Did someone hide them in the update control panel?
From: [email protected] [mailto:[email protected]] On
Behalf Of Michael Leone
Sent: Wednesday, October 26, 2016 10:05 AM
To: [email protected]; Patch Management Mailing List
Subject: Re: [NTSysADM] Fwd: Client shows no updates needed, sows WU exits with
code 0x240001 - MORE
Found this, earlier in the log:
2016-10-25 14:52:45:474 784 119c SLS Retrieving SLS response
from server using ETAG "4V8nqvoeoxgpu+6kKNNNGpLr4BCvPTmaz82CIDm5o5g=_1440"...
2016-10-25 14:52:45:476 784 119c SLS Making request with URL
HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340<HTTPS://sls.update.microsoft.com/SLS/%7b9482F4B4-E343-43B6-B170-9A65BC822C77%7d/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340>
2016-10-25 14:52:45:785 784 23ac SLS Retrieving SLS response
from server using ETAG "4V8nqvoeoxgpu+6kKNNNGpLr4BCvPTmaz82CIDm5o5g=_1440"...
2016-10-25 14:52:45:829 784 23ac SLS Making request with URL
HTTPS://sls.update.microsoft.com/SLS/{9482F4B4-E343-43B6-B170-9A65BC822C77}/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340<HTTPS://sls.update.microsoft.com/SLS/%7b9482F4B4-E343-43B6-B170-9A65BC822C77%7d/x64/6.3.9600.0/0?CH=197&L=en-US&P=&PT=0x7&WUA=7.9.9600.18340>
2016-10-25 14:52:45:890 784 119c EP Got
9482F4B4-E343-43B6-B170-9A65BC822C77 redir SecondaryServiceAuth URL:
"117cab2d-82b1-4b5a-a08c-4d62dbee7782"
2016-10-25 14:52:45:969 784 23ac EP Got WSUS Client/Server
URL: "http://dctrman001.wrk.ads.pha.phila.gov/ClientWebService/client.asmx";
2016-10-25 14:52:45:978 784 23ac Setup Checking for agent
SelfUpdate
2016-10-25 14:52:45:988 784 23ac Setup Client version: Core:
7.9.9600.18340 Aux: 7.9.9600.18340
2016-10-25 14:52:45:991 784 23ac EP Got WSUS SelfUpdate
URL: "http://dctrman001.wrk.ads.pha.phila.gov/selfupdate";
2016-10-25 14:52:46:045 784 119c EP Got
117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 redir Client/Server URL:
"https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx";
2016-10-25 14:52:46:077 784 23ac Misc Validating signature
for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags
0x00000080:
2016-10-25 14:52:46:380 784 23ac Misc Microsoft signed: NA
2016-10-25 14:52:46:391 784 23ac Misc Infrastructure signed:
Yes
2016-10-25 14:52:46:433 784 23ac Misc WARNING: Cab does not
contain correct inner CAB file.
2016-10-25 14:52:46:438 784 23ac Misc Validating signature
for C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab with dwProvFlags
0x00000080:
2016-10-25 14:52:46:448 784 23ac Misc Microsoft signed: NA
2016-10-25 14:52:46:461 784 23ac Misc Infrastructure signed:
Yes
2016-10-25 14:52:46:476 784 119c PT +++++++++++ PT:
Synchronizing server updates +++++++++++
2016-10-25 14:52:46:505 784 119c PT + ServiceId =
{117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}, Server URL =
https://fe2.ws.microsoft.com/v6/ClientWebService/client.asmx
2016-10-25 14:52:46:555 784 119c Agent Reading cached app
categories using lifetime 604800 seconds
2016-10-25 14:52:46:566 784 119c Agent Read 0 cached app
categories
2016-10-25 14:52:46:574 784 23ac Setup Skipping SelfUpdate
check based on the /SKIP directive in wuident
2016-10-25 14:52:46:576 784 119c Agent SyncUpdates adding 0
visited app categories
2016-10-25 14:52:46:580 784 23ac Setup SelfUpdate check
completed. SelfUpdate is NOT required.
