Clients not showing up in WSUS

I am having some wired problems with WSUS.

I am running in a domain environment using a GPO to push the WSUS
information to the clients. Many of my clients are not showing in the all
computers group in WSUS. The registry settings for clients seem to be ok. I
have noticed when I force an update on the client side with "gpupdate
/force" or "wuauclt.exe /detectnow" it will remove a working client.

Have you checked a client computer update log? you can find it at
C:\windows\windowsupdate.log . Check to see if there are any errors and that
the URL you set in your GPO is definately correct.

Alex

"Ryan Maider" wrote:

> I am having some wired problems with WSUS.
>
> I am running in a domain environment using a GPO to push the WSUS
> information to the clients. Many of my clients are not showing in the all
> computers group in WSUS. The registry settings for clients seem to be ok. I
> have noticed when I force an update on the client side with "gpupdate
> /force" or "wuauclt.exe /detectnow" it will remove a working client.
>
>
>

The logs are not showing any errors and they are connecting to the correct
URL


"Alex Tweed (MCP)" <AlexTweedMCP@discussions.microsoft.com> wrote in message
news:E022CCB3-4D6C-4CD1-A9D6-EFC0CF91D351@microsoft.com...
> Have you checked a client computer update log? you can find it at
> C:\windows\windowsupdate.log . Check to see if there are any errors and
> that
> the URL you set in your GPO is definately correct.
>
> Alex
>
> "Ryan Maider" wrote:
>
>> I am having some wired problems with WSUS.
>>
>> I am running in a domain environment using a GPO to push the WSUS
>> information to the clients. Many of my clients are not showing in the all
>> computers group in WSUS. The registry settings for clients seem to be ok.
>> I
>> have noticed when I force an update on the client side with "gpupdate
>> /force" or "wuauclt.exe /detectnow" it will remove a working client.
>>
>>
>>

Ryan, my assumption is that you used a ghosted image on these machines?
If you did, you need to change the SID. Do a search for new SID tool
on google. In the future, run sysprep on your machine before you ghost
the image.
Ryan Maider wrote:
> I am having some wired problems with WSUS.
>
> I am running in a domain environment using a GPO to push the WSUS
> information to the clients. Many of my clients are not showing in the all
> computers group in WSUS. The registry settings for clients seem to be ok. I
> have noticed when I force an update on the client side with "gpupdate
> /force" or "wuauclt.exe /detectnow" it will remove a working client.

I did think of that also and ran dsget here are my results:

C:\>dsget computer
CN=auh-0179,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
-sid
sid
S-1-5-21-502536679-1125923469-1539857752-3656215
dsget succeeded

C:\>dsget computer
CN=auh-0075a,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
-sid
sid
S-1-5-21-502536679-1125923469-1539857752-3718833
dsget succeeded

I ran it on all of the systems that are in the OU that are having the
problem and no duplicate SID's

<dannyjwarner@gmail.com> wrote in message
news:1161291983.376862.147670@i42g2000cwa.googlegroups.com...
> Ryan, my assumption is that you used a ghosted image on these machines?
> If you did, you need to change the SID. Do a search for new SID tool
> on google. In the future, run sysprep on your machine before you ghost
> the image.
> Ryan Maider wrote:
>> I am having some wired problems with WSUS.
>>
>> I am running in a domain environment using a GPO to push the WSUS
>> information to the clients. Many of my clients are not showing in the all
>> computers group in WSUS. The registry settings for clients seem to be ok.
>> I
>> have noticed when I force an update on the client side with "gpupdate
>> /force" or "wuauclt.exe /detectnow" it will remove a working client.
>

Check out "How the fix the duplicate SUSClientID" problem
http://wsusinfo.onsitechsolutions.com/articles/025.htm

It is the SUSClientID the causes WSUS to think two or more PCs are all the same
one. Usually changing the domain SID triggers a change in the SUSClientID but
maybe you have found a way of not triggering the change.

Typical symptom of the problem is that running wuauclt /detectnow will add that
computer but replace one of the already listed ones.



