Have you ever wanted a machine to just hurry up and install it’s updates already. Bjorn has a nice task that would be equally handy in Ops Mgr or Essentials for deploying updates immediately on an agent-managed target machine.
Check it out HERE.
I was confronted with a client workstation the other day that was not reporting back inventory data to my Essentials 2007 (SCE) Server. This is a sure sign that the Automatic Updates Client is not communicating successfully with the SCE. Although the software deployment and patch management features resemble those of SMS/SCCM, these functions within SCE are actually built on the WSUS 3.0 APIs, which exposes some functionality not necessary utilized by WSUS 3.0.
I usually start by checking my client settings on the affected machine to make sure they are pointed to the SCE Server, and not picking up settings from another GPO. This can be easily accomplished a couple of ways, but I usually grab the WSUS Client Diagnostic Tool, which has been designed to aid the WSUS administrator in troubleshooting client machines that are failing to report back to the WSUS Server. The tool will conduct preliminary checks and test the communication between the WSUS Server and the client machine. Once the tool has completed the tests it will display the results in the console window.
You can download a copy of the WSUS Diagnostic Tool HERE.
That being said, troubleshooting the Automatic Updates Client is a key part of managing your SCE deployment. For troubleshooting the Auto Update Client, status messages are written to log file, named “WindowsUpdate.Log”. The log is the same for AutoUpdate functionality for when visiting http://windowsupdate.microsoft.com or for communications with a WSUS 3.0 Server - our SCE Server in this case . The log file is located in the SystemRoot directory (generally C:\WINDOWS\)
In this example, when I went to the WinddowsUpdate.log on this workstation, I found the following error code: 0×80072efd
Error 0×80072efd translates to ERROR_INTERNET_CANNOT_CONNECT which means ‘The attempt to connect to the server failed’
When I see this error, and other clients are connecting successfully, it’s usually a problem with proxy settings.
The Automatic Updates Client uses WinHTTP proxy settings to access the SCE WSUS instance. WinHTTP proxy settings are separate from the proxy settings in Internet Explorer. If you are using Proxy server to access internet and proxy settings are configured for IE and WinHTTP proxy settings are set to null, then sometimes Automatic Updates Client fails with the errors shown above.
Again, we can use the WSUS Client Diagnostic Tool, which will check for WinHTTP local machine Proxy settings and User IE Proxy settings. In the below sample, WinHTTP local machine Proxy settings is set to Direct Connection whereas User IE Proxy settings is set to a local proxy server.
Output of the tool looks something like this:
Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy
proxy:8080
User IE ProxyByPass
10.*;;<local>
User IE AutoConfig URL Proxy . . . . . . . . . NONE
User IE AutoDetect
AutoDetect not in use
To update proxy settings used by the Automatic Updates Client, you can use the proxycfg command line utility.
To correct the problem we see in the above example, we can simply issue the command at a command prompt:
proxycfg.exe -u. This sets the WinHTTP Proxy settings to match IE proxy settings.
Were the situation reversed, meaning no proxy necessary but a proxy has for some reason been set for the WinHTTP Proxy service, issue the following command to remove the proxy: proxycfg.exe -d which specifies no proxy, or direct connection.
For more on proxycfg utility syntax, see
http://msdn2.microsoft.com/en-us/library/aa384069.aspx
The error codes in the Windowsupdate.log file are not plain English by any means, and require some translation. Automatic Updates Client / Windows Update error codes can be found at the following URL:
http://inetexplorer.mvps.org/archive/windows_update_codes.htm
It’s pretty common in the Essentials support forums we see administrators with Automatic Updates Clients pointed to a WSUS Server other than their SCE Server. This can happen with conflicting group policies are present in the Active Directory, and one GPO overrides another. To check to make sure your appropriate SCE Group Polices are applied, be sure to have a look at the Resultant Set of Policies with rsop.msc (XP and Windows 2003) or the gpresult command line utility (Windows 2000).
With the new Catalog, you can search for updates available through the Microsoft Update service and download them to your machine (regardless of whether the update is applicable to your machine).
You can also import updates from the Catalog directly into WSUS 3.0, System Center Essentials 2007, or System Center Configuration Manager 2007….
Additional features of the new catalog include Full-text search, RSS, Download with BITS, Shopping basket for multiple update selection.
More info at the source HERE.
Microsoft has released WSUS 3.0.
“Microsoft Windows Server Update Services (WSUS) 3.0 delivers new
features including an MMC-based user interface with advanced filtering
and reporting, improved performance and operational reliability,
flexible deployment options to improve branch office support, and more
content access through the Microsoft Update Catalog site.”
RTM bits are available for download from the URL below.
