Found this, earlier in the log:
2016-10-25 14:52:45:474 784 119c SLS Retrieving SLS response from server
using ETAG "4V8nqvoeoxgpu+6kKNNNGpLr4BCvPTmaz82CIDm5o5g=_1440"...
2016-10-25 14:52:45:476 784 119c SLS Making request with URL
HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340
2016-10-25 14:52:45:785 784 23ac SLS Retrieving SLS response from server
using ETAG "4V8nqvoeoxgpu+6kKNNNGpLr4BCvPTmaz82CIDm5o5g=_1440"...
2016-10-25 14:52:45:829 784 23ac SLS Making request with URL
HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340
2016-10-25 14:52:45:890 784 119c EP Got
9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL:
"117cab2d-82b1-4b5a-a08c-4d62dbee7782"
2016-10-25 14:52:45:969 784 23ac EP Got WSUS Client/Server URL: "
http://dctrman001.wrk.ads.pha.phila.gov/ClientWebService/client.asmx";
2016-10-25 14:52:45:978 784 23ac Setup Checking for agent SelfUpdate
2016-10-25 14:52:45:988 784 23ac Setup Client version: Core: 7.9.9600.18340
Aux: 7.9.9600.18340
2016-10-25 14:52:45:991 784 23ac EP Got WSUS SelfUpdate URL: "
http://dctrman001.wrk.ads.pha.phila.gov/selfupdate";
2016-10-25 14:52:46:045 784 119c EP Got
117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 redir Client/Server URL: "
https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx";
2016-10-25 14:52:46:077 784 23ac Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags
0x00000080:
2016-10-25 14:52:46:380 784 23ac Misc Microsoft signed: NA
2016-10-25 14:52:46:391 784 23ac Misc Infrastructure signed: Yes
2016-10-25 14:52:46:433 784 23ac Misc WARNING: Cab does not contain correct
inner CAB file.
2016-10-25 14:52:46:438 784 23ac Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags
0x00000080:
2016-10-25 14:52:46:448 784 23ac Misc Microsoft signed: NA
2016-10-25 14:52:46:461 784 23ac Misc Infrastructure signed: Yes
2016-10-25 14:52:46:476 784 119c PT +++++++++++ PT: Synchronizing server
updates +++++++++++
2016-10-25 14:52:46:505 784 119c PT + ServiceId =
{117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}, Server URL =
https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx
2016-10-25 14:52:46:555 784 119c Agent Reading cached app categories using
lifetime 604800 seconds
2016-10-25 14:52:46:566 784 119c Agent Read 0 cached app categories
2016-10-25 14:52:46:574 784 23ac Setup Skipping SelfUpdate check based on
the /SKIP directive in wuident
2016-10-25 14:52:46:576 784 119c Agent SyncUpdates adding 0 visited app
categories
2016-10-25 14:52:46:580 784 23ac Setup SelfUpdate check completed.
SelfUpdate is NOT required.
