume If content is being stored on a volume other than the system volume, most likely, access is being denied on that other volume. You will often see this as “access denied” for drive D or drive E, etc. The solution: This is actually a defect in the .NET Framework. Unfortunately, .NET does not automatically give the Network Service read access to the ROOT of non-SYSVOL drives. So when WSUS is configured to write to those drives, the Network Service cannot read the ROOT of the drive and find the path to write. To fix this issue, you must add the Network Service to the ROOT drive and give it “read” permissions. Simply select the drive, go to the security tab, add the Network Service , and add “read” permissions.
Recent Windows Update Agents: Details •
Version 7.6 is an upgrade available for Windows 7 SP1 and Windows Server 2008 R2 SP1 systems to fix a defect in the 7.5 agent.
•
Version 7.5 shipped in the Service Pack 1 upgrade for Windows Server 2008 R2.
•
Version 7.4 is the current primary production release. It shipped with WSUS Version 3 Service Pack 2
•
Version 7.3 shipped in Windows 7 and Windows Server 2008 R2
•
Version 7.2 was released in Summer, 2008, to Windows Update and Microsoft Update clients
•
Version 7.1 comes from WSUS Version 3 Service Pack 1
•
Version 7.0 client comes from WSUS Version 3, the release version from 2007
•
Finally, there are the older version 5 clients, which are relevant to WSUS Version 2 and Software Update Services-
Follow SolarWinds:
13
Common Windows Update Agent Error Codes HTTP 401 error codes (0x80190191 or 0x80244017) These are access issues and are typically caused because the virtual server, the default website, the WSUS istration website, or one or more of the virtual directories don’t have the correct IIS permissions – and anonymous access has been removed. This may be caused where permissions have been set on the IIS web server before WSUS installed. HTTP 403 error codes (0x80190193 or 0x80244018) Commonly caused when the proxy client configuration for Win HTTP is not correct or when the proxy server is interfering. These may also occur on the server side if the Options|Proxy Configuration setting for the WSUS server is improperly set and the Internet firewall or proxy server is interfering. You may also see these on Windows Server 2008 systems or down level systems if the firewall has been enabled and the proper ingress filters for the web service ports are not enabled. (By default, a WSUS server needs to have port 80 open to basic content. If you’re using the WSUS istration alternate site, you’ll need 8530, if you’re using SSL, you’ll also need 443 or 8531.) HTTP 404 errors (0x80190194 or 0x80244019) This typically occurs after WSUS 3 Service Pack 1 has been applied. It may also occur when content has been inadvertently deleted from the WSUS content folder, and the WUA tries to the missing file. This may happen after using the Server Cleanup Wizard while the client is still trying to content that that was previously approved or because the files have actually been removed from the folder tree. Use the wsusutil reset command to have the WSUS server identify any content that should be there and it again. 0x80072EE5 is an invalid URL error code Typical cause: there are trailing slashes in the URL in the policy definition, resulting in a double-slash when the rest of the path name is appended for a file . The trailing slash should not be in the URL name and should be removed. 0x80072EE6 error, identified as an unrecognized scheme This is a URL problem. A URL may have missing or invalid characters; URLs have backslashes instead of forward slashes, the URLs are missing the prefix entirely, or the URLs have been defined with a UNC machine name rather than a URL. To fix, check all URLs to ensure that they are correct.
Follow SolarWinds:
14
HTTP 401 error codes (0x80190191 or 0x80244017) These are access issues and are typically caused because the virtual server, the default website, the WSUS istration website, or one or more of the virtual directories don’t have the correct IIS permissions – and anonymous access has been removed. This may be caused where permissions have been set on the IIS web server before WSUS installed. HTTP 403 error codes (0x80190193 or 0x80244018) Commonly caused when the proxy client configuration for Win HTTP is not correct or when the proxy server is interfering. These may also occur on the server side if the Options|Proxy Configuration setting for the WSUS server is improperly set and the Internet firewall or proxy server is interfering. You may also see these on Windows Server 2008 systems or down level systems if the firewall has been enabled and the proper ingress filters for the web service ports are not enabled. (By default, a WSUS server needs to have port 80 open to basic content. If you’re using the WSUS istration alternate site, you’ll need 8530, if you’re using SSL, you’ll also need 443 or 8531.) HTTP 404 errors (0x80190194 or 0x80244019) This typically occurs after WSUS 3 Service Pack 1 has been applied. It may also occur when content has been inadvertently deleted from the WSUS content folder, and the WUA tries to the missing file. This may happen after using the Server Cleanup Wizard while the client is still trying to content that that was previously approved or because the files have actually been removed from the folder tree. Use the wsusutil reset command to have the WSUS server identify any content that should be there and it again. 0x80072EE5 is an invalid URL error code Typical cause: there are trailing slashes in the URL in the policy definition, resulting in a double-slash when the rest of the path name is appended for a file . The trailing slash should not be in the URL name and should be removed. 0x80072EE6 error, identified as an unrecognized scheme This is a URL problem. A URL may have missing or invalid characters; URLs have backslashes instead of forward slashes, the URLs are missing the prefix entirely, or the URLs have been defined with a UNC machine name rather than a URL. To fix, check all URLs to ensure that they are correct.
Follow SolarWinds:
15
Related Documents 543cg
Wsus Diagnostics Issues Solved Final Final 3p2616
October 2021 0
Final n7354
March 2021 0
Final n7354
April 2022 0
Final n7354
November 2019 75
Final n7354
January 2021 0