Group Problems with Client Targeting

I have a Windows Servers group which seems to have developed some members
that are not supposed to be in the group. The Windows Servers group
contains only our W2K3 servers and DCs, but some XP machines are in the same
WSUS group despite not being in the AD group that WSUS is (supposed to be)
picking up.

I have looked at this issue a lot, and have done plenty of research, but I
can't work out what the problem is.


Tim

"Tim Gowen" <> wrote in message
news:%...
|I have a Windows Servers group which seems to have developed some members
| that are not supposed to be in the group. The Windows Servers group
| contains only our W2K3 servers and DCs, but some XP machines are in the same
| WSUS group despite not being in the AD group that WSUS is (supposed to be)
| picking up.
|
| I have looked at this issue a lot, and have done plenty of research, but I
| can't work out what the problem is.
|
|
| Tim
|

Perhaps try the WSUS Newsgroup
http://www.microsoft.com/technet/com...pdate_services

news://msnews.microsoft.com/microsof...pdate_services
(OE client)

xposted for convenience


--
====================================
TaurArian [MS-MVP] 2005-2008 - Australia
====================================
How to make a good post: http://www.dts-l.org/goodpost.htm
Defending your machine: http://defendingyourmachine2.blogspot.com/
http://taurarian.mvps.org/index.htm

Emails will not be acknowledged - please post to the newsgroup so all may benefit.

> |I have a Windows Servers group which seems to have developed some members
> | that are not supposed to be in the group. The Windows Servers group
> | contains only our W2K3 servers and DCs, but some XP machines are in the same
> | WSUS group despite not being in the AD group that WSUS is (supposed to be)
> | picking up.

It isn't clear quite what you mean.

Are you assigning computer group membership using the console or using group
policy?

Are the extraneous machines supposed to be in WSUS but in a different computer
group, or are they not supposed to be in WSUS at all?

Harry.

"Harry Johnston" <> wrote in message
news:...
>
>> |I have a Windows Servers group which seems to have developed some
>> members
>> | that are not supposed to be in the group. The Windows Servers group
>> | contains only our W2K3 servers and DCs, but some XP machines are in the
>> same
>> | WSUS group despite not being in the AD group that WSUS is (supposed to
>> be)
>> | picking up.
>
> It isn't clear quite what you mean.
>
> Are you assigning computer group membership using the console or using
> group policy?

Group Policy.

> Are the extraneous machines supposed to be in WSUS but in a different
> computer group, or are they not supposed to be in WSUS at all?

Mostly in different groups, some are meant to be in non-WSUS groups.


Tim

Tim Gowen wrote:

>>> I have a Windows Servers group which seems to have developed some members
>>> that are not supposed to be in the group. The Windows Servers group
>>> contains only our W2K3 servers and DCs, but some XP machines are in the
>>> same WSUS group despite not being in the AD group that WSUS is (supposed
>>> to be) picking up.

I'm still not sure I'm understanding the situation correctly. Correct me if I'm
wrong.

The problem is that some computers are turning up in the wrong WSUS groups, and
some are turning up in WSUS when they shouldn't be there at all.

Computers are configured to use WSUS and assigned to WSUS groups using group
policy. Presumably there is one group policy object per WSUS group, and it does
both jobs, i.e., configures the computer to use WSUS and assigns the WSUS group.

The computers in question are not in "the AD group that WSUS is (supposed to be)
picking up".

This sounds like a group policy configuration issue. When you say "the AD
group" do you mean an actual group object in Active Directory or an
organisational unit?

You can use the gpresult command-line tool on one of the misplaced computers to
show you which group policy object(s) are being applied. This may help identify
the source of the problem.

Harry.

"Harry Johnston" <> wrote in message
news:e%...


> You can use the gpresult command-line tool on one of the misplaced
> computers to show you which group policy object(s) are being applied.
> This may help identify the source of the problem.

Yes, it said that the "Windows Server" policy object is 'empty'. I will
take a look at that.


Tim

Tim Gowen wrote:

>> You can use the gpresult command-line tool on one of the misplaced
>> computers to show you which group policy object(s) are being applied.
>> This may help identify the source of the problem.
>
> Yes, it said that the "Windows Server" policy object is 'empty'. I will
> take a look at that.

That may be the correct behaviour, if you are using security filtering to
control which computers get which group policy. The more interesting question
is why you don't see the group policy that /should/ be applying to this
computer, to put it in the WSUS group it should be in.

You can check what settings are actually configured in the registry using this
documentation:

<http://technet2.microsoft.com/WindowsServer/en/library/75ee9da8-0ffd-400c-b722-aeafdb68ceb31033.mspx?mfr=true>

Harry.