2016-10-25 14:52:47:409 784 119c PT + SyncUpdates round trips: 0
2016-10-25 14:52:47:762 784 119c Agent * Added update
{C21E26AB-BFEE-425B-BD0B-C0043B81B034}.1 to search result
2016-10-25 14:52:47:774 784 119c Agent * Added update
{F944750C-BED6-4116-BFC4-91361F87CE97}.1 to search result
2016-10-25 14:52:47:776 784 119c Agent * Added update
{AE53F50B-1F53-4E10-93A2-7005AD671608}.100 to search result
2016-10-25 14:52:47:787 784 119c Agent * Added update
{17A599BB-6485-4405-89C1-77A260C078D9}.100 to search result
2016-10-25 14:52:47:789 784 119c Agent * Added update
{1E536662-7256-42FA-9373-7A009A14400B}.100 to search result
2016-10-25 14:52:47:792 784 119c Agent * Added update
{DE323AF5-28CA-4BAB-A85B-B074001783BF}.1 to search result
2016-10-25 14:52:47:794 784 119c Agent * Added update
{D87FA2B6-A04D-4920-92AE-7C6586F98ED4}.1 to search result
2016-10-25 14:52:47:801 784 119c Agent * Added update
{00563009-B9BF-43A4-8B4E-5ACE3172912B}.2 to search result
2016-10-25 14:52:47:802 784 23ac PT +++++++++++ PT: Synchronizing server
updates +++++++++++
2016-10-25 14:52:47:803 784 119c Agent * Added update
{BB8EED48-5EB9-481D-A043-D8BE51942055}.1 to search result
2016-10-25 14:52:47:805 784 23ac PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://dctrman001.wrk.ads.pha.phila.gov/ClientWebService/client.asmx
2016-10-25 14:52:47:807 784 119c Agent * Added update
{4849182B-70A4-4A3F-9FF9-054D8BCDCDDD}.1 to search result
2016-10-25 14:52:47:809 784 23ac PT WARNING: Cached cookie has expired or
new PID is available
2016-10-25 14:52:47:811 784 119c Agent * Added update
{A44878FB-450F-4C78-AC58-0F32712DDA1A}.1 to search result
2016-10-25 14:52:47:815 784 119c Agent * Added update
{5DBBEA84-90D6-42A4-B8EE-CA2BA1A42B1C}.1 to search result
2016-10-25 14:52:47:820 784 23ac EP Got WSUS SimpleTargeting URL: "
http://dctrman001.wrk.ads.pha.phila.gov";
2016-10-25 14:52:47:822 784 119c Agent * Added update
{2A4D62A5-450B-450C-A44E-65E9CC5DBD45}.1 to search result
2016-10-25 14:52:47:831 784 23ac IdleTmr WU operation
(CAuthorizationCookieWrapper::InitializeSimpleTargetingCookie) started;
operation # 10; does use network; is at background priority
2016-10-25 14:52:47:833 784 119c Agent Update
{A646B27E-937C-419F-B2A0-8817A4D1D5FD}.1 is pruned out due to potential
supersedence
2016-10-25 14:52:47:835 784 23ac PT Initializing simple targeting cookie,
clientId = 789a07cb-494a-4c4b-b3fe-f30dd93886da, target group = , DNS name
= admnftp001.wrk.ads.pha.phila.gov
2016-10-25 14:52:47:837 784 119c Agent * Added update
{58045100-5E56-41CE-B7AD-8A306A21F9CB}.1 to search result
2016-10-25 14:52:47:841 784 23ac PT Server URL =
http://dctrman001.wrk.ads.pha.phila.gov/SimpleAuthWebService/SimpleAuth.asmx
2016-10-25 14:52:47:844 784 119c Agent * Found 14 updates and 24
categories in search; evaluated appl. rules of 75 out of 90 deployed
entities
2016-10-25 14:52:47:884 784 119c Agent *********
2016-10-25 14:52:47:896 784 119c Agent ** END ** Agent: Finding updates
[CallerId = AutomaticUpdates Id = 2]
2016-10-25 14:52:47:903 784 119c Agent *************
2016-10-25 14:52:47:969 784 728 Report REPORT EVENT:
{08AF8782-C9E9-4FD3-8D30-B8834B66981C} 2016-10-25 14:52:47:884-0400 1 147
[AGENT_DETECTION_FINISHED] 101 {00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Software Synchronization Windows Update Client
successfully detected 14 updates.
