WSUS 3.0 SP1 KB948014 shows needed even though roll is not install

[Jordan]

All of our Windows 2008 Server machines are showing that KB948018 WSUS 3.0
SP1 is needed even though none of these servers have the WSUS roll installed.

When I click "Check for Updates" or run wuauclt /detectnow I am told that
there are no updates available and that everything is up to date.

All other updates that have been approved have installed successfully. This
one continues to stick around.

[Nico]

I'm experiencing the same problem.
Multiple 2008 servers, WSUS says that they need KB948018 but no update shows
up.
The only 2008 server that doesn't show this update in WSUS is the
WSUS-Server itself (already 3.0 SP1).

...Nico...

[Lawrence Garvin]

I've bounced this question up to the WSUS team and they're looking into it.

"Nico" <Ni...@discussions.microsoft.com> wrote in message
news:4390CBD6-BFF0-474C...@microsoft.com...

--
Lawrence Garvin, M.S., MCITP(x2), MCTS(x5), MCP(x7), MCBMSP
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus
My Websites: http://www.onsitechsolutions.com;
http://wsusinfo.onsitechsolutions.com
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

[Harry Johnston [MVP]]

Jordan wrote:

> All of our Windows 2008 Server machines are showing that KB948018 WSUS 3.0
> SP1 is needed even though none of these servers have the WSUS roll installed.

I think you mean KB948014 (as in the subject) rather than KB948018 (which as far
as I can tell doesn't exist).

There are two pairs of WSUS packages referencing KB948014. One pair updates
existing WSUS installations to SP1, and should only apply to the server with
WSUS installed. The other pair allow WSUS 3 SP1 to be offered as a role on a
Windows 2008 server, and these apply to all servers - except perhaps if WSUS is
already installed, and/or Server Core installations.

> When I click "Check for Updates" or run wuauclt /detectnow I am told that
> there are no updates available and that everything is up to date.

That suggests the package being detected as needed isn't approved. If you go to
the updates view and look for needed updates, you should be able to find the
package easily and check whether or not it is approved for the relevant group.

Harry.

[Lawrence Garvin]

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message
news:OPAJKmzL...@TK2MSFTNGP05.phx.gbl...

> Jordan wrote:
>
>> All of our Windows 2008 Server machines are showing that KB948018 WSUS
>> 3.0 SP1 is needed even though none of these servers have the WSUS roll
>> installed.
>
> I think you mean KB948014 (as in the subject) rather than KB948018 (which
> as far as I can tell doesn't exist).
>
> There are two pairs of WSUS packages referencing KB948014. One pair
> updates existing WSUS installations to SP1, and should only apply to the
> server with WSUS installed. The other pair allow WSUS 3 SP1 to be offered
> as a role on a Windows 2008 server, and these apply to all servers -
> except perhaps if WSUS is already installed, and/or Server Core
> installations.

This being the case, and I hadn't considered it to be... it would seem to be
a serious flaw that the ROLE package installer references the KB article ID
assigned to the Service Pack!

I'll pass along this extra info to the team.

[Jordan]

You are right, I got the KB number wrong. The correct number is KB948014.

I checked WSUS again and the update was already approved for installation a
few days ago.
Why the servers are not downloading and installing it I am not sure. I
manually ran a check for updates on one of the servers this morning. It
again told me that there were no updates available and that everything was up
to date.

Thanks for looking into the problem.

[Harry Johnston [MVP]]

Jordan wrote:

> I checked WSUS again and the update was already approved for installation a
> few days ago.

Just to be absolutely clear, all four updates are approved? And have finished
downloading?

Harry.

[Jordan]

I will check.

Do you have the exact KB numbers I should check for?

[Harry Johnston [MVP]]

Jordan wrote:

> I will check.
>
> Do you have the exact KB numbers I should check for?

There are four update packages (two x86, two x64) listing KB948014 as their KB
number.

Harry.

[Jordan]

Thanks, I just wanted to verify that there was only one KB number to worry
about.
All of those updates were approved previously.

It does not appear that any of the updates have installed on any of the
Windows 2008 x64 servers.

WSUS 3.0 SP1 did install on a Windows 2003 Server.
WSUS 3.0 SP1 for x64 did install on the Vista machine that I use to manage
the WSUS server.
The dynamic installer has not installed on any machine.
I have no Windows 2008 32 bit servers.

I took some screenshots of my WSUS console and posted them at
http://www.mhsaa.com/temp/screenshots/

I hope they will be helpful.

MHSIDS2 is our current Windows 2003 32bit WSUS Server

[Dag Arne Kirkerød]

I have the exact same problem. KB948014 are aproved and needed on all my W2K8
servers. Will not install..

Regards

[Harry Johnston [MVP]]

Jordan wrote:

> It does not appear that any of the updates have installed on any of the
> Windows 2008 x64 servers.

OK, there's definitely something fishy going on. Lawrence, have you heard
anything back from MS yet?

Jordan, please look in Update File Information for the package that is detecting
as needed, and then see if the file listed (under File URI) is actually present
in the content store.

If it is, go to one of the affected servers and type:

wuauclt /detectnow

wait 30 minutes then post the contents of WindowsUpdate.log starting from the
time just before you issued the wuauclt command.

Harry.

[Jordan]

The contents of my wsuscontent\39 folder are as follows.

08/12/2008 07:32 AM 28,738
766D385C29137DF6E33414BE268E7DD34F888E39.txt

02/18/2007 06:34 PM 142,329
8701BF4C0A2232BD3EEB954605674BB934AF3139.cab

03/21/2008 03:14 PM 86,308,464
E49552A4A96E0F2F065F39001C2F8A9FDFFEF739.exe

When I browse to the URI listed in the file information with by browser I am
prompted to download the exe file, so I am pretty sure that the servers would
have no problem accessing this location.

I will run the detectnow command and post the contents of the log file
shortly.

[Lawrence Garvin (MVP)]

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message

news:uPOqLfuM...@TK2MSFTNGP04.phx.gbl...

> Jordan wrote:
>
>> It does not appear that any of the updates have installed on any of the
>> Windows 2008 x64 servers.
>
> OK, there's definitely something fishy going on. Lawrence, have you heard
> anything back from MS yet?

I have not -- just that they were looking into it and an "answer" was
forthcoming.

[Harry Johnston [MVP]]

Jordan wrote:

> It does not appear that any of the updates have installed on any of the
> Windows 2008 x64 servers.

Stupid question - they're not Windows Core Server installations, are they?

Harry.

[Jordan]

No.
All of them are Windows 2008 Ent. VMs running under hyperV except one which
is a hardware based Windows 2008 Data Center Machine.

It seems like all the Windows 2008 Servers regardless of hardware or edition
is having the problem.

BTW: I will have that log for you by 9AM ET.

[Jordan]

For easy reading I have also posted this at
http://www.mhsaa.com/temp/screenshots/windowsupdate.txt

