Outlook by the sound : WUS

Extremely Slow WSUS Downloading Updates

OBTS — Tue, 06 Sep 2005 03:55:00 GMT

From: <Mark@discussions.microsoft.com>

Subject: Extremely Slow WSUS Downloading Updates

Date: Mon, 8 Aug 2005 18:19:01 -0700

Newsgroups: microsoft.public.softwareupdatesvcs

Hi All

I have read through all the other downloading issues and am still unable to answer my problem. I installed WSUS about a week ago and the install went fine and all machines reported back. I then started testing a few updates and found that it took ages 4 days to download XP SP 2. Eventually it worked and patched the relevant machines so I decided to install a few more updates. It is now downloading at an incredibly slow rate and I predict it will take about 2 weeks to download all the updates I have selected! Why is that?

Our internet connection is 2mb up and down so it should be alot faster. We only have an ISA firewall here so it is going through that. Any ideas would be gratefully received!

thanks

Mark

*************************************

Date: Tue, 09 Aug 2005 11:37:05 +0200

From: "Torgeir Bakken \(MVP\)"

Subject: Re: Extremely Slow WSUS Downloading Updates

Newsgroups: microsoft.public.softwareupdatesvcs

Hi,

This might speed up the downloads:

Download the Server Diagnostic Tool from here:

http://www.microsoft.com/windowsserversystem/updateservices/downloads/default.mspx

Run the following commands in a command prompt:

net.exe stop WSusService

<some path here>\WsusDebugTool.exe /Tool:SetForegroundDownload net.exr start WSusService

If the server is used for other things than WSUS, you should monitor the performance of those other functions, as setting BITS to Foreground mode might have a performance impact on them.

If you want to set it back to it's original status later on:

<some path here>WsusDebugTool.exe /Tool:ResetForegroundDownload

And a FYI:

Please post WSUS questions to the newsgroup dedicated to WSUS:

microsoft.public.windows.server.update_services

(the microsoft.public.softwareupdatesvcs newsgroup is for SUS)

WebNews link to the WSUS newsgroup:

http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windows.server.update_services

Or use a newsgroup reader (default Outlook Express) to access this new

group:

Clicking on this link should open this group in OE:

news://msnews.microsoft.com/microsoft.public.windows.server.update_services

torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide:

http://www.microsoft.com/technet/scriptcenter/default.mspx

*************************************

From: <Stephen Travers@discussions.microsoft.com>

Subject: Re: Extremely Slow WSUS Downloading Updates

Date: Fri, 2 Sep 2005 08:49:31 -0700

Newsgroups: microsoft.public.softwareupdatesvcs

THANK YOU for the information!!! this was a HUGE help and should be inclded with the documentation that is shipped with WSUS. I've had this problem on 2 installations at 2 different companies. now i know how to fix my dedicated wsus servers!!

-s

WSUS Installation document

OBTS — Tue, 06 Sep 2005 03:52:00 GMT

From: <Chris@discussions.microsoft.com>

Subject: Re: WSUS Mistake - now what?

Date: Wed, 31 Aug 2005 08:10:01 -0700

Newsgroups: microsoft.public.windows.server.sbs

Here is the guide to installing WSUS on SBS 2003...

http://www.microsoft.com/downloads/details.aspx?FamilyID=28c43d57-2e15-47b2-9a6f-1514aa3ed05f&displaylang=en

Chris

Rochester, NY

Servers not showing in Computers

OBTS — Fri, 01 Jul 2005 02:04:00 GMT

From: "LarMan"

Subject: Servers not showing in Computers

Date: Fri, 22 Apr 2005 19:37:57 -0700

Newsgroups: microsoft.beta.wusoep.general

Hi,

Okay I fixed the deal with the clients not showing/reporting in to the WSUS server. I just reverted to port 80 and all started talking sans one machine. I'm sure I can lick that problem. but now I have another. The servers are not showing up at all. Not in unassigned or a group. I have 2 servers on this domain-one Win2kSP4 running WSUS and the other Win2k3 running ISA with IIS turned off. What is wrong? Do I need to do anything special (the GPO's are applied to the servers). Please help! I would appreciate any input at all.

LarMan

*************************************

From: "LarMan"

Subject: Servers not showing in Computers

Date: Sat, 23 Apr 2005 15:16:46 -0700

Newsgroups: microsoft.beta.wusoep.general

Hi,

Ok I fixed the server situation as well. Here's the deal: you must manually do a Windows Update on the WSUS server to assure the new Windows Installer is in place. After that is done just wait for the next sync and BAM! It's all working now and this fine product is head and shoulders above (IMO) my OLD recommended/installed solution that regularly missed and failed on updates. I just wish this product was as easy to install as the 'other'.