2016-10-25 14:52:48:588 784 119c Agent Removing per user update
{58045100-5E56-41CE-B7AD-8A306A21F9CB} from search result since it applies
to no users
2016-10-25 14:52:48:650 784 119c Agent Removing per user update
{2A4D62A5-450B-450C-A44E-65E9CC5DBD45} from search result since it applies
to no users
2016-10-25 14:52:48:653 784 23ac IdleTmr WU operation
(CAuthorizationCookieWrapper::InitializeSimpleTargetingCookie, operation #
10) stopped; does use network; is at background priority
2016-10-25 14:52:48:710 784 119c Agent Removing per user update
{5DBBEA84-90D6-42A4-B8EE-CA2BA1A42B1C} from search result since it applies
to no users
2016-10-25 14:52:48:712 784 728 Report CWERReporter finished handling 10
events. (00000000)
2016-10-25 14:52:48:715 784 23ac IdleTmr WU operation
(CAgentProtocolTalker::GetCookie_WithRecovery) started; operation # 11;
does use network; is at background priority
2016-10-25 14:52:48:717 784 119c Agent Removing per user update
{A44878FB-450F-4C78-AC58-0F32712DDA1A} from search result since it applies
to no users
2016-10-25 14:52:48:725 784 119c Agent Removing per user update
{4849182B-70A4-4A3F-9FF9-054D8BCDCDDD} from search result since it applies
to no users
2016-10-25 14:52:48:733 784 119c Agent Removing per user update
{BB8EED48-5EB9-481D-A043-D8BE51942055} from search result since it applies
to no users
2016-10-25 14:52:48:736 784 119c Agent Removing per user update
{00563009-B9BF-43A4-8B4E-5ACE3172912B} from search result since it applies
to no users
2016-10-25 14:52:48:756 784 119c Agent Removing per user update
{D87FA2B6-A04D-4920-92AE-7C6586F98ED4} from search result since it applies
to no users
2016-10-25 14:52:48:758 784 119c Agent Removing per user update
{DE323AF5-28CA-4BAB-A85B-B074001783BF} from search result since it applies
to no users
2016-10-25 14:52:48:761 784 119c Agent Removing per user update
{1E536662-7256-42FA-9373-7A009A14400B} from search result since it applies
to no users
2016-10-25 14:52:48:763 784 119c Agent Removing per user update
{17A599BB-6485-4405-89C1-77A260C078D9} from search result since it applies
to no users
2016-10-25 14:52:48:763 784 23ac IdleTmr WU operation
(CAgentProtocolTalker::GetCookie_WithRecovery, operation # 11) stopped;
does use network; is at background priority
2016-10-25 14:52:48:765 784 119c Agent Removing per user update
{AE53F50B-1F53-4E10-93A2-7005AD671608} from search result since it applies
to no users
2016-10-25 14:52:48:779 784 119c Agent Removing per user update
{F944750C-BED6-4116-BFC4-91361F87CE97} from search result since it applies
to no users
2016-10-25 14:52:48:794 784 119c Agent Removing per user update
{C21E26AB-BFEE-425B-BD0B-C0043B81B034} from search result since it applies
to no users
2016-10-25 14:52:48:797 784 23ac Agent Reading cached app categories using
lifetime 604800 seconds
2016-10-25 14:52:48:799 784 119c IdleTmr WU operation (CSearchCall::Init ID
2, operation # 9) stopped; does use network; is at background priority
2016-10-25 14:52:48:802 784 23ac Agent Read 0 cached app categories
2016-10-25 14:52:48:804 784 2a5c AU >>## RESUMED ## AU: Search for
updates [CallId = {B55596F2-C555-43B0-9210-EB4F564968BE} ServiceId =
{117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2016-10-25 14:52:48:806 784 23ac Agent SyncUpdates adding
So apparently it had been finding updates, then it removed them, for some
reason I can't fathom ...
On Wed, Oct 26, 2016 at 9:40 AM, Michael Leone <[email protected]> wrote:
> I have a Win2012 R2 client that gets it's updates from my WSUS 3.2 server.
> We ran updates this past weekend (not me, it was not my shift). Apparently
> this one server shows no updates needed. Now, every other Win2012 R2 server
> we have needed at least a few updates ...