On Thu, 19 Oct 2006 20:15:48 -0400, "Ryan Maider" <Ryan_Maider@Jabil.com> wrote:

>I did think of that also and ran dsget here are my results:
>
>C:\>dsget computer
>CN=auh-0179,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
> -sid
> sid
> S-1-5-21-502536679-1125923469-1539857752-3656215
>dsget succeeded
>
>C:\>dsget computer
>CN=auh-0075a,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
> -sid
> sid
> S-1-5-21-502536679-1125923469-1539857752-3718833
>dsget succeeded
>
>I ran it on all of the systems that are in the OU that are having the
>problem and no duplicate SID's
>
><dannyjwarner@gmail.com> wrote in message
>news:1161291983.376862.147670@i42g2000cwa.googlegroups.com...
>> Ryan, my assumption is that you used a ghosted image on these machines?
>> If you did, you need to change the SID. Do a search for new SID tool
>> on google. In the future, run sysprep on your machine before you ghost
>> the image.
>> Ryan Maider wrote:
>>> I am having some wired problems with WSUS.
>>>
>>> I am running in a domain environment using a GPO to push the WSUS
>>> information to the clients. Many of my clients are not showing in the all
>>> computers group in WSUS. The registry settings for clients seem to be ok.
>>> I
>>> have noticed when I force an update on the client side with "gpupdate
>>> /force" or "wuauclt.exe /detectnow" it will remove a working client.
>>
>
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.

Thank you very much that looks like where my problem is coming from.

"Dave Mills" <News1@nospam--djmills-dot-co.uk> wrote in message
news:9higj2tv3c30d3uofljgt4q73aln11sfro@4ax.com...
> Check out "How the fix the duplicate SUSClientID" problem
> http://wsusinfo.onsitechsolutions.com/articles/025.htm
>
> It is the SUSClientID the causes WSUS to think two or more PCs are all the
> same
> one. Usually changing the domain SID triggers a change in the SUSClientID
> but
> maybe you have found a way of not triggering the change.
>
> Typical symptom of the problem is that running wuauclt /detectnow will add
> that
> computer but replace one of the already listed ones.
>
>
>
> On Thu, 19 Oct 2006 20:15:48 -0400, "Ryan Maider" <Ryan_Maider@Jabil.com>
> wrote:
>
>>I did think of that also and ran dsget here are my results:
>>
>>C:\>dsget computer
>>CN=auh-0179,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
>> -sid
>> sid
>> S-1-5-21-502536679-1125923469-1539857752-3656215
>>dsget succeeded
>>
>>C:\>dsget computer
>>CN=auh-0075a,ou=workstations,ou=auburnhills,OU=RegionAmericas,DC=corp,DC=XXXX,DC=ORG
>> -sid
>> sid
>> S-1-5-21-502536679-1125923469-1539857752-3718833
>>dsget succeeded
>>
>>I ran it on all of the systems that are in the OU that are having the
>>problem and no duplicate SID's
>>
>><dannyjwarner@gmail.com> wrote in message
>>news:1161291983.376862.147670@i42g2000cwa.googlegroups.com...
>>> Ryan, my assumption is that you used a ghosted image on these machines?
>>> If you did, you need to change the SID. Do a search for new SID tool
>>> on google. In the future, run sysprep on your machine before you ghost
>>> the image.
>>> Ryan Maider wrote:
>>>> I am having some wired problems with WSUS.
>>>>
>>>> I am running in a domain environment using a GPO to push the WSUS
>>>> information to the clients. Many of my clients are not showing in the
>>>> all
>>>> computers group in WSUS. The registry settings for clients seem to be
>>>> ok.
>>>> I
>>>> have noticed when I force an update on the client side with "gpupdate
>>>> /force" or "wuauclt.exe /detectnow" it will remove a working client.
>>>
>>
> --
> Dave Mills
> There are 10 type of people, those that understand binary and those that
> don't.

also QUESTION - We are having the same issue and we use images (True Image),
but, when we create our images it is BEFORE the system ever gets added to a
domain. So none of our images have ever been part of a domain at any time.

Will this still be an issue with WSUS ?

________________________________________

"dannyjwarner@gmail.com" wrote:

> Ryan, my assumption is that you used a ghosted image on these machines?
> If you did, you need to change the SID. Do a search for new SID tool
> on google. In the future, run sysprep on your machine before you ghost
> the image.

It is more a question of whether the SUSClientID is created before the image is
taken. If your master client is updated from your WSUS server the SUSClientID
will be created and then be duplicated. If the clients subsequently joins the
domain then the client SID will be changed to a new domain SID and when this
happens the SUSClientID should be changed too but I have not personally tested
this. I do know that when I remove a PC from the domain and then re-join the
domain I get a duplicate entry in WSUS for the PC.

