Clients showing up as "Not Yet Reported"

Discussion:

(too old to reply)

Unee

2005-08-10 18:50:50 UTC

Some clients status indicates "not yet reported", the update status is listed
as "unknown" and "Last updated" is listed as N/A. I do know that some of
these clients have received and installed updates via WSUS but continue to
display inaccurate status information. Any suggestions?

JeffG

2005-08-10 19:30:06 UTC

Permalink

Check for and dig through the "windowsupdate.log" file (no space in
the filename) for errors and you should get some idea of what is
happening. If there is not a windowsupdate.log file, it's not getting
updates from WSUS...

HTH
JeffG

On Wed, 10 Aug 2005 11:50:50 -0700, "Unee"

Post by Unee
Some clients status indicates "not yet reported", the update status is listed
as "unknown" and "Last updated" is listed as N/A. I do know that some of
these clients have received and installed updates via WSUS but continue to
display inaccurate status information. Any suggestions?

Unee

2005-08-10 20:16:03 UTC

Permalink

I am not sure what I should be looking for in the log file. As I stated I do
know that at least some of the clients are receiving and installing the
updates without any problems, but continue to display this "not yet reported"
status. I'm including some of the information from the windowsupdate.log:

AU received event of type: 1
2005-08-10 00:10:06-0500 1512 7f0 WU client succeeds
CClientCallRecorder::BeginFindUpdatesEx from AutomaticUpdates with call id
{48453BAF-A7BA-4497-B534-BAAC93965981}
2005-08-10 00:10:06-0500 1512 5f8 WU client executing call
{48453BAF-A7BA-4497-B534-BAAC93965981} of type Search Call
2005-08-10 00:10:09-0500 1512 5f8 WinHttpGetProxyForUrl failed with
0x80072f94. Continuing with NULL autoproxy list
2005-08-10 00:10:09-0500 1512 5f8 Loading inf file
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wusetup.inf
2005-08-10 00:10:09-0500 1512 5f8 Section name: cdm: Index: 0
2005-08-10 00:10:09-0500 1512 5f8 Section name: iuengine: Index: 1
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuapi: Index: 2
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuauclt: Index: 3
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuauclt1: Index: 4
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuaucpl: Index: 5
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuaueng_SelfUpdate: Index: 6
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuaueng1: Index: 7
2005-08-10 00:10:09-0500 1512 5f8 Section name: wucltui: Index: 8
2005-08-10 00:10:09-0500 1512 5f8 Section name: wups: Index: 9
2005-08-10 00:10:09-0500 1512 5f8 Section name: wups2: Index: 10
2005-08-10 00:10:09-0500 1512 5f8 Section name: wuweb: Index: 11
2005-08-10 00:10:09-0500 1512 5f8 Section name: winhttp: Index: 12
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\cdm.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\cdm.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\iuengine.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\iuengine.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuapi.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuapi.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuauclt.exe is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuauclt.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuauclt1.exe is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuauclt1.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuaucpl.cpl is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuaucpl.cpl:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuaueng.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuaueng.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuaueng1.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuaueng1.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wucltui.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wucltui.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wups.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wups.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wups2.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wups2.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 1512 5f8 Required Version for binary
C:\WINDOWS\system32\wuweb.dll is: 5,8,0,2339
2005-08-10 00:10:09-0500 1512 5f8 Binary: C:\WINDOWS\system32\wuweb.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-10 00:10:09-0500 3444 17c Trying to make out of proc datastore active
2005-08-10 00:10:10-0500 3444 17c Out of proc datastore is now active
2005-08-10 00:10:10-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-10 00:10:10-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-10 00:10:10-0500 1512 5f8 PT: Using server URL
http://etccantispy/SimpleAuthWebService/SimpleAuth.asmx
2005-08-10 00:10:10-0500 1512 5f8 DetectCompressionType returning type 0,
hr=0x1
2005-08-10 00:10:10-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-10 00:10:10-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-10 00:10:11-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-10 00:10:11-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-10 00:10:11-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-10 00:10:11-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-10 00:10:11-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-10 00:10:11-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-10 00:10:11-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-10 00:10:11-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-10 00:10:11-0500 1512 5f8 WU client found 0 updates and 7 categories
in search
2005-08-10 00:10:11-0500 1512 5f8 BatchFlushAge = 205.
2005-08-10 00:10:11-0500 1512 5f8 BatchFlushAgeSus = 0.
2005-08-10 00:10:11-0500 1512 5f8 SamplingValue2 = 451, sampling required = No
2005-08-10 00:10:11-0500 1512 5f8 Detection success event regulation is
disabled
2005-08-10 00:10:11-0500 1512 5f8 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-10 00:10:11-0500 1512 5f8 InitReportingComponents failed: 8024f002
2005-08-10 00:10:11-0500 1512 5f8 BatchFlushAge = 205.
2005-08-10 00:10:11-0500 1512 5f8 BatchFlushAgeSus = 0.
2005-08-10 00:10:11-0500 1512 5f8 SamplingValue2 = 451, sampling required = No
2005-08-10 00:10:11-0500 1512 5f8 Detection success event regulation is
disabled
2005-08-10 00:10:11-0500 1512 5f8 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-10 00:10:11-0500 1512 5f8 InitReportingComponents failed: 8024f002
2005-08-10 00:10:11-0500 1512 5f8 WU client finished Searching for update
2005-08-10 00:10:12-0500 1512 5f8 AU Detection callback: 0 updates detected
2005-08-10 00:10:12-0500 1512 5f8 Setting next AU detection timeout to
2005-08-10 06:03:26
2005-08-10 00:10:12-0500 1512 5f8 WU client calls back to search call
{48453BAF-A7BA-4497-B534-BAAC93965981} with code Call complete and error 0
2005-08-10 00:10:12-0500 1512 5f8 WU client completed and deleted call
{48453BAF-A7BA-4497-B534-BAAC93965981}
2005-08-10 00:15:12-0500 3444 17c Out of proc datastore is shutting down
2005-08-10 00:15:13-0500 3444 17c Out of proc datastore is now inactive

Post by JeffG
Check for and dig through the "windowsupdate.log" file (no space in
the filename) for errors and you should get some idea of what is
happening. If there is not a windowsupdate.log file, it's not getting
updates from WSUS...
HTH
JeffG
On Wed, 10 Aug 2005 11:50:50 -0700, "Unee"

Eddie Bowers [MSFT]

2005-08-10 20:43:30 UTC

Permalink

This may be an imaged machine causing it to have a duplicate SusClientId

Perform the following steps on the client workstations.

net stop wuauserv

Delete the following registry keys:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PingID

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\AccountDomainSi
d

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientId

net start wuauserv
wuauclt.exe /resetauthorization /detectnow

Eddie Bowers
Security Support
Microsoft Corporation

This posting is provided "AS IS" with no warranties, and confers no rights.

