WSUS clients won't download updates 1

[pinkpanther56]

I'm having trouble getting my WSUS clients to download updates, i've approved all the ones they should need and setup the GP. I'm sure the GP is working as the clients appear in the list on the WSUS server and say what updates they need and what they don't, but they never get applied.

Has anyone else had this problem?

Using 2003 server and IIS6.

Thanks.

 

[markdmac]

What setting in the group policy did you configure for installation?

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

4 Auto download and schedule install

 

[markdmac]

And if you run GPRESULT on the PC does it show that policy as being applied?

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

It shows the policy as applying.

I've noticed that the 2000 SP4 PC has shown up but won't download updates, the XP SP2 box doesn't even show up. I'm going to reinstall WSUS and try again now i think i'm more familiar with it.

I'll post back if it works.

Thanks.

 

[mikiemov]

I know its obvious but I presume you have also put

http://servername

for both entries under the "specify intranet microsoft update service location" ??

 

[AndrewTait]

Also, you have to make sure that the PC is on and logged off at the scheduled install time. The machine should then reboot if necessary, and show the patches installed.

If the PC is switched off or logged in the install will not start.

He's not the messiah, he's a very naughty boy (Monty Python's The Life of Brian)

 

[pinkpanther56]

I had it set to download from

http://lab/selfupdate

is that incorrect?

I'm just in the process of reinstalling it as i had fiddled and wasn't sure how to get back to scratch, i'll post back if your suggestions work.

Thanks guys.

 

[mikiemov]

I have our WSUS clients set to check

http://servername

only...that could be your reason.

 

[markdmac]

And if the WSUS was installed into its own web site then you need to make the path include the site port.

http://servername:5380.

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

I did have it installed to it's own web site last time but i went with the defaults this time. It seems to be working now so i'll see how it goes.

I have another question if you guys don't mind.

We are a college and so we have several rooms full of PC's 400 in all, these PC's each reside in their own OU as they have different software requirements. Should i have one GPO controlling windows updates attached to them all or should i have a policy per OU (about 10 OU's) to avoid a disaster?

What do you think guys?

Thanks.

 

[markdmac]

If you will need to block the application of hotfixes for certain PCs then you will need to move those PCs to their own group with WSUS. That can be done manually or via GPO.

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

Ahh i see there is a client side targeting GPO.

I don't want a situation where a set of updates takes out all our PC's even though i've tested them, so i was hoping to schedule them in groups.

Thanks.

 

[pinkpanther56]

I've decided to use client side targeting on each OU as i already have a settings GPO for each OU. It will mean me setting this 10 times but i can cope with that, also i can set the roons for different times to avoid swamping the server.

Please feel free to tell me i'm going down the wrong path.

Thanks for you help.

 

[pinkpanther56]

It now seems that only the XP SP2 PC's are receiving the updates and adding themselves to the correct WSUS group, the Win2k SP4 PC's are not. Any ideas this is driving me mad.

 

[markdmac]

In my testing I had to manually update Win2K machines wuaueng.dll file.

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

Hmm that could be the case here one of our rooms that has been around for a while has updated no problem but a room that's just been built will not contact the WSUS untill it has been to Windows update.

 

[pinkpanther56]

Do you use client side targeting?

 

[markdmac]

yes, I configure policies to tell the servers and workstations to go to WSUS groups called "servers" & "workstations."

I confiuure those policies so that server do not auto reboot but the workstations do.

I hope you find this post helpful.

Regards,

Mark

 

[pinkpanther56]

I'm slightly concerned about applying updates to so many clients in one go, i do test patches first but sometime problems don't always show up straight away.

Am i being over cautious creating three or four groups for my 400 clients?

Thanks.