LarMan

You can get the WUS RC from

OBTS — Sat, 26 Mar 2005 21:16:00 GMT

From: "A McGuire" <amcguire@flad.com.invalid>

Subject: Re: Other sources of help

Date: Tue, 22 Mar 2005 11:11:35 -0600

Newsgroups: microsoft.beta.wusoep.general

You can get the RC from:

http://download.microsoft.com/download/9/8/4/984c8f16-47b1-475b-ace0-2d07c0b12501/WSUSSetup.exe

A McGuire

*************************************

From: "A McGuire"

Subject: Re: Release Candidate 1 rolling out now?

Date: Tue, 22 Mar 2005 10:14:43 -0600

Newsgroups: microsoft.beta.wusoep.general

Note: After logging into my .NET and registering, I would get an error. I changed the URL from:

https://profile.microsoft.com/Regsysprofilecenter/%20http://download.microsoft.com/download/9/8/4/984c8f16-47b1-475b-ace0-2d07c0b12501/WSUSSetup.exe

http://download.microsoft.com/download/9/8/4/984c8f16-47b1-475b-ace0-2d07c0b12501/WSUSSetup.exe

and it worked. Strange, but in case any of you get the error after registering.

A McGuire

Customize XP SP2--WUS Install

OBTS — Thu, 17 Mar 2005 03:22:00 GMT

From: "Al"

Subject: Customize XP SP2 (WUS Install)?

Date: Mon, 14 Mar 2005 11:21:12 -0800

Newsgroups: microsoft.beta.wusoep.general

Is it possible to customize the XP SP2 (WUS Install) version so that the Firewall is turned off as well as the Pop-up blocker etc.?

*************************************

From: "Mike Kapos"

Subject: Re: Customize XP SP2 (WUS Install)?

Date: Mon, 14 Mar 2005 11:22:54 -0800

Newsgroups: microsoft.beta.wusoep.general

Are you using AD? I use GPO's that automatically turn off the Firewall....

*************************************

From: "Al"

Subject: Re: Customize XP SP2 (WUS Install)?

Date: Mon, 14 Mar 2005 11:37:37 -0800

Newsgroups: microsoft.beta.wusoep.general

No, we don't run AD. This would have to be via Registry settings or some other way. I would like to turn it off so that on the reboot, the end users wouldn't have to make any choices about allowing (unblocking) this or that. Without being able to customize it, the EU would have to unblock at least one service and maybe some other stuff or else they wouldn't be able to log back in.

*************************************

From: "Bezalel Geretz"

Subject: Re: Customize XP SP2 (WUS Install)?

Date: Tue, 15 Mar 2005 15:16:47 -0500

Newsgroups: microsoft.beta.wusoep.general

Here is the .REG file to disable the filewall

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall

\StandardProfile] "EnableFirewall"=dword:00000000

The pop-up blocker is set in the users profile so deploying .reg files is a bit more difficult.

Windows XP SP2 Detection

OBTS — Thu, 24 Feb 2005 02:44:00 GMT

"Michael Davis" wrote in message

I have not seen a post recently about this issue. Do we have a resolution for this yet? To recap, after I pushed XPSP2 to 4 of my computers, they no longer can talk to the WUS Server. I run the wuauclt /detectnow and no luck. I try to hit the site using IE's windowsupdate and I get an error there. I then noticed that the Automatic Updates service was not running and I try starting the service and I get an error there. Other than this issue, I really like the use and feel of WUS. Can someone please let me know the status of this issue?

Thanks - Mike Davis

**************************************

From: "Michael Davis" <mdavis coxsmith com>

Subject: Re: Windows XP SP2 Detection

Date: Thu, 10 Feb 2005 14:54:58 -0600

Newsgroups: microsoft.beta.wusoep.general

I finally found an answer out there. And it worked. Thank you Sergei

To give credit, here is the link with the text at the bottom.

http://techrepublic.com.com/5208-6247-0.html?forumID=12&threadID=157166&messageID=1663085

Hi all

I also trap to this problem. After deep Internet investigation I found only one solution that eliminate this problem. Author recommended run following command.

sc sdset wuauserv

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRC

WDWO;;;BA)(A;;CCLCSW

LOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

Unfortunately this settings does not work on next day. I assumed that this problem occured as a result of an GPO was applied everyday in my network. I compare results of

sc sdshow wuauserv

in both cases: when problem occured and with worked one. I found that only one chanhge is enough for success.