Unee

2005-08-11 14:58:02 UTC

Permalink

Thanks for your input. I've tried your suggestions on one of the clients
having this issue. Unfortunately I now get a duplication of the same results
with the same client. So now the WSUS console displays the same client twice
with the "not yet reported" status. Do you have any additional suggestions?

Post by Eddie Bowers [MSFT]
This may be an imaged machine causing it to have a duplicate SusClientId
Perform the following steps on the client workstations.
net stop wuauserv
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\PingID
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\AccountDomainSi
d
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\SusClientId
net start wuauserv
wuauclt.exe /resetauthorization /detectnow
Eddie Bowers
Security Support
Microsoft Corporation
This posting is provided "AS IS" with no warranties, and confers no rights.

Lawrence Garvin

2005-08-11 17:33:31 UTC

Permalink

Post the WindowUpdate.log so we can see what's actually happening at the
client.

Post by Unee
Thanks for your input. I've tried your suggestions on one of the clients
having this issue. Unfortunately I now get a duplication of the same results
with the same client. So now the WSUS console displays the same client twice
with the "not yet reported" status. Do you have any additional suggestions?

Unee

2005-08-11 17:48:07 UTC

Permalink

That was included earlier within this thread....

Post by Lawrence Garvin
Post the WindowUpdate.log so we can see what's actually happening at the
client.

Lawrence Garvin

2005-08-11 20:51:25 UTC

Permalink

Yes... and then it got cut out by a post that didn't include the thread in
the reply.

I'm not in the habit of scanning back through threads to look for
information that may or not be there. I saw it wasn't contained in the
current message, and it's a critical part of this diagnostic effort.

Referring back to your earlier post to obtain the WindowsUpdate.log, I see
that the detection cycle completed normally, no updates were detected to be
downloaded, and in the five minutes of log entries posted no abnormal
activity is reported, and no error messages are recorded.

First, we need to clarify the previous advice you received. The symptom of
a duplicated SusClientId value is that /some/ or /most/ of your clients
never appear in the WSUS server, or the list of computer names on the WSUS
server continually changes, but always has the same /quantity/ of systems
listed. What is actually observed by you will depend on the frequency of
your detection interval, how many client systems are involved, and how often
you "check" the WSUS Admin console, but the one constant that is symptomtic
of this issue is that the /number/ of clients reported in WSUS does not
change -- this would represent the number of /unique/ SusClientId values
contained in your entire client population. The other symptom is /normal/
reporting of update data, but the actual reported data also changes.

I don't think your issue with "Some clients status is 'Not yet reported'" is
a SusClientId value. A duplicated SusClientId does not keep a WUA from
operating normally, it just prevents the complete recording of all systems'
data in the database. What we're observing here is a bona fide malfunction
in the client-to-server communication process, manifested in the failure of
clients to report at all.

The conditions under which a client will continue to display as "Not Yet
Reported", are that the client has successfully checked in with the WSUS
server and performed a selfupdate (confirmed by the fact that your clients
are at the current version), but it has not properly reported status after
detecting, downloading, and installing updates. This status report, which
clears the "Not Yet Reported" condition, is performed either in response to
a detection, download, installation, and restart of approved updates, or at
the next scheduled detection cycle after the selfupdate of the WUA.

Jeff suggested that you should scan the WindowsUpdate.log for ERRORS. You
posted back and said you weren't sure what you were looking for, but only
included five minutes of a log file, which shows there are no updates
approved for installation.

So.... having done and said all of that....

Could you please post the segment of the WindowsUpdate.log for the time
period in which this client is believed to have detected, downloaded, and
installed updates, and that includes entries showing reporting, or attempts
to report, so that we can see what's actually happening at the client?
Specifically, we'll be looking for calls to the ReportingEventService.asmx
file in the log file.

In addition, in a separate message, please post the collection of entries
from the ReportingEvents.log file (found in %windir%\SoftwareDistribution)
for the month of August 2005 (for starters .. hopefully we'll not need to go
farther back).

Post by Unee
That was included earlier within this thread....

Post by Lawrence Garvin
Post the WindowUpdate.log so we can see what's actually happening at the
client.

Unee

2005-08-11 21:49:36 UTC

Permalink

Thanks for your help!! This client has received and installed updates from
WSUS today. I'm unable to attach all events from today's windowsupdate.log
because of text posting limitation that's why I could only post 5 minutes of
the log file in the earlier thread. I'm hoping what I provide here will
maybe include a little more infomation tahn included earlier.