2008-10-21 08:22:30:667 308 be0 AU Triggering AU detection through
DetectNow API
2008-10-21 08:22:30:667 308 be0 AU Triggering Online detection
(non-interactive)
2008-10-21 08:22:30:667 308 aa4 AU #############
2008-10-21 08:22:30:667 308 aa4 AU ## START ## AU: Search for updates
2008-10-21 08:22:30:667 308 aa4 AU #########
2008-10-21 08:22:30:682 308 aa4 AU <<## SUBMITTED ## AU: Search for updates
[CallId = {71284434-C52F-4475-8B18-EBEE4D573DA7}]
2008-10-21 08:22:30:682 308 414 Agent *************
2008-10-21 08:22:30:682 308 414 Agent ** START ** Agent: Finding updates
[CallerId = AutomaticUpdates]
2008-10-21 08:22:30:682 308 414 Agent *********
2008-10-21 08:22:30:682 308 414 Agent * Online = Yes; Ignore download
priority = No
2008-10-21 08:22:30:682 308 414 Agent * Criteria = "IsInstalled=0 and
DeploymentAction='Installation' or IsPresent=1 and
DeploymentAction='Uninstallation' or IsInstalled=1 and
DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and
DeploymentAction='Uninstallation' and RebootRequired=1"
2008-10-21 08:22:30:682 308 414 Agent * ServiceID =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2008-10-21 08:22:30:682 308 414 Setup Checking for agent SelfUpdate
2008-10-21 08:22:30:682 308 414 Setup Client version: Core: 7.1.6001.65
Aux: 7.1.6001.65
2008-10-21 08:22:30:682 308 414 Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2008-10-21 08:22:30:682 308 414 Misc Microsoft signed: Yes
2008-10-21 08:22:30:682 308 414 Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wuident.cab:
2008-10-21 08:22:30:682 308 414 Misc Microsoft signed: Yes
2008-10-21 08:22:30:682 308 414 Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2008-10-21 08:22:30:698 308 414 Misc Microsoft signed: Yes
2008-10-21 08:22:30:698 308 414 Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2008-10-21 08:22:30:698 308 414 Misc Microsoft signed: Yes
2008-10-21 08:22:30:713 308 414 Setup Determining whether a new setup
handler needs to be downloaded
2008-10-21 08:22:30:713 308 414 Misc Validating signature for
C:\Windows\SoftwareDistribution\SelfUpdate\Handler\WuSetupV.exe:
2008-10-21 08:22:30:713 308 414 Misc Microsoft signed: Yes
2008-10-21 08:22:30:713 308 414 Setup SelfUpdate handler update NOT
required: Current version: 7.1.6001.65, required version: 7.1.6001.65
2008-10-21 08:22:30:713 308 414 Setup Evaluating applicability of setup
package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.1.6001.65"
2008-10-21 08:22:30:776 308 414 Setup Setup package
"WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.1.6001.65" is already
installed.
2008-10-21 08:22:30:776 308 414 Setup Evaluating applicability of setup
package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.1.6001.65"
2008-10-21 08:22:30:792 308 414 Setup Setup package
"WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.1.6001.65" is
already installed.
2008-10-21 08:22:30:792 308 414 Setup Evaluating applicability of setup
package
"WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.1.6001.65"
2008-10-21 08:22:30:838 308 414 Setup Setup package
"WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.1.6001.65" is
already installed.
2008-10-21 08:22:30:838 308 414 Setup SelfUpdate check completed.
SelfUpdate is NOT required.
2008-10-21 08:22:31:698 308 414 PT +++++++++++ PT: Synchronizing server
updates +++++++++++
2008-10-21 08:22:31:698 308 414 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://mhsids2/ClientWebService/client.asmx
2008-10-21 08:22:33:401 308 414 PT +++++++++++ PT: Synchronizing extended
update info +++++++++++
2008-10-21 08:22:33:401 308 414 PT + ServiceId =
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL =
http://mhsids2/ClientWebService/client.asmx
2008-10-21 08:22:34:652 308 414 Agent * Found 0 updates and 41 categories
in search; evaluated appl. rules of 326 out of 384 deployed entities
2008-10-21 08:22:34:652 308 414 Agent *********
2008-10-21 08:22:34:652 308 414 Agent ** END ** Agent: Finding updates
[CallerId = AutomaticUpdates]
2008-10-21 08:22:34:652 308 414 Agent *************
2008-10-21 08:22:34:667 308 ab8 AU >>## RESUMED ## AU: Search for updates
[CallId = {71284434-C52F-4475-8B18-EBEE4D573DA7}]
2008-10-21 08:22:34:667 308 ab8 AU # 0 updates detected
2008-10-21 08:22:34:667 308 ab8 AU #########
2008-10-21 08:22:34:667 308 ab8 AU ## END ## AU: Search for updates
[CallId = {71284434-C52F-4475-8B18-EBEE4D573DA7}]
2008-10-21 08:22:34:667 308 ab8 AU #############
2008-10-21 08:22:34:667 308 ab8 AU AU setting next detection timeout to
2008-10-21 14:12:29
2008-10-21 08:22:34:667 308 ab8 AU Setting AU scheduled install time to
2008-10-26 06:00:00
2008-10-21 08:22:39:652 308 414 Report REPORT EVENT:
{62025668-6139-467A-9B34-E2A21BF43E07} 2008-10-21
08:22:34:652-0400 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software
Synchronization Windows Update Client successfully detected 0 updates.
2008-10-21 08:22:39:652 308 414 Report REPORT EVENT:
{39FD0159-A241-46DE-8341-C8FD7BDA531A} 2008-10-21
08:22:34:652-0400 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting client status.
2008-10-21 08:32:45:872 308 414 Report Uploading 2 events using cached
cookie, reporting URL =
http://mhsids2/ReportingWebService/ReportingWebService.asmx
2008-10-21 08:32:45:887 308 414 Report Reporter successfully uploaded 2
events.

[Jordan]

Any new info on this one?

[mixont70706]

I am having the same issue with a server that has W2k8 (Full
installation) reporting all Windows Updates are complete but Wsus 3.0
SP1 is reporting that it needs KB948014.

In Wsus it is Approved for install, I have another Server 2k8 server
that has the update installed but it is a WSUS 3.0 SP1 Upstream server.
The other Server 2k8 server that is having the problem is just a file
server that is not a Upstream or Downstream server with Wsus service
running on it and only the Wsus client installed.

All other WSUS Approved install associations for KB948014 are reporting
Not Applicable

Any word from MS?

--
mixont70706
------------------------------------------------------------------------
mixont70706's Profile: http://forums.techarena.in/members/mixont70706.htm
View this thread: http://forums.techarena.in/server-update-service/1055407.htm

http://forums.techarena.in

[Harry Johnston [MVP]]

Jordan wrote:

> Any new info on this one?

I'm out of ideas, I'm afraid.

Harry.

[Jordan]

I noticed when I try to install the update manually it attempts to run the
installer for WSUS Server. If I select Full Install I am told that IIS must
be installed in order for the installer to run. If I select admin console
only the installer runs however the update still shows as "needed" in WSUS.

Since this update appears to actually install WSUS as opposed to enabling
the server in question to provide WSUS as a server roll I am simply going to
decline the update and manually install WSUS on the servers I actually want
it on.

[Lawrence Garvin (MVP)]

"Jordan" <Jor...@discussions.microsoft.com> wrote in message
news:6C29F968-BA88-4DC6...@microsoft.com...

>I noticed when I try to install the update manually it attempts to run the
> installer for WSUS Server. If I select Full Install I am told that IIS
> must
> be installed in order for the installer to run. If I select admin
> console
> only the installer runs however the update still shows as "needed" in
> WSUS.
>
> Since this update appears to actually install WSUS as opposed to enabling
> the server in question to provide WSUS as a server roll I am simply going
> to
> decline the update and manually install WSUS on the servers I actually
> want
> it on.

KB948014 =is= WSUS 3.0 Service Pack 1.
http://support.microsoft.com/kb/948014

The only reason this update should detect is if you have WSUS installed
(or previously had some version of WSUS installed and it wasn't fully
uninstalled).

The update to install the WSUS 3.0 ROLE onto a Windows Server 2008 system is
KB940518 and is titled "Update for Windows Server 2008 Server Manager
(KB940518)".

And, despite all of our previous discussions in this newsgroup (which took
place before I was syncing Win2008 content to my system), my WSUS Server
shows no confusion at all between these two updates.

KB940518 successfully installed to my Windows Server 2008 Web Edition
system, and was reported as "Not Applicable" on my Windows Server 2008
Standard Edition CORE installation (as is should have been, since WSUS
cannot run on a core server install), I didn't approve the update for my
Windows Server 2003 based WSUS Server, so no conclusion can be drawn there.
If anybody has indications there's a potential issue here, I'll be happy to
approve the update and observe the behavior.

KB948014 is not applicable in my entire environment, as I installed WSUS 3.0
SP1 as a baseline installation.

[Jordan]

I observed the issue on all (as in every single one) of our new Windows 2008
servers which have been set up for less than two months and have never had
WSUS installed.

In fact some of them don't actually do anything yet, they are simply running
with the default installation with no, I repeat NO, rolls installed as we
have not had time to migrate everything from 2003 to 2008 yet.

[Dag Arne Kirkerød]

This goes for mee too. No roles have been applyed on the servers. Its W2K8
Ent. & std x32 servers AND one W2K8 Ent. x64 server. All with the same issue
(948014 needed & will not install).

[MALeonard]

I have the same issue...
2 new W2K8 Entr x64 servers, both report into my WSUS.

In WSUS console: 1 says needs WSUS 3.0 SP1, the other does not.

