1 Out Of 30+ Clients Not Reporting In WSUS - Error 8007007a

I was instructed to re-post here so...

My problem is a bit different so I hope it was appropriate to ask a new
question.

I have a server running SBS2K3 SP2 and 30 or so client PCs with about half
running VISTA Business SP1 and the other half running XP-Pro SP3. All of the
PCs are reporting to WSUS and all are being updated. However, one of the XP
machines (according to WSUS) has not reported to the server yet.

I ran 'wuauclt /resetauthorization /detectnow' this morning on the subject
machine and on another that runs the same OS. I printed the logs and did a
side-by-side comparison. Everything looked ok except at the end of the
subject machine's report, where it kicks out the 8007007a error as you can
see here:

2009-05-20 09:07:20:313 1416 38c AU AU received policy change subscription
event
2009-05-20 09:07:53:656 1416 8c8 AU Triggering AU detection through
DetectNow API
2009-05-20 09:07:53:656 1416 8c8 AU Triggering Online detection
(non-interactive)
2009-05-20 09:07:53:656 1416 38c AU #############
2009-05-20 09:07:53:656 1416 38c AU ## START ## AU: Search for updates
2009-05-20 09:07:53:656 1416 38c AU #########
2009-05-20 09:07:53:656 1416 38c AU <<## SUBMITTED ## AU: Search for updates
[CallId = {2B4E6AE0-8353-40B7-AEC2-99BC3A589CB3}]
2009-05-20 09:07:53:656 1416 764 Agent *************
2009-05-20 09:07:53:656 1416 764 Agent ** START ** Agent: Finding updates
[CallerId = AutomaticUpdates]
2009-05-20 09:07:53:656 1416 764 Agent *********
2009-05-20 09:07:53:656 1416 764 Agent * Online = Yes; Ignore download
priority = No
2009-05-20 09:07:53:656 1416 764 Agent * Criteria = "IsHidden=0 and
IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or
IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and
IsAssigned=1 or IsHidden=0 and IsInstalled=1 and
DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or
IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and
IsAssigned=1 and RebootRequired=1"
2009-05-20 09:07:53:656 1416 764 Agent * ServiceID =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2009-05-20 09:07:53:656 1416 764 Agent * Search Scope = {Machine}
2009-05-20 09:07:53:656 1416 764 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wuident.cab:
2009-05-20 09:07:53:703 1416 764 Misc Microsoft signed: Yes
2009-05-20 09:07:53:719 1416 764 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wuident.cab:
2009-05-20 09:07:53:719 1416 764 Misc Microsoft signed: Yes
2009-05-20 09:07:53:735 1416 764 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wsus3setup.cab:
2009-05-20 09:07:53:735 1416 764 Misc Microsoft signed: Yes
2009-05-20 09:07:53:750 1416 764 Setup *********** Setup: Checking whether
self-update is required ***********
2009-05-20 09:07:53:750 1416 764 Setup * Inf file:
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wsus3setup.inf
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\cdm.dll: target version = 7.2.6001.788, required version
= 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt.exe: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wups.dll: target version = 7.2.6001.788, required version
= 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wups2.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup Update NOT required for
C:\WINDOWS\system32\wuweb.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-05-20 09:07:53:750 1416 764 Setup * IsUpdateRequired = No
2009-05-20 09:07:56:797 1416 764 PT +++++++++++ PT: Synchronizing server
updates +++++++++++
2009-05-20 09:07:56:797 1416 764 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://wagsrv:8530/ClientWebService/client.asmx
2009-05-20 09:07:56:828 1416 764 PT WARNING: Cached cookie has expired or
new PID is available
2009-05-20 09:07:56:828 1416 764 PT Initializing simple targeting cookie,
clientId = 70d404c5-dbb0-4a01-b407-ef1fae30ff4c, target group = Vista
Business; XP Pro SP2, DNS name = meghan.wilsonargroup.local
2009-05-20 09:07:56:828 1416 764 PT Server URL =
http://wagsrv:8530/SimpleAuthWebService/SimpleAuth.asmx
2009-05-20 09:07:57:594 1416 764 PT +++++++++++ PT: Synchronizing extended
update info +++++++++++
2009-05-20 09:07:57:594 1416 764 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://wagsrv:8530/ClientWebService/client.asmx
2009-05-20 09:08:00:266 1416 764 Agent * Found 0 updates and 46 categories
in search; evaluated appl. rules of 453 out of 754 deployed entities
2009-05-20 09:08:00:328 1416 764 Agent *********
2009-05-20 09:08:00:328 1416 764 Agent ** END ** Agent: Finding updates
[CallerId = AutomaticUpdates]
2009-05-20 09:08:00:328 1416 764 Agent *************
2009-05-20 09:08:00:328 1416 dd4 AU >>## RESUMED ## AU: Search for updates
[CallId = {2B4E6AE0-8353-40B7-AEC2-99BC3A589CB3}]
2009-05-20 09:08:00:328 1416 dd4 AU # 0 updates detected
2009-05-20 09:08:00:328 1416 dd4 AU #########
2009-05-20 09:08:00:328 1416 dd4 AU ## END ## AU: Search for updates
[CallId = {2B4E6AE0-8353-40B7-AEC2-99BC3A589CB3}]
2009-05-20 09:08:00:328 1416 dd4 AU #############
2009-05-20 09:08:00:328 1416 dd4 AU AU setting next detection timeout to
2009-05-21 00:06:53
2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
{1D194FB4-F389-4B70-A0E0-7908628E8CC9} 2009-05-20
09:08:00:328-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Software
Synchronization Windows Update Client successfully detected 0 updates.
2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
{E7D20B16-BD8C-43C4-9D60-0893779195C0} 2009-05-20
09:08:00:328-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Pre-Deployment Check Reporting client status.
2009-05-20 09:16:02:947 1416 764 Report WARNING: Reporter failed to upload
events with hr = 8007007a.
2009-05-20 09:32:57:934 1416 d3c Report WARNING: Reporter failed to upload
events with hr = 8007007a.
2009-05-20 09:56:38:916 1416 b8 Report WARNING: Reporter failed to upload
events with hr = 8007007a.
2009-05-20 10:22:11:896 1416 bbc Report WARNING: Reporter failed to upload
events with hr = 8007007a.