2005-08-11 14:04:31-0500 1512 6f0 WU client found 0 updates and 8 categories
in search
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAge = 86.
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:04:31-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 14:04:31-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:04:31-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:04:31-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAge = 86.
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:04:31-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 14:04:31-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:04:31-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:04:31-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:04:31-0500 1512 6f0 WU client finished Searching for update
2005-08-11 14:04:31-0500 1512 6f0 AU Detection callback: 0 updates detected
2005-08-11 14:04:31-0500 1512 6f0 Setting next AU detection timeout to
2005-08-11 19:55:06
2005-08-11 14:04:31-0500 1512 6f0 WU client calls back to search call
{7CF5E3B0-2857-49FF-85BF-B771E4E0CB1B} with code Call complete and error 0
2005-08-11 14:04:31-0500 1512 6f0 WU client completed and deleted call
{7CF5E3B0-2857-49FF-85BF-B771E4E0CB1B}
2005-08-11 14:09:31-0500 224 864 Out of proc datastore is shutting down
2005-08-11 14:09:32-0500 224 864 Out of proc datastore is now inactive
2005-08-11 14:55:06-0500 1512 fa4 AU received event of type: 1
2005-08-11 14:55:06-0500 1512 fa4 WU client succeeds
CClientCallRecorder::BeginFindUpdatesEx from AutomaticUpdates with call id
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3}
2005-08-11 14:55:06-0500 1512 6f0 WU client executing call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3} of type Search Call
2005-08-11 14:55:08-0500 1512 6f0 WinHttpGetProxyForUrl failed with
0x80072f94. Continuing with NULL autoproxy list
2005-08-11 14:55:08-0500 1512 6f0 Loading inf file
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wusetup.inf
2005-08-11 14:55:08-0500 1512 6f0 Section name: cdm: Index: 0
2005-08-11 14:55:08-0500 1512 6f0 Section name: iuengine: Index: 1
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuapi: Index: 2
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuauclt: Index: 3
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuauclt1: Index: 4
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuaucpl: Index: 5
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuaueng_SelfUpdate: Index: 6
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuaueng1: Index: 7
2005-08-11 14:55:08-0500 1512 6f0 Section name: wucltui: Index: 8
2005-08-11 14:55:08-0500 1512 6f0 Section name: wups: Index: 9
2005-08-11 14:55:08-0500 1512 6f0 Section name: wups2: Index: 10
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuweb: Index: 11
2005-08-11 14:55:08-0500 1512 6f0 Section name: winhttp: Index: 12
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\cdm.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\cdm.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\iuengine.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\iuengine.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuapi.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuapi.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuauclt.exe is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuauclt.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuauclt1.exe is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuauclt1.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaucpl.cpl is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuaucpl.cpl:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaueng.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuaueng.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaueng1.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuaueng1.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wucltui.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wucltui.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wups.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wups.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wups2.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wups2.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuweb.dll is: 5,8,0,2339
2005-08-11 14:55:08-0500 1512 6f0 Binary: C:\WINDOWS\system32\wuweb.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:09-0500 3988 374 Trying to make out of proc datastore active
2005-08-11 14:55:10-0500 3988 374 Out of proc datastore is now active
2005-08-11 14:55:10-0500 1512 6f0 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:10-0500 1512 6f0 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:10-0500 1512 6f0 PT: Using server URL
http://etccantispy/SimpleAuthWebService/SimpleAuth.asmx
2005-08-11 14:55:10-0500 1512 6f0 DetectCompressionType returning type 0,
hr=0x1
2005-08-11 14:55:10-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:10-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:11-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:11-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:12-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:12-0500 1512 6f0 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:12-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:12-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 WU client add update
{06F7520C-2CF3-46AB-A457-402327016632}.100 to search result
2005-08-11 14:55:12-0500 1512 6f0 WU client found 1 updates and 8 categories
in search
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAge = 598.
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:12-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 14:55:12-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:12-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:12-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAge = 598.
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:12-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 14:55:12-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:12-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:12-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:12-0500 1512 6f0 WU client finished Searching for update
2005-08-11 14:55:12-0500 1512 6f0 AU Detection callback: 1 updates detected
2005-08-11 14:55:12-0500 1512 6f0 Setting next AU detection timeout to
2005-08-11 20:43:29
2005-08-11 14:55:12-0500 1512 5f8 WU client executing call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} of type Download Call
2005-08-11 14:55:12-0500 1512 6f0 WU client persisted 1 download calls
2005-08-11 14:55:12-0500 1512 6f0 WU client succeeds
CClientCallRecorder::BeginDownloadUpdates from AutomaticUpdates with call id
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA}
2005-08-11 14:55:12-0500 1512 6f0 Successfully created download call for
below update
2005-08-11 14:55:12-0500 1512 5f8 Dumping out update 1 of 1
2005-08-11 14:55:12-0500 1512 5f8 title = Update for Windows XP (KB894391)
2005-08-11 14:55:12-0500 1512 5f8 dumping updateId
{06F7520C-2CF3-46AB-A457-402327016632}.100 bundling 1 updates
2005-08-11 14:55:12-0500 1512 5f8 bundled update No. 1 is
