GPO not working

I have an Active Directory 2003, with a WSUS 3.0 server running. This
morning, I approved the 972260 update for all computers.

I have different SUS GPOs for different groups. For public PCs without a
specific owner, in several different OUs, I use setting 4 to force the
install and reboot. This GPO worked just fine for each of the OUs. For
large group of intelligent responsible users, I use setting 3 and do not
force a restart. This GPO was working last week for Patch Tuesday, but
even manually running wuauclt /detectnow does nothing. Here is the log
entry:

2009-07-30 15:33:52:553 1948 600 AU Triggering AU detection through
DetectNow API
2009-07-30 15:33:52:553 1948 600 AU Triggering Online detection
(non-interactive)
2009-07-30 15:33:52:569 1948 9c4 AU #############
2009-07-30 15:33:52:569 1948 9c4 AU ## START ## AU: Search for updates
2009-07-30 15:33:52:569 1948 9c4 AU #########
2009-07-30 15:33:52:569 1948 9c4 AU <<## SUBMITTED ## AU: Search for
updates [CallId = {B0959FB7-C355-4EB2-B46F-C7A54FD38201}]
2009-07-30 15:33:52:569 1948 224 Agent *************
2009-07-30 15:33:52:569 1948 224 Agent ** START ** Agent: Finding
updates [CallerId = AutomaticUpdates]
2009-07-30 15:33:52:569 1948 224 Agent *********
2009-07-30 15:33:52:569 1948 224 Agent * Online = Yes; Ignore download
priority = No
2009-07-30 15:33:52:569 1948 224 Agent * Criteria = "IsHidden=0 and
IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or
IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and
IsAssigned=1 or IsHidden=0 and IsInstalled=1 and
DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or
IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and
IsAssigned=1 and RebootRequired=1"
2009-07-30 15:33:52:569 1948 224 Agent * ServiceID =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2009-07-30 15:33:52:569 1948 224 Agent * Search Scope = {Machine}
2009-07-30 15:33:52:569 1948 224 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wuident.cab:
2009-07-30 15:33:52:600 1948 224 Misc Microsoft signed: Yes
2009-07-30 15:33:52:631 1948 224 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wuident.cab:
2009-07-30 15:33:52:647 1948 224 Misc Microsoft signed: Yes
2009-07-30 15:33:52:678 1948 224 Misc Validating signature for
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wsus3setup.cab:
2009-07-30 15:33:52:694 1948 224 Misc Microsoft signed: Yes
2009-07-30 15:33:52:694 1948 224 Setup *********** Setup: Checking
whether self-update is required ***********
2009-07-30 15:33:52:694 1948 224 Setup * Inf file:
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default \wsus3setup.inf
2009-07-30 15:33:52:710 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\cdm.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:741 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:741 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.2.6001.788,
required version = 7.1.6001.65
2009-07-30 15:33:52:741 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuauclt.exe: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:756 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:756 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.2.6001.788,
required version = 7.1.6001.65
2009-07-30 15:33:52:772 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:772 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.2.6001.788,
required version = 7.1.6001.65
2009-07-30 15:33:52:788 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:788 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.2.6001.788,
required version = 7.1.6001.65
2009-07-30 15:33:52:788 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wups.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:803 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wups2.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:819 1948 224 Setup Update NOT required for
C:\WINDOWS\system32\wuweb.dll: target version = 7.2.6001.788, required
version = 7.1.6001.65
2009-07-30 15:33:52:819 1948 224 Setup * IsUpdateRequired = No
2009-07-30 15:33:56:288 1948 224 PT +++++++++++ PT: Synchronizing
server updates +++++++++++
2009-07-30 15:33:56:288 1948 224 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://wuau.domain.local:8530/Client...ce/client.asmx
2009-07-30 15:33:56:522 1948 224 PT WARNING: Cached cookie has expired
or new PID is available
2009-07-30 15:33:56:522 1948 224 PT Initializing simple targeting
cookie, clientId = 169cb308-22dd-4b94-84be-f7e7149cc90b, target group =
notebooks, DNS name = maxcomp.domain.local
2009-07-30 15:33:56:522 1948 224 PT Server URL =
http://wuau.domain.local:8530/Simple...impleAuth.asmx
2009-07-30 15:33:59:506 1948 224 PT +++++++++++ PT: Synchronizing
extended update info +++++++++++
2009-07-30 15:33:59:506 1948 224 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://wuau.domain.local:8530/Client...ce/client.asmx
2009-07-30 15:34:04:163 1948 224 Agent * Found 0 updates and 52
categories in search; evaluated appl. rules of 446 out of 708 deployed
entities
2009-07-30 15:34:04:569 1948 224 Agent *********
2009-07-30 15:34:04:569 1948 224 Agent ** END ** Agent: Finding
updates [CallerId = AutomaticUpdates]
2009-07-30 15:34:04:569 1948 224 Agent *************
2009-07-30 15:34:04:569 1948 f0 AU >>## RESUMED ## AU: Search for
updates [CallId = {B0959FB7-C355-4EB2-B46F-C7A54FD38201}]
2009-07-30 15:34:04:569 1948 f0 AU # 0 updates detected
2009-07-30 15:34:04:569 1948 f0 AU #########
2009-07-30 15:34:04:569 1948 f0 AU ## END ## AU: Search for updates
[CallId = {B0959FB7-C355-4EB2-B46F-C7A54FD38201}]
2009-07-30 15:34:04:569 1948 f0 AU #############
2009-07-30 15:34:04:569 1948 f0 AU AU setting next detection timeout to
2009-07-31 10:07:43
2009-07-30 15:34:09:585 1948 224 Report REPORT EVENT:
{EA279F7E-36F6-49FE-A0C0-7F78FE37DCAE} 2009-07-30
15:34:04:569+0300 1 147 101
{00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success
Software Synchronization Windows Update Client successfully detected 0
updates.
2009-07-30 15:34:09:585 1948 224 Report REPORT EVENT:
{0F4AB8D7-5F54-4330-AD70-C0BD2A31B1AD} 2009-07-30
15:34:04:569+0300 1 156 101
{00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success
Pre-Deployment Check Reporting client status.

