WSUS Client Update Problem

You may need to check for rootkits

http://pclan.us/articles/34-code-80072efe-windows-update.html

Ah ha, I wish i had found that kb before going through everything else I had to get to this point... It has worked, however, I have noticed in the log that the client appears to be pulling it's updates directly from Microsoft as opposed to the WSUS server:

2012-03-13      05:01:09:660      1440      558      DnldMgr      ***********  DnldMgr: New download job [UpdateId = {6497A0D7-0B72-489B-A1B1-232DA483C5AA}.106]  ***********
2012-03-13      05:01:10:191      1440      558      DnldMgr        * BITS job initialized, JobId = {4B08E85F-04FF-44A6-8894-8462672048BE}
2012-03-13      05:01:10:598      1440      558      DnldMgr        * Downloading from http://au.download.windowsupdate.com/msdownload/update/software/secu/2011/11/windowsxp-kb2585542-x86-enu_8812e165246f8a1b68f65330ba5621818d9d348c.exe to C:\WINDOWS\SoftwareDistribution\Download\f6704dac24299a592e4e7aa77f5965e1\windowsxp-kb2585542-x86-enu.exe (full file).
2012-03-13      05:01:11:535      1440      df4      DnldMgr      BITS job {7F75A129-CB88-4E91-AA61-2D8B92D90DF5} completed successfully
2012-03-13      05:01:11:723      1440      df4      Misc      Validating signature for C:\WINDOWS\SoftwareDistribution\Download\c3620a167d80b131f28b6d5b0bebf853\windowsxp-kb2646524-x86-express-enu.cab:
2012-03-13      05:01:11:738      1440      df4      Misc       Microsoft signed: Yes
2012-03-13      05:01:11:738      1440      df4      DnldMgr        Download job bytes total = 247122, bytes transferred = 244238
2012-03-13      05:01:11:770      1440      df4      DnldMgr      ***********  DnldMgr: New download job [UpdateId = {4619C813-5E67-4170-AC1B-41B9871BC8E2}.101]  ***********
2012-03-13      05:01:11:770      1440      df4      DnldMgr        * Queueing update for download handler request generation.
2012-03-13      05:01:11:770      1440      df4      DnldMgr      Generating download request for update {4619C813-5E67-4170-AC1B-41B9871BC8E2}.101
2012-03-13      05:01:12:129      1440      df4      Handler      Windows Patch download for UpdateId = {4619C813-5E67-4170-AC1B-41B9871BC8E2}: selected action is download express (delta).
2012-03-13      05:01:12:160      1440      df4      Handler      Updateci: ExpandTokenizedPath( <hklm\software\microsoft\preinstall,path>\winse\wxp_x86_0409_v1\update.exe.ref ): failed (2)
2012-03-13      05:01:12:160      1440      df4      Handler      Updateci: ConvertToXpdFailure: Change error 2 (0x2) to 4316
2012-03-13      05:01:12:160      1440      df4      Handler      Updateci: WinSEUpdateHandler::_UnpackCab: Failed extracting XPD to C:\WINDOWS\SoftwareDistribution\Download\c3620a167d80b131f28b6d5b0bebf853 (4316, 0x10dc)
2012-03-13      05:01:12:160      1440      df4      Handler      Updateci: WinSEUpdateHandler::_Unpack: Mapping XPD failure to STATUS_RETRY_SELF_CONTAINED 0xF207
2012-03-13      05:01:12:160      1440      df4      Handler      Updateci: WinSEUpdateHandler::_Unpack: C:\WINDOWS\SoftwareDistribution\Download\c3620a167d80b131f28b6d5b0bebf853\windowsxp-kb2646524-x86-express-enu.cab failed (61959)
2012-03-13      05:01:12:160      1440      df4      Handler      FATAL: UH: 0x8007f207: Unpack failed in CUHWindowsPatchHandler::ValidateAndUnpackPackage
2012-03-13      05:01:12:160      1440      df4      Handler      FATAL: UH: 0x8024200c: ValidateAndUnpackPackage failed in CUHWindowsPatchHandler::GetRequiredFilesForSandboxState
2012-03-13      05:01:12:176      1440      df4      Handler      Windows Patch download for UpdateId = {4619C813-5E67-4170-AC1B-41B9871BC8E2}: selected action is download full-file.
2012-03-13      05:01:12:207      1440      df4      DnldMgr      ***********  DnldMgr: New download job [UpdateId = {4619C813-5E67-4170-AC1B-41B9871BC8E2}.101]  ***********
2012-03-13      05:01:12:738      1440      df4      DnldMgr        * BITS job initialized, JobId = {AAC811D3-E57D-4D28-8D62-AF19C4F84F1A}
2012-03-13      05:01:13:113      1440      df4      DnldMgr        * Downloading from http://au.download.windowsupdate.com/msdownload/update/software/secu/2011/12/windowsxp-kb2646524-x86-enu_4d4352a7ab38598cd5503dec07f03d5c9a10b928.exe to C:\WINDOWS\SoftwareDistribution\Download\c3620a167d80b131f28b6d5b0bebf853\windowsxp-kb2646524-x86-enu.exe (full file).
2012-03-13      05:01:13:723      1440      558      DnldMgr      BITS job {5923CC79-40BA-400F-908D-39B960CB2E78} completed successfully
2012-03-13      05:01:13:910      1440      558      Misc      Validating signature for C:\WINDOWS\SoftwareDistribution\Download\9e60c24a6ee0f71be2a1e782caa15bc5\windowsxp-kb2544893-v2-x86-express-enu.cab:

The WSUS settings are done by GPO and running a quick results wizard does indicate that the GPO is still reaching the machine, yet all of the download attempts i have seen in the windows update log indicate the client is ignoring the WSUS Server.. And i've also got a log full of this again:

2012-03-13      05:06:44:145      1440      4cc      DnldMgr      Error 0x80072efe occurred while downloading update; notifying dependent calls.

Any ideas?

Is the time correct on this PC?

Yeah, they're all set to read from the pdc. It's not just one client either. Basically, I ran the MS 'Fix it' on one of the problem clients yesterday. I then noticed numerous updates scheduled for install and after looking this morning, all of the updates went on fine. However, there were still quite a few updates needed for this PC and yet again, they won't download:

I've attached an excerpt from the log showing the results after I stop/started the automatic updates service.

Well, I think I've found part of the problem. Executables are blocked at the firewall level and since opening this up, it looks like all clients are now able to download the updates. However, I'm not entirely sure why the clients seem to be going directly to MS as opposed to the WSUS Server. Even so, at least they are updating which is a start.

Multiple reasons mostly server related and not client related which I resolved myself