We help IT Professionals succeed at work.

Windows Update Event log

jskfan
jskfan asked
on
506 Views
Last Modified: 2007-12-19
I got many event ID 19 on W2k pro machine.

Source:Windows Update Agent
Computer: MYCOMPUTERNAME
Description: Installation Successful: Windows successfully installed the following update: Update for Windows 2000 (KB922582)


in the computer field I can se the name of my computer and for the same event ID I can see a different computer name in the next line.

I don't know where it got the computer name from. I tried to ping the name but it says uknow host.
Comment
Watch Question

Can you give a better example of what you are seeing?

I see where Computer: MyCmputerName is at, are you saying another computer name is in there as well?
Is it in the description field, or where exactly is the other computer name at?

Author

Commented:
event ID 19 has been logged in many lines. in some lines when you double click the log you see

Computer field on the event log, on some of the logs the field contains my correct computer name  and on some of them the Computer field has a different name, it is not my computer name and I don't know where the computer name came from.

Author

Commented:
Hold on, I am wrong

Author

Commented:
Event ID 19 has not been logged today, it is old 11/29/2006.

So I am not sure my PC has been updated through windows update.
I have been going through my past logs, and don't see anything like you are describing.

Could be an glitch?
Ok.

Have you seen the system tray icon for the updates pop up lately?

another thing too, sort the event log by date, and look for the entries that way.

Also the windowsupdate.log file might have been updated. Post that
Now thinking about it, check for Event 18 from today. The updates might have been downloaded and just not installed yet.
The updates will register an event 18 once they have successfully downloaded.

Author

Commented:
I look for event ID 18,19,21 for today but there is not any.
Post the WindowsUpdate.log

Can you run the WSUS Client Diagnostics Tool and log it?
It can be downloaded here:
http://download.microsoft.com/download/9/7/6/976d1084-d2fd-45a1-8c27-a467c768d8ef/WSUS%20Client%20Diagnostic%20Tool.EXE

Extract it and run it with the /t option
This will creat a clientdiag.log file

Post that too.

Commented:
Event ID 19 is generally posted for successful installs of Microsoft updates. With regard to different computer names in your Event Log, have you used system properties to change the computer name recently?

Author

Commented:
WSUS Client Diagnostics Tool

Checking Machine State
        Checking for admin rights to run tool . . . . . . . . . PASS
        Automatic Updates Service is running. . . . . . . . . . PASS
        Background Intelligent Transfer Service is running. . . PASS
        Wuaueng.dll version 5.8.0.2469. . . . . . . . . . . . . PASS
                This version is WSUS 2.0

Checking AU Settings
        AU Option is 4: Scheduled Install . . . . . . . . . . . PASS
                Option is from Policy settings

Checking Proxy Configuration
        Checking for winhttp local machine Proxy settings . . . PASS
                Winhttp local machine access type
                        <Direct Connection>
                Winhttp local machine Proxy. . . . . . . . . .  NONE
                Winhttp local machine ProxyBypass. . . . . . .  NONE
        Checking User IE Proxy settings . . . . . . . . . . . . PASS
                User IE Proxy. . . . . . . . . . . . . . . . .  NONE
                User IE ProxyByPass. . . . . . . . . . . . . .  NONE
                User IE AutoConfig URL Proxy
                http://autoproxy.na.abnamro.com
                User IE AutoDetect
                AutoDetect not in use

Checking Connection to WSUS/SUS Server
                WUServer = http://usbkmia001
                WUStatusServer = http://usbkmia001
        UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS
                Client is pointed to SUS 1.0 Server
        Connection to server. . . . . . . . . . . . . . . . . . PASS
        SelfUpdate folder is present. . . . . . . . . . . . . . PASS

Press Enter to Complete
Now I am really wondering what is going on.

This looks like it is working fine as far as connection to SUS goes.
SUS is supported until Tuesday, July 10, 2007
WSUS clients are backward compatible with SUS 1.0

Hmmm.
Verify you have patches approved on the SUS server. It has been a long time since I used SUS though I don't recall the interface, or how to set that up.

I would highly recommend upgrading to WSUS on the server.
Check here for info on the upgrade if you are interested.
http://www.microsoft.com/windowsserversystem/updateservices/downloads/wsus.mspx

Author

Commented:
SUS works fine here there is no need to upgrade but from this workstation it doesn't work.
CERTIFIED EXPERT
Author of the Year 2011
Top Expert 2006

Commented:
Hi jskfan,
Are you getting any Errors or Warnings in your Event Viewer logs (System or Application)?

Post back when you can.
Vic

Author

Commented:
No event log related to Windows update at all

Commented:
http://support.microsoft.com/kb/836941

let me know if you need any assistance

Author

Commented:
let me paste the last few lines of windowsupdate.log:

2007-01-29      08:48:38       988      3e0      AU        # WSUS server: http://SuSServerName.com
2007-01-29      08:48:38       988      3e0      AU        # Detection frequency: 22
2007-01-29      08:48:38       988      3e0      AU        # Approval type: Scheduled (Policy)
2007-01-29      08:48:38       988      3e0      AU        # Scheduled install day/time: Every day at 4:00
2007-01-29      08:48:38       988      3e0      AU        # Auto-install minor updates: Yes (Policy)
2007-01-29      08:48:38       988      3e0      AU        # Will interact with non-admins (Non-admins are elevated)
2007-01-29      08:48:38       988      3e0      AU        # Launching old AU client