{418BD412-1A4C-44B7-8C96-5515E77F8657}.100
2005-08-11 14:55:12-0500 1512 5f8 Got new download call for 1 updates at pri
2 against service 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7
2005-08-11 14:55:13-0500 1512 6f0 WU client calls back to search call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3} with code Call complete and error 0
2005-08-11 14:55:13-0500 1512 6f0 WU client completed and deleted call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3}
2005-08-11 14:55:13-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:13-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:13-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:13-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:13-0500 1512 5f8 PT: GetFileLocations: cFileDigests[in]=2;
cFileLocations[out]=0
2005-08-11 14:55:13-0500 3988 374 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 14:55:13-0500 3988 374 could not delete the default service
registration value 0x80070002
2005-08-11 14:55:13-0500 3988 374 Update Service: Failed to update backup
store
2005-08-11 14:55:13-0500 1512 5f8 CheckIfDirExists returned error 0x80070002.
2005-08-11 14:55:14-0500 1512 5f8 Calling into handler 0x2 to generate
download request for update 418BD412-1A4C-44B7-8C96-5515E77F8657.100
2005-08-11 14:55:14-0500 1512 6f0 WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call progress and error 0
2005-08-11 14:55:14-0500 1512 5f8 CheckIfDirExists returned error 0x80070002.
2005-08-11 14:55:16-0500 1512 5f8 WinHttpGetProxyForUrl failed with
0x80072f94. Continuing with NULL autoproxy list
2005-08-11 14:55:16-0500 1512 5f8 Downloading from
http://etccantispy/Content/CA/C76E693ACD51414FD7B822C71A4E7523269DCCCA.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4c2b648798502aebebccbb2c468d2c97\WindowsXP-KB894391-x86-ENU.exe (full file).
2005-08-11 14:55:26-0500 1512 fa4 AU received event of type: 1
2005-08-11 14:55:27-0500 1512 fa4 Successfully launched client for directive 3
2005-08-11 14:55:37-0500 1512 f50 Download job for update
{418BD412-1A4C-44B7-8C96-5515E77F8657}, revision 100 completed successfully.
2005-08-11 14:55:37-0500 1512 f50 Successfully downloaded file from
http://etccantispy/Content/CA/C76E693ACD51414FD7B822C71A4E7523269DCCCA.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4c2b648798502aebebccbb2c468d2c97\WindowsXP-KB894391-x86-ENU.exe.
2005-08-11 14:55:38-0500 1512 f50 Calling into handler 0x2 to generate
download request for update 418BD412-1A4C-44B7-8C96-5515E77F8657.100
2005-08-11 14:55:38-0500 1512 7fc WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call progress and error 0
2005-08-11 14:55:39-0500 1512 f50 WU client persisted 1 download calls
2005-08-11 14:55:39-0500 1512 f50 WU client persisted 1 download calls
2005-08-11 14:55:39-0500 3988 374 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 14:55:39-0500 3988 374 could not delete the default service
registration value 0x80070002
2005-08-11 14:55:39-0500 3988 374 Update Service: Failed to update backup
store
2005-08-11 14:55:39-0500 1512 f50 BatchFlushAge = 807.
2005-08-11 14:55:39-0500 1512 f50 BatchFlushAgeSus = 0.
2005-08-11 14:55:39-0500 1512 f50 SamplingValue2 = 451, sampling required = No
2005-08-11 14:55:39-0500 1512 f50 Detection success event regulation is
disabled
2005-08-11 14:55:39-0500 1512 f50 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:39-0500 1512 f50 InitReportingComponents failed: 8024f002
2005-08-11 14:55:39-0500 1512 6f0 Download complete for all calls
2005-08-11 14:55:39-0500 1512 6f0 BatchFlushAge = 459.
2005-08-11 14:55:39-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:39-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 14:55:39-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:39-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:39-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:39-0500 1512 6f0 WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call complete and error 0
2005-08-11 14:55:39-0500 1512 6f0 WU client completed and deleted call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA}
2005-08-11 14:55:39-0500 1512 6f0 WU client persisted 0 download calls
2005-08-11 15:00:39-0500 3988 374 Out of proc datastore is shutting down
2005-08-11 15:00:41-0500 3988 374 Out of proc datastore is now inactive
2005-08-11 15:34:48-0500 3872 dd0 Trying to make out of proc datastore active
2005-08-11 15:34:48-0500 3872 dd0 Out of proc datastore is now active
2005-08-11 15:39:48-0500 3872 dd0 Out of proc datastore is shutting down
2005-08-11 15:39:50-0500 3872 dd0 Out of proc datastore is now inactive
2005-08-11 15:43:29-0500 1512 fa4 AU received event of type: 1
2005-08-11 15:43:29-0500 1512 fa4 WU client succeeds
CClientCallRecorder::BeginFindUpdatesEx from AutomaticUpdates with call id
{0518C565-7D34-43AC-8D68-D549F4B3F68C}
2005-08-11 15:43:30-0500 1512 7fc WU client executing call
{0518C565-7D34-43AC-8D68-D549F4B3F68C} of type Search Call
2005-08-11 15:43:30-0500 1512 7fc Loading inf file
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wusetup.inf
2005-08-11 15:43:30-0500 1512 7fc Section name: cdm: Index: 0
2005-08-11 15:43:30-0500 1512 7fc Section name: iuengine: Index: 1
2005-08-11 15:43:30-0500 1512 7fc Section name: wuapi: Index: 2
2005-08-11 15:43:30-0500 1512 7fc Section name: wuauclt: Index: 3
2005-08-11 15:43:30-0500 1512 7fc Section name: wuauclt1: Index: 4
2005-08-11 15:43:30-0500 1512 7fc Section name: wuaucpl: Index: 5
2005-08-11 15:43:30-0500 1512 7fc Section name: wuaueng_SelfUpdate: Index: 6
2005-08-11 15:43:30-0500 1512 7fc Section name: wuaueng1: Index: 7
2005-08-11 15:43:30-0500 1512 7fc Section name: wucltui: Index: 8
2005-08-11 15:43:30-0500 1512 7fc Section name: wups: Index: 9
2005-08-11 15:43:30-0500 1512 7fc Section name: wups2: Index: 10
2005-08-11 15:43:30-0500 1512 7fc Section name: wuweb: Index: 11
2005-08-11 15:43:30-0500 1512 7fc Section name: winhttp: Index: 12
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\cdm.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\cdm.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\iuengine.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\iuengine.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuapi.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuapi.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuauclt.exe is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuauclt.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuauclt1.exe is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuauclt1.exe:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaucpl.cpl is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuaucpl.cpl:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaueng.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuaueng.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaueng1.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuaueng1.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wucltui.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wucltui.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wups.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wups.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wups2.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wups2.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuweb.dll is: 5,8,0,2339