2016-10-25 14:52:47:409 784 119c PT + SyncUpdates round
trips: 0
2016-10-25 14:52:47:762 784 119c Agent * Added update
{C21E26AB-BFEE-425B-BD0B-C0043B81B034}.1 to search result
2016-10-25 14:52:47:774 784 119c Agent * Added update
{F944750C-BED6-4116-BFC4-91361F87CE97}.1 to search result
2016-10-25 14:52:47:776 784 119c Agent * Added update
{AE53F50B-1F53-4E10-93A2-7005AD671608}.100 to search result
2016-10-25 14:52:47:787 784 119c Agent * Added update
{17A599BB-6485-4405-89C1-77A260C078D9}.100 to search result
2016-10-25 14:52:47:789 784 119c Agent * Added update
{1E536662-7256-42FA-9373-7A009A14400B}.100 to search result
2016-10-25 14:52:47:792 784 119c Agent * Added update
{DE323AF5-28CA-4BAB-A85B-B074001783BF}.1 to search result
2016-10-25 14:52:47:794 784 119c Agent * Added update
{D87FA2B6-A04D-4920-92AE-7C6586F98ED4}.1 to search result
2016-10-25 14:52:47:801 784 119c Agent * Added update
{00563009-B9BF-43A4-8B4E-5ACE3172912B}.2 to search result
2016-10-25 14:52:47:802 784 23ac PT +++++++++++ PT:
Synchronizing server updates +++++++++++
2016-10-25 14:52:47:803 784 119c Agent * Added update
{BB8EED48-5EB9-481D-A043-D8BE51942055}.1 to search result
2016-10-25 14:52:47:805 784 23ac PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://dctrman001.wrk.ads.pha.phila.gov/ClientWebService/client.asmx
2016-10-25 14:52:47:807 784 119c Agent * Added update
{4849182B-70A4-4A3F-9FF9-054D8BCDCDDD}.1 to search result
2016-10-25 14:52:47:809 784 23ac PT WARNING: Cached
cookie has expired or new PID is available
2016-10-25 14:52:47:811 784 119c Agent * Added update
{A44878FB-450F-4C78-AC58-0F32712DDA1A}.1 to search result
2016-10-25 14:52:47:815 784 119c Agent * Added update
{5DBBEA84-90D6-42A4-B8EE-CA2BA1A42B1C}.1 to search result
2016-10-25 14:52:47:820 784 23ac EP Got WSUS
SimpleTargeting URL: "http://dctrman001.wrk.ads.pha.phila.gov";
2016-10-25 14:52:47:822 784 119c Agent * Added update
{2A4D62A5-450B-450C-A44E-65E9CC5DBD45}.1 to search result
2016-10-25 14:52:47:831 784 23ac IdleTmr WU operation
(CAuthorizationCookieWrapper::InitializeSimpleTargetingCookie) started;
operation # 10; does use network; is at background priority
2016-10-25 14:52:47:833 784 119c Agent Update
{A646B27E-937C-419F-B2A0-8817A4D1D5FD}.1 is pruned out due to potential
supersedence
2016-10-25 14:52:47:835 784 23ac PT Initializing simple
targeting cookie, clientId = 789a07cb-494a-4c4b-b3fe-f30dd93886da, target group
= , DNS name =
admnftp001.wrk.ads.pha.phila.gov<http://admnftp001.wrk.ads.pha.phila.gov>
2016-10-25 14:52:47:837 784 119c Agent * Added update
{58045100-5E56-41CE-B7AD-8A306A21F9CB}.1 to search result
2016-10-25 14:52:47:841 784 23ac PT Server URL =
http://dctrman001.wrk.ads.pha.phila.gov/SimpleAuthWebService/SimpleAuth.asmx
2016-10-25 14:52:47:844 784 119c Agent * Found 14 updates and
24 categories in search; evaluated appl. rules of 75 out of 90 deployed entities
2016-10-25 14:52:47:884 784 119c Agent *********
2016-10-25 14:52:47:896 784 119c Agent ** END ** Agent:
Finding updates [CallerId = AutomaticUpdates Id = 2]
2016-10-25 14:52:47:903 784 119c Agent *************
2016-10-25 14:52:47:969 784 728 Report REPORT EVENT:
{08AF8782-C9E9-4FD3-8D30-B8834B66981C} 2016-10-25 14:52:47:884-0400
1 147 [AGENT_DETECTION_FINISHED] 101
{00000000-0000-0000-0000-000000000000} 0 0
AutomaticUpdates Success Software Synchronization Windows
Update Client successfully detected 14 updates.