"Max" <> wrote in message
news:...

>I have an Active Directory 2003, with a WSUS 3.0 server running. This
>morning, I approved the 972260 update for all computers.
>
> I have different SUS GPOs for different groups. For public PCs without a
> specific owner, in several different OUs, I use setting 4 to force the
> install and reboot. This GPO worked just fine for each of the OUs. For
> large group of intelligent responsible users, I use setting 3 and do not
> force a restart. This GPO was working last week for Patch Tuesday, but
> even manually running wuauclt /detectnow does nothing. Here is the log
> entry:

> 2009-07-30 15:33:56:522 1948 224 PT Initializing simple targeting cookie,
> clientId = 169cb308-22dd-4b94-84be-f7e7149cc90b, target group = notebooks,
> DNS name = maxcomp.domain.local

> 2009-07-30 15:34:04:163 1948 224 Agent * Found 0 updates and 52
> categories in search; evaluated appl. rules of 446 out of 708 deployed
> entities

About the only thing that can be concluded from this log segment, is that
either the update is not yet approved for the 'notebooks' group, or it's
already installed on this machine.

There are no errors in this log segment. What is reported in the WSUS server
console for this machine? (Should be Installed/Not Applicable, but that's
not detailed enough to diagnose this issue any farther.)

Have you checked the installation logs for the machine to see if that the
update has already been installed? The update was an out-of-band security
update, released Tuesday, today is Thursday, maybe your "intelligent
responsible user" browsed to WU/MU and installed the update?