>
> WSUS shows that the client is checking in. I ran a script to reset
> autorization and re-detect:
>
> ----------------------
> NET STOP WUAUSERV
>
> REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
> /v PingID /f
> REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
> /v AccountDomainSid /f
> REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
> /v SusClientId /f
> REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
> /v SusClientIdValidation /f
>
> NET STOP BITS
> NET START BITS
>
> NET START WUAUSERV
>
> WUAUCLT /resetauthorization /detectnow
> ----------------------
>
> Still no updates found. I checked the WindowsUpdate log, shows exit code
> 0x240001.
>
> 2016-10-26 08:27:35:416 784 11c Misc =========== Logging initialized
> (build: 7.9.9600.18340, tz: -0400) ===========
> 2016-10-26 08:27:35:416 784 11c Misc = Process:
> C:\Windows\system32\svchost.exe
> 2016-10-26 08:27:35:416 784 11c Misc = Module:
> c:\windows\system32\wuaueng.dll
> 2016-10-26 08:27:35:416 784 11c Service *************
> 2016-10-26 08:27:35:416 784 11c Service ** START ** Service: Service
> startup
> 2016-10-26 08:27:35:416 784 11c Service *********
> 2016-10-26 08:27:35:427 784 11c IdleTmr Non-AoAc machine. Aoac
> operations will be ignored.
> 2016-10-26 08:27:35:427 784 11c Agent * WU client version 7.9.9600.18340
> 2016-10-26 08:27:35:427 784 11c Agent WARNING: SleepStudyTracker: Machine
> is non-AOAC. Sleep study tracker disabled.
> 2016-10-26 08:27:35:427 784 11c Agent * Base directory:
> C:\Windows\SoftwareDistribution
> 2016-10-26 08:27:35:427 784 11c Agent * Access type: No proxy
> 2016-10-26 08:27:35:428 784 11c Service UpdateNetworkState Ipv6,
> cNetworkInterfaces = 1.
> 2016-10-26 08:27:35:428 784 11c Service UpdateNetworkState Ipv4,
> cNetworkInterfaces = 1.
> 2016-10-26 08:27:35:428 784 11c Agent * Network state: Connected
> 2016-10-26 08:27:35:430 784 11c Service UpdateNetworkState Ipv6,
> cNetworkInterfaces = 1.
> 2016-10-26 08:27:35:430 784 11c Service UpdateNetworkState Ipv4,
> cNetworkInterfaces = 1.
> 2016-10-26 08:27:35:461 784 11c Agent *********** Agent: Initializing
> global settings cache ***********
> 2016-10-26 08:27:35:461 784 11c Agent * Endpoint Provider:
> 00000000-0000-0000-0000-000000000000
> 2016-10-26 08:27:35:461 784 11c Agent * WSUS server:
> http://dctrman001.wrk.ads.pha.phila.gov
> 2016-10-26 08:27:35:461 784 11c Agent * WSUS status server:
> http://dctrman001.wrk.ads.pha.phila.gov
> 2016-10-26 08:27:35:461 784 11c Agent * Target group: (Unassigned
> Computers)
> 2016-10-26 08:27:35:461 784 11c Agent * Windows Update access disabled:
> No
> 2016-10-26 08:27:35:461 784 11c Misc WARNING: Network Cost is assumed to
> be not supported as something failed with trying to get handles to
> wcmapi.dll
> 2016-10-26 08:27:35:479 784 11c WuTask WuTaskManager delay initialize
> completed successfully..