2005-08-11 15:43:30-0500 1512 7fc Binary: C:\WINDOWS\system32\wuweb.dll:
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1368 994 Trying to make out of proc datastore active
2005-08-11 15:43:31-0500 1368 994 Out of proc datastore is now active
2005-08-11 15:43:31-0500 1512 7fc PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:31-0500 1512 7fc PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:31-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:31-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:32-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:32-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:32-0500 1512 7fc PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:32-0500 1512 7fc PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:32-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:32-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:33-0500 1512 7fc WU client add update
{5BC6E116-9964-4452-AE5A-C54BD709BC53}.100 to search result
2005-08-11 15:43:33-0500 1512 7fc WU client add update
{06F7520C-2CF3-46AB-A457-402327016632}.100 to search result
2005-08-11 15:43:33-0500 1512 7fc WU client found 2 updates and 8 categories
in search
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAge = 811.
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAgeSus = 0.
2005-08-11 15:43:33-0500 1512 7fc SamplingValue2 = 451, sampling required = No
2005-08-11 15:43:33-0500 1512 7fc Detection success event regulation is
disabled
2005-08-11 15:43:33-0500 1512 7fc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:33-0500 1512 7fc InitReportingComponents failed: 8024f002
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAge = 221.
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAgeSus = 0.
2005-08-11 15:43:33-0500 1512 7fc SamplingValue2 = 451, sampling required = No
2005-08-11 15:43:33-0500 1512 7fc Detection success event regulation is
disabled
2005-08-11 15:43:33-0500 1512 7fc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:33-0500 1512 7fc InitReportingComponents failed: 8024f002
2005-08-11 15:43:33-0500 1512 7fc WU client finished Searching for update
2005-08-11 15:43:33-0500 1512 7fc AU Detection callback: 2 updates detected
2005-08-11 15:43:33-0500 1512 7fc Setting next AU detection timeout to
2005-08-11 21:42:05
2005-08-11 15:43:33-0500 1512 7fc WU client persisted 1 download calls
2005-08-11 15:43:33-0500 1512 5f8 WU client executing call
{C81757BF-134D-4C54-9259-6BF4A95372CB} of type Download Call
2005-08-11 15:43:33-0500 1512 7fc WU client succeeds
CClientCallRecorder::BeginDownloadUpdates from AutomaticUpdates with call id
{C81757BF-134D-4C54-9259-6BF4A95372CB}
2005-08-11 15:43:33-0500 1512 7fc Successfully created download call for
below update
2005-08-11 15:43:33-0500 1512 5f8 Dumping out update 1 of 1
2005-08-11 15:43:33-0500 1512 5f8 title = Security Update for Windows XP
(KB896428)
2005-08-11 15:43:33-0500 1512 5f8 dumping updateId
{5BC6E116-9964-4452-AE5A-C54BD709BC53}.100 bundling 1 updates
2005-08-11 15:43:33-0500 1512 5f8 bundled update No. 1 is
{B79264A4-8376-49BD-866A-A181F7143753}.100
2005-08-11 15:43:33-0500 1512 5f8 Got new download call for 1 updates at pri
2 against service 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7
2005-08-11 15:43:33-0500 1512 7fc WU client calls back to search call
{0518C565-7D34-43AC-8D68-D549F4B3F68C} with code Call complete and error 0
2005-08-11 15:43:33-0500 1512 7fc WU client completed and deleted call
{0518C565-7D34-43AC-8D68-D549F4B3F68C}
2005-08-11 15:43:33-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:33-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:33-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:33-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:33-0500 1512 5f8 PT: GetFileLocations: cFileDigests[in]=2;
cFileLocations[out]=0
2005-08-11 15:43:33-0500 1368 994 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 15:43:33-0500 1368 994 could not delete the default service
registration value 0x80070002
2005-08-11 15:43:33-0500 1368 994 Update Service: Failed to update backup
store
2005-08-11 15:43:33-0500 1512 5f8 CheckIfDirExists returned error 0x80070002.
2005-08-11 15:43:34-0500 1512 5f8 Calling into handler 0x2 to generate
download request for update B79264A4-8376-49BD-866A-A181F7143753.100
2005-08-11 15:43:34-0500 1512 5f8 CheckIfDirExists returned error 0x80070002.
2005-08-11 15:43:34-0500 1512 5f8 Downloading from
http://etccantispy/Content/A0/24F66BC1E3B8107EC580BA2C53148A69DBC606A0.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\58f82c247dea6af8cfcf4740c8846627\WindowsXP-KB896428-x86-ENU.exe (full file).
2005-08-11 15:43:34-0500 1512 7fc WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call progress and error 0
2005-08-11 15:43:36-0500 1512 8cc Download job for update
{B79264A4-8376-49BD-866A-A181F7143753}, revision 100 completed successfully.
2005-08-11 15:43:36-0500 1512 8cc Successfully downloaded file from
http://etccantispy/Content/A0/24F66BC1E3B8107EC580BA2C53148A69DBC606A0.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\58f82c247dea6af8cfcf4740c8846627\WindowsXP-KB896428-x86-ENU.exe.
2005-08-11 15:43:37-0500 1512 8cc Calling into handler 0x2 to generate
download request for update B79264A4-8376-49BD-866A-A181F7143753.100
2005-08-11 15:43:37-0500 1512 5f8 WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call progress and error 0
2005-08-11 15:43:37-0500 1512 8cc WU client persisted 1 download calls
2005-08-11 15:43:37-0500 1512 8cc WU client persisted 1 download calls
2005-08-11 15:43:37-0500 1368 994 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 15:43:37-0500 1368 994 could not delete the default service
registration value 0x80070002
2005-08-11 15:43:37-0500 1368 994 Update Service: Failed to update backup
store
2005-08-11 15:43:37-0500 1512 8cc BatchFlushAge = 135.
2005-08-11 15:43:37-0500 1512 8cc BatchFlushAgeSus = 0.
2005-08-11 15:43:37-0500 1512 8cc SamplingValue2 = 451, sampling required = No
2005-08-11 15:43:37-0500 1512 8cc Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 8cc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 8cc InitReportingComponents failed: 8024f002
2005-08-11 15:43:37-0500 1512 6f0 Download complete for all calls
2005-08-11 15:43:37-0500 1512 6f0 BatchFlushAge = 627.
2005-08-11 15:43:37-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 15:43:37-0500 1512 6f0 SamplingValue2 = 451, sampling required = No
2005-08-11 15:43:37-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 15:43:37-0500 1512 6f0 WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call complete and error 0
2005-08-11 15:43:37-0500 1512 6f0 WU client completed and deleted call
{C81757BF-134D-4C54-9259-6BF4A95372CB}
2005-08-11 15:43:37-0500 1512 6f0 WU client persisted 0 download calls
2005-08-11 15:48:37-0500 1368 994 Out of proc datastore is shutting down
2005-08-11 15:48:39-0500 1368 994 Out of proc datastore is now inactive

