Automatic Update client tends to update from WindowsUpdate rather than SUS.
Automatic Update client tends to update from WindowsUpdate rather than SUS.
In this Article, I will explain why Automatic Update client tends to update from WindowsUpdate rather than SUS.
CASE 1: This actually started with V5 version of Windows Update & with Windows XP SP# 2. This is actually normal. That said, it means,
C:\Windows\Windows Update.log refers to V4 version of Windows Update &
C:\Windows\WindowsUpdate.log refers to V5 version of Windows Update.
That means, C:\Windows\WindowsUpdate.log (without the space) refers to V5 & C:\Windows\Windows Update.log log (with the space).
If you have V5 version of Windows Update, make sure the following registry values exist. If they don't exist, then create them.
Navigate to the following location by opening REGEDIT from Command Prompt;
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"SusServerVersion" = REG_DWORD: 0x00000001 (1)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]
"ConfigVer" = REG_DWORD: 0x00000001 (1)
***NOTE: If these values are not present, a V5 client tends to update from WindowsUpdate rather than SUS.
In my workstation, it looks something like:
C:\Documents and Settings\User>Reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\AutoUpdate
SusServerVersion REG_DWORD 0x1
AUState REG_DWORD 0x2
NextDetectionTime REG_SZ 2004-10-06 05:54:40
ConfigVer REG_DWORD 0x1
LastWaitTimeout REG_SZ 2004.10.07 01:23:20
CASE 2: Sometimes in WindowsUpdate.log you may see that even after configuring Automatic Updates to use SUSServer, it goes to Windowsupdate.com as shown below;
02-03 11:47:29-0000 804 634 PT: Using ServerID {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-02-03 11:47:29-0000 804 634 PT:
Using server URL https://v5.windowsupdate.microsoft.com/ClientWebService/client.asmx
2005-02-03 11:47:29-0000 804 634
URL for server is http://v5stats.windowsupdate.microsoft.com/ReportingWebService/Report...
This is because of a registry value, ODFFileURL REG_SZ , which is pointing to windowsupdate.com;
C:\>Reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
! REG.EXE VERSION 3.0
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto
Update
ODFFileURL REG_SZ http://v4.windowsupdate.microsoft.com/odf/wuodf.xml
You have to DELETE the following "ODFFileURL REG_SZ http://v4.windowsupdate.microsoft.com/odf/wuodf.xml" registry value from "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update"
Restart the machine which will also restart the Automatic Update Services. Now, force the update detection and monitor the logs.
CASE 3: When the Automatic Update Client polls a SUS server, several scripts are run on the SUS server to retrieve user configuration settings including the SUS server content store URL. If the content store URL cannot be retrieved because of a race condition or because the client hard disk is full, the Automatic Update Client computer is routed to the Windows Update Web site. The configuration settings may be partially written or not written at all.
RESOLUTION:
A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.
http://support.microsoft.com/default.aspx?scid=kb;en-us;892311
Happy Reading!
Mohammed Athif Khaleel
MVP - SUS / WSUS
Windows Server Update Services Wiki
http://www.wsuswiki.com/Athifs
"Save the Internet. Keep all Systems Patched"
[This posting is provided "AS IS" with no warranties and confers no rights.]