Tracked this down to the installed/available Roles on the servers,
the 1 has- Windows Server Update Services Role available, the other
does not.

When run wuauclt /detectnow - the one does not "get" the SP1

Deleted the machine from my WSUS console.
Then ran wuauclt /resetauthorization /detectnow on the server.

It rereported into WSUS and said need the SP, but still cannot get it
to download/etc from my WSUS server.

and when run manual MS updates in IE... does not show up either.
==

Can remove the available role from the server?

--
MALeonard
------------------------------------------------------------------------
MALeonard's Profile: http://forums.techarena.in/members/maleonard.htm

[MALeonard]

addendum #2...

I compared the Updates installed between the two servers...

The one with the problem had additional...
KB940518 - Update for Windows Server 2008 Server Manager (WSUS)
"Install this update to enable full integration of Windows Server
Update
Services (WSUS) 3.0 SP1 into Server Manager on a system running Windows
Server 2008."

I uninstalled the KB.
The WSUS role is no longer listed as available.

Reran wuauclnt /detectnow.
The server no longer lists the WSUS SP as being needed.

--FINI--

[Jon Harris]

I have this same error on a SCE machine running WSUS 3.0 with SP1 and when I
try applying KB940518 to the system it tells me this patch does not apply to
it. I have tried apply it to all my Windows 2008 servers reporting the same
issue and received the same response (This patch does not apply to this
system).

[Diana]

Hello,

KB948014 is WSUS 3.0 Service Pack 1. So, if you are already running WSUS
SP1, there is no need to install this.

948014 Description of the Windows Server Update Services 3.0 Service Pack 1
package
http://support.microsoft.com/default.aspx?scid=kb;EN-US;948014

Diana

Diana Smith [MSFT] <dias...@hotmail.com>
CSS Security Team

This posting is provided "AS IS" with no warranties, and confers no rights.

"Jon Harris" <JonH...@discussions.microsoft.com> wrote in message
news:9435E0A3-8386-4AC4...@microsoft.com...

[Jon Harris]

I am aware of that but 3 of my 2008 servers including my WSUS 3.0 SP 1 server
all report the same error and all of them will also respond that KB940518
does not apply. I am simply trying to get my SCE server and my 2008 WSUS
server to agree on what is needed by my clients and not report missing
patches that are not needed or are already installed. Sorry if I sound a bit
grumpy but it has already been a long tiring day for me and this is getting
on to 3 weeks of fighting this same issue.

Jon

[Alatar]

We too have this problem at client site. The installation is:
- One SBS 2003 Server running WSUS 3 SP 1 (and numerous other roles as per
SBS norms);
- Two Windows 2008 Servers (hereafter called W2K8) set up only as data
servers; and,
- 30 XP and 2 Vista workstations.

All the above has always run fine until the introduction of the W2K8
servers. Simply put the problem is:

- WSUS (running on SBS 2003) persists in reporting KB948014 as still
required on both the W2K8 Servers but the servers cannot be persuaded that
there are any patches needed, much less install them.

Manually checking for required patches does not help.

I suppose we can just decline the update and the nagging yellow pie segment
in the WSUS console will go away, but that's essentially sweeping dust under
the carpet. WSUS 3.1 and the W2K8 Servers should agree on whether or not a
patch is required.

[Jon Harris]

I agree with this. Why ignore a problem, if one exist, that my come back to
bite us later. I would prefer it is fixed rather than ignored.

Jon

[Lawrence Garvin (MVP)]

"Alatar" <Ala...@discussions.microsoft.com> wrote in message
news:43D8E249-BEA7-4C04...@microsoft.com...

Okay... some reality here.... WSUS is reporting a patch is needed because
the =WUA= on those machines is reporting as such. So they do agree. The
statement "the servers cannot be persuaded that there are any patches
needed" is contradictory, because it's the =servers= (W2K8) who have
actually (and erronously, I agree) reporting this update as needed. I'm not
sure what you're basing that statement on, but the mere fact that the update
is reported as "Needed" in the WSUS Console is based on the fact that the
client-side Windows Update Agent reported that as fact to the WSUS Server.

(Or, put another way, the WSUS Server is a *passive* device. It does not do
any analysis and it has very little intelligence. All of the intelligence
involved in update processing is contained in either the Windows Update
Agent, or the update installer itself.)

Now, the servers *should* be reporting KB940518 as Needed, as that's the
installer for the W2K8 WSUS Server ROLE package.

You're not the first, however, to report W2K8 servers as erronously
reporting KB948014 as needed.

I have two possible suggestions to address this (and other related)
scenario:

Create a target group for your WSUS Server as a subgroup of your master
Servers group. Place your WSUS Server in this group. Approve KB948014 ONLY
for the "WSUS Server" group.

=or=

Create a target group in WSUS for Windows Server 2008 systems. Place your
Windows Server 2008 systems in this group. Mark KB948014 as "Not Approved"
for the Windows Server 2008 systems.

=or=

Consider doing both! :-)

[Alatar]

Hi Lawrence, thanks for the info.

I understand what you mean -- and hadn't realized -- when you say that "the
WSUS server is a passive device". I also will implement, failing an even
better solution resulting from this thread, one or both of your suggested
solutions.

However, your explanation shifts the location of the discrepancy somewhat
further down the pipeline but doesn't really alleviate the problem we have.
The fact remains that at this very moment the WSUS Detailed Status Report
shows (Slightly paraphrased):

samoa.<domain>.local
===============
Needed
---------
Title: Windows Server Update ..... (KB948018)
Classification: Updates
Approval: Install
Status: Not Installed

while Windows Update on samoa.<domain>.local says:
"Windows is up to date"
No new updates are available for your computer.

Note that the former also means that there is yellow pie slice on the WSUS
control display and it cannot be made to be all green without some fudge
along the lines you describe.

The issue is causing the (junior) technical people at our customer to go
nuts as they've been told that anytime they see yellow pie slices their work
of running updates / checking for machines awaiting reboot (automatic reboot
is not an option in this application) etc. is incomplete. Also, it makes them
less likely to take other yellow pie slices seriously.

Again, I realize your suggestion is a good work-around, but we have 15
customers in this boat; this particular one is the first with W2K8 Data
Servers, but you can understand that I'm not looking forward to having to set
up special target groups in a dozen different sites just because an internal
misconfiguration error in one update causes it to endlessly show as needed in
the WSUS console.

Thanks again for your comments,
Alatar

[Lawrence Garvin (MVP)]

"Alatar" <Ala...@discussions.microsoft.com> wrote in message

news:1A1D7550-1EF2-4125...@microsoft.com...

> The fact remains that at this very moment the WSUS Detailed Status Report
> shows (Slightly paraphrased):
>
> samoa.<domain>.local
> ===============
> Needed
> ---------
> Title: Windows Server Update ..... (KB948018)
> Classification: Updates
> Approval: Install
> Status: Not Installed
>
> while Windows Update on samoa.<domain>.local says:
> "Windows is up to date"
> No new updates are available for your computer.

There is no KB948018 in the system.

Taking from the subject line, rather than the text (i.e. KB948014), this is
the WSUS Service Pack 1 update. There are *KNOWN* issues with the detection
logic in this package, and this newsgroup is replete with threads reporting
that the package has improperly detected on machines that do not have WSUS.

Suggestion: Create a SUBGROUP just for WSUS Servers. Approve KB948014 only
for the WSUSServers group. Better yet, BASELINE your WSUS Servers at WSUS
3.0 SP1 and DECLINE this update. Problem solved.

> Note that the former also means that there is yellow pie slice on the WSUS
> control display and it cannot be made to be all green without some fudge
> along the lines you describe.
>
> The issue is causing the (junior) technical people at our customer to go
> nuts as they've been told that anytime they see yellow pie slices their
> work
> of running updates / checking for machines awaiting reboot (automatic
> reboot
> is not an option in this application) etc. is incomplete. Also, it makes
> them
> less likely to take other yellow pie slices seriously.

This is a *training* issue. The WSUS server will ALWAYS show yellow slices
in the default view unless your organization is in the habit of approving
and installing every available update for every system -- which is the only
way you'll ever get a pie at 100% green. The pies on the WSUS Updates page
report status based on all synchronized updates -- regardless of their
approval status.

If you need pies with 100% green, then you'll need to create custom Update
Views which are based on updates Approved for specified group(s).