Lawrence Garvin

2005-08-11 22:06:38 UTC

Permalink

Under normal circumstances this would have been sufficient logging, but I'm
noting a significant deficiency of reporting events or even a call to the
ReportingEventService. In fact, it looks like the WUA isn't even recording
events to the ReportingEvents.log file.

Can you please email me a zip file containing complete copies of the
following:

%windir%\WindowsUpdate.log

%windir%\SoftwareDistribution\ReportingEvents.log

and an export of the registry key at
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.

to

l a w r e n c e a t e f o r e s t d o t c o m

Post by Unee
Thanks for your help!! This client has received and installed updates from
WSUS today. I'm unable to attach all events from today's
windowsupdate.log
because of text posting limitation that's why I could only post 5 minutes of
the log file in the earlier thread. I'm hoping what I provide here will
maybe include a little more infomation tahn included earlier.
2005-08-11 14:04:31-0500 1512 6f0 WU client found 0 updates and 8
categories
in search
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAge = 86.
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:04:31-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:04:31-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:04:31-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:04:31-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAge = 86.
2005-08-11 14:04:31-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:04:31-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:04:31-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:04:31-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:04:31-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:04:31-0500 1512 6f0 WU client finished Searching for update
2005-08-11 14:04:31-0500 1512 6f0 AU Detection callback: 0 updates
detected
2005-08-11 14:04:31-0500 1512 6f0 Setting next AU detection timeout to
2005-08-11 19:55:06
2005-08-11 14:04:31-0500 1512 6f0 WU client calls back to search call
{7CF5E3B0-2857-49FF-85BF-B771E4E0CB1B} with code Call complete and error 0
2005-08-11 14:04:31-0500 1512 6f0 WU client completed and deleted call
{7CF5E3B0-2857-49FF-85BF-B771E4E0CB1B}
2005-08-11 14:09:31-0500 224 864 Out of proc datastore is shutting down
2005-08-11 14:09:32-0500 224 864 Out of proc datastore is now inactive
2005-08-11 14:55:06-0500 1512 fa4 AU received event of type: 1
2005-08-11 14:55:06-0500 1512 fa4 WU client succeeds
CClientCallRecorder::BeginFindUpdatesEx from AutomaticUpdates with call id
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3}
2005-08-11 14:55:06-0500 1512 6f0 WU client executing call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3} of type Search Call
2005-08-11 14:55:08-0500 1512 6f0 WinHttpGetProxyForUrl failed with
0x80072f94. Continuing with NULL autoproxy list
2005-08-11 14:55:08-0500 1512 6f0 Loading inf file
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wusetup.inf
2005-08-11 14:55:08-0500 1512 6f0 Section name: cdm: Index: 0
2005-08-11 14:55:08-0500 1512 6f0 Section name: iuengine: Index: 1
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuapi: Index: 2
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuauclt: Index: 3
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuauclt1: Index: 4
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuaucpl: Index: 5
6
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuaueng1: Index: 7
2005-08-11 14:55:08-0500 1512 6f0 Section name: wucltui: Index: 8
2005-08-11 14:55:08-0500 1512 6f0 Section name: wups: Index: 9
2005-08-11 14:55:08-0500 1512 6f0 Section name: wups2: Index: 10
2005-08-11 14:55:08-0500 1512 6f0 Section name: wuweb: Index: 11
2005-08-11 14:55:08-0500 1512 6f0 Section name: winhttp: Index: 12
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\cdm.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\iuengine.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuapi.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuauclt.exe is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuauclt1.exe is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaucpl.cpl is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaueng.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuaueng1.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wucltui.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wups.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wups2.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:08-0500 1512 6f0 Required Version for binary
C:\WINDOWS\system32\wuweb.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 14:55:09-0500 3988 374 Trying to make out of proc datastore
active
2005-08-11 14:55:10-0500 3988 374 Out of proc datastore is now active
2005-08-11 14:55:10-0500 1512 6f0 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:10-0500 1512 6f0 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:10-0500 1512 6f0 PT: Using server URL
http://etccantispy/SimpleAuthWebService/SimpleAuth.asmx
2005-08-11 14:55:10-0500 1512 6f0 DetectCompressionType returning type 0,
hr=0x1
2005-08-11 14:55:10-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:10-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:11-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:11-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:12-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:12-0500 1512 6f0 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:12-0500 1512 6f0 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:12-0500 1512 6f0 DetectCompressionType returning type 1,
hr=0x0
2005-08-11 14:55:12-0500 1512 6f0 WU client add update
{06F7520C-2CF3-46AB-A457-402327016632}.100 to search result
2005-08-11 14:55:12-0500 1512 6f0 WU client found 1 updates and 8
categories
in search
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAge = 598.
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:12-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:55:12-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:12-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:12-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAge = 598.
2005-08-11 14:55:12-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:12-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:55:12-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:12-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:12-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:12-0500 1512 6f0 WU client finished Searching for update
2005-08-11 14:55:12-0500 1512 6f0 AU Detection callback: 1 updates
detected
2005-08-11 14:55:12-0500 1512 6f0 Setting next AU detection timeout to
2005-08-11 20:43:29
2005-08-11 14:55:12-0500 1512 5f8 WU client executing call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} of type Download Call
2005-08-11 14:55:12-0500 1512 6f0 WU client persisted 1 download calls
2005-08-11 14:55:12-0500 1512 6f0 WU client succeeds
CClientCallRecorder::BeginDownloadUpdates from AutomaticUpdates with call id
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA}
2005-08-11 14:55:12-0500 1512 6f0 Successfully created download call for
below update
2005-08-11 14:55:12-0500 1512 5f8 Dumping out update 1 of 1
2005-08-11 14:55:12-0500 1512 5f8 title = Update for Windows XP (KB894391)
2005-08-11 14:55:12-0500 1512 5f8 dumping updateId
{06F7520C-2CF3-46AB-A457-402327016632}.100 bundling 1 updates
2005-08-11 14:55:12-0500 1512 5f8 bundled update No. 1 is