2016-10-25 14:52:48:588 784 119c Agent Removing per user update
{58045100-5E56-41CE-B7AD-8A306A21F9CB} from search result since it applies to
no users
2016-10-25 14:52:48:650 784 119c Agent Removing per user update
{2A4D62A5-450B-450C-A44E-65E9CC5DBD45} from search result since it applies to
no users
2016-10-25 14:52:48:653 784 23ac IdleTmr WU operation
(CAuthorizationCookieWrapper::InitializeSimpleTargetingCookie, operation # 10)
stopped; does use network; is at background priority
2016-10-25 14:52:48:710 784 119c Agent Removing per user update
{5DBBEA84-90D6-42A4-B8EE-CA2BA1A42B1C} from search result since it applies to
no users
2016-10-25 14:52:48:712 784 728 Report CWERReporter finished
handling 10 events. (00000000)
2016-10-25 14:52:48:715 784 23ac IdleTmr WU operation
(CAgentProtocolTalker::GetCookie_WithRecovery) started; operation # 11; does
use network; is at background priority
2016-10-25 14:52:48:717 784 119c Agent Removing per user update
{A44878FB-450F-4C78-AC58-0F32712DDA1A} from search result since it applies to
no users
2016-10-25 14:52:48:725 784 119c Agent Removing per user update
{4849182B-70A4-4A3F-9FF9-054D8BCDCDDD} from search result since it applies to
no users
2016-10-25 14:52:48:733 784 119c Agent Removing per user update
{BB8EED48-5EB9-481D-A043-D8BE51942055} from search result since it applies to
no users
2016-10-25 14:52:48:736 784 119c Agent Removing per user update
{00563009-B9BF-43A4-8B4E-5ACE3172912B} from search result since it applies to
no users
2016-10-25 14:52:48:756 784 119c Agent Removing per user update
{D87FA2B6-A04D-4920-92AE-7C6586F98ED4} from search result since it applies to
no users
2016-10-25 14:52:48:758 784 119c Agent Removing per user update
{DE323AF5-28CA-4BAB-A85B-B074001783BF} from search result since it applies to
no users
2016-10-25 14:52:48:761 784 119c Agent Removing per user update
{1E536662-7256-42FA-9373-7A009A14400B} from search result since it applies to
no users
2016-10-25 14:52:48:763 784 119c Agent Removing per user update
{17A599BB-6485-4405-89C1-77A260C078D9} from search result since it applies to
no users
2016-10-25 14:52:48:763 784 23ac IdleTmr WU operation
(CAgentProtocolTalker::GetCookie_WithRecovery, operation # 11) stopped; does
use network; is at background priority
2016-10-25 14:52:48:765 784 119c Agent Removing per user update
{AE53F50B-1F53-4E10-93A2-7005AD671608} from search result since it applies to
no users
2016-10-25 14:52:48:779 784 119c Agent Removing per user update
{F944750C-BED6-4116-BFC4-91361F87CE97} from search result since it applies to
no users
2016-10-25 14:52:48:794 784 119c Agent Removing per user update
{C21E26AB-BFEE-425B-BD0B-C0043B81B034} from search result since it applies to
no users
2016-10-25 14:52:48:797 784 23ac Agent Reading cached app
categories using lifetime 604800 seconds
2016-10-25 14:52:48:799 784 119c IdleTmr WU operation
(CSearchCall::Init ID 2, operation # 9) stopped; does use network; is at
background priority
2016-10-25 14:52:48:802 784 23ac Agent Read 0 cached app
categories
2016-10-25 14:52:48:804 784 2a5c AU >>## RESUMED ## AU:
Search for updates [CallId = {B55596F2-C555-43B0-9210-EB4F564968BE} ServiceId =
{117CAB2D-82B1-4B5A-A08C-4D62DBEE7782}]
2016-10-25 14:52:48:806 784 23ac Agent SyncUpdates adding
So apparently it had been finding updates, then it removed them, for some
reason I can't fathom ...