It's unfortunate that the junior admins are being sent on such wild goose
chases. A bit of appropriate product training would have saved a lot of
people a lot of wasted time trying to achieve the impossible.

[jgeddes]

I just came across this thread, as I was having this same problem. I
too didn't want to ignore it and have it come back to bite me.

However, I found that in my case, the problem servers are 2008 web
edition, which won't allow those roles to be installed, so WSUS says
they are needed for 2008, but the web edition machine won't install
them.

It looks like WSUS should recognize this, right?

Just wanted to throw that out there.

--
jgeddes
------------------------------------------------------------------------
jgeddes's Profile: http://forums.techarena.in/members/jgeddes.htm

[schtebo]

we have here the same problem on 7 win 2008 64bit machines
on one of the 7 machines a wsus server is installed, but on the other 6
not.

but wsus reports that all machines need the update??

any other suggestions?

well it will work createing 2 groupt one for the servers (server) and
one for the wsus servers server (wsus)

but this could be still a workaround.

thanks!!

--
schtebo
------------------------------------------------------------------------
schtebo's Profile: http://forums.techarena.in/members/115679.htm

[Lawrence Garvin [MVP]]

"schtebo" <schtebo...@DoNotSpam.com> wrote in message
news:schtebo...@DoNotSpam.com...

>
> we have here the same problem on 7 win 2008 64bit machines
> on one of the 7 machines a wsus server is installed, but on the other 6
> not.
>
> but wsus reports that all machines need the update??

This question has been asked and answered a dozen times in this newsgroup
and in the Win2008\WSUS forum, and is as well documented in this blog
posting as any question/answer will ever get:

http://blogs.technet.com/wsus/archive/2009/01/16/installing-wsus-3-0-sp1-through-window-server-2008-sp1-server-manager.aspx

The fundamental challenge here is understanding *why* an update is reported
as "Needed", and understanding that KB948014 is reported as Needed for
EXACTLY the reason you think it shouldn't -- Because WSUS is Not Installed
on those machines.

KB948014 is "Needed" by those machines for exactly the same reasons that
Internet Explorer 7 is "Needed" by Windows Server 2003 machines, or for
exactly the same reason that Internet Explorer 8 will be "Needed" by Windows
Server 2008 machines next month.

Also, when you generically talk about "KB948014 is needed", you also need to
specify which of the two packages you're actually looking at. One package is
simply to upgrade WSUS v3.0 to WSUS v3.0 SP1:

Windows Server Update Services 3.0 SP1 (KB948014)
Windows Server Update Services 3.0 SP1 for x64-based Systems (KB948014)

The other is to actually install the Role on Win2008 systems (which also
requires the installation of KB940518):

Windows Server Update Services 3.0 SP1 Dynamic Install for Windows Server
2008 (KB948014)
Windows Server Update Services 3.0 SP1 Dynamic Install for Windows Server
2008 for x64-based Systems (KB948014)

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA

Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

MS WSUS Website: http://www.microsoft.com/wsus

My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

[techie007]

OK, at the risk of Lawrence Garvin just telling me this has been discussed
to death I'm still looking for an answer, and that Blog doesn't help my
situation in the slightest.

I have WSUS 3.0 SP1 running on a Windows 2003 server.

WSUS says that our Server 2008 Service Pack *2* system needs this update
(KB948014), but the client side (the 2K8 machine) doesn't report it as
needed, and it's obviously not installing it (since it's been approved and
reported as needed for over a month now, and all other updates have been
installed correctly).

So since the server is at SP2, WSUS is already available as a Role in the
Server Manager and KB940518 doesn't install when I manually attempt to
install it ("not applicable")

Going to get KB948014 manually takes me to a full install of WSUS 3 SP1,
which I don't want, as I'm not planning on installing WSUS on the 2K8 machine
anytime soon.

I understand how WSUS works, I understand that the update is to either add
or update the Role of WSUS to 2K8 (that why it wants it, not becuase the
server has or hasn't got WSUS installed).

So my questions are simple:

How do I get WSUS to recognize that the update isn't needed by the 2K8 SP2
server?

If it IS still need by a 2K8 SP*2* system, then HTH do I get it (KB948014)
installed without installing WSUS 3 SP1?

If I reset the approval to "Declined" is the fact that WSUS thinks it's
needed going to go away?

If I reset the approval to "Declined" am I screwing myself in the future?

Thanks in advance!

[techie007]

Just to be clear, the 'version' of KB948014 that WSUS is reporting as needed
by our 2K8 server is "Windows Server Update Services 3.0 SP1 Dynamic Install
for Windows Server 2008 (KB948014)".

[Lawrence Garvin [MVP]]

"techie007" <tech...@discussions.microsoft.com> wrote in message
news:7FE6BEF3-CC83-4278...@microsoft.com...

> OK, at the risk of Lawrence Garvin just telling me this has been
> discussed
> to death

Well... it has! :-)

> I'm still looking for an answer, and that Blog doesn't help my
> situation in the slightest.
>
> I have WSUS 3.0 SP1 running on a Windows 2003 server.
>
> WSUS says that our Server 2008 Service Pack *2* system needs this update
> (KB948014),

Well, yes... the update is "Needed" (meaning the update can be installed, if
you so desire). Whether you desire or not, is no different than whether you
desire Silverlight, NET35SP1, IE8, or any other update that is available to
be installed. They also are reported as "Needed", and as a WSUS
Administrator -- you need to determine the appropriate reaction to that
fact.

> but the client side (the 2K8 machine) doesn't report it as needed,

I think you misunderstand here... the "WSUS says" **IS** the "client side"
reporting the update as needed. The only information WSUS has is what is
reported to it by the WUAgent on that "client" machine -- in this case the
Win2008SP2 system.

So, please clarify what *you* mean by "...the client side doesn't report it
as needed..."? The client side Has Already Reported the update as needed (to
the WSUS Server).

> and it's obviously not installing it (since it's been approved and
> reported as needed for over a month now, and all other updates have been
> installed correctly).

Next point... there are two different packages for KB948014 available for
Windows Server 2008 systems....

[1] Windows Server Update Services 3.0 SP1 (KB948014)
-- this update is only applicable to systems which have WSUS 3.0 already
installed. This package is the UPDATE package to update WSUS3.0RTM systems
to WSUS3.0SP1 systems.

[2] Windows Server Update Services 3.0 SP1 Dynamic Install for Windows
Server 2008 (KB948014)
-- this update is only applicable to systems which have KB940518 installed
or have =SP2= installed, enabling Server Manager to host WSUS as a Win2008
ROLE. If KB940518 is not installed on an SP1 system, this update will
report as Not Applicable; if KB948014 is installed on an SP1 system, or SP2
is installed, this update will always report as applicable -- even if WSUS
is not installed. On a Win2008SP2 system that does not have WSUS installed,
this update is implemented by choosing "Windows Server Update Services" from
the Add Role screen of Server Manager.

> So since the server is at SP2, WSUS is already available as a Role in the
> Server Manager and KB940518 doesn't install when I manually attempt to
> install it ("not applicable")

Well, technically only =KB940518= is installed by SP2. Choosing the =Windows
Server Update Services= role for installation will actually cause the
DOWNLOAD of =Windows Server Update Services 3.0 SP1 Dynamic Install for
Windows Server 2008 (KB948014)= from the Microsoft Update site. This package
is not installed by SP2, and that's why the package shows as NEEDED for any
SP2 systsem.

> Going to get KB948014 manually takes me to a full install of WSUS 3 SP1,

And so it should.

> which I don't want, as I'm not planning on installing WSUS on the 2K8
> machine
> anytime soon.

Then why are we concerned about this update at all ????? Simply ignore the
update, just like you're doing for Silverlight, IE7 on Win2003, IE8 on
Win2008, or any of a half dozen other updates you've probably chosen not to
install at this time.

> How do I get WSUS to recognize that the update isn't needed by the 2K8 SP2
> server?

You DO NOT -- any more than you don't get "WSUS" to recognize that
Silverlight is "not needed" by any Windows Server system, or that IE8 is
"not needed" by any Windows Server system, or NET35SP1 is "not needed" by
any Window Server system.

You must understand that the term "Needed" means "IS Installable if you WANT
TO". Whether you choose to Approve the update and actually install it is
always the ultimate question. The fact that it *can* be installed is a fact
that you cannot change.