I would avoid using WSUS on the master image and bring it up to date using the
WU/MU sites where no SUSClientID will be created.


On Wed, 1 Nov 2006 08:51:02 -0800, Mark Ranson <Mark
Ranson@discussions.microsoft.com> wrote:

>also QUESTION - We are having the same issue and we use images (True Image),
>but, when we create our images it is BEFORE the system ever gets added to a
>domain. So none of our images have ever been part of a domain at any time.
>
>Will this still be an issue with WSUS ?
>
>________________________________________
>
>"dannyjwarner@gmail.com" wrote:
>
>> Ryan, my assumption is that you used a ghosted image on these machines?
>> If you did, you need to change the SID. Do a search for new SID tool
>> on google. In the future, run sysprep on your machine before you ghost
>> the image.
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.

"Dave Mills" <News1@nospam--djmills-dot-co.uk> wrote in message
news:pbilk2happua42s7df7jtcub0tu3nqci9e@4ax.com...

> It is more a question of whether the SUSClientID is created before the
> image is
> taken. If your master client is updated from your WSUS server the
> SUSClientID
> will be created and then be duplicated. If the clients subsequently joins
> the
> domain then the client SID will be changed to a new domain SID and when
> this
> happens the SUSClientID should be changed too but I have not personally
> tested
> this. I do know that when I remove a PC from the domain and then re-join
> the
> domain I get a duplicate entry in WSUS for the PC.
>
> I would avoid using WSUS on the master image and bring it up to date using
> the
> WU/MU sites where no SUSClientID will be created.

However, this still does not remove the /requirement/ to run
'sysprep -reseal' on a master image, and since running 'sysprep -reseal' on
that master image will, in fact, remove any SIDs (effectively forcing
creation of a new SusClientID on all cloned systems), there's no issue with
using WSUS to update a master image if it has been properly sysprepped.

In addition you run all of the risks of having 'extra' stuff installed on
the master image, as a result of browsing to WU/MU, or inadvertently
browsing anywhere else.

Personally I think it best to not even fire up a browser on a master image
machine! In fact, the machine being used to build a master image should be
fully blocked at the firewall and have absolutely no egress capability.

I would also suggest enabling the master image machine's Windows Firewall,
and place it in "No Exceptions" mode during the course of building the
image. The firewall can then be disabled immediately before burning the
image; or the firewall can be 'reconfigured/disabled' via policy when the
cloned machine(s) join the domain.


--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/window...s/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

Just to clarify the common imaging issue and to see it with my own eyes I
created a new install from scratch using Win XP SP2 VL, updated the OS from
the WU/MU site and imaged the system.
I uploaded the image onto an identical Dell Latitude D600

Registry showed IDENTICAL SUSClientID's

To clarify, neither system had been added to the domain or had any
additional users added etc

I also connected the original laptop to the internet via our wireless
network which sits outside our firewall to ensure there was no communication
with the WSUS server and that it was only talking to the WU/MU website during
setup.

I also checked the WindowsUpdate.log on both systems and there was no
indication of any communication with our WSUS server.

Also, the SUSClientID did NOT change when I added either of the systems to
the domain.

I hope this helps provide more background info for those unsure about this
subject.
I also wish to thank those that wrote the batch file and logon script as our
network of systems is now communication fully with our WSUS server.

_____________________________________________________________

"Dave Mills" wrote:

> It is more a question of whether the SUSClientID is created before the image is
> taken. If your master client is updated from your WSUS server the SUSClientID
> will be created and then be duplicated. If the clients subsequently joins the
> domain then the client SID will be changed to a new domain SID and when this
> happens the SUSClientID should be changed too but I have not personally tested
> this. I do know that when I remove a PC from the domain and then re-join the
> domain I get a duplicate entry in WSUS for the PC.
>
> I would avoid using WSUS on the master image and bring it up to date using the
> WU/MU sites where no SUSClientID will be created.
>
>
> On Wed, 1 Nov 2006 08:51:02 -0800, Mark Ranson <Mark
> Ranson@discussions.microsoft.com> wrote:
>
> >also QUESTION - We are having the same issue and we use images (True Image),
> >but, when we create our images it is BEFORE the system ever gets added to a
> >domain. So none of our images have ever been part of a domain at any time.
> >
> >Will this still be an issue with WSUS ?
> >
> >________________________________________
> >
> >"dannyjwarner@gmail.com" wrote:
> >
> >> Ryan, my assumption is that you used a ghosted image on these machines?
> >> If you did, you need to change the SID. Do a search for new SID tool
> >> on google. In the future, run sysprep on your machine before you ghost
> >> the image.
> --
> Dave Mills
> There are 10 type of people, those that understand binary and those that don't.
>

