Windows Update on Server 2000 through Terminal Services
in hand@discussions.microsoft.com Cap in hand
server through terminal services, the security patches will not install
failing with an error. When running windows update from the console of the
same server, all installs Ok. Although we can work around the proplem we
would prefer to install through terminal services. Does anybody know how to
resolve this issue?
Kazimirov@discussions.microsoft.com Timur Kazimirov
Cap in hand
The proxy is configured for anonymous access to the Windows Update Web site.
The following destinations are included in the destination setfor Windows
Update:
• http://download.windowsupdate.com
• https://*.windowsupdate.microsoft.com
• http://*.windowsupdate.microsoft.com
• http://update.microsoft.com
The update works from the console so rules out a proxy issue.
The windows update log is as follows:
2005-08-05 09:44:03 2044 1180 DnldMgr *************
2005-08-05 09:44:03 2044 1180 DnldMgr ** START ** DnldMgr: Downloading
updates [CallerId = WindowsUpdate]
2005-08-05 09:44:03 2044 1180 DnldMgr *********
2005-08-05 09:44:03 2044 1180 DnldMgr * Priority = 3, ServiceId =
{9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:03 2044 1180 DnldMgr * Updates to download = 3
2005-08-05 09:44:03 2044 1180 Agent * Title = Security Update for
Windows 2000 (KB901214)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{D49F8CD9-750B-410D-91FA-BD8DEC51D9A6}.102
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102
2005-08-05 09:44:03 2044 1180 Agent * Title = Windows Malicious Software
Removal Tool - July 2005 (KB890830)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{32BC69AD-E033-4000-9613-0604FFF996D2}.100
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{8E7F26E6-3735-43D4-9812-0CD2E8FEB937}.100
2005-08-05 09:44:03 2044 1180 Agent * Title = Security Update for JView
Profiler (KB903235)
2005-08-05 09:44:03 2044 1180 Agent * UpdateId =
{C5E60BC2-721C-40BB-94EC-D3CFF054871D}.101
2005-08-05 09:44:03 2044 1180 Agent * Bundles 1 updates:
2005-08-05 09:44:03 2044 1180 Agent *
{9AFFA28E-4E3F-48E7-80C7-B3502E7E153B}.101
2005-08-05 09:44:03 2044 1180 DtaStor Update service properties: service
registered with AU is {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:03 2044 1180 DtaStor WARNING: Update Service: Failed to
update backup store
2005-08-05 09:44:03 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd
2005-08-05 09:44:03 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager::DownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 0 in call 15. Notifying call.
2005-08-05 09:44:03 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:03 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {8E7F26E6-3735-43D4-9812-0CD2E8FEB937}.100] ***********
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd
2005-08-05 09:44:04 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager::DownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 1 in call 15. Notifying call.
2005-08-05 09:44:04 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:04 2044 1180 DnldMgr *********** DnldMgr: New download job
[UpdateId = {9AFFA28E-4E3F-48E7-80C7-B3502E7E153B}.101] ***********
2005-08-05 09:44:04 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd
2005-08-05 09:44:05 2044 1180 DnldMgr FATAL:
DM:CAgentDownloadManager::DownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-05 09:44:05 2044 1180 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 2 in call 15. Notifying call.
2005-08-05 09:44:05 2044 1180 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
2005-08-05 09:44:05 2044 1180 DtaStor Update service properties: service
registered with AU is {9482F4B4-E343-43B6-B170-9A65BC822C77}
2005-08-05 09:44:05 2044 1180 DtaStor WARNING: Update Service: Failed to
update backup store
2005-08-05 09:44:05 2044 1180 Agent *********
2005-08-05 09:44:05 2044 1180 Agent ** END ** Agent: Downloading updates
[CallerId = WindowsUpdate]
2005-08-05 09:44:05 2044 1180 Agent *************
2005-08-05 09:44:05 1228 1428 COMAPI >>-- RESUMED -- COMAPI: Download
[ClientId = WindowsUpdate]
2005-08-05 09:44:05 1228 1428 COMAPI - Download call complete (succeeded =
0, succeeded with errors = 0, failed = 3, unaccounted = 0)
2005-08-05 09:44:05 1228 1428 COMAPI - WARNING: Exit code = 0x00000000;
Call error code = 0x80240022
2005-08-05 09:44:05 1228 1428 COMAPI ---------
2005-08-05 09:44:05 1228 1428 COMAPI -- END -- COMAPI: Download [ClientId
= WindowsUpdate]
2005-08-05 09:44:05 1228 1428 COMAPI -------------
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{AAC118DA-D1A8-40D0-ABC4-9610BDF5E76B} 2005-08-05
09:44:03+0100 1 161 101 {D49F8CD9-750B-410D-91FA-BD8DEC51D9A6} 102 8024401b WindowsUpdate Failure Content Download Error: Download failed.
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{CE5AE42E-B255-4062-A60F-44FE0ED1767D} 2005-08-05
09:44:04+0100 1 161 101 {32BC69AD-E033-4000-9613-0604FFF996D2} 100 8024401b WindowsUpdate Failure Content Download Error: Download failed.