{418BD412-1A4C-44B7-8C96-5515E77F8657}.100
2005-08-11 14:55:12-0500 1512 5f8 Got new download call for 1 updates at
pri
2 against service 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7
2005-08-11 14:55:13-0500 1512 6f0 WU client calls back to search call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3} with code Call complete and error 0
2005-08-11 14:55:13-0500 1512 6f0 WU client completed and deleted call
{3A6CCEFB-1A92-4DC8-ABFE-C65CE93DADA3}
2005-08-11 14:55:13-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 14:55:13-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 14:55:13-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-11 14:55:13-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
cFileDigests[in]=2;
cFileLocations[out]=0
2005-08-11 14:55:13-0500 3988 374 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 14:55:13-0500 3988 374 could not delete the default service
registration value 0x80070002
2005-08-11 14:55:13-0500 3988 374 Update Service: Failed to update backup
store
2005-08-11 14:55:13-0500 1512 5f8 CheckIfDirExists returned error
0x80070002.
2005-08-11 14:55:14-0500 1512 5f8 Calling into handler 0x2 to generate
download request for update 418BD412-1A4C-44B7-8C96-5515E77F8657.100
2005-08-11 14:55:14-0500 1512 6f0 WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call progress and error 0
2005-08-11 14:55:14-0500 1512 5f8 CheckIfDirExists returned error
0x80070002.
2005-08-11 14:55:16-0500 1512 5f8 WinHttpGetProxyForUrl failed with
0x80072f94. Continuing with NULL autoproxy list
2005-08-11 14:55:16-0500 1512 5f8 Downloading from
http://etccantispy/Content/CA/C76E693ACD51414FD7B822C71A4E7523269DCCCA.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4c2b648798502aebebccbb2c468d2c97\WindowsXP-KB894391-x86-ENU.exe
(full file).
2005-08-11 14:55:26-0500 1512 fa4 AU received event of type: 1
2005-08-11 14:55:27-0500 1512 fa4 Successfully launched client for
directive 3
2005-08-11 14:55:37-0500 1512 f50 Download job for update
{418BD412-1A4C-44B7-8C96-5515E77F8657}, revision 100 completed
successfully.
2005-08-11 14:55:37-0500 1512 f50 Successfully downloaded file from
http://etccantispy/Content/CA/C76E693ACD51414FD7B822C71A4E7523269DCCCA.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\4c2b648798502aebebccbb2c468d2c97\WindowsXP-KB894391-x86-ENU.exe.
2005-08-11 14:55:38-0500 1512 f50 Calling into handler 0x2 to generate
download request for update 418BD412-1A4C-44B7-8C96-5515E77F8657.100
2005-08-11 14:55:38-0500 1512 7fc WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call progress and error 0
2005-08-11 14:55:39-0500 1512 f50 WU client persisted 1 download calls
2005-08-11 14:55:39-0500 1512 f50 WU client persisted 1 download calls
2005-08-11 14:55:39-0500 3988 374 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 14:55:39-0500 3988 374 could not delete the default service
registration value 0x80070002
2005-08-11 14:55:39-0500 3988 374 Update Service: Failed to update backup
store
2005-08-11 14:55:39-0500 1512 f50 BatchFlushAge = 807.
2005-08-11 14:55:39-0500 1512 f50 BatchFlushAgeSus = 0.
2005-08-11 14:55:39-0500 1512 f50 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:55:39-0500 1512 f50 Detection success event regulation is
disabled
2005-08-11 14:55:39-0500 1512 f50 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:39-0500 1512 f50 InitReportingComponents failed: 8024f002
2005-08-11 14:55:39-0500 1512 6f0 Download complete for all calls
2005-08-11 14:55:39-0500 1512 6f0 BatchFlushAge = 459.
2005-08-11 14:55:39-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 14:55:39-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 14:55:39-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 14:55:39-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 14:55:39-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 14:55:39-0500 1512 6f0 WU client calls back to download call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA} with code Call complete and error 0
2005-08-11 14:55:39-0500 1512 6f0 WU client completed and deleted call
{C15A4F4E-7B58-4BBF-9736-7B6966A249CA}
2005-08-11 14:55:39-0500 1512 6f0 WU client persisted 0 download calls
2005-08-11 15:00:39-0500 3988 374 Out of proc datastore is shutting down
2005-08-11 15:00:41-0500 3988 374 Out of proc datastore is now inactive
2005-08-11 15:34:48-0500 3872 dd0 Trying to make out of proc datastore
active
2005-08-11 15:34:48-0500 3872 dd0 Out of proc datastore is now active
2005-08-11 15:39:48-0500 3872 dd0 Out of proc datastore is shutting down
2005-08-11 15:39:50-0500 3872 dd0 Out of proc datastore is now inactive
2005-08-11 15:43:29-0500 1512 fa4 AU received event of type: 1
2005-08-11 15:43:29-0500 1512 fa4 WU client succeeds
CClientCallRecorder::BeginFindUpdatesEx from AutomaticUpdates with call id
{0518C565-7D34-43AC-8D68-D549F4B3F68C}
2005-08-11 15:43:30-0500 1512 7fc WU client executing call
{0518C565-7D34-43AC-8D68-D549F4B3F68C} of type Search Call
2005-08-11 15:43:30-0500 1512 7fc Loading inf file
C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wusetup.inf
2005-08-11 15:43:30-0500 1512 7fc Section name: cdm: Index: 0
2005-08-11 15:43:30-0500 1512 7fc Section name: iuengine: Index: 1
2005-08-11 15:43:30-0500 1512 7fc Section name: wuapi: Index: 2
2005-08-11 15:43:30-0500 1512 7fc Section name: wuauclt: Index: 3
2005-08-11 15:43:30-0500 1512 7fc Section name: wuauclt1: Index: 4
2005-08-11 15:43:30-0500 1512 7fc Section name: wuaucpl: Index: 5
6
2005-08-11 15:43:30-0500 1512 7fc Section name: wuaueng1: Index: 7
2005-08-11 15:43:30-0500 1512 7fc Section name: wucltui: Index: 8
2005-08-11 15:43:30-0500 1512 7fc Section name: wups: Index: 9
2005-08-11 15:43:30-0500 1512 7fc Section name: wups2: Index: 10
2005-08-11 15:43:30-0500 1512 7fc Section name: wuweb: Index: 11
2005-08-11 15:43:30-0500 1512 7fc Section name: winhttp: Index: 12
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\cdm.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\iuengine.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuapi.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuauclt.exe is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuauclt1.exe is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaucpl.cpl is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaueng.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuaueng1.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wucltui.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wups.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wups2.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1512 7fc Required Version for binary
C:\WINDOWS\system32\wuweb.dll is: 5,8,0,2339
Target version: 5.8.0.2339 Required: 5.8.0.2339
2005-08-11 15:43:30-0500 1368 994 Trying to make out of proc datastore
active
2005-08-11 15:43:31-0500 1368 994 Out of proc datastore is now active
2005-08-11 15:43:31-0500 1512 7fc PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:31-0500 1512 7fc PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:31-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:31-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:32-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:32-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:32-0500 1512 7fc PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:32-0500 1512 7fc PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:32-0500 1512 7fc Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:32-0500 1512 7fc DetectCompressionType returning type 1,