I'd appreciate any help that can be offered to determine why WSUS is saying
that the PC is not reporting.

--
Gramps98

Gramps98 wrote:

> I was instructed to re-post here so...
>
> My problem is a bit different so I hope it was appropriate to ask a new
> question.

Certainly. In fact we prefer that each person start a new thread, as it helps
avoid confusion. (Often problems that may seem the same turn out not to be.)

> I have a server running SBS2K3 SP2 and 30 or so client PCs with about half
> running VISTA Business SP1 and the other half running XP-Pro SP3. All of the
> PCs are reporting to WSUS and all are being updated. However, one of the XP
> machines (according to WSUS) has not reported to the server yet.

So the first question to ask is: what's different about this machine?

> I ran 'wuauclt /resetauthorization /detectnow' this morning on the subject
> machine and on another that runs the same OS. I printed the logs and did a
> side-by-side comparison. Everything looked ok except at the end of the
> subject machine's report, where it kicks out the 8007007a error as you can
> see here:

As you say, that all looks fine up to the end. 8007007a is an insufficient
buffer error, which is very odd. Basically it means that the Windows Update
Agent is asking the operating system a question and the response is larger than
it was expected to be. I can't quite imagine how this would happen!

Is this client really supposed to be in both the "Vista Business" and the "XP
Pro SP2" target groups? It isn't the only such client by any chance?

About the only thing I can think of to try would be to delete the computer entry
from the WSUS server - I assume it has an entry in the database saying something
like "has not reported yet"? - and then run

wuauclt /resetauthorization /detectnow

on the client. Lawrence might have some better ideas.

Harry.

"Gramps98" <> wrote in message
news:32FF77C1-103C-4130-AA7F-...
>I was instructed to re-post here so...
>
> My problem is a bit different so I hope it was appropriate to ask a new
> question.

Starting a new thread is never inappropriate... only latching onto an
existing thread with a new topic. :-)


> I have a server running SBS2K3 SP2 and 30 or so client PCs with about half
> running VISTA Business SP1 and the other half running XP-Pro SP3. All of
> the
> PCs are reporting to WSUS and all are being updated. However, one of the
> XP
> machines (according to WSUS) has not reported to the server yet.

> 2009-05-20 09:07:56:828 1416 764 PT Initializing simple targeting cookie,
> clientId = 70d404c5-dbb0-4a01-b407-ef1fae30ff4c, target group = Vista
> Business; XP Pro SP2, DNS name = meghan.wilsonargroup.local

> 2009-05-20 09:08:00:266 1416 764 Agent * Found 0 updates and 46 categories
> in search; evaluated appl. rules of 453 out of 754 deployed entities

It's useful to note that the client is searching a valid target group, but
is not finding any approved updates.

> 2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
> {1D194FB4-F389-4B70-A0E0-7908628E8CC9} 2009-05-20
> 09:08:00:328-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
> AutomaticUpdates Success Software
> Synchronization Windows Update Client successfully detected 0 updates.

And would have reported as such.

> 2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
> {E7D20B16-BD8C-43C4-9D60-0893779195C0} 2009-05-20
> 09:08:00:328-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0
> AutomaticUpdates Success Pre-Deployment Check Reporting client status.
> 2009-05-20 09:16:02:947 1416 764 Report WARNING: Reporter failed to upload
> events with hr = 8007007a.