2005-08-05 09:44:08 2044 1180 Report REPORT EVENT:
{ED3553D1-01E7-4142-A37E-F58F0A8072F1} 2005-08-05
09:44:05+0100 1 161 101 {C5E60BC2-721C-40BB-94EC-D3CFF054871D} 101 8024401b WindowsUpdate Failure Content Download Error: Download failed.
Robert Aldwinckle
news:BB721377-E04E-4938...@microsoft.com...
> Error number is: 0x8024401b
>
> The proxy is configured for anonymous access to the Windows Update Web site.
Doesn't look like it...
> [UpdateId = {76D6D2AF-930A-4A5D-A0EB-DB83C873304D}.102] ***********
> 2005-08-05 09:44:03 2044 1180 DnldMgr WARNING: SetCredentials for NEGOTIATE
> AUTH proxy failed with 0x800704dd
Can you bypass the proxy?
If not it looks as if you could use AU in its prompt mode or WU Custom
to inform yourself about which updates they think you need and then
use the WU Catalog to download them and install them manually.
HTH
Robert Aldwinckle
---
Neil Price
that it is NOT a proxy problem. When logged in as domain admin via terminal
services I get 0x8024401B error for all downloads it attempts (the scan
functionality works correctly). However when logged in as domain admin on
the console (without any changes to the system or user) the patches all
downloaded and installed correctly. I have since returned to the TS session
(same login) and tried to install an optional hardware update ... and it
fails with 0x8024401B error.
Example Details from WindowsUpdate.log for successful item (Console):
2005-08-11 10:56:47 432 2b4 DnldMgr *********** DnldMgr: New download job
[UpdateId = {ECE36A54-7D3A-4935-AD93-D85B77137D15}.100] ***********
2005-08-11 10:56:47 432 2b4 DnldMgr * BITS job initialized, JobId =
{70D2F24F-C995-4499-98DF-005D89497FBC}
2005-08-11 10:56:47 432 2b4 DnldMgr BITS job
{70D2F24F-C995-4499-98DF-005D89497FBC} using proxy = gtproxy2:80;gtproxy2:80,
bypass = <local>;<local>
2005-08-11 10:56:47 432 2b4 DnldMgr * Downloading from
http://www.download.windowsupdate.com/msdownload/update/v5/psf/windows2000-kb899591-x86-enu_c0661008d11438e5f5f498694e6f421743f0b198.psf
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1390067357-1177238915-682003330-500\13b2a74dd74e724931de0d368835e7fa\download\Windows2000-KB899591-x86-ENU.psf.blob (1 subranges).
2005-08-11 10:56:48 432 2b4 DnldMgr BITS job
{70D2F24F-C995-4499-98DF-005D89497FBC} completed successfully
Details from WindowsUpdate.log for failed item (TS Session):
2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
bypass = <local>;<local>
2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f (full file).
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
{C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
{1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
= 5
2005-08-11 11:07:39 1176 344 DnldMgr Progress failure bytes total =
196362, bytes transferred = 0
2005-08-11 11:07:39 1176 344 DnldMgr Failed job file: URL =
http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab,
local path =
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Download job failed because of
proxy auth or server auth.
2005-08-11 11:07:39 1176 344 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: SetCredentials for NEGOTIATE
AUTH proxy failed with 0x800704dd
2005-08-11 11:07:39 1176 344 DnldMgr FATAL:
DM:CAgentDownloadManager::DownloadUpdate: pDownloadJob->Init failed with
0x8024401b.
2005-08-11 11:07:39 1176 344 DnldMgr WARNING: Got error (hr = 8024401b)
starting update 0 in call 3. Notifying call.
2005-08-11 11:07:39 1176 344 DnldMgr Error 0x8024401b occurred while
downloading update; notifying dependent calls.
Neil Price
The problem with terminal services doesn't happen when logged on as a local
administrator (rather than domain admin). However, when logged on as a local
administrator, I do not have the domain credentials required to use the proxy
and so it requests a domain username and password several times throughout
the process.
Although it required me to enter a fully qualified username (domain\user)
and corresponding password 2-3 times during the process, it did successfully
update the optional hardware update that it failed on earlier (when logged in
as a Domain Admin that has the credentials required to use the proxy).
It's a bit of a pain if you have to enter username and password for each
download ... but at least it works.
The issue seems to me to be some difference between console & TS sessions as
to how the user's credentials are retrieved and applied for proxy access.
The following extract from WindowsUpdate.log shows that it fails the first
attempt due to lack of authorisation (local admin doesn't have domain
credentials), but the second attemp succeeds after domain username and
password are entered when requested:
2005-08-11 11:29:46 1176 b28 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:29:46 1176 b28 DnldMgr * BITS job initialized, JobId =
{8054EB02-9DCD-448F-9B61-D85CC681957C}
2005-08-11 11:29:46 1176 b28 DnldMgr BITS job
{8054EB02-9DCD-448F-9B61-D85CC681957C} using proxy = gtproxy2:80;gtproxy2:80,
bypass = 127.0.0.1;*.local;192.9.*;<local>;<local>
2005-08-11 11:29:46 1176 b28 DnldMgr * Downloading from
http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f (full file).
