No problem. With the behavior you are seeing (patched systems but non-existent in WSUS) it is almost certainly the problem that Richard describes. I assumed that sysprep took care of this, but it looks like that isn't the case until you get to Windows Vista and above: http://support.microsoft.com/kb/903262:
"When you use Sysprep to generalize an image for a virtual machine, or when you use a unique SID-generating technology to create the images, the SusClientId registry value is not cleared if it is populated within the image before the image is deployed. Note In WSUS 3.0, the client changes its SusClientID if the hardware configuration changes. For Windows Vista, for Windows Server 2008, and for later versions, Sysprep is changed to reset the SusClientID. Therefore, this problem affects only virtual machines that run pre-Windows Vista operating systems, or that were not created by using Sysprep." From: David Lum [mailto:david....@nwea.org] Sent: Thursday, December 31, 2009 4:35 PM To: NT System Admin Issues Subject: RE: WSUS Hi Joe, thanks for the suggestions! 1) No. windowsupdate.log has always given "Report Reporter successfully uploaded 3 events." 2) The machines in question aren't appearing in WSUS at all. I do have 239 systems reporting successfully 3) 239 systems report in OK I have run both the WSUS server and client reporting tools and both come back good. The fix Richard sent worked on one system and makes sense why we would have so many working and not. David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 From: Joe Tinney [mailto:jtin...@lastar.com] Sent: Thursday, December 31, 2009 1:18 PM To: NT System Admin Issues Subject: RE: WSUS David, I've never seen this issue myself so these are just troubleshooting ideas running through my brain: 1. Does running 'wuauclt /reportnow' on the affected clients resolve the issue for the client? 2. Is it the last report date that you are not seeing getting updated or some other behavior that pointed out the issue to you? 3. Have you checked your WSUS server to make sure everything is running okay? a. Free disk space b. Database still running? 4. How is your WSUS configured? 5. You might check out 'wsusutil checkhealth' command: http://technet.microsoft.com/en-us/library/cc708604%28WS.10%29.aspx. 6. Check out this KB article on dealing with the WindowsUpdate.log file: http://support.microsoft.com/kb/902093. In addition to explaining its structure (it is tab-delimited, by the way, if you want to open it in something like Excel to analyze it better), it also provides info on how to increase logging to Extended Logging at the end of the document. Good luck and Happy New year, Joe From: David Lum [mailto:david....@nwea.org] Sent: Thursday, December 31, 2009 4:06 PM To: NT System Admin Issues Subject: WSUS It seems I have about ½ my PC's getting updated from WSUS but not reporting back to it. I seem to find a ton of near-misses via Google. The WindowsUpdate.log on the client doesn't show any errors and in fact the client thinks it's reporting to the server. Clients are Win7 and XP SP3. Any here see this type of behavior before? Same WSUS GPO for all systems, etc. David Lum // SYSTEMS ENGINEER NORTHWEST EVALUATION ASSOCIATION (Desk) 971.222.1025 // (Cell) 503.267.9764 ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~