> If it IS still need by a 2K8 SP*2* system, then HTH do I get it (KB948014)
> installed without installing WSUS 3 SP1?

You don't. KB948014 =IS= WSUS3SP1!!! It comes in two package types:

As an application, using the =Windows Server Update Services 3.0 SP1
(KB948014)= package on any Win2003 or Win2008 product.

As a ROLE, on Win2008SP1 using KB940518 and the =Windows Server Update
Services 3.0 SP1 Dynamic Install for Windows Server 2008 (KB948014)= package
from a configured WSUS Server.

As a ROLE, on Win2008SP2 using the Add Role option of Server Manager and
selecting "Windows Server Update Services" from the available roles, which
will cause the download and installation of the KB948014 WSUS3SP1 Dynamic
Installer package from the appropriate resource.

All three of those methodologies are documented in the blog post I cited.

> If I reset the approval to "Declined" is the fact that WSUS thinks it's
> needed going to go away?

Yes -- just like it would for any other update. But you'd only want to do
this if you NEVER want to install WSUS on a Win2008 server in your entire
environment from the existing Win2003 WSUS Server. This may well be an
appropriate solution.

> If I reset the approval to "Declined" am I screwing myself in the future?

Not really. You can always remove the Declined approval if you discover you
need it.

[Lawrence Garvin [MVP]]

"techie007" <tech...@discussions.microsoft.com> wrote in message

news:56F3942E-7AA9-46C1...@microsoft.com...

Exactly. Becaue it *is* installable on that system. Whether you *choose* to
install it, or not, is your decision.

This update will report as needed on *ALL* Windows Server 2008 SP2 systems.

[techie007]

Hey Lawrence, thanks for the reply,

"Lawrence Garvin [MVP]" wrote:

> Well... it has! :-)

Hopefully I'm just missing something and we can keep this short. :)

> Well, yes... the update is "Needed" (meaning the update can be installed, if
> you so desire). Whether you desire or not, is no different than whether you
> desire Silverlight, NET35SP1, IE8, or any other update that is available to
> be installed. They also are reported as "Needed", and as a WSUS
> Administrator -- you need to determine the appropriate reaction to that
> fact.

Ok I understand what you're saying, but what you're describing is the
'problem' I'm having.

Let pretend I've decided, based on the description of update provided, to
approve 'Silverlight For Windows 95' to be installed. Following my WSUS
settings from there, the update will install on any machines in the Approval
Group(s) that are applicable (ie: Windows 95 machines).

Now let's pretend the update isn't "Silverlight for Windows 95", but that
it's "Windows Server Update Services 3.0 SP1 Dynamic Install for Windows
Server 2008".

The description is:

"Approving this update enables Windows Server 2008 Server Manager to install
WSUS as a new server role".

I think "Well I have a Windows 2008 Server, and I'm considering running WSUS
from it within the year, and I'd like to have the Server Manager offer it as
a 'built-in' role - strange though as I swear I saw it in the SM already, but
apparently it's reporting it wants/needs it."

The only prerequisite I'm going to need (before I decide to roll out WSUS on
the 2K8 server) is listed as "Windows Server 2008 must have update KB940518
installed before using Server Manager to install WSUS".

Sounds good, I have SP2 installed, and apparently this is included
(confirmed by trying to run the manual version of it and having it tell me it
doesn't apply).

So I approve this update.

And --- NOTHING HAPPENS. Unlike "Silverlight for Windows 95" this thing
isn't installing, or even trying as far as I can tell. But I approved it?
So what's up with that?

My understanding is that this thing is supposed to make it so the SM in 2K8
offers WSUS 3.0 SP1 as the role (my guess is that what it's offering now,
without this update installed, is just 3.0, not 3.0 SP1).

Is that not what this update does? Regardless of what it's supposed to
actually do, it isn't doing it, even though it's been approved, yet it keeps
thinking it needs it.

> So, please clarify what *you* mean by "...the client side doesn't report it
> as needed..."? The client side Has Already Reported the update as needed (to
> the WSUS Server).

Sorry, let me expand - when I look at the client (the 2K8 server) it doesn't
seem to indicate that it needs or wants that update in the Windows Update
applet, even if I force it to go check on-line.

Yet it's reporting to WSUS that it wants/needs that update (according to
WSUS).

> report as Not Applicable; if KB948014 is installed on an SP1 system, or SP2
> is installed, this update will always report as applicable -- even if WSUS
> is not installed. On a Win2008SP2 system that does not have WSUS installed,
> this update is implemented by choosing "Windows Server Update Services" from
> the Add Role screen of Server Manager.

So you're saying that to install this "update", that the server thinks it
needs because it doesn't have WSUS installed, I have to install WSUS on that
server???

Can you explain what it is this "update" does then, because that doesn't
sound anything like "enables Windows Server 2008 Server Manager to install
WSUS as a new server role" to me?

> Then why are we concerned about this update at all ????? Simply ignore the
> update, just like you're doing for Silverlight, IE7 on Win2003, IE8 on
> Win2008, or any of a half dozen other updates you've probably chosen not to
> install at this time.

Can you explain what you mean by "Ignore it"? I don't have an "Ignore"
option in my WSUS. :)

The customers and bosses I have to answer to don't like 99%, and I don't
feel like explaining it to them over and over as time passes -- until WSUS
finally ends up installed. I manage several WSUS installs on several
networks, with more coming, so I have to future proof my decisions based on a
large group of similar networks. Finally, this “update” is not working like
any other WSUS update I‘ve dealt with, is that enough “why” for you? :)

> You DO NOT -- any more than you don't get "WSUS" to recognize that
> Silverlight is "not needed" by any Windows Server system, or that IE8 is
> "not needed" by any Windows Server system, or NET35SP1 is "not needed" by
> any Window Server system.

Ok, sorry, let me rephrase: Aside from installing WSUS, is there a way for
me to get the client to think it doesn't want the update without ''declining"
it for everyone in the group who may want it in the future?

> You must understand that the term "Needed" means "IS Installable if you WANT
> TO". Whether you choose to Approve the update and actually install it is
> always the ultimate question. The fact that it *can* be installed is a fact
> that you cannot change.

I understand WSUS's loose use of the term 'needed', I'm not trying to change
the fact that it "can" be installed, and of course I get to decide -- I can
either approve the update, or decline it. I approve it, and it doesn't do
anything. Nothing pops up and says "Hey, you're going to have to go the
client directly and install WSUS for this non-WSUS "Update" to install", or
"Failed" or "Succeeded", etc.

> As a ROLE, on Win2008SP2 using the Add Role option of Server Manager and
> selecting "Windows Server Update Services" from the available roles, which
> will cause the download and installation of the KB948014 WSUS3SP1 Dynamic
> Installer package from the appropriate resource.

Ok, so since I have SP2, this is the one that applies -- When I turn on the
Role it would "cause the download and installation of the KB948014 WSUS3SP1

Dynamic Installer package from the appropriate resource."

So the 'appropriate resource' is my WSUS server, and so I have to leave it
sitting as 'needed' indefinitely for any 2K8 server that _may_ have the WSUS
Role enabled sometime in the future?

Is that how all these "Dynamic Installer" 'products' work? Do you have a
link with more information on that technology; apparently I do not understand
them well enough.

If I remove the "Windows Server 2008 Server Manager - Windows Server Updates
Services (WSUS) Dynamic Installer" 'product' from my WSUS configuration, and
then in the future I go to install the WSUS role on a 2K8 server, will it
shift the "appropriate resource" to the Internet and download and install the
"KB948014 WSUS3SP1 Dynamic Installer package" at that time, directly from MS?

Ok, not short, but it seems that I (and perhaps others) need some
clarification on how these "Dynamic Installers" work?

The good news? One more round of answers from you and this should serve so
that no one ever needs to wonder/ask about this again, cause apparently I'm
as thick as anyone could be. :)

D

[Harry Johnston [MVP]]

Ah, so the problem you're actually having is that the update isn't installing
when it should be? I'd guess that Lawrence didn't realise this - I certainly
didn't, up until your latest post.

Go to the update in the updates view and click on "Computers needing this
update" to get a report. What does the report say about the computer in
question? Does WSUS think the update is approved for that computer?