Had we not encountered the noted 0x8007007a error.

According to the info available at this site:
http://inetexplorer.mvps.org/archive...date_codes.htm

the error is:
0x8007007A -2147024774 ERROR_INSUFFICIENT_BUFFER
and is included amongst a group of error codes related to hardware/system
resources.

So my next question would be:
How much memory is installed in this PC?
What applications are in use?
Is the paging file enabled and properly sized?

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Lawrence Garvin [MVP] wrote:

> It's useful to note that the client is searching a valid target group,
> but is not finding any approved updates.

Presumably any that were needed were already installed, since it seems that
everything except the reporting is functioning normally.

> According to the info available at this site:
> http://inetexplorer.mvps.org/archive...date_codes.htm
>
> the error is:
> 0x8007007A -2147024774 ERROR_INSUFFICIENT_BUFFER
> and is included amongst a group of error codes related to
> hardware/system resources.

Resource shortages should show up as ERROR_NOT_ENOUGH_MEMORY or E_OUTOFMEMORY,
or more often as an uncaught exception. ERROR_INSUFFICIENT_BUFFER usually
indicates a programming error, although in some cases it could mean that a piece
of data - a string value in the registry, for example - is larger than allowed.

Gramps98: depending on your level of technical expertise, you could try using
Process Monitor to monitor the system calls the Windows Update Service is making
and see if one of them is returning ERROR_INSUFFICIENT_BUFFER. If we can
identify exactly what the service is trying to at the time it fails it might
help resolve the problem.

<http://technet.microsoft.com/en-us/sysinternals/bb795533.aspx>

http://technet.microsoft.com/en-us/s.../bb795533.aspx

Harry.

Thanks for the response. I checked the machine and here are answers to the
questions you asked:

So my next question would be:
> How much memory is installed in this PC?
2 Gig of RAM is installed

> What applications are in use?
MS Office 2007 Standard, AutoCAD, Adobe Reader, Symantec Endpoint
Protection, IE 7,etc. Nothing too far out of the ordinary. We're sort of
strict about what gets loaded onto the PCs around here.

> Is the paging file enabled and properly sized?
Paging file is enabled and was set to 2000(ish)MB
I bumped it up to the suggested 3072 MB

From the two responses that I've received regarding this issue, it is more
of a mystery than a harm (I hope) to my network, so I won't ask you guys to
throw a lot of effort at this. If you happen to come up with an "Aha" at
some point though, please feel free to let me know.

Thanks again and your efforts are truly appreciated.

--
Gramps98


"Lawrence Garvin [MVP]" wrote:

> "Gramps98" <> wrote in message
> news:32FF77C1-103C-4130-AA7F-...
> >I was instructed to re-post here so...
> >
> > My problem is a bit different so I hope it was appropriate to ask a new
> > question.
>
> Starting a new thread is never inappropriate... only latching onto an
> existing thread with a new topic. :-)
>
>
> > I have a server running SBS2K3 SP2 and 30 or so client PCs with about half
> > running VISTA Business SP1 and the other half running XP-Pro SP3. All of
> > the
> > PCs are reporting to WSUS and all are being updated. However, one of the
> > XP
> > machines (according to WSUS) has not reported to the server yet.
>
> > 2009-05-20 09:07:56:828 1416 764 PT Initializing simple targeting cookie,
> > clientId = 70d404c5-dbb0-4a01-b407-ef1fae30ff4c, target group = Vista
> > Business; XP Pro SP2, DNS name = meghan.wilsonargroup.local
>
> > 2009-05-20 09:08:00:266 1416 764 Agent * Found 0 updates and 46 categories
> > in search; evaluated appl. rules of 453 out of 754 deployed entities
>
> It's useful to note that the client is searching a valid target group, but
> is not finding any approved updates.
>
> > 2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
> > {1D194FB4-F389-4B70-A0E0-7908628E8CC9} 2009-05-20
> > 09:08:00:328-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0
> > AutomaticUpdates Success Software
> > Synchronization Windows Update Client successfully detected 0 updates.
>
> And would have reported as such.
>
> > 2009-05-20 09:08:05:328 1416 764 Report REPORT EVENT:
> > {E7D20B16-BD8C-43C4-9D60-0893779195C0} 2009-05-20
> > 09:08:00:328-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0
> > AutomaticUpdates Success Pre-Deployment Check Reporting client status.
> > 2009-05-20 09:16:02:947 1416 764 Report WARNING: Reporter failed to upload
> > events with hr = 8007007a.
>
> Had we not encountered the noted 0x8007007a error.
>
> According to the info available at this site:
> http://inetexplorer.mvps.org/archive...date_codes.htm
>
> the error is:
> 0x8007007A -2147024774 ERROR_INSUFFICIENT_BUFFER
> and is included amongst a group of error codes related to hardware/system
> resources.
>
> So my next question would be:
> How much memory is installed in this PC?
> What applications are in use?
> Is the paging file enabled and properly sized?
>
> --
> Lawrence Garvin, M.S., MCITP:EA, MCDBA
> Principal/CTO, Onsite Technology Solutions, Houston, Texas
> Microsoft MVP - Software Distribution (2005-2009)
>
> MS WSUS Website: http://www.microsoft.com/wsus
> My Websites: http://www.onsitechsolutions.com;
> http://wsusinfo.onsitechsolutions.com
> My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin
>
>

