Question

Microsoft updates show up on clients even though they are not approved by WSUS - Revisited

Asked by: Barnabus2006

We posted a similar question before, but it seems we have gotten "wrapped around the axle" since then. The XP Pro SP3 computers (that's the only type on this network) all show pending updates that have been downloaded even though the updates have not been approved in WSUS.

Case in point, KB956844 from Sept 8, 2009 is awaiting installation via the tray update icon this morning. Sep 9, 2009.  The WU Server synchronizes every night at 1:00am and the WSUS
GPO has the clients pointed to the WSUS server for updates.  (See Code section for GPO settings, client registry, clientdiag, and client windowsupdate.log)

The WSUS console is used to assign computer to groups.
The WSUS GPO is linked to the domain and not embedded in the Default Domain Policy

GPO
-------------------------------------
Setting	State
Allow Automatic Updates immediate installation - ENABLED
Allow non-administrators to receive update notifications - NOT CONFIGURED
Allow signed content from intranet Microsoft update service location - NOT CONFIGURED
Automatic Updates detection frequency - NOT CONFIGURED
Configure Automatic Updates - ENABLED
Delay Restart for scheduled installations - NOT CONFIGURED
Do not adjust default option to 'Install Updates and Shut Down' in Shut Down Windows dialog box - NOT CONFIGURED
Do not display 'Install Updates and Shut Down' option in Shut Down Windows dialog box - DISABLED
Enable client-side targeting - NOT CONFIGURED
Enable recommended updates via Automatic Updates - ENABLED
Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates - ENABLED
No auto-restart with logged on users for scheduled automatic updates installations - Disabled
Re-prompt for restart with scheduled installations - NOT CONFIGURED
Reschedule Automatic Updates scheduled installations - ENABLED
Specify intranet Microsoft update service location - ENABLED
 
CLIENT REGISITRY
-------------------------------------
C:\reg query "HKLM\SOFTWARE\Policies\M\Windows\WindowsUpdate" /s
 
! REG.EXE VERSION 3.0
 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
    WUServer    REG_SZ  http://WUSERVER1
    WUStatusServer      REG_SZ  http://WUSERVER1
 
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    AutoInstallMinorUpdates     REG_DWORD       0x1
    AUPowerManagement   REG_DWORD       0x1
    IncludeRecommendedUpdates   REG_DWORD       0x1
    NoAutoRebootWithLoggedOnUsers       REG_DWORD       0x0
    RescheduleWaitTimeEnabled   REG_DWORD       0x1
    RescheduleWaitTime  REG_DWORD       0x1
    NoAUShutdownOption  REG_DWORD       0x0
    NoAutoUpdate        REG_DWORD       0x0
    AUOptions   REG_DWORD       0x4
    ScheduledInstallDay REG_DWORD       0x0
    ScheduledInstallTime        REG_DWORD       0x3
    UseWUServer REG_DWORD       0x1
 
 
CLIENTDIAG
------------------------------------
c:\bin\clientdiag
 
WSUS Client Diagnostics Tool
 
Checking Machine State
        Checking for admin rights to run tool . . . . . . . . . PASS
        Automatic Updates Service is running. . . . . . . . . . PASS
        Background Intelligent Transfer Service is running. . . PASS
        Wuaueng.dll version 7.4.7600.226. . . . . . . . . . . . PASS
                This version is WSUS 2.0
 
Checking AU Settings
        AU Option is 4: Scheduled Install . . . . . . . . . . . PASS
                Option is from Policy settings
 
Checking Proxy Configuration
        Checking for winhttp local machine Proxy settings . . . PASS
                Winhttp local machine access type
                        <Direct Connection>
                Winhttp local machine Proxy. . . . . . . . . .  NONE
                Winhttp local machine ProxyBypass. . . . . . .  NONE
        Checking User IE Proxy settings . . . . . . . . . . . . PASS
                User IE Proxy. . . . . . . . . . . . . . . . .  NONE
                User IE ProxyByPass. . . . . . . . . . . . . .  NONE
                User IE AutoConfig URL Proxy . . . . . . . . .  NONE
                User IE AutoDetect
                AutoDetect not in use
 
Checking Connection to WSUS/SUS Server
                WUServer = http://WUSERVER1
                WUStatusServer = http://WUSERVER1
        UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS
        Connection to server. . . . . . . . . . . . . . . . . . PASS
        SelfUpdate folder is present. . . . . . . . . . . . . . PASS
 