Make a note of the time, then start a detection by entering this at the command
line:

wuauclt /detectnow

Wait thirty minutes, then post the contents of Windowsupdate.log starting at the
time you issued the command.

Regarding your attempts to install the update manually: note that there may be
more than one download with the same KB number. Sounds like you got the wrong
one. If the download center doesn't contain the dynamic installer, the
Microsoft Update Catalog should. (It contains every update distributed to
WU/MU/WSUS, albiet sometimes for a given value of "every".)

Harry.

[Lawrence Garvin [MVP]]

"techie007" <tech...@discussions.microsoft.com> wrote in message

news:339BF388-B2CA-4F58...@microsoft.com...

> Let pretend I've decided, based on the description of update provided, to
> approve 'Silverlight For Windows 95' to be installed.

You couldn't have picked a *realistic* example??? :-)

> Following my WSUS
> settings from there, the update will install on any machines in the
> Approval
> Group(s) that are applicable (ie: Windows 95 machines).

Correct.

> Now let's pretend the update isn't "Silverlight for Windows 95", but that
> it's "Windows Server Update Services 3.0 SP1 Dynamic Install for Windows
> Server 2008".
>
> The description is:
>
> "Approving this update enables Windows Server 2008 Server Manager to
> install
> WSUS as a new server role".

Correct. That means the update is *visible* to the Windows Server 2008
Server Manager IF/WHEN you open up the Server Manager, click on Add Roles,
and CHOOSE to install "Windows Server Update Services". The thing that makes
"Windows Server Update Services" visible as an installable role is KB940518
or Service Pack 2. On a Windows Server 2008 SP1 machine that does NOT have
KB940518 installed, the "Windows Server Update Services 3.0 SP1 (KB948014)"
update will only be applicable to machines with WSUS3 (RTM) already
installed, and the "Windows Server Update Services 3.0 SP1 Dynamic Install
for Windows Server 2008 (KB948014)" update will not be applicable at all
(because the prerequisites are not yet installed).

The fundamental challenge here is expecting the behavior of a standard
update package to be the same as the behavior of a "Dynamic Installer"
package. Dynamic Installer packages have most decidely different behaviors.
If the behavior was the same -- simply downloading and installing via the
WUAgent -- the package would have just been released as a standard update in
the Updates classification.

> I think "Well I have a Windows 2008 Server, and I'm considering running
> WSUS
> from it within the year, and I'd like to have the Server Manager offer it
> as
> a 'built-in' role - strange though as I swear I saw it in the SM already,
> but
> apparently it's reporting it wants/needs it."

On Service Pack 2 systems, you are absolutely right, you see the "Windows
Server Update Service" selection =LISTED= but the application bits are not
installed yet.

On Service Pack 1 systems with KB940518 installed, you will see the "Windows
Server Update Service" selection =LISTED= but the application bits are not
installed yet.

The application bits are installed only when you actually select "Window
Server Update Services" as a role to be installed from Server Manager,
=OR=
If Windows Server Update Services has previously been installed before the
"role" option was available and:
[a] KB940518 is added, or
[b] Service Pack 2 is applied, which contains the capabilities provided
in KB940518,
==> which automagically converts the installed WSUS application into an
Installed Role and integrates the console into Server Manager.

> The only prerequisite I'm going to need (before I decide to roll out WSUS
> on
> the 2K8 server) is listed as "Windows Server 2008 must have update
> KB940518
> installed before using Server Manager to install WSUS".

Partially correct. This update is required on Windows Server 2008 =SP1=
systems so that "Windows Server Update Services" can be =LISTED= as an
installable role. This update is Not Applicable on =SP2= systems, because
=SP2= already contains the modifications necessary to allow "Windows Server
Update Services" to be =LISTED= as an installable role.

> Sounds good, I have SP2 installed, and apparently this is included
> (confirmed by trying to run the manual version of it and having it tell me
> it
> doesn't apply).

Also confirmable by reading the documentation for SP2 which notes that
KB940518 is included/superceded. :-)

> So I approve this update.
>
> And --- NOTHING HAPPENS.

Nothing is supposed to happen. KB940518 does not contain any application
bits for WSUS, it only contains the modification necessary to allow "Windows
Server Update Services" to be =LISTED= as an installable role.

> Unlike "Silverlight for Windows 95" this thing
> isn't installing, or even trying as far as I can tell. But I approved it?
> So what's up with that?

You've misunderstood the purposes of the two update packages.

> My understanding is that this thing is supposed to make it so the SM in
> 2K8
> offers WSUS 3.0 SP1 as the role

Yes. and that is the ONLY thing that it does.. it adds "Windows Server
Update Services" to the list of installable roles.

> (my guess is that what it's offering now, without this update installed,
> is just 3.0, not 3.0 SP1).

Without this update installed you *cannot* install WSUS as a Windows Server
2008 =ROLE=,
you can only install it as an APPLICATION.

Either version of WSUS .. v3.0 RTM or v3.0 SP1 can be installed as an
application.
Converting WSUS to be an Installed Role *requires* the upgrade to WSUS v3
SP1.

> Is that not what this update does?

No. The update (KB9040518) mere causes the =LISTING= of the option to
install "Windows Server Update Services" as a role in Server Manager. When
you select "Windows Server Update Services" as a role to install, the Server
Manager queries the assigned update source (WSUS, MU), and attempts to
obtain the "Windows Server Update Services 3.0 SP1 Dynamic Install for
Windows Server 2008 (KB948014)" package. If the assigned update source is
the WSUS Server and the package is Approved, then the installation succeeds.
If the assigned update source is Microsoft Update, the installation
succeeds. I've not tested this, but my suspicion is that if the assigned
update source is the WSUS Server and the package is Not Approved -- then the
installation will FAIL.

All of this, of course, is TESTABLE -- and were you to actually install a
TEST machine and step through the procedures documented in the blog post,
all of this would have become crystal clear to you about a half dozen
messages ago. :-)

> Regardless of what it's supposed to actually do, it isn't doing it,

Truly, how can you responsibly claim something isn't "doing it", when you're
not even confident in your knowledge of what it is it's "supposed to do"?

> Sorry, let me expand - when I look at the client (the 2K8 server) it
> doesn't
> seem to indicate that it needs or wants that update in the Windows Update
> applet, even if I force it to go check on-line.

That would be because this update is not published via the
interactive/web-based interface to Windows Update (or even Microsoft
Update)! It's not an interactively installable update.

The *only* way to install this update is by selecting "Windows Server Update
Services" from the ADD ROLES screen of the Windows Server 2008 Server
Manager.

> Yet it's reporting to WSUS that it wants/needs that update (according to
> WSUS).

It is... because it *can* install that package from WSUS if you so instruct
the Server Manager to do.

>> report as Not Applicable; if KB948014 is installed on an SP1 system, or
>> SP2
>> is installed, this update will always report as applicable -- even if
>> WSUS
>> is not installed. On a Win2008SP2 system that does not have WSUS
>> installed,
>> this update is implemented by choosing "Windows Server Update Services"
>> from
>> the Add Role screen of Server Manager.
>
> So you're saying that to install this "update", that the server thinks it
> needs because it doesn't have WSUS installed, I have to install WSUS on
> that
> server???

No.... I'm saying, first, that you need to recognize that there are =TWO=
entirely distinct update packages for KB948014.

One is designed for installation on an EXISTING WSUS 3.0 RTM server
or for installation on any server that wishes to have WSUS3SP1 as an
installed APPLICATION.

The other package is designed for installation from the Windows Server 2008
Server Manager.
On Windows Server 2008 SP1 systems, this package will report as Not
Applicable unless KB940518 is also installed.
On Windows Server 2008 SP2 systems, this package will *ALWAYS* report as
Needed, unless WSUS has been added as an Installed Role.

> Can you explain what it is this "update" does then, because that doesn't
> sound anything like "enables Windows Server 2008 Server Manager to install
> WSUS as a new server role" to me?

But it does *exactly* that. It ADDS the item "Windows Server Update
Services" to the list of installable roles in Server Manager.