--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin

Lawrence Garvin [MVP] wrote:
> "Max" <> wrote in message
> news:...
>
>> I have an Active Directory 2003, with a WSUS 3.0 server running. This
>> morning, I approved the 972260 update for all computers.
>>
>> I have different SUS GPOs for different groups. For public PCs without
>> a specific owner, in several different OUs, I use setting 4 to force
>> the install and reboot. This GPO worked just fine for each of the
>> OUs. For large group of intelligent responsible users, I use setting
>> 3 and do not force a restart. This GPO was working last week for Patch
>> Tuesday, but even manually running wuauclt /detectnow does nothing.
>> Here is the log entry:
>
>> 2009-07-30 15:33:56:522 1948 224 PT Initializing simple targeting
>> cookie, clientId = 169cb308-22dd-4b94-84be-f7e7149cc90b, target group
>> = notebooks, DNS name = maxcomp.domain.local
>
>> 2009-07-30 15:34:04:163 1948 224 Agent * Found 0 updates and 52
>> categories in search; evaluated appl. rules of 446 out of 708 deployed
>> entities
>
> About the only thing that can be concluded from this log segment, is
> that either the update is not yet approved for the 'notebooks' group, or
> it's already installed on this machine.
>
> There are no errors in this log segment. What is reported in the WSUS
> server console for this machine? (Should be Installed/Not Applicable,
> but that's not detailed enough to diagnose this issue any farther.)
>
> Have you checked the installation logs for the machine to see if that
> the update has already been installed? The update was an out-of-band
> security update, released Tuesday, today is Thursday, maybe your
> "intelligent responsible user" browsed to WU/MU and installed the update?
>
>
>
sorry I didn't explain well enough. The log was a sample. It is every
machine covered by the GPO that isn't getting the update, even though
I've released it for all groups on my WSUS server. I've checked on a few
machines in the group using 'systeminfo |find "972260"'. The console
shows 'installed' for all of the different versions of the hotfix.
The GPOs all use client-side targeting and I've checked that the group
is correct. What else can I do to trigger activity.
Max

Max wrote:
> Lawrence Garvin [MVP] wrote:
>> "Max" <> wrote in message
>> news:...
>>
>>> I have an Active Directory 2003, with a WSUS 3.0 server running. This
>>> morning, I approved the 972260 update for all computers.
>>>
>>> I have different SUS GPOs for different groups. For public PCs
>>> without a specific owner, in several different OUs, I use setting 4
>>> to force the install and reboot. This GPO worked just fine for each
>>> of the OUs. For large group of intelligent responsible users, I use
>>> setting 3 and do not force a restart. This GPO was working last week
>>> for Patch Tuesday, but even manually running wuauclt /detectnow does
>>> nothing. Here is the log entry:
>>
>>> 2009-07-30 15:33:56:522 1948 224 PT Initializing simple targeting
>>> cookie, clientId = 169cb308-22dd-4b94-84be-f7e7149cc90b, target group
>>> = notebooks, DNS name = maxcomp.domain.local
>>
>>> 2009-07-30 15:34:04:163 1948 224 Agent * Found 0 updates and 52
>>> categories in search; evaluated appl. rules of 446 out of 708
>>> deployed entities
>>
>> About the only thing that can be concluded from this log segment, is
>> that either the update is not yet approved for the 'notebooks' group,
>> or it's already installed on this machine.
>>
>> There are no errors in this log segment. What is reported in the WSUS
>> server console for this machine? (Should be Installed/Not Applicable,
>> but that's not detailed enough to diagnose this issue any farther.)
>>
>> Have you checked the installation logs for the machine to see if that
>> the update has already been installed? The update was an out-of-band
>> security update, released Tuesday, today is Thursday, maybe your
>> "intelligent responsible user" browsed to WU/MU and installed the update?
>>
>>
>>
> sorry I didn't explain well enough. The log was a sample. It is every
> machine covered by the GPO that isn't getting the update, even though
> I've released it for all groups on my WSUS server. I've checked on a few
> machines in the group using 'systeminfo |find "972260"'. The console
> shows 'installed' for all of the different versions of the hotfix.
> The GPOs all use client-side targeting and I've checked that the group
> is correct. What else can I do to trigger activity.
> Max
Ignore this thread. I missed something. It is working fine. Sorry to
bother you, Mr. Garvin.

"Max" <> wrote in message
news:%230%...

>> About the only thing that can be concluded from this log segment, is that
>> either the update is not yet approved for the 'notebooks' group, or it's
>> already installed on this machine.

> The console shows 'installed' for all of the different versions of the
> hotfix.

Well, there it is. Why do you not believe this?

Do you have *specific* evidence that the update is *not* installed?


--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/pro...awrence.Garvin