Bad Security descriptor:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCS

WRPWPDTLOCRSDRCWDWO;;;SY)

Worked one:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)

(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)

As you can see difference is only in one permission. I think new version of wuauserv required "Authenticated User" with read permission not "Interactive User".

To solve this problem I use GPMC snap-in and find the place where this permissions can be added. In my case it was Default Domain Security policy.

Start->Administrative Tools->Active Directory Users and

Computers->Right Click on domain -> Select Properties-> Select Group

Policy

In Group Policy Snap-in open folowing

Computer Configuration -> Windows Settings -> Security Settings ->

System Services

Select Service named Authomatic Updates and click properties.

Click Edit Security and Just add Authenticated Users with read

permissions to Group or user names.

Don't forget run gpupdate on your target computer.

Have fun

Sergei Podnos

Tech Dept Manager

MIIK Ltd.

Microsoft Certified Partner

Kharkiv

Ukraine

*************************************

From: "Gary L. Spohn"

Subject: Re: Windows XP SP2 Detection

Date: Mon, 14 Feb 2005 11:17:00 -0500

Newsgroups: microsoft.beta.wusoep.general

I have experimented to with the settings below. But, in my situation

the updates are occurring when no one is logged on. So, I'm skeptical

about "Authenticated Users" having read permission. Couple this with

other info in this newsgroup that talks about NETWORK SERVICE being the

system account that runs WU. I compared two GPOs: one where I have WU working; one not working. I found that the GPO setting that Sergei

discusses in the working GPO had NETWORK SERVICE permissions "read" and "start, pause, stop" and the failing GPO did not have NETWORK SERVICE listed. I have now given the WU setting in the failing GPO the same settings as the working GPO. If this works, it will fix my last

remaining WUS failures.

************************************

From: "Gary L. Spohn"

Subject: Re: Windows XP SP2 Detection

Date: Tue, 15 Feb 2005 07:35:54 -0500

Newsgroups: microsoft.beta.wusoep.general

Adding NETWORK SERVICE as I discussed below, in fact did allow my

remaining missing workstations to contact WUS. To be clear, I did NOT

add Authenticated Users nor did I need to run any of the security

descriptor commands listed below. I simply added NETWORK SERVICE (read and start/pause/stop) to the permissions for Computer Configuration -> Windows Settings -> Security Settings -> System Services -> Automatic

Updates in the GPO controlling the OU in which these computers were

located.

SUS & SP2 Firewall Configuration

OBTS — Thu, 24 Feb 2005 02:40:00 GMT

From: <DrNASA@discussions.microsoft.com>

Subject: SUS & SP2 Firewall Configuration

Date: Mon, 14 Feb 2005 08:59:05 -0800

Newsgroups: microsoft.public.softwareupdatesvcs

I am implementing SUS and have approved SP2 to be rolled out.

I use DameWare to connect and administer clients remotely until I get my SMS 2003 immplementation rolling.

SUS works brilliantly, but I need to be able to configure SP2 Firewall to be turned off or be able to configure an exception because I cannot remote in once SP2 is installed because the firewall is on by default.

I have to physically go to each machine and make this change which is a beating as the whole point of SUS is to avoid that.

I don't think that I can do that in SUS (which sucks, I probably can in

an SMS package, but that is not how I want to do it >:(

Thanks!

****************************************

Date: Mon, 14 Feb 2005 18:32:26 +0100

From: "Torgeir Bakken \(MVP\)" <Torgeir.Bakken-spam@hydro.com>

Subject: Re: SUS & SP2 Firewall Configuration

Newsgroups: microsoft.public.softwareupdatesvcs

Correct, you cannot use SUS to do anything with this.

If you have Active Directory, use Group Policy for this, more about Windows Firewall Group Policy settings in WF_XPSP2.doc:

http://www.microsoft.com/downloads/details.aspx?familyid=4454e0e1-61fa-447a-bdcd-499f73a637d1

If Group Policy is not an option:

An alternative is to set some registry settings before the SP2 installation so the FW disables itself when it finds those registry settings. Then, if you want to enable the FW after the SP2 installation, remote in and remove the registry values and configure the firewall.