Press Enter to Complete
 
 
WindowsUpdate.log
------------------------------------
 
2009-09-08	03:00:10:441	1444	3a4	AU	Forced install timer expired for scheduled install
2009-09-08	03:00:10:441	1444	3a4	AU	UpdateDownloadProperties: 0 download(s) are still in progress.
2009-09-08	03:00:10:441	1444	3a4	AU	Setting AU scheduled install time to 2009-09-09 07:00:00
2009-09-08	15:59:17:805	1444	3a4	AU	AU received policy change subscription event
2009-09-08	16:54:54:876	1444	3a4	AU	#############
2009-09-08	16:54:54:876	1444	3a4	AU	## START ##  AU: Search for updates
2009-09-08	16:54:54:876	1444	3a4	AU	#########
2009-09-08	16:54:54:876	1444	3a4	AU	<<## SUBMITTED ## AU: Search for updates [CallId = {B3D738A0-7831-47B9-AEEE-4A34FE36869C}]
2009-09-08	16:54:54:876	1444	f68	Agent	*************
2009-09-08	16:54:54:876	1444	f68	Agent	** START **  Agent: Finding updates [CallerId = AutomaticUpdates]
2009-09-08	16:54:54:876	1444	f68	Agent	*********
2009-09-08	16:54:54:876	1444	f68	Agent	  * Online = Yes; Ignore download priority = No
2009-09-08	16:54:54:876	1444	f68	Agent	  * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1"
2009-09-08	16:54:54:876	1444	f68	Agent	  * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2009-09-08	16:54:54:876	1444	f68	Agent	  * Search Scope = {Machine}
2009-09-08	16:54:56:220	1444	f68	Misc	Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2009-09-08	16:54:56:282	1444	f68	Misc	 Microsoft signed: Yes
2009-09-08	16:54:56:360	1444	f68	Misc	Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab:
2009-09-08	16:54:56:360	1444	f68	Misc	 Microsoft signed: Yes
2009-09-08	16:54:56:392	1444	f68	Misc	Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.cab:
2009-09-08	16:54:56:392	1444	f68	Misc	 Microsoft signed: Yes
2009-09-08	16:54:56:407	1444	f68	Setup	***********  Setup: Checking whether self-update is required  ***********
2009-09-08	16:54:56:407	1444	f68	Setup	  * Inf file: C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wsus3setup.inf
2009-09-08	16:54:56:423	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\cdm.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:454	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuapi.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:470	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuapi.dll.mui: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:470	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuauclt.exe: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:485	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:501	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuaucpl.cpl.mui: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:501	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuaueng.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:501	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuaueng.dll.mui: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:501	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wucltui.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:517	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wucltui.dll.mui: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:517	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wups.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:517	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wups2.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:532	1444	f68	Setup	Update NOT required for C:\WINDOWS\system32\wuweb.dll: target version = 7.4.7600.226, required version = 7.4.7600.226
2009-09-08	16:54:56:532	1444	f68	Setup	  * IsUpdateRequired = No
2009-09-08	16:55:01:329	1444	f68	PT	+++++++++++  PT: Synchronizing server updates  +++++++++++
2009-09-08	16:55:01:329	1444	f68	PT	  + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WUSERVER1/ClientWebService/client.asmx
2009-09-08	16:55:02:032	1444	f68	PT	WARNING: Cached cookie has expired or new PID is available
2009-09-08	16:55:02:032	1444	f68	PT	Initializing simple targeting cookie, clientId = 31b6f369-c28d-4ef4-acad-b3065a29bad0, target group = , DNS name = public3.cspc.local
2009-09-08	16:55:02:032	1444	f68	PT	  Server URL = http://WUSERVER1/SimpleAuthWebService/SimpleAuth.asmx
2009-09-08	16:55:06:251	1444	f68	PT	+++++++++++  PT: Synchronizing extended update info  +++++++++++
2009-09-08	16:55:06:251	1444	f68	PT	  + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = http://WUSERVER1/ClientWebService/client.asmx
2009-09-08	16:55:12:220	1444	f68	Agent	  * Found 0 updates and 47 categories in search; evaluated appl. rules of 526 out of 1100 deployed entities
2009-09-08	16:55:12:298	1444	f68	Agent	*********
2009-09-08	16:55:12:298	1444	f68	Agent	**  END  **  Agent: Finding updates [CallerId = AutomaticUpdates]
2009-09-08	16:55:12:298	1444	f68	Agent	*************
2009-09-08	16:55:12:314	1444	dc8	AU	>>##  RESUMED  ## AU: Search for updates [CallId = {B3D738A0-7831-47B9-AEEE-4A34FE36869C}]
2009-09-08	16:55:12:314	1444	dc8	AU	  # 0 updates detected
2009-09-08	16:55:12:314	1444	dc8	AU	#########
2009-09-08	16:55:12:314	1444	dc8	AU	##  END  ##  AU: Search for updates [CallId = {B3D738A0-7831-47B9-AEEE-4A34FE36869C}]
2009-09-08	16:55:12:314	1444	dc8	AU	#############
2009-09-08	16:55:12:314	1444	dc8	AU	Featured notifications is disabled.
2009-09-08	16:55:12:314	1444	dc8	AU	AU setting next detection timeout to 2009-09-09 18:27:04
2009-09-08	16:55:12:314	1444	dc8	AU	Setting AU scheduled install time to 2009-09-09 07:00:00
2009-09-08	16:55:17:298	1444	f68	Report	REPORT EVENT: {F33D121E-9838-479D-A714-CC2AD9E44C0B}	2009-09-08 16:55:12:298-0400	1	147	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Software Synchronization	Windows Update Client successfully detected 0 updates.
2009-09-08	16:55:17:298	1444	f68	Report	REPORT EVENT: {901CD64D-8569-46A6-8B7F-040EDE6E2D75}	2009-09-08 16:55:12:298-0400	1	156	101	{00000000-0000-0000-0000-000000000000}	0	0	AutomaticUpdates	Success	Pre-Deployment Check	Reporting client status.
2009-09-08	16:56:44:456	1444	f68	Report	Uploading 2 events using cached cookie, reporting URL = http://WUSERVER1/ReportingWebService/ReportingWebService.asmx
2009-09-08	16:56:44:487	1444	f68	Report	Reporter successfully uploaded 2 events.
2009-09-09	03:00:11:324	1444	3a4	AU	Forced install timer expired for scheduled install
2009-09-09	03:00:11:324	1444	3a4	AU	UpdateDownloadProperties: 0 download(s) are still in progress.
2009-09-09	03:00:11:324	1444	3a4	AU	Setting AU scheduled install time to 2009-09-10 07:00:00

                                  
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:

Select allOpen in new window

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

  • Plus...
  • 30 Day FREE access, no risk, no obligation
  • Collaborate with the world's top tech experts
  • Unlimited access to our exclusive solution database
  • Never be left without tech help again

Subscribe Now

Asked On
2009-09-09 at 08:20:13ID24718437
Tags

WSUS

,

Server 2003

Topic

Windows 2003 Server

Participating Experts
1
Points
500
Comments
2

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

  • "The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
  • "Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
  • "Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Screenshot of Experts Exchange Knowledgebase

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Screenshot of an Article

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Screenshot of Experts Exchange Knowledgebase

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Related Solutions

  1. WSUS Automatic Approvals
    I would like to know the role of WSUS Approve the Updates. I just thought if there is a GPO for automatic updates set up the WSUS "Approve the updates" option has no effect example: in GPO if you select "Autodownload and schedule the install" even if you d...
  2. WSUS approval procedures.
    Hello all, I've been trying to get some definite answers on a couple of wsus scenarios and can't seem to find anything definitive. So I'm asking for some help on either finding Microsoft's official answers to these questions or answers based on the experience of the experts...
  3. Approve WSUS Updates
    Is there any way to approve multiple updates to a single computer instead of to a group of computers in WSUS console? Thanks
  4. WSUS updating client stop when not approved
    Hi , I setup a WSUS server for my office and start to deploy some replicas for other offices. Some updates are not approved yet but needed (ex : internet explorer 8) and it appears to block the upgrade process. For instance, the first 20 updates will be installed on the clie...

Free Tech Articles

  1. WARNING: 5 Reasons why you should NEVER fix a computer for free.
    It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
  2. SCCM OSD Basic troubleshooting
    SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
  3. Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
    This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
  4. Create a Win7 Gadget
    This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
  5. Outlook continually prompting for username and password
    There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
  6. Backup Exchange 2010 Information Store using Windows Backup
    There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

  1. Avoiding Bugs in Microsoft Access
    Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
  2. Top 10 Best New Features in Visio 2010
    Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
  3. IT Consultant Business Secrets Revealed
    Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
  4. Disaster Recovery and Business Continuity
    Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
  5. Organize Your Visio Diagrams with Containers and Lists
    Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
  6. How to Us Objects, Properties, Events and Methods in Microsoft Access
    Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

 

by: ChiefITPosted on 2009-09-09 at 08:58:15ID: 25292611

Well, I was going to suggest two things.

1) you were still pointed to microsoft updates for these updates. But, in your client diag, I see that's not the case.

2) You have autoapprovals for service packs and security patches. This is by default of the WSUS server.

Do you know how to check your auto approved updates??

 

by: Barnabus2006Posted on 2009-09-15 at 07:18:31ID: 31626667

WSUS Automaitc Approvals was turned on.
Thank you ChiefIT !!!

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...