On Wed, Oct 26, 2016 at 9:40 AM, Michael Leone
<[email protected]<mailto:[email protected]>> wrote:
I have a Win2012 R2 client that gets it's updates from my WSUS 3.2 server. We
ran updates this past weekend (not me, it was not my shift). Apparently this
one server shows no updates needed. Now, every other Win2012 R2 server we have
needed at least a few updates ...
WSUS shows that the client is checking in. I ran a script to reset autorization
and re-detect:
----------------------
NET STOP WUAUSERV
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v
PingID /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v
AccountDomainSid /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v
SusClientId /f
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate" /v
SusClientIdValidation /f
NET STOP BITS
NET START BITS
NET START WUAUSERV
WUAUCLT /resetauthorization /detectnow
----------------------
Still no updates found. I checked the WindowsUpdate log, shows exit code
0x240001.
2016-10-26 08:27:35:416 784 11c Misc =========== Logging initialized (build:
7.9.9600.18340, tz: -0400) ===========
2016-10-26 08:27:35:416 784 11c Misc = Process: C:\Windows\system32\svchost.exe
2016-10-26 08:27:35:416 784 11c Misc = Module: c:\windows\system32\wuaueng.dll
2016-10-26 08:27:35:416 784 11c Service *************
2016-10-26 08:27:35:416 784 11c Service ** START ** Service: Service startup
2016-10-26 08:27:35:416 784 11c Service *********
2016-10-26 08:27:35:427 784 11c IdleTmr Non-AoAc machine. Aoac operations will
be ignored.
2016-10-26 08:27:35:427 784 11c Agent * WU client version 7.9.9600.18340
2016-10-26 08:27:35:427 784 11c Agent WARNING: SleepStudyTracker: Machine is
non-AOAC. Sleep study tracker disabled.
2016-10-26 08:27:35:427 784 11c Agent * Base directory:
C:\Windows\SoftwareDistribution
2016-10-26 08:27:35:427 784 11c Agent * Access type: No proxy
2016-10-26 08:27:35:428 784 11c Service UpdateNetworkState Ipv6,
cNetworkInterfaces = 1.
2016-10-26 08:27:35:428 784 11c Service UpdateNetworkState Ipv4,
cNetworkInterfaces = 1.
2016-10-26 08:27:35:428 784 11c Agent * Network state: Connected
2016-10-26 08:27:35:430 784 11c Service UpdateNetworkState Ipv6,
cNetworkInterfaces = 1.
2016-10-26 08:27:35:430 784 11c Service UpdateNetworkState Ipv4,
cNetworkInterfaces = 1.
2016-10-26 08:27:35:461 784 11c Agent *********** Agent: Initializing global
settings cache ***********
2016-10-26 08:27:35:461 784 11c Agent * Endpoint Provider:
00000000-0000-0000-0000-000000000000
2016-10-26 08:27:35:461 784 11c Agent * WSUS server:
http://dctrman001.wrk.ads.pha.phila.gov
2016-10-26 08:27:35:461 784 11c Agent * WSUS status server:
http://dctrman001.wrk.ads.pha.phila.gov
2016-10-26 08:27:35:461 784 11c Agent * Target group: (Unassigned Computers)
2016-10-26 08:27:35:461 784 11c Agent * Windows Update access disabled: No
2016-10-26 08:27:35:461 784 11c Misc WARNING: Network Cost is assumed to be not
supported as something failed with trying to get handles to wcmapi.dll
2016-10-26 08:27:35:479 784 11c WuTask WuTaskManager delay initialize completed
successfully..