The registry settings are:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall

\DomainProfile\EnableFirewall=0 (DWORD data type)

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall

\StandardProfile\EnableFirewall=0 (DWORD data type)

(adding the registry values after SP2 is installed will also disable the firewall at next startup)

Those registry values are documented in WF_XPSP2.doc

WF_XPSP2.doc "Deploying Windows Firewall Settings for Microsoft Windows XP with Service Pack 2" is downloadable from

http://www.microsoft.com/downloads/details.aspx?familyid=4454e0e1-61fa-447a-bdcd-499f73a637d1

torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide:

http://www.microsoft.com/technet/scriptcenter/default.mspx

Force WUS

OBTS — Thu, 24 Feb 2005 02:30:00 GMT

From: "Olof Helge" <ohelge@spray.se>

Subject: Suggestion about a new AU client feature

Date: Thu, 10 Feb 2005 16:43:46 +0100

Newsgroups: microsoft.beta.wusoep.general

Hi WUS team! :)

I'm well happy to see the WUS Beta. It works like a dream, and finally I can tell that the PC's are patched or not.

One thing though.

I first experienced this problem when the Blaster virus came. All of my Windows XP OS-images were out-of-date. I created a RunOnce script that installed the RPC patches on the first login. This worked ok, but I was never totally fine with it. I updated the images with the patches and so on. Now to the point........

Will I ever be able to use a webbrowser to my WUS server? So I can manually go and install the approved patches, right after the OS is deployed (I want to be able to install a new PC and give it to the user all done. I don't want to wait X number of hours before AU is

done) If I wont be able to surf to the WUS, maybe a button on the AU tab, saying something like "detect and install" so I can trigger it immediately for the same reason.

I'm really looking forward to the RC. Great job people.

Best Regards

Olof

****************************************

From: "WUS Announcements" <administrator@maxwinders.com.au>

Subject: Re: Suggestion about a new AU client feature

Date: Fri, 11 Feb 2005 10:04:34 +1000

Newsgroups: microsoft.beta.wusoep.general

you can execute "wuauclt /detectnow" from the command line (or run) to force a detection cycle. from here, the system tray automatic updates icon will appear if there are updates available and you can choose to install them on the spot

How to get existing SUS to survive a reconstruction of IIS?

OBTS — Thu, 03 Feb 2005 21:09:00 GMT

Date: Sat, 22 Jan 2005 16:29:08 PST

Subject: How to get existing SUS to survive a reconstruction of IIS?

From: "Hollis D. Paul"

Newsgroups: microsoft.public.softwareupdatesvcs

I am trying to repair my SPS server, and this entails uninstalling SPS, WSS, and IIS, and reinstalling them all again, making sure FPSE is not on the box when done.

SUS is also on this box, on its own Virtual Server. I have saved the configuration of the SUS VS to a file. Is that enough to resurrect the SUS server when IIS is restored? I am looking at Atif's instructions on 3-step plan on how to move to a new server and save the patch database and content.

1: copy all of the \content\cab files from the old server to the target server. (I see this as a No-op, as the files will not be removed when IIS is removed. But I have saved the configuration of the virtual server to a file, and will use that to restore the VS.)

2: copy the following files under the VROOT of the default web site {to} (I think that this is a No-op, also, because they are already there and will be preserved.)

3: create a VROOT called "content" and point to the "content\cabs"

directory. I am not sure what the VROOT is in this case. I think it is a Virtual Server, but the home directory of current SUS Virtual Server is not pointing to the "content\cabs" directory, but to C:\SUS\vroot, which contains the four cabs and the ApprovedText file.

Is there anything I have to do for this step?

In addition, the root of the default web contains a 2.48 meg aucatalog1.cab, and an aurtf1.cab. Will these be preserved when IIS is un-installed?

**************************************

Date: Mon, 24 Jan 2005 16:30:40 PST

Subject: How to get existing SUS to survive a reconstruction of IIS?

From: "Hollis D. Paul"

Newsgroups: microsoft.public.softwareupdatesvcs

Well, the usefulness of SUS 1.x, has just dropped down to zero. I tried to do a backup and found that it would have produced a 25 gig file. My partition ran out of space, first. So I deleted all the cabs and backed up what was left. I suppose it will download all those 6000 plus cabs if I try to sync with the server again?

Is the WUS beta running reasonably well by now?

Hollis D. Paul [MVP - Outlook]

**************************************

From: eddieb@online.microsoft.com (Eddie Bowers [MSFT])

Date: Tue, 25 Jan 2005 23:23:29 GMT

Subject: RE: How to get existing SUS to survive a reconstruction of IIS?

Newsgroups: microsoft.public.softwareupdatesvcs

You can use metaedit or metabase explorer to export your sus web site and then import it again after the rebuild.

http://support.microsoft.com/default.aspx?scid=kb;en-us;301386

http://www.microsoft.com/resources/documentation/IIS/6/all/techref/en-us/iisRG_MET_37.mspx

You would want to export just that particular site, not all IIS settings.

All of the other SUS files should remain untouched, so they should work after reimporting the IIS settings.

Eddie Bowers

Security Support

Microsoft Corporation