In a rare instance -- this title you can actually read literally...
"Enables... =Server Manager= to Install WSUS as a ... Role"

>> Then why are we concerned about this update at all ????? Simply ignore
>> the
>> update, just like you're doing for Silverlight, IE7 on Win2003, IE8 on
>> Win2008, or any of a half dozen other updates you've probably chosen not
>> to
>> install at this time.
>
> Can you explain what you mean by "Ignore it"? I don't have an "Ignore"
> option in my WSUS. :)

<sigh> it means quit freaking out because an update is reported as Needed.
Just leave it alone. Pretend it's not there. Don't do anything with it at
all, and focus your efforts on more constructive activities.

Just like you are, no doubt, leaving alone the Silverlight package, because
I doubt you're installing Silverlight on all of your Windows Server systems.
Just like you're ignoring IE7 for Windows Server 2003, because I doubt
you're installing IE7 on all of your Windows Server 2003 systems - though
you might be installing it on *SELECTED* Windows Server 2003 systems, which
is why you can't decline it.
Just like, starting in three weeks, you'll ignore IE8 for Windows Server
2008, because I doubt you're going to install IE8 on ALL of your WIndows
Server 2008 systems, although you might install it on *SELECTED* Windows
Server 2008 systems, which is why you won't decline it.

> The customers and bosses I have to answer to don't like 99%, and I don't
> feel like explaining it to them over and over as time passes

Then =WSUS= is the wrong product for your customers and bosses -- or else
*you* need to make them understand that 100% is not a practical, nor
realistic, nor even *desirable* objective.

The fact of the matter is, in a responsible organization, hardly ever are
=100%= of all available updates installed on a machine. As a matter of
practice I only install specific non-critical/non-security updates on my
systems. For example, I've not installed NET35SP1 on my systems yet, so the
update to fix the printer driver digital signatures, although Installable --
has no purpose on my machines, because NET35SP1 is not installed. In fact,
it's a flaw in the detection logic for that update because it *should* only
be installable on machines that do have NET35SP1 installed.

> Ok, sorry, let me rephrase: Aside from installing WSUS, is there a way for
> me to get the client to think it doesn't want the update without
> ''declining"
> it for everyone in the group who may want it in the future?

NO.

> Ok, so since I have SP2, this is the one that applies -- When I turn on
> the
> Role it would "cause the download and installation of the KB948014
> WSUS3SP1
> Dynamic Installer package from the appropriate resource."

Bingo!

> So the 'appropriate resource' is my WSUS server, and so I have to leave it
> sitting as 'needed' indefinitely for any 2K8 server that _may_ have the
> WSUS
> Role enabled sometime in the future?

Or.. decline it now, and UNdecline it if/when you need it. It's all Personal
Preference.

> Is that how all these "Dynamic Installer" 'products' work?

It's how *THIS* Dynamic Installer product works.

> Do you have a
> link with more information on that technology; apparently I do not
> understand
> them well enough.

No, I do not. This is actually the first product actually released to WSUS
as a "dynamic installer" product. Ostensibly in a few weeks we'll get to see
how IE8 behaves as a "dynamic installer" product.

> If I remove the "Windows Server 2008 Server Manager - Windows Server
> Updates
> Services (WSUS) Dynamic Installer" 'product' from my WSUS configuration,
> and
> then in the future I go to install the WSUS role on a 2K8 server, will it
> shift the "appropriate resource" to the Internet and download and install
> the
> "KB948014 WSUS3SP1 Dynamic Installer package" at that time, directly from
> MS?

This is partially unknown to me, as I've not expressly tested it. My
expectation is that if your Win2008SP2 machine is configured to use WSUS,
and the Dynamic Installer update is Not Approved, then the attempt to
install "Windows Server Update Services" as a role will FAIL, because the
update is not available from the assigned update source (shucks, the bits
are probably not even physically on the WSUS server!).

Today I actually did this installation process, but I did it on a machine
not yet configured to use a WSUS Server. Time permitting, and subject to a
few other Win2008/WSUS tests I need to do, I'll find out what happens when
the Win2008SP2 machine is configured to use a WSUS Server and the update is
Not Approved.

> Ok, not short, but it seems that I (and perhaps others) need some
> clarification on how these "Dynamic Installers" work?

Or at least on how *THIS* Dynamic Installer works. :-)

Hint: Actual *installation* in a TEST environment will work 1000x better in
understanding the behavior than trying to hash it out in a written
half-duplex communications channel.

> The good news? One more round of answers from you and this should serve so
> that no one ever needs to wonder/ask about this again, cause apparently
> I'm
> as thick as anyone could be. :)

Hehe.... it's not an *easy* concept, so I do appreciate your frustration
with understanding how it works.

The other good news is that I'll probably take everything I've written in
this collection of messages and publish it as an article in the newly
launched "WSUSTips Newsletter".

[Lawrence Garvin [MVP]]

"Lawrence Garvin [MVP]" <lawr...@news.postalias> wrote in message
news:e1fx4gwF...@TK2MSFTNGP02.phx.gbl...

>> The description is:
>>
>> "Approving this update enables Windows Server 2008 Server Manager to
>> install
>> WSUS as a new server role".

Arrrghhh.. I got so confused writing this.. had to proofread it twice.. and
I still messed up this question.

This update, the one you describe here, is the KB940518 update. It's *only*
purpose is to add "Windows Server Update Service" to the =LIST= of
Installable Roles that is presented by the Server Manager when you select
Add Roles.

So.. ignore this first sentence.
> =======================================================

> Correct. That means the update is *visible* to the Windows Server 2008
> Server Manager IF/WHEN you open up the Server Manager, click on Add Roles,
> and CHOOSE to install "Windows Server Update Services".

> =======================================================

The rest is still valid:

[Harry Johnston [MVP]]

Harry Johnston [MVP] wrote:

> Ah, so the problem you're actually having is that the update isn't
> installing when it should be? I'd guess that Lawrence didn't realise
> this - I certainly didn't, up until your latest post.

Ignore me, I'm gibbering. Listen to Lawrence.

Harry.

[Dave Mills]

I have to chip in here. I have 2 W2008 SP2 servers that do not have WSUS
installed in any way, application or role. Both detect 948014 as needed and
neither will install it. The summary issue is not whether this update is needed
or not but that it is detected as needed but will never install. There is no
acceptable situation for me where an update is detected as needed but cannot be
installed. Either it IS NEEDED and should be able to install or it IS NOT NEEDED
and should not be detected as needed.

Dave Mills
There are 10 types of people, those that understand binary and those that don't.

[Lawrence Garvin [MVP]]

"Dave Mills" <Ne...@nospam--djmills-dot-co.uk> wrote in message
news:pm0a859f8q25k7m4c...@4ax.com...

>I have to chip in here. I have 2 W2008 SP2 servers that do not have WSUS
> installed in any way, application or role. Both detect 948014 as needed
> and
> neither will install it. The summary issue is not whether this update is
> needed
> or not but that it is detected as needed but will never install. There is
> no
> acceptable situation for me where an update is detected as needed but
> cannot be
> installed. Either it IS NEEDED and should be able to install or it IS NOT
> NEEDED
> and should not be detected as needed.

The point is that these "Dynamic Installer" updates (or at least this one),
is not designed to deploy and install in the traditional way. The "Dynamic
Installer" updates are designed to be downloaded by the machine at the
moment it is needed. In the case of 948014 this moment occurs when an
administrator chooses to install Windows Server Update Services on a Windows
Server 2008 system.

If you forced 948014 onto a machine via normal WSUS updating methodologies,
then *EVERY* Windows Server 2008 SP2 system in your enviroment would be a
Windows Server Update Services server. I'm sure that's not what you want.

[Dave Mills]

I just cannot get my head round this concept. If the update "enables" a WSUS
role when selected to be SP1 instead of RTM then the update has done its job. It
has not installed WSUS by simply made a change that will cause WSUS to be SP1
when it is selected. What I do not understand is why after it has done this does
it still get detected as needed.

PS: Sorry for not snipping before.

[Lawrence Garvin [MVP]]

"Dave Mills" <Ne...@nospam--djmills-dot-co.uk> wrote in message

news:b75b85pt55vbp44st...@4ax.com...

>>>I have to chip in here. I have 2 W2008 SP2 servers that do not have WSUS
>>>installed in any way, application or role. Both detect 948014 as needed
>>>and neither will install it. The summary issue is not whether this update
>>>is
>>>needed or not but that it is detected as needed but will never install.
>>>There is
>>>no acceptable situation for me where an update is detected as needed but
>>>cannot be installed. Either it IS NEEDED and should be able to install or
>>>it IS NOT
>>>NEEDED and should not be detected as needed.

