WSUS server synchronizing, but missing updates

[FLPeople]

- WSUS 3.0 (3.0.6000.374) Win2k3 R2+SP2 server had an issue, tempdb
transaction log was missing, easy enough to fix.
- Rebooted WSUS server, all was well, Synchronizations (3/day) were
going, no sync errors anywhere. Even ran a server cleanup and a database
defrag without problems (except for the known online defrag problem, but
that's just a matter of restarting the db -
http://support.microsoft.com/kb/961479).
- I have automatic approvals set up for a few workstations, The Group
Policy is set to update these machines nightly. Ran wuauclt /detectnow
and they are reporting to WSUS server properly. This has been working
fine for months.
When these workstations visit the Windows Update website from the local
PC, several critical updates are waiting for them: KB976325 KB970430
KB971737 KB974318 KB974392 KB955759 KB973904 KB890830, these updates are
not on the WSUS server, the server is synchronizing, as I recently got
Windows Defender updates (this morning)... all syncs show successful.
(Unrelated: but the Windows Catalog seems broken)

However in the app log, I saw this two days ago (just once):
Event Type: Error
Event Source: Windows Server Update Services
Event Category: Core
Event ID: 10032
Date: 12/12/2009
Time: 12:49:03 AM
User: N/A
Computer: WSUS
Description:
The server is failing to download some updates.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

50 minutes later, I saw this:
Event Type: Information
Event Source: Windows Server Update Services
Event Category: Core
Event ID: 10030
Date: 12/12/2009
Time: 1:39:05 AM
User: N/A
Computer: WSUS
Description:
The server is downloading updates successfully.
For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

Like I said, I am synchronizing fine, I just am not getting those
updates (and some other newly-released critical updates for server
2003)... BITS is set to automatic, plenty of disk space, wsusutil
checkhealth reports everything is fine. There are no inactive approvals,
even uninstalled KB973917 (http://support.microsoft.com/kb/2009746).
Everything appears healthy, so why aren't recent critical updates
getting to my WSUS server from MS? Are these special?

--
FLPeople
------------------------------------------------------------------------
FLPeople's Profile: http://forums.techarena.in/members/163929.htm
View this thread: http://forums.techarena.in/server-update-service/1282324.htm

http://forums.techarena.in

[Harry Johnston [MVP]]

Hi,

Have you checked that Critical Updates is selected in Classifications and that
your client OS is selected in Products? (Under Products and Classifications in
the Options window.)

Harry.

[Lawrence Garvin [MVP]]

"FLPeople" <FLPeopl...@DoNotSpam.com> wrote in message
news:FLPeopl...@DoNotSpam.com...

>
> - WSUS 3.0 (3.0.6000.374) Win2k3 R2+SP2

Yeah.. first thing you need to do is update this WSUS server to the latest
version -- you're now *two* service packs behind.

> tempdb transaction log was missing, easy enough to fix.

But not necessarily the end of the story.

> When these workstations visit the Windows Update website from the local
> PC, several critical updates are waiting for them: KB976325 KB970430
> KB971737 KB974318 KB974392 KB955759 KB973904 KB890830, these updates are
> not on the WSUS server,

This is caused by one of three things:

1. The update are declined, and you're not looking at declined updates.

2. The updates are in an update classification (or product category) you're
not synchronizing.

3. Problems continue as a result of trashing the tempdb earlier.

> (Unrelated: but the Windows Catalog seems broken)

No great surprise if the database or database service has been trashed.

> Description:
> The server is failing to download some updates.

This would keep clients from *installing* the updates; but wouldn't keep
them from appearing in the updates list of the console.

> 50 minutes later, I saw this:

> Description:

> The server is downloading updates successfully.

Okay.. either a transient problem that can be ignored; or something to keep
a watch on.

> Like I said, I am synchronizing fine, I just am not getting those
> updates (and some other newly-released critical updates for server
> 2003)... BITS is set to automatic, plenty of disk space, wsusutil
> checkhealth reports everything is fine. There are no inactive approvals,
> even uninstalled KB973917 (http://support.microsoft.com/kb/2009746).
> Everything appears healthy, so why aren't recent critical updates
> getting to my WSUS server from MS? Are these special?

At least one isn't . . . KB976325; so if that update is missing from your
server (Release Date: 12/8/2009), then I'd be highly suspect of the
integrity of your WSUS database.

--
Lawrence Garvin, M.S., MCITP:EA, MCDBA, MCSA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)

My Blog: http://onsitechsolutions.spaces.live.com
Microsoft WSUS Website: http://www.microsoft.com/wsus
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin

[Lawrence Garvin [MVP]]

"Harry Johnston [MVP]" <ha...@scms.waikato.ac.nz> wrote in message
news:%23zJbdaQ...@TK2MSFTNGP04.phx.gbl...

> Hi,
>
> Have you checked that Critical Updates is selected in Classifications and
> that your client OS is selected in Products? (Under Products and
> Classifications in the Options window.)

Except that KB976325 is a Security Update for IE (all IE versions, all
platforms, all architectures) and covers at least a half dozen product
categories.

As noted in my other reply -- I likely think it's a corrupted database
caused by whatever crashed the tempdb.

[FLPeople]

In Options, Automatic Approvals, the rule I have is checked, my
Classifications I have are Critical Updates, Security Updates, Service
Packs, Update Rollups, Updates.
I have any Windows, Developer, SQL, products... it's a big list, but
definitely "any Windows product" is there.

All my declined updates are superseded or expired - normal. KB976325 is
not on the server... still no errors and Windows Defender syncs seem to
be happening just fine.

Are we looking at simply a *wsusutil reset* command to fix the
database?

And if I upgrade to the latest version of WSUS 3.0 SP2, will my WSUS
server affect my clients? I have some computer groups that do not get
patched from WSUS (used for reporting only). I thought I read that
clients may get a new agent pushed to them for SP2 even if it isn't
approved?