> 2016-10-26 08:27:35:479 784 11c AU Timer:
> 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
> idle-only, not network-only
> 2016-10-26 08:27:35:479 784 11c AU Timer:
> CF1ABEC6-7887-4964-BB93-B2E21B31CEC1, Expires 2016-10-27 12:02:36, not
> idle-only, not network-only
> 2016-10-26 08:27:35:479 784 11c AU Timer:
> 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2016-10-27 12:02:36, not
> idle-only, not network-only
> 2016-10-26 08:27:35:487 784 11c Report WARNING: CSerializationHelper::
> InitSerialize failed : 0x80070002
> 2016-10-26 08:27:35:488 784 11c Report CWERReporter::Init succeeded
> 2016-10-26 08:27:35:488 784 11c Agent *********** Agent: Initializing
> Windows Update Agent ***********
> 2016-10-26 08:27:35:488 784 11c DnldMgr Download manager restoring 0
> downloads
> 2016-10-26 08:27:35:489 784 11c AU ########### AU: Initializing
> Automatic Updates ###########
> 2016-10-26 08:27:35:489 784 11c AU Additional Service
> {117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} with Approval type {Pre-download
> notify} added to AU services list
> 2016-10-26 08:27:35:489 784 11c AU AIR Mode is disabled
> 2016-10-26 08:27:35:490 784 11c AU # Policy Driven Provider:
> http://dctrman001.wrk.ads.pha.phila.gov
> 2016-10-26 08:27:35:490 784 11c AU # Detection frequency: 22
> 2016-10-26 08:27:35:490 784 11c AU # Approval type: Pre-download notify
> (Policy)
> 2016-10-26 08:27:35:490 784 11c AU # ServiceTypeDefault: Service
> 117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 Approval type: (Pre-download notify)
> 2016-10-26 08:27:35:490 784 11c AU # Will interact with non-admins
> (Non-admins are elevated (User preference))
> 2016-10-26 08:27:35:490 784 11c Agent Switching to hardware-verified
> ClientId.
> 2016-10-26 08:27:35:492 784 11c AU WARNING: Failed to get Wu Exemption
> info from NLM, assuming not exempt, error = 0x80240037
> 2016-10-26 08:27:35:492 784 11c AU WARNING: Failed to get Network Cost
> info from NLM, assuming network is NOT metered, error = 0x80240037
> 2016-10-26 08:27:35:497 784 11c AU AU finished delayed initialization
> 2016-10-26 08:27:35:497 784 11c AU Currently AUX is enabled - so not show
> any WU Upgrade notifications.
> 2016-10-26 08:27:35:498 784 11c AU WARNING: Failed to get Network Cost
> info from NLM, assuming network is NOT metered, error = 0x80240037
> 2016-10-26 08:27:35:500 784 11c AU WARNING: Failed to get Network Cost
> info from NLM, assuming network is NOT metered, error = 0x80240037
> 2016-10-26 08:27:35:505 784 11c AU Adding timer:
> 2016-10-26 08:27:35:505 784 11c AU Timer:
> 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
> idle-only, not network-only
> 2016-10-26 08:27:35:507 784 278 DnldMgr Asking handlers to reconcile
> their sandboxes
> 2016-10-26 08:47:33:593 784 974 AU Earliest future timer found:
> 2016-10-26 08:47:33:593 784 974 AU Timer:
> 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
> idle-only, not network-only
> 2016-10-26 08:47:34:594 784 11c AU ########### AU: Uninitializing
> Automatic Updates ###########
> 2016-10-26 08:47:34:630 784 11c WuTask Uninit WU Task Manager
> 2016-10-26 08:47:34:671 784 11c AU Earliest future timer found:
> 2016-10-26 08:47:34:671 784 11c AU Timer:
> 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
> idle-only, not network-only
> 2016-10-26 08:47:34:688 784 11c AU Earliest future timer found:
> 2016-10-26 08:47:34:688 784 11c AU Timer:
> 31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
> idle-only, not network-only
> 2016-10-26 08:47:34:766 784 11c Service *********
> 2016-10-26 08:47:34:766 784 11c Service ** END ** Service: Service
> exit [Exit code = 0x240001]
> 2016-10-26 08:47:34:766 784 11c Service *************
>
> Thoughts? Not finding anything that seems relevant in my searches. Last
> month's updates (i.e., Sept 2016_ installed fine, and show as last updated
> date). And it seems to be talking to WSUS. I see no errors in the log
> snippet that show me anything wrong.
>
>
>
>