"Mark Ranson" <MarkRanson@discussions.microsoft.com> wrote in message
news:032C6949-18AD-4859-83D5-F460636E3149@microsoft.com...
> Just to clarify the common imaging issue and to see it with my own eyes I
> created a new install from scratch using Win XP SP2 VL, updated the OS
> from
> the WU/MU site and imaged the system.
> I uploaded the image onto an identical Dell Latitude D600
>
> Registry showed IDENTICAL SUSClientID's

As expected. (I believe Dave misspoke when he stated that a SusClientID
would not be created by the WUA when connecting to WU/MU. As far as the WUA
is concerned, any approval/content source is a source, and the SusClientID
is always generated.)

-- but it was your test here that confirmed it for me (I had not yet had
the chance to look at a non-WSUS client.)

> Also, the SUSClientID did NOT change when I added either of the systems to
> the domain.

Because, at that point, the client /never/ had a Domain SID! Thus the Domain
SID did not =change=, it was merely added.

To take this a step farther, if you were now to unjoin the domain, and
rejoin the domain, you would get a new SusClient ID. But as noted in a
different thread, that's a pretty radical 'solution', as simply deleting the
AccountDomainSID and SusClientID registry values, and restarting the AU
service, will accomplish the same thing.

Furthermore, if you were to take that system, updated from WU, apply
'sysprep -reseal', and build an image from it. The clones of that image
would NOT have a SusClientID until after connecting with WU/WSUS ==
regardless of whether they were, or were not, joined to a domain.

--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/window...s/default.mspx
And, everything else is at
http://wsusinfo.onsitechsolutions.com
.....

"Lawrence Garvin (MVP)" wrote:

>
> "Mark Ranson" <MarkRanson@discussions.microsoft.com> wrote in message
> news:032C6949-18AD-4859-83D5-F460636E3149@microsoft.com...
> > Just to clarify the common imaging issue and to see it with my own eyes I
> > created a new install from scratch using Win XP SP2 VL, updated the OS
> > from
> > the WU/MU site and imaged the system.
> > I uploaded the image onto an identical Dell Latitude D600
> >
> > Registry showed IDENTICAL SUSClientID's
>
> As expected. (I believe Dave misspoke when he stated that a SusClientID
> would not be created by the WUA when connecting to WU/MU. As far as the WUA
> is concerned, any approval/content source is a source, and the SusClientID
> is always generated.)
>
> -- but it was your test here that confirmed it for me (I had not yet had
> the chance to look at a non-WSUS client.)
>
> > Also, the SUSClientID did NOT change when I added either of the systems to
> > the domain.
>
> Because, at that point, the client /never/ had a Domain SID! Thus the Domain
> SID did not =change=, it was merely added.
>
> To take this a step farther, if you were now to unjoin the domain, and
> rejoin the domain, you would get a new SusClient ID. But as noted in a
> different thread, that's a pretty radical 'solution', as simply deleting the
> AccountDomainSID and SusClientID registry values, and restarting the AU
> service, will accomplish the same thing.
>
> Furthermore, if you were to take that system, updated from WU, apply
> 'sysprep -reseal', and build an image from it. The clones of that image
> would NOT have a SusClientID until after connecting with WU/WSUS ==
> regardless of whether they were, or were not, joined to a domain.
>
> --
> Lawrence Garvin, M.S., MVP-Software Distribution
> Everything you need for WSUS is at
> http://technet2.microsoft.com/window...s/default.mspx
> And, everything else is at
> http://wsusinfo.onsitechsolutions.com
> .....
>
>
>

Excuse me, I have a similar problem with computers on our network. I have
cloned several pc's running a mix of w2k and xp sp2. Deleting the
susclientid on the xp pc's fixed their problem but the pc's running w2k still
are not showing up in the console after deleting the susclientid. I would
appreciate any help with this or ideas.
Thank you Louie W

"Lawrence Garvin (MVP)" wrote:

>
> "Mark Ranson" <MarkRanson@discussions.microsoft.com> wrote in message
> news:032C6949-18AD-4859-83D5-F460636E3149@microsoft.com...
> > Just to clarify the common imaging issue and to see it with my own eyes I
> > created a new install from scratch using Win XP SP2 VL, updated the OS
> > from
> > the WU/MU site and imaged the system.
> > I uploaded the image onto an identical Dell Latitude D600
> >
> > Registry showed IDENTICAL SUSClientID's
>
> As expected. (I believe Dave misspoke when he stated that a SusClientID
> would not be created by the WUA when connecting to WU/MU. As far as the WUA
> is concerned, any approval/content source is a source, and the SusClientID
> is always generated.)
>
> -- but it was your test here that confirmed it for me (I had not yet had
> the chance to look at a non-WSUS client.)
>
> > Also, the SUSClientID did NOT change when I added either of the systems to
> > the domain.
>
> Because, at that point, the client /never/ had a Domain SID! Thus the Domain
> SID did not =change=, it was merely added.
>
> To take this a step farther, if you were now to unjoin the domain, and
> rejoin the domain, you would get a new SusClient ID. But as noted in a
> different thread, that's a pretty radical 'solution', as simply deleting the
> AccountDomainSID and SusClientID registry values, and restarting the AU
> service, will accomplish the same thing.
>
> Furthermore, if you were to take that system, updated from WU, apply
> 'sysprep -reseal', and build an image from it. The clones of that image
> would NOT have a SusClientID until after connecting with WU/WSUS ==
> regardless of whether they were, or were not, joined to a domain.
>
> --
> Lawrence Garvin, M.S., MVP-Software Distribution
> Everything you need for WSUS is at
> http://technet2.microsoft.com/window...s/default.mspx
> And, everything else is at
> http://wsusinfo.onsitechsolutions.com
> .....
>
>
>

On Tue, 14 Nov 2006 11:56:02 -0800, Louie W <LouieW@discussions.microsoft.com>
wrote:

>Excuse me, I have a similar problem with computers on our network. I have
>cloned several pc's running a mix of w2k and xp sp2. Deleting the
>susclientid on the xp pc's fixed their problem but the pc's running w2k still
>are not showing up in the console after deleting the susclientid. I would
>appreciate any help with this or ideas.
>Thank you Louie W

Are the PC even attempting to contact WSUS. Check the windowsupdate.log on the
client or run the client diagnostic on them

>
>"Lawrence Garvin (MVP)" wrote:
>
>>
>> "Mark Ranson" <MarkRanson@discussions.microsoft.com> wrote in message
>> news:032C6949-18AD-4859-83D5-F460636E3149@microsoft.com...
>> > Just to clarify the common imaging issue and to see it with my own eyes I
>> > created a new install from scratch using Win XP SP2 VL, updated the OS
>> > from
>> > the WU/MU site and imaged the system.
>> > I uploaded the image onto an identical Dell Latitude D600
>> >
>> > Registry showed IDENTICAL SUSClientID's
>>
>> As expected. (I believe Dave misspoke when he stated that a SusClientID
>> would not be created by the WUA when connecting to WU/MU. As far as the WUA
>> is concerned, any approval/content source is a source, and the SusClientID
>> is always generated.)
>>
>> -- but it was your test here that confirmed it for me (I had not yet had
>> the chance to look at a non-WSUS client.)
>>
>> > Also, the SUSClientID did NOT change when I added either of the systems to
>> > the domain.
>>
>> Because, at that point, the client /never/ had a Domain SID! Thus the Domain
>> SID did not =change=, it was merely added.
>>
>> To take this a step farther, if you were now to unjoin the domain, and
>> rejoin the domain, you would get a new SusClient ID. But as noted in a
>> different thread, that's a pretty radical 'solution', as simply deleting the
>> AccountDomainSID and SusClientID registry values, and restarting the AU
>> service, will accomplish the same thing.
>>
>> Furthermore, if you were to take that system, updated from WU, apply
>> 'sysprep -reseal', and build an image from it. The clones of that image
>> would NOT have a SusClientID until after connecting with WU/WSUS ==
>> regardless of whether they were, or were not, joined to a domain.
>>
>> --
>> Lawrence Garvin, M.S., MVP-Software Distribution
>> Everything you need for WSUS is at
>> http://technet2.microsoft.com/window...s/default.mspx
>> And, everything else is at
>> http://wsusinfo.onsitechsolutions.com
>> .....
>>
>>
>>
--
Dave Mills
There are 10 type of people, those that understand binary and those that don't.