2016-10-26 08:27:35:479 784 11c AU Timer:
31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
idle-only, not network-only
2016-10-26 08:27:35:479 784 11c AU Timer:
CF1ABEC6-7887-4964-BB93-B2E21B31CEC1, Expires 2016-10-27 12:02:36, not
idle-only, not network-only
2016-10-26 08:27:35:479 784 11c AU Timer:
29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2016-10-27 12:02:36, not
idle-only, not network-only
2016-10-26 08:27:35:487 784 11c Report WARNING: CSerializationHelper::
InitSerialize failed : 0x80070002
2016-10-26 08:27:35:488 784 11c Report CWERReporter::Init succeeded
2016-10-26 08:27:35:488 784 11c Agent *********** Agent: Initializing Windows
Update Agent ***********
2016-10-26 08:27:35:488 784 11c DnldMgr Download manager restoring 0 downloads
2016-10-26 08:27:35:489 784 11c AU ########### AU: Initializing Automatic
Updates ###########
2016-10-26 08:27:35:489 784 11c AU Additional Service
{117CAB2D-82B1-4B5A-A08C-4D62DBEE7782} with Approval type {Pre-download notify}
added to AU services list
2016-10-26 08:27:35:489 784 11c AU AIR Mode is disabled
2016-10-26 08:27:35:490 784 11c AU # Policy Driven Provider:
http://dctrman001.wrk.ads.pha.phila.gov
2016-10-26 08:27:35:490 784 11c AU # Detection frequency: 22
2016-10-26 08:27:35:490 784 11c AU # Approval type: Pre-download notify
(Policy)
2016-10-26 08:27:35:490 784 11c AU # ServiceTypeDefault: Service
117CAB2D-82B1-4B5A-A08C-4D62DBEE7782 Approval type: (Pre-download notify)
2016-10-26 08:27:35:490 784 11c AU # Will interact with non-admins (Non-admins
are elevated (User preference))
2016-10-26 08:27:35:490 784 11c Agent Switching to hardware-verified ClientId.
2016-10-26 08:27:35:492 784 11c AU WARNING: Failed to get Wu Exemption info
from NLM, assuming not exempt, error = 0x80240037
2016-10-26 08:27:35:492 784 11c AU WARNING: Failed to get Network Cost info
from NLM, assuming network is NOT metered, error = 0x80240037
2016-10-26 08:27:35:497 784 11c AU AU finished delayed initialization
2016-10-26 08:27:35:497 784 11c AU Currently AUX is enabled - so not show any
WU Upgrade notifications.
2016-10-26 08:27:35:498 784 11c AU WARNING: Failed to get Network Cost info
from NLM, assuming network is NOT metered, error = 0x80240037
2016-10-26 08:27:35:500 784 11c AU WARNING: Failed to get Network Cost info
from NLM, assuming network is NOT metered, error = 0x80240037
2016-10-26 08:27:35:505 784 11c AU Adding timer:
2016-10-26 08:27:35:505 784 11c AU Timer:
31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
idle-only, not network-only
2016-10-26 08:27:35:507 784 278 DnldMgr Asking handlers to reconcile their
sandboxes
2016-10-26 08:47:33:593 784 974 AU Earliest future timer found:
2016-10-26 08:47:33:593 784 974 AU Timer:
31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
idle-only, not network-only
2016-10-26 08:47:34:594 784 11c AU ########### AU: Uninitializing Automatic
Updates ###########
2016-10-26 08:47:34:630 784 11c WuTask Uninit WU Task Manager
2016-10-26 08:47:34:671 784 11c AU Earliest future timer found:
2016-10-26 08:47:34:671 784 11c AU Timer:
31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
idle-only, not network-only
2016-10-26 08:47:34:688 784 11c AU Earliest future timer found:
2016-10-26 08:47:34:688 784 11c AU Timer:
31DA7559-FE27-4810-8FF6-987195B1FD98, Expires 2016-10-27 08:01:01, not
idle-only, not network-only
2016-10-26 08:47:34:766 784 11c Service *********
2016-10-26 08:47:34:766 784 11c Service ** END ** Service: Service exit
[Exit code = 0x240001]
2016-10-26 08:47:34:766 784 11c Service *************
Thoughts? Not finding anything that seems relevant in my searches. Last month's
updates (i.e., Sept 2016_ installed fine, and show as last updated date). And
it seems to be talking to WSUS. I see no errors in the log snippet that show me
anything wrong.
