6 Replies Latest reply on Aug 6, 2014 8:50 AM by Lawrence Garvin

    Wrong Report Information?

    sz-a

      I want to see which updates failed install on what Computer. I use the following Report:

       

       

      But after running this report, I checked some clients and did see some failed updates which not occurred in the report. Manually do an Inventory on this clients and re-run the report didn't help.

       

      How can I trust my own inventory data this way?

        • Re: Wrong Report Information?
          sz-a

          After rebooting Patchmanager-and-WSUS server the report is longer, but I don't know how to check if the information is valid now.

            • Re: Wrong Report Information?
              Lawrence Garvin

              FAILED is a transient state which is only reported on INSTALLABLE updates.

              In fact, it's an event that is only reported once, and until the WUA reports some other status on that update, it reports nothing, thus the WSUS server continues to display the "failed" state.

              Once an update is no longer applicable, it becomes NotApplicable, is reported as such by the WUA, and the previous failed state is no longer present, or relevant.

               

              However, the Windows Update History retains a full and permanent history of every event performed by the WUA, including every installation attempt.

              Ergo, an update that was applicable in February, but failed in February, will still show up in a Windows Update History report as a failed update,

              but will NOT appear in the console (or a WSUS update status report) as a Failed update, because now the Update Installation State = "Not Applicable".

                • Re: Wrong Report Information?
                  sz-a

                  But there are updates which ARE applicable and would be installed if Windows update is run locally (and the Installation fails under several circumstances). But these fails are not shown (several tries today with additional "report now"). If I have to modify the report please give me a hint.

                   

                  Ok, after reading again and again ... which time the FAILED state should be reported to WSUS? At the next client "Report" after the fail (wuauclt /reportnow) ?

                    • Re: Wrong Report Information?
                      Lawrence Garvin
                      But there are updates which ARE applicable and would be installed if Windows update is run locally

                      The fact that there may be updates available from Windows Update is somewhat irrelevant to what is, or is not, available from your local WSUS server.

                      If you don't have those product categories or update classifications configured for synchronization on your WSUS server, the client won't see them from WSUS.

                      If you don't have those updates approved for installation, the client won't see them from WSUS.

                      If the files for the approved updates are not downloaded, the client won't see them from WSUS.

                      which time the FAILED state should be reported to WSUS?

                      The FAILED state is reported to WSUS when the installation failure occurs, but since Windows Vista, there are two points at which an installation failure can occur.

                      The installation failure can occur during the immediate call from the Windows Update Agent. The installer reports a non-zero success code to the WUA, and the WUA immediately reports that installation as FAILED.

                      The installation failure occurs during the final phase of installation during restart. In this instance, the installer initially reports a "success" code to the WUA, so it reports it as InstalledPendingReboot to the WSUS Server. When the installation subsequently fails during the startup sequence, the WUA subsequently reports that installation as FAILED, but not until after the system has restarted (and failed) -- which could be several hours (or, yikes! days!) after the actual installation event.


                      Additionally, if the installation is continually repeated, and fails, then the FAILED state is the most recent installation failure.


                      When the update ceases to be installable, the update will be reported as NotApplicable,

                      or if the update is successfully installed, it will be reported as Installed.


                      Remember, all status data displayed in the WSUS console is derived from EVENTS reported by the Windows Update Agent.

                      If the Windows Update Agent does not report an EVENT, the status does not change in the console.

                        • Re: Wrong Report Information?
                          sz-a

                          The fact that there may be updates available from Windows Update is somewhat irrelevant to what is, or is not, available from your local WSUS server. ...

                          What I said should be read like: If I run "Windows Update" on the Client, which is connected to my WSUS, gets the Update and installs.

                          Because of that the question: Why the Report stated the update would not have been installed?

                           

                          The following sounds like a missing Event report could be the cause:

                          Remember, all status data displayed in the WSUS console is derived from EVENTS reported by the Windows Update Agent.

                          If the Windows Update Agent does not report an EVENT, the status does not change in the console.

                          And how can/should I solve this? An Update which is installed but not reported as installed by WUA? I thought wuauclt /reportnow should do but it didn't.

                            • Re: Wrong Report Information?
                              Lawrence Garvin
                              What I said should be read like: If I run "Windows Update" on the Client, which is connected to my WSUS, gets the Update and installs.

                              There is no logical reason why anything that happens using the Control Panel WUApp would be any different than what happens via the WUA natively or a Patch Manager deployment task,

                              EXCEPT when an update requires user input, and there are some of them out there.


                              Updates that require user input must be launched by a logged-in user from the WUApp.

                              These updates are noted in the update description if they have that requirement.


                              If you believe you observed differences in behaviors, I'd need to inspect the WindowsUpdate.log of the client to determine exactly what did happen.

                               

                              An Update which is installed but not reported as installed by WUA?

                               

                              There are really only two possible causes:

                              • The update package has defective rules and is not properly detecting the installed update.
                              • The update is not actually installed.

                               

                              If we're going to talk about a specific update on a specific computer, then details will be helpful. This thread started out as a question on a report definition, and digressed into a conversation based on distrust in the information presented in the report and the console.

                              I thought wuauclt /reportnow should do but it didn't.

                              The /reportnow option is a severely misunderstood and often misused option. The /reportnow option merely flushes the client's event buffer after the completion of successful operations, but before the client would normally initiate a reporting event. Reporting events are intentionally delayed 15-20 minutes after the completion of other operations. The /reportnow option simply expires that timer.