>>The point is that these "Dynamic Installer" updates (or at least this
>>one),
>>is not designed to deploy and install in the traditional way. The "Dynamic
>>Installer" updates are designed to be downloaded by the machine at the
>>moment it is needed. In the case of 948014 this moment occurs when an
>>administrator chooses to install Windows Server Update Services on a
>>Windows
>>Server 2008 system.
>>
>>If you forced 948014 onto a machine via normal WSUS updating
>>methodologies,
>>then *EVERY* Windows Server 2008 SP2 system in your enviroment would be a
>>Windows Server Update Services server. I'm sure that's not what you want.

> I just cannot get my head round this concept.

Understood. It's a non-traditional use of the update methodology we've all
come to understand intimately over the past ten years.

> If the update "enables" a WSUS
> role when selected to be SP1 instead of RTM then the update has done its
> job.

The functionality has nothing to do with the version of WSUS. ONLY WSUS3SP1
(or WSUS3SP2 when released) can be installed as a role. In fact, once
WSUS3SP2 is released, I believe selecting the role for installation will
automatically download WSUS3SP2. (I've not tested this yet.)

> It has not installed WSUS by simply made a change that will cause WSUS to
> be SP1
> when it is selected.

Not really.... part of the confusion may lie in understanding exactly what
each update does.

KB940518 only does one thing: It =ADDS= the item "Windows Server Update
Services" to the list of installable roles in the Windows Server 2008 Server
Manager. It does not install any application bits.

KB940518 is included in Windows Server 2008 Service Pack 2 and Windows
Server 2008 R2.

KB948014 contains the actual _BITS_ that are used to install Windows Server
Update Services.

Also, remember, WSUS3RTM cannot be installed on Windows Server 2008 -- it's
not supported. Windows Server 2008 RTM/SP1 *requires* WSUS3SP2. Windows
Server 2008 R2 requires WSUS3SP2.

There are two ways to install WSUS on Windows Server 2008:

1. As an application, by downloading and installing the WSUS30 installer, or

2. As a role -- by selecting "Windows Server Update Services" from the list,
which will then query either Microsoft Update or a local WSUS Server to
obtain the current "Dynamic Installer" package.

> What I do not understand is why after it has done this does it still get
> detected as needed.

Because =WSUS=, specifically the ROLE defined by that package, is NOT
installed, but it IsInstallable. Just the same as any other update reports
as Needed (Silverlight, IE7 for Win2003, IE8 for Win2008, NET35SP1).

[Dave Mills]

Thanks Lawrence this is very clear KB940518 gets installed and adds the role to
the list. It is thus no longer "needed" but installed.

What I don't see is why KB948014 is "needed" before I tick the role. If KB948014
has the "bits" for WSUS then it is not needed on a server for which the Role is
not selected.

[Lawrence Garvin [MVP]]

"Dave Mills" <Ne...@nospam--djmills-dot-co.uk> wrote in message

news:foec85l2err4ud6qq...@4ax.com...

> Thanks Lawrence this is very clear KB940518 gets installed and adds the
> role to
> the list. It is thus no longer "needed" but installed.
>
> What I don't see is why KB948014 is "needed" before I tick the role. If
> KB948014
> has the "bits" for WSUS then it is not needed on a server for which the
> Role is
> not selected.

I can't really argue with your point, Dave. It's a valid point. I wish that
logic also applied to things like Silverlight and IE7-for-Win2003, neither
of which will ever see the light of day on my servers. For that matter, why
is any update marked as "Needed" before I mark it as "Approved"? The answer
to that is because WSUS v3 made "Detect Only" an always-on option and no
longer user-selectable, and because I really want to be able to tell if an
update I've forgotten/failed to approve might actually be Needed by a
system.

It's also a valid point that the update *is* Installable; It just happens
that the methodology for implementing that installation is not the
conventional one.

The complication comes in how the product opted to define the term "Needed",
and right or wrong.. for purposes of WSUS "Needed" == "Can Be Installed If
You Want To".

[Dave Mills]

I don't think this is the same case. For these update if I approve them they are
installed and the "needed" status changes to installed. This is no the case for
KB948014 it remains "needed" even if it is approved.

I do agree though that although at first the removal of "approve for detection"
was a good idea in hindsight is was a poor decision. It would be far better if
"approve for detection" was still available but was set to on by default for all
new updates. We could then turn if off for certain groups.

[Lawrence Garvin [MVP]]

"Dave Mills" <Ne...@nospam--djmills-dot-co.uk> wrote in message

news:h50f855dccqrsfr1p...@4ax.com...

> I don't think this is the same case. For these update if I approve them
> they are
> installed and the "needed" status changes to installed. This is no the
> case for
> KB948014 it remains "needed" even if it is approved.

Well.. yes.. just like it would if you had AUOptions=3 and the local user
chose to never install an update. Once the update is =installed=, the status
will change, appropriately so, to Installed. The *only* difference is the
methodology by which the installation is initiated. In a standard
installation it's initiated by the WUAgent, either via a scheduled event, or
the WUAgent User Interface; in this scenaro, it's initiated by selecting
"Windows Server Update Services" via Server Manager.

> I do agree though that although at first the removal of "approve for
> detection"
> was a good idea in hindsight is was a poor decision.

Actually I was trying to make a point. I've presented elsewhere a very
specific reason why making this change was a critical and significant
improvement to the reliability of using WSUS for deploying security updates.
I was, originally, opposed to the change; now I'm 100% in favor of the
change.

> It would be far better if
> "approve for detection" was still available but was set to on by default
> for all
> new updates. We could then turn if off for certain groups.

Now... there's an option that maybe was never considered. It has merit.

Alas, as you and I both know, the product is as "feature complete" as it's
ever likely going to get, so we have what we have, and it is what it is. :-)

[Ahrens@discussions.microsoft.com Andreas Ahrens]

Quite a lot of people clearly sees this as a problem, including me. I will
not go into argument about how servers should report their status when it
comes to this update, as we clearly stand to far from each other.

What I will do is to present a work around. Just create a new computer group
in WSUS, and put your WSUS server(s) here. Approve the update for this group
only, and decline for all others. Then only WSUS servers will be affected and
they have it already installed. In this way, the only thing you need to do to
add a new WSUS server is to make sure it reports to the right computer group.
You get the best of both worlds.

[Lawrence Garvin [MVP]]

"Andreas Ahrens" <Andreas Ahr...@discussions.microsoft.com> wrote in message
news:4D5C80CE-6127-4935...@microsoft.com...

> Quite a lot of people clearly sees this as a problem, including me.

It's a moot point now. WSUS 3 Service Pack 2 has been released and the
WSUS3SP1 Dynamic Installer update is deprecated.

> What I will do is to present a work around. Just create a new computer
> group
> in WSUS, and put your WSUS server(s) here. Approve the update for this
> group
> only, and decline for all others. Then only WSUS servers will be affected
> and
> they have it already installed. In this way, the only thing you need to do
> to
> add a new WSUS server is to make sure it reports to the right computer
> group.
> You get the best of both worlds.

Your workaround is not physically possible; WSUS does not support Decline of
an update By Group.

And, on the off chance that you've simply misused the term "Decline" and
mean "Not Approved", that won't work either, because this configuration will
still not prevent the update from being reported as Needed by any Window
Server 2008 system. Detection is *ON* for all systems, all of the time, for
all updates on the WSUS Server. As long as the update is present on the WSUS
Server, Windows Server 2008 systems will report the update as isInstallable
(which is reflected in the WSUS console with the term "Needed").

The correct 'workaround' is to DECLINE the update ... PERIOD -- for two
reasons:

1. Because it's deprecated by WSUS 3 SP2 and shouldn't be installed at all,
anywhere, and
2. Because unless you actually have a Window Server 2008 machine you're
going to install WSUS onto as a Role, the update is not needed by the
environment and *should* be declined. (This point also applies to the
WSUS3SP2 Dynamic Installer.)

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus

[CX4gunman]

Same problem here.
Afther installing the updates on the Wsus servers I just declined
them.
Problem solved (ehh worked around ;-)

--
CX4gunman
------------------------------------------------------------------------
CX4gunman's Profile: http://forums.techarena.in/members/153869.htm