Thanks for the response H. I'm more hardware than software, but at your
suggestion I ran Process Monitor on the machine. I don't know what it all
means (yet) but I was able to see where the error began reporting "Buffer
Overflow". I'll keep plugging at it until I figure it out...thanks for the
tip.

Several months ago, I did delete this PC from the WSUS console list. It
came back with the same problem. I'll try that again though...I've fixed
several issues by doing it a second time. Amazing how that works sometimes.

The main thing is that it seems to not be anything that degrades machine or
LAN performance, so I don't see the need for you and LG to throw a lot of
effort at this. You guys seem to have enough real issues to deal with. If
however you think of something, feel free to send me a post. If I figure it
out I'll let you guys know.

Thanks a million for the help.
--
Gramps98


"Harry Johnston [MVP]" wrote:

> Gramps98 wrote:
>
> > I was instructed to re-post here so...
> >
> > My problem is a bit different so I hope it was appropriate to ask a new
> > question.
>
> Certainly. In fact we prefer that each person start a new thread, as it helps
> avoid confusion. (Often problems that may seem the same turn out not to be.)
>
> > I have a server running SBS2K3 SP2 and 30 or so client PCs with about half
> > running VISTA Business SP1 and the other half running XP-Pro SP3. All of the
> > PCs are reporting to WSUS and all are being updated. However, one of the XP
> > machines (according to WSUS) has not reported to the server yet.
>
> So the first question to ask is: what's different about this machine?
>
> > I ran 'wuauclt /resetauthorization /detectnow' this morning on the subject
> > machine and on another that runs the same OS. I printed the logs and did a
> > side-by-side comparison. Everything looked ok except at the end of the
> > subject machine's report, where it kicks out the 8007007a error as you can
> > see here:
>
> As you say, that all looks fine up to the end. 8007007a is an insufficient
> buffer error, which is very odd. Basically it means that the Windows Update
> Agent is asking the operating system a question and the response is larger than
> it was expected to be. I can't quite imagine how this would happen!
>
> Is this client really supposed to be in both the "Vista Business" and the "XP
> Pro SP2" target groups? It isn't the only such client by any chance?
>
> About the only thing I can think of to try would be to delete the computer entry
> from the WSUS server - I assume it has an entry in the database saying something
> like "has not reported yet"? - and then run
>
> wuauclt /resetauthorization /detectnow
>
> on the client. Lawrence might have some better ideas.
>
> Harry.
>

Gramps98 wrote:

> Thanks for the response H. I'm more hardware than software, but at your
> suggestion I ran Process Monitor on the machine. I don't know what it all
> means (yet) but I was able to see where the error began reporting "Buffer
> Overflow". I'll keep plugging at it until I figure it out...thanks for the
> tip.

You're welcome. If you want to email me the process monitor log I'd be happy to
have a look at it for you. (I'm old-fashioned enough to post under my real
email address!)

Harry.

Harry/Lawrence,

I'm not sure if you remember this, but the problem went away. I happened to
think about it and looked at the status of the PC in WSUS last week and it is
reporting like it is supposed to.

Just wanted to let you guys know that the issue resolved itself.
--
Gramps98


"Harry Johnston [MVP]" wrote:

> Gramps98 wrote:
>
> > Thanks for the response H. I'm more hardware than software, but at your
> > suggestion I ran Process Monitor on the machine. I don't know what it all
> > means (yet) but I was able to see where the error began reporting "Buffer
> > Overflow". I'll keep plugging at it until I figure it out...thanks for the
> > tip.
>
> You're welcome. If you want to email me the process monitor log I'd be happy to
> have a look at it for you. (I'm old-fashioned enough to post under my real
> email address!)
>
> Harry.
>

Gramps98 wrote:

> Harry/Lawrence,
>
> I'm not sure if you remember this, but the problem went away. I happened to
> think about it and looked at the status of the PC in WSUS last week and it is
> reporting like it is supposed to.
>
> Just wanted to let you guys know that the issue resolved itself.

Thanks.

Harry.