PCs with no 'net access but with local WSUS server can't get updat

Hi. We have a few Win XP SP2 machines. They are on the domain. They are in an
OU which is getting the quivalent to the following as a group policy and yet
thet don't seem to see the WSUS server:

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate]
"WUServer"="http://wsusserver"
"WUStatusServer"="http://wsusserver"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000002
"UseWUServer"=dword:00000001
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"RebootRelaunchTimeoutEnabled"=dword:00000001
"RebootRelaunchTimeout"=dword:0000005a
"AutoInstallMinorUpdates"=dword:00000001

These machines have no Internet access [because they don't need it] but are
on the domain [they are getting AV updates, I can access them remotely, etc.].

Any reason why the WSUS server won't see them?

Thanks

Oh ya. It's running WSUS 2.0. We're going to 3.0 later this year....

"Gis Bun" wrote:

> Hi. We have a few Win XP SP2 machines. They are on the domain. They are in an
> OU which is getting the quivalent to the following as a group policy and yet
> thet don't seem to see the WSUS server:
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate]
> "WUServer"="http://wsusserver"
> "WUStatusServer"="http://wsusserver"
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
> "NoAutoUpdate"=dword:00000000
> "AUOptions"=dword:00000004
> "ScheduledInstallDay"=dword:00000000
> "ScheduledInstallTime"=dword:00000002
> "UseWUServer"=dword:00000001
> "NoAutoRebootWithLoggedOnUsers"=dword:00000001
> "RebootRelaunchTimeoutEnabled"=dword:00000001
> "RebootRelaunchTimeout"=dword:0000005a
> "AutoInstallMinorUpdates"=dword:00000001
>
> These machines have no Internet access [because they don't need it] but are
> on the domain [they are getting AV updates, I can access them remotely, etc.].
>
> Any reason why the WSUS server won't see them?
>
> Thanks
>
>
>
>
>

Forwarded to WSUS newsgroup via crosspost:
microsoft.public.windows.server.update_services as a convenience to OP.

On the web:
http://www.microsoft.com/communities...pdate_services

In your newsreader:
news://msnews.microsoft.com/microsof...pdate_services
--
~Robear Dyer (PA Bear)
MS MVP-Windows (IE, OE, Security, Shell/User)
AumHa VSOP & Admin http://aumha.net
DTS-L http://dts-l.org/

Gis Bun wrote:
> Oh ya. It's running WSUS 2.0. We're going to 3.0 later this year....
>
> "Gis Bun" wrote:
>
>> Hi. We have a few Win XP SP2 machines. They are on the domain. They are
>> in
>> an OU which is getting the quivalent to the following as a group policy
>> and yet thet don't seem to see the WSUS server:
>>
>> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate]
>> "WUServer"="http://wsusserver"
>> "WUStatusServer"="http://wsusserver"
>>
>> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
>> "NoAutoUpdate"=dword:00000000
>> "AUOptions"=dword:00000004
>> "ScheduledInstallDay"=dword:00000000
>> "ScheduledInstallTime"=dword:00000002
>> "UseWUServer"=dword:00000001
>> "NoAutoRebootWithLoggedOnUsers"=dword:00000001
>> "RebootRelaunchTimeoutEnabled"=dword:00000001
>> "RebootRelaunchTimeout"=dword:0000005a
>> "AutoInstallMinorUpdates"=dword:00000001
>>
>> These machines have no Internet access [because they don't need it] but
>> are
>> on the domain [they are getting AV updates, I can access them remotely,
>> etc.].
>>
>> Any reason why the WSUS server won't see them?
>>
>> Thanks

You'd be better off posting this to the WSUS newsgroup:

http://www.microsoft.com/technet/com...pdate_services

MowGreen [MVP 2003-2007]
===============
*-343-* FDNY
Never Forgotten
===============


Gis Bun wrote:

> Oh ya. It's running WSUS 2.0. We're going to 3.0 later this year....
>
> "Gis Bun" wrote:
>
>
>>Hi. We have a few Win XP SP2 machines. They are on the domain. They are in an
>>OU which is getting the quivalent to the following as a group policy and yet
>>thet don't seem to see the WSUS server:
>>
>>[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate]
>>"WUServer"="http://wsusserver"
>>"WUStatusServer"="http://wsusserver"
>>
>>[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Win dows\WindowsUpdate\AU]
>>"NoAutoUpdate"=dword:00000000
>>"AUOptions"=dword:00000004
>>"ScheduledInstallDay"=dword:00000000
>>"ScheduledInstallTime"=dword:00000002
>>"UseWUServer"=dword:00000001
>>"NoAutoRebootWithLoggedOnUsers"=dword:00000001
>>"RebootRelaunchTimeoutEnabled"=dword:00000001
>>"RebootRelaunchTimeout"=dword:0000005a
>>"AutoInstallMinorUpdates"=dword:00000001
>>
>>These machines have no Internet access [because they don't need it] but are
>>on the domain [they are getting AV updates, I can access them remotely, etc.].
>>
>>Any reason why the WSUS server won't see them?
>>
>>Thanks
>>
>>
>>
>>
>>

Gis Bun,

My experience is that the Windows Update Agent self-update functionality doesn't
work reliably on machines without internet access. If you install the current
client version manually, it might resolve your problem.

<http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>

Harry.

First, thanks to PA Bear for forwarding.

For Harry, this issue really [partially] defeats one of the reasons to have
WSUS - giving everyone the current security updates without having to
download them off the 'Net.

I have a copy of the agent already. Wasn't there a KB EXE that goes hand in
hand with the agent? I"m sure I read that somewhere in a blog.

Thanks


"Harry Johnston" wrote:

> Gis Bun,
>
> My experience is that the Windows Update Agent self-update functionality doesn't
> work reliably on machines without internet access. If you install the current
> client version manually, it might resolve your problem.
>
> <http://download.windowsupdate.com/v7/windowsupdate/redist/standalone/WindowsUpdateAgent30-x86.exe>
>
> Harry.
>

Gis Bun wrote:

> For Harry, this issue really [partially] defeats one of the reasons to have
> WSUS - giving everyone the current security updates without having to
> download them off the 'Net.

In our environment installing the agent as part of the installation sequence of
new machines isn't a problem, so I've never had cause to investigate the problem
in any depth. Hopefully someone else may have resolved it and be able to help.

However, the first step would be to install the agent on one or two of the
clients that are having trouble and see whether it actually solves your
particular problem or not. You might have a different issue entirely.

> I have a copy of the agent already. Wasn't there a KB EXE that goes hand in
> hand with the agent? I"m sure I read that somewhere in a blog.

You're probably thinking of an issue that caused machines to become unresponsive
when scanning for updates. This required both the updated agent and an OS patch
in order to completely resolve the problem. It isn't related to your problem,
and once the machines are connecting to the WSUS server they'll get both the
current agent and the necessary patch.

Harry.

Thanks. I should be able to verify if the Agent works shortly. Not a very
high priority on my things to do. :-)

"Harry Johnston" wrote:

> Gis Bun wrote:
>
> > For Harry, this issue really [partially] defeats one of the reasons to have
> > WSUS - giving everyone the current security updates without having to
> > download them off the 'Net.
>
> In our environment installing the agent as part of the installation sequence of
> new machines isn't a problem, so I've never had cause to investigate the problem
> in any depth. Hopefully someone else may have resolved it and be able to help.
>
> However, the first step would be to install the agent on one or two of the
> clients that are having trouble and see whether it actually solves your
> particular problem or not. You might have a different issue entirely.
>
> > I have a copy of the agent already. Wasn't there a KB EXE that goes hand in
> > hand with the agent? I"m sure I read that somewhere in a blog.
>
> You're probably thinking of an issue that caused machines to become unresponsive
> when scanning for updates. This required both the updated agent and an OS patch
> in order to completely resolve the problem. It isn't related to your problem,
> and once the machines are connecting to the WSUS server they'll get both the
> current agent and the necessary patch.
>
> Harry.
>