2005-08-11 11:29:46 1176 698 DnldMgr WARNING: BITS job
{8054EB02-9DCD-448F-9B61-D85CC681957C} failed, updateId =
{1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
= 5
2005-08-11 11:29:46 1176 698 DnldMgr Progress failure bytes total =
196362, bytes transferred = 0
2005-08-11 11:29:46 1176 698 DnldMgr Failed job file: URL =
http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab,
local path =
C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f
2005-08-11 11:29:46 1176 698 DnldMgr WARNING: Download job failed because of
proxy auth or server auth.
2005-08-11 11:29:46 1176 698 DnldMgr *********** DnldMgr: New download job
[UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
2005-08-11 11:29:46 1176 698 DnldMgr * BITS job initialized, JobId =
{AD0A9CFA-E983-4027-B02B-91A5E638DC61}
2005-08-11 11:29:46 1176 698 DnldMgr BITS job
{AD0A9CFA-E983-4027-B02B-91A5E638DC61} using proxy = gtproxy2:80;gtproxy2:80,
bypass = 127.0.0.1;*.local;192.9.*;<local>;<local>
2005-08-11 11:29:46 1176 698 DnldMgr * Downloading from
http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab
to
C:\WINNT\SoftwareDistribution\Download\S-1-5-21-1708537768-329068152-682003330-1001\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f (full file).
2005-08-11 11:29:55 1176 834 DnldMgr BITS job
{AD0A9CFA-E983-4027-B02B-91A5E638DC61} completed successfully
Robert Aldwinckle
news:BB656805-8737-4038...@microsoft.com
...
> Details from WindowsUpdate.log for failed item (TS Session):
>
> 2005-08-11 11:07:38 1176 b28 DnldMgr *********** DnldMgr: New download job
> [UpdateId = {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100] ***********
> 2005-08-11 11:07:39 1176 b28 DnldMgr * BITS job initialized, JobId =
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8}
> 2005-08-11 11:07:39 1176 b28 DnldMgr BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} using proxy = gtproxy2:80;gtproxy2:80,
> bypass = <local>;<local>
> 2005-08-11 11:07:39 1176 b28 DnldMgr * Downloading from
> http://www.download.windowsupdate.com/msdownload/update/v3-19990518/cabpool/10784089.cab
> to
> C:\WINNT\SoftwareDistribution\Download\S-1-5-18\ba5f07d10005bdf6a1af363275005181\6312f4f04ff6aded5598b009787817f91d70e12f (full
> file).
> 2005-08-11 11:07:39 1176 344 DnldMgr WARNING: BITS job
> {C9022E6C-8770-402D-9B4F-BBFDB22D61B8} failed, updateId =
> {1A525ACB-FF8E-4973-AA47-598AD84DE645}.100, hr = 0x80190197, BG_ERROR_CONTEXT
> = 5
S-1-5-18 is the SID for the System Account.
0x80190197 is your intermediate server (whatever you want to call it)
telling WU (in an HTTP 407 response) that it is not authorized
to use the link.
You need to get your server to allow anonymous connections
for the services. There is provision for specific logons in the
services' properties pages but supposedly it is not supported.
http://www.microsoft.com/technet/prodtechnol/winxppro/support/updateauthen.mspx
(Courtesy suraj )
HTH
Robert
---
...
Neil Price
that it correctly uses S-1-5-21-1390067357-1177238915-682003330-500 not
S-1-5-18 & it works correctly.
I don't have control over the proxy & in any case this isn't a proxy problem
- as the content in the link you gave states, this is a WU problem
(attempting to auth with null credentials).
Personally I prefer the workaround I found (see my 2nd message yesterday) -
where logging onto TS as a user without proxy access forces it to request
user/password on each connection. That removes the need for meddling with
our proxy.
Regarding your comment about service login settings - I did also try setting
the BITS service logon account to a domain admin (this was before discovering
this thread on the newsgroup & trying it from the console). However, this
just caused it to produce a different error number (relating to RPC failures
as far as I remember), so I set it back to the system account.
Regards,
Neil
"Robert Aldwinckle" wrote:
> "Neil Price" <msgt1...@newsgroup.nospam> wrote in message
> news:BB656805-8737-4038...@microsoft.com
> ....
> ....
>
>
>
>
Nigel H. Lin
firewall. I couldn't produce the same problem. I did encounter the problem
discussed in this thread with TS on Server 2000 after upgrade to windows
update v6. When I did it with Server 2000 and TS with windows update v4, I
didn't find this problem. As a result, I suspect that it's windows update
v6's problem.
Luca
have Win2k only on servers, so I can't tell if this occurs also on Win 2k
Pro. But I can tell it does not happen with XP, whatever Service Pack.
Luckily we can manage working directly from the console, but I agree it's
not the best way...
PowerPlay
(failed).