We help IT Professionals succeed at work.

wsus clients updating from Internet instead of wsus server

Most of my clients are now connecting via the Internet to download their apps instead of talking directly to the WSUS server. I'm not sure what the problem is. I deleted the windowsupdate.log on one of my machines and started the service back up to get a clean log and this is what I got. The log references the WSUS server (srvautil01) but I can see connections for Windows update going out our Internet line from this machine. wsus.txt
Comment
Watch Question

Commented:
Look for events 1030 and 1058, on the domain controllers. You might have a problem with your Group policies replicating from one server to the other.
Logs say that update is download from the wsus server,how you are saying that the client download update from internet.Internet means , are you refering windows update?

Author

Commented:
ChiefIT - I looked on both my domain controllers and didn't see any error codes in any of the logs. Also, it appears the correct information is coming down from GP since my windowsupdate.log references the correct server.
Venuraiav - We have a packeteer at our Internet border that classifies traffic at layer 7 and I'm still seeing "Microsoft Updates" traffic coming from our machines. That and the workstations are still at 20% after running for two days. Oh, and my T-1 stays maxed out. ;)

Author

Commented:
BTW, I have run wuauclt /resetauthorization /detectnow in a multitude of fashions to try and kick the client into gear. I'm getting a gut feeling that the problem is on the server since it's happening to so many clients.

Commented:
On one of the troublec clients, run the WSUS client diagnostic tool and post its results.

Author

Commented:

WSUS Client Diagnostics Tool

Checking Machine State
        Checking for admin rights to run tool . . . . . . . . . PASS
        Automatic Updates Service is running. . . . . . . . . . PASS
        Background Intelligent Transfer Service is running. . . PASS
        Wuaueng.dll version 7.4.7600.226. . . . . . . . . . . . PASS
                This version is WSUS 2.0

Checking AU Settings
        AU Option is 3 : Notify Prior to Install. . . . . . . . PASS
                Option is from Policy settings

Checking Proxy Configuration
        Checking for winhttp local machine Proxy settings . . . PASS
                Winhttp local machine access type
                        <Direct Connection>
                Winhttp local machine Proxy. . . . . . . . . .  NONE
                Winhttp local machine ProxyBypass. . . . . . .  NONE
        Checking User IE Proxy settings . . . . . . . . . . . . PASS
                User IE Proxy. . . . . . . . . . . . . . . . .  NONE
                User IE ProxyByPass. . . . . . . . . . . . . .  NONE
                User IE AutoConfig URL Proxy . . . . . . . . .  NONE
                User IE AutoDetect
                AutoDetect not in use

Checking Connection to WSUS/SUS Server
                WUServer = http://srvautil01:8530
                WUStatusServer = http://srvautil01:8530
        UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS
        Connection to server. . . . . . . . . . . . . . . . . . PASS
        SelfUpdate folder is present. . . . . . . . . . . . . . PASS

Press Enter to Complete

Author

Commented:
When I navigate to http://srvautil01:8530 in my browser I get
Directory Listing Denied

This Virtual Directory does not allow contents to be listed

Not sure if this is normal behavior or not.

Commented:
Well the clients are the ones that navigate to the server and pull updates from them. I am assuming they show up in WSUS console and are checking in regularly??
yes they do. I really hate stupid stuff like this. Under Options/Update Files & Languages there was an option to store locally or connect directly to the Internet. Apparently someone (maybe me, who knows) chose the connect directly to save HDD space and we didn't notice it until this large update came from MS and killed our Internet connection. Sorry to waste everyone's time.