hr=0x0
2005-08-11 15:43:33-0500 1512 7fc WU client add update
{5BC6E116-9964-4452-AE5A-C54BD709BC53}.100 to search result
2005-08-11 15:43:33-0500 1512 7fc WU client add update
{06F7520C-2CF3-46AB-A457-402327016632}.100 to search result
2005-08-11 15:43:33-0500 1512 7fc WU client found 2 updates and 8
categories
in search
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAge = 811.
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAgeSus = 0.
2005-08-11 15:43:33-0500 1512 7fc SamplingValue2 = 451, sampling required
= No
2005-08-11 15:43:33-0500 1512 7fc Detection success event regulation is
disabled
2005-08-11 15:43:33-0500 1512 7fc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:33-0500 1512 7fc InitReportingComponents failed: 8024f002
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAge = 221.
2005-08-11 15:43:33-0500 1512 7fc BatchFlushAgeSus = 0.
2005-08-11 15:43:33-0500 1512 7fc SamplingValue2 = 451, sampling required
= No
2005-08-11 15:43:33-0500 1512 7fc Detection success event regulation is
disabled
2005-08-11 15:43:33-0500 1512 7fc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:33-0500 1512 7fc InitReportingComponents failed: 8024f002
2005-08-11 15:43:33-0500 1512 7fc WU client finished Searching for update
2005-08-11 15:43:33-0500 1512 7fc AU Detection callback: 2 updates
detected
2005-08-11 15:43:33-0500 1512 7fc Setting next AU detection timeout to
2005-08-11 21:42:05
2005-08-11 15:43:33-0500 1512 7fc WU client persisted 1 download calls
2005-08-11 15:43:33-0500 1512 5f8 WU client executing call
{C81757BF-134D-4C54-9259-6BF4A95372CB} of type Download Call
2005-08-11 15:43:33-0500 1512 7fc WU client succeeds
CClientCallRecorder::BeginDownloadUpdates from AutomaticUpdates with call id
{C81757BF-134D-4C54-9259-6BF4A95372CB}
2005-08-11 15:43:33-0500 1512 7fc Successfully created download call for
below update
2005-08-11 15:43:33-0500 1512 5f8 Dumping out update 1 of 1
2005-08-11 15:43:33-0500 1512 5f8 title = Security Update for Windows XP
(KB896428)
2005-08-11 15:43:33-0500 1512 5f8 dumping updateId
{5BC6E116-9964-4452-AE5A-C54BD709BC53}.100 bundling 1 updates
2005-08-11 15:43:33-0500 1512 5f8 bundled update No. 1 is
{B79264A4-8376-49BD-866A-A181F7143753}.100
2005-08-11 15:43:33-0500 1512 5f8 Got new download call for 1 updates at
pri
2 against service 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7
2005-08-11 15:43:33-0500 1512 7fc WU client calls back to search call
{0518C565-7D34-43AC-8D68-D549F4B3F68C} with code Call complete and error 0
2005-08-11 15:43:33-0500 1512 7fc WU client completed and deleted call
{0518C565-7D34-43AC-8D68-D549F4B3F68C}
2005-08-11 15:43:33-0500 1512 5f8 PT: Using serverID
{3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}
2005-08-11 15:43:33-0500 1512 5f8 PT: Using server URL
http://etccantispy/ClientWebService/client.asmx
2005-08-11 15:43:33-0500 1512 5f8 Add header for accept-encoding: xpress
succeeded
2005-08-11 15:43:33-0500 1512 5f8 DetectCompressionType returning type 1,
hr=0x0
cFileDigests[in]=2;
cFileLocations[out]=0
2005-08-11 15:43:33-0500 1368 994 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 15:43:33-0500 1368 994 could not delete the default service
registration value 0x80070002
2005-08-11 15:43:33-0500 1368 994 Update Service: Failed to update backup
store
2005-08-11 15:43:33-0500 1512 5f8 CheckIfDirExists returned error
0x80070002.
2005-08-11 15:43:34-0500 1512 5f8 Calling into handler 0x2 to generate
download request for update B79264A4-8376-49BD-866A-A181F7143753.100
2005-08-11 15:43:34-0500 1512 5f8 CheckIfDirExists returned error
0x80070002.
2005-08-11 15:43:34-0500 1512 5f8 Downloading from
http://etccantispy/Content/A0/24F66BC1E3B8107EC580BA2C53148A69DBC606A0.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\58f82c247dea6af8cfcf4740c8846627\WindowsXP-KB896428-x86-ENU.exe
(full file).
2005-08-11 15:43:34-0500 1512 7fc WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call progress and error 0
2005-08-11 15:43:36-0500 1512 8cc Download job for update
{B79264A4-8376-49BD-866A-A181F7143753}, revision 100 completed
successfully.
2005-08-11 15:43:36-0500 1512 8cc Successfully downloaded file from
http://etccantispy/Content/A0/24F66BC1E3B8107EC580BA2C53148A69DBC606A0.exe to
C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\58f82c247dea6af8cfcf4740c8846627\WindowsXP-KB896428-x86-ENU.exe.
2005-08-11 15:43:37-0500 1512 8cc Calling into handler 0x2 to generate
download request for update B79264A4-8376-49BD-866A-A181F7143753.100
2005-08-11 15:43:37-0500 1512 5f8 WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call progress and error 0
2005-08-11 15:43:37-0500 1512 8cc WU client persisted 1 download calls
2005-08-11 15:43:37-0500 1512 8cc WU client persisted 1 download calls
2005-08-11 15:43:37-0500 1368 994 Update service props: default for AU is
9482F4B4-E343-43B6-B170-9A65BC822C77
2005-08-11 15:43:37-0500 1368 994 could not delete the default service
registration value 0x80070002
2005-08-11 15:43:37-0500 1368 994 Update Service: Failed to update backup
store
2005-08-11 15:43:37-0500 1512 8cc BatchFlushAge = 135.
2005-08-11 15:43:37-0500 1512 8cc BatchFlushAgeSus = 0.
2005-08-11 15:43:37-0500 1512 8cc SamplingValue2 = 451, sampling required
= No
2005-08-11 15:43:37-0500 1512 8cc Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 8cc CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 8cc InitReportingComponents failed: 8024f002
2005-08-11 15:43:37-0500 1512 6f0 Download complete for all calls
2005-08-11 15:43:37-0500 1512 6f0 BatchFlushAge = 627.
2005-08-11 15:43:37-0500 1512 6f0 BatchFlushAgeSus = 0.
2005-08-11 15:43:37-0500 1512 6f0 SamplingValue2 = 451, sampling required
= No
2005-08-11 15:43:37-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 6f0 InitReportingComponents failed: 8024f002
2005-08-11 15:43:37-0500 1512 6f0 WU client calls back to download call
{C81757BF-134D-4C54-9259-6BF4A95372CB} with code Call complete and error 0
2005-08-11 15:43:37-0500 1512 6f0 WU client completed and deleted call
{C81757BF-134D-4C54-9259-6BF4A95372CB}
2005-08-11 15:43:37-0500 1512 6f0 WU client persisted 0 download calls
2005-08-11 15:48:37-0500 1368 994 Out of proc datastore is shutting down
2005-08-11 15:48:39-0500 1368 994 Out of proc datastore is now inactive

Unee

2005-08-12 14:15:03 UTC

Permalink

I have emailed the files you've requested. Thanks!!

Post by Lawrence Garvin
Under normal circumstances this would have been sufficient logging, but I'm
noting a significant deficiency of reporting events or even a call to the
ReportingEventService. In fact, it looks like the WUA isn't even recording
events to the ReportingEvents.log file.
Can you please email me a zip file containing complete copies of the
%windir%\WindowsUpdate.log
%windir%\SoftwareDistribution\ReportingEvents.log
and an export of the registry key at
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.
to
l a w r e n c e a t e f o r e s t d o t c o m

Lawrence Garvin

2005-08-15 13:51:16 UTC

Permalink

I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Unee

2005-08-15 14:09:07 UTC

Permalink

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Lawrence Garvin

2005-08-15 14:56:09 UTC

Permalink

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Post by Lawrence Garvin
Under normal circumstances this would have been sufficient logging,
but
I'm
noting a significant deficiency of reporting events or even a call to the
ReportingEventService. In fact, it looks like the WUA isn't even recording