Author

Commented:
Let me post the settings of the SUS servers:
in SUS server 1 /set options

  Select a proxy server configuration:
        Use a proxy server to access the Internet   is selected
       address:http://xyz.abc.com     Port:80
 
Specify the name your clients use to locate this update server:
Server Name: UBDCK

Select which server to synchronize content from:
Synchronize directly from the Microsoft Windows Update servers is selected

================
in SUS server 2 /set options
Select a proxy server configuration:
       Use a proxy server to access the Internet is selected
      Automatically detect proxy server settings is selected

Specify the name your clients use to locate this update server:
Server Name: SUSserverName2
Select which server to synchronize content from:
   Synchronize from a local Software Update Services server:
    http://SUSserver1
Synchronize list of approved items updated from this location (replace mode)  is selected
Select how you want to handle new versions of previously approved updates:
  Automatically approve new versions of previously approved updates is selected

Select where you want to store updates:
Save the updates to a local folder  selected.








Author

Commented:
any update?
This utility I have used in the past. It will force a check in and install.
Syntax is "nwsusutil.exe <susServerName>"

I would clear the log file, and try this to see if it will get updates.
Here is a link to download nwsusutil.zip
http://public.planetmirror.com/pub/nextwish/utils/?fl=

Author

Commented:
I am going to paste the last lines of the windowsupdate.log file.
Now I can see event ID 17 on the event viewer/system


2007-01-30      07:19:10      1076      704      Report      REPORT EVENT: {D3333C63-8CD0-4335-A24D-612611980CD4}      2007-01-30 07:19:05-0500      1      189      102      {00000000-0000-0000-0000-000000000000}      0      0      AutomaticUpdates      Success      Content Install      Installation Ready: The following updates are downloaded and ready for installation. To install the updates, an administrator should log on to this computer and Windows will prompt with further instructions:  - Cumulative Security Update for Outlook Express 5.5 Service Pack 2 (KB923694) - Windows Malicious Software Removal Tool - January 2007 (KB890830) - MSXML 4.0 SP2 Security Update (KB927978) - Security Update for Windows 2000 (KB926247) - Security Update for Microsoft .NET Framework, Version 2.0 (KB922770) - Security Update for Internet Explorer 6 Service Pack 1 (KB929969) - Cumulative Security Update for Internet Explorer 6 Service Pack 1 (KB925454) - Security Update for Microsoft .NET Framework, Version 2.0 (KB917283) - Security Update for Windows 2000 (KB923689) - Security Update for Windows Media Player 6.4 (KB925398)
2007-01-30      07:19:10      1076      704      Report      REPORT EVENT: {F6A2C95D-F67D-4195-A4DD-2A3B413D5C64}      2007-01-30 07:19:05-0500      1      162      101      {CF0E5C77-F048-42AF-8816-E806595F31FD}      103      0      AutomaticUpdates      Success      Content Download      Download succeeded.
Was that after you ran the nwsusutil?

Author

Commented:
Yes
That is good news.

If the install goes well, I would suggest before you reboot to grab an export of the HKLM\Software\Policies\Windows\WindowsUpdate Key

With nwsusutil.exe it temporarly modifies your registry to pull the updates, then upon reboot your registry is restored to its original state.

Author

Commented:
I couldn't find this

HKLM\Software\Policies\Windows\WindowsUpdate

Author

Commented:
I can see this
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate
That is the one. Sorry fingers faster than brain this morning.

Author

Commented:
Ok I exported the resgistery key to a file and rebooted the workstation.
what should I do next?

Your registry should be back to original. Compare what is there now, and what was in the export.

Make any adjustments in regards to time of install, day of install, etc..

After that your registry settings should be set, and you should be good to go.

Hope that helped.

Author

Commented:
Good to go where?

how do I know that my workstation is downloading windows updates?
how do I make similar changes to other workstations?

thanks
Sorry "Good to go" is slang for you system should be ok now.

You can check the status of you updates by:
1. Checking the windowsupdate.log
2. Look in event logs for EventID: 19 Source: Windows Update Agent
3. Check Update History from the windows update site.

As far as making changes to other workstations.
Take the registry file from your "successfull" system, and import those settings on the any other systems.

Author

Commented:
the windows update icon showed on the task bar and installed the updates manually. Do you think there is a way to make the updates install automatically?

This one is on us!
(Get your first solution completely free - no credit card required)
UNLOCK SOLUTION

Author

Commented:
thank you.

I amgoin to post another question regarding SUS in a few minutes
You can create a reg file out of the following for default SUS client settings to import to other workstations

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://sus"
"WUStatusServer"="http://sus"

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"AUOptions"=dword:00000004
"NoAutoUpdate"=dword:00000000
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000017
"UseWUServer"=dword:00000001

Which would do the following
1. automatically download updates and install on the scheduled day/time. Admin users will see a brief ballon and system tray icon which allows
2. a warning will be displayed that the computer is to restart in 5 minutes.
3. Clients will update every day.
4. Updates will install at 11pm
5. enable Automatic Updates to use the server running Software Update Services as specified in WUServer from above.


I hope this helps.
Unlock the solution to this question.
Join our community and discover your potential

Experts Exchange is the only place where you can interact directly with leading experts in the technology field. Become a member today and access the collective knowledge of thousands of technology experts.

*This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

OR

Please enter a first name

Please enter a last name

8+ characters (letters, numbers, and a symbol)

By clicking, you agree to the Terms of Use and Privacy Policy.