Dave Hildebrand.com » wsus

IMF Updates Keep Prompting for Installation

Dave — Mon, 22 Jun 2009 21:02:56 +0000

With the recent update to the IMF signatures for Exchange 2003 I got caught in a never ending circle of installation prompts. The new update would install, then last months update would ask to install and so on and so on. After realizing what was going on I went in search of answers. The 1st thing to try was to reset the Windows Update Cache. It can be done by plopping the code below in to a bat file and running it on the offending server.

net stop bits
net stop wuauserv
regsvr32 /u wuaueng.dll /s
del /f /s /q %windir%\SoftwareDistribution\*.*
del /f /s /q %windir%\windowsupdate.log
regsvr32 wuaueng.dll /s
net start bits
net start wuauserv
wuauclt.exe /resetauthorization /detectnow

This did not solve the issue for me. I turned out that my WSUS server did not mark the old IMF update as declined. Once the old update’s status was changed to declined the update cycle was stopped dead in its tracks.

WSUS 3.1 and the SelfUpdate Virtual Directory

Dave — Sun, 18 Jan 2009 23:14:21 +0000

I came back from my extended leave to find that my workstations and servers had not checked into the WSUS server for months. After a bit of detective work the issue came down to the SelfUpdate virtual directory in IIS was missing. The Microsoft help page details how to fix the issue but wasn’t completely helpful. More on that later.

Here is what I did to get my clients checking in again.

Check the folder permissions on the SelfUpdate directory, located at C:\Program Files\Update Service\SelfUpdate. Make sure the permissions like this;

Group	Permissions
Administrators	Full Control
System	Full Control
Domain/Users or Local/Users	Read&Execute, Read, List Folders
IUSR_ComputerName	Read&Execute, Read, List Folders

In my case the IUSR_ComputerName permission was missing.

After adding the correct permissions I looked for the re-installation msi, Selfupdate.msi. The only problem is that the SelfUpdate re-installation msi was not found on my WSUS server. Turns out in the recent WSUS update to 3.1 this installer can become corrupted and not installed on the server.

To get the Virtual Directory back I would have to install it by hand. Here are the settings you need to create it;

Open Internet Information Services (IIS) Manager. Right click on the “Default Web Site” and choose;

New
Virtual Directory…
It started the VD Creation Wizard
Alias = SelfUpdate
Path = C:\Program Files\Update Services\SelfUpdate
Finish the wizard.
Right click on the newly SelfUpdate and choose Permissions.
I added “Authenticated Users” and gave them the default rights:

Read & Execute
List Folder Contents
Read

After completing these steps I ran “wuauclt /detectnow” on each of my servers. I left the workstations to check in on their own.

Within 12 hours the number of missing clients had gone from nearly 200 to less than 50. Once everyone logs in on Monday morning this number should dwindle to nothing.

WSUS: Force a client update

Dave — Thu, 14 Sep 2006 15:23:39 +0000

For anyone who uses Microsoft's Windows Server Update Services (WSUS) and needs to force a client to check for updates, you can run the following command and the client will check with your WSUS server.

wuauclt /detectnow

This method is much faster, it usually takes only a few minutes, compared to the old way of deleting keys in the registry (& much safer too).

A good resource for admins running WSUS is at WSUS Forums. The folks there have helped many WSUS admins through many errors and mis-configurations.

Windows Defender & WSUS

Dave — Thu, 14 Sep 2006 15:00:55 +0000

I have installed Windows Defender on a few of the corporate laptops and noticed that they were not getting definition updates. I tried reinstalling the product but was unable to get it to update. Google turned up some leads but none of them worked for me. On a whim I went to check out WSUS server to see if the updates were available there. In the Sync Options area, under Products I saw what I wanted to see. Windows Defender updates are pushed through MS Update and since we use WSUS instead of MS Update the laptops were not getting updated. I few clicks and a sync later our Windows Defender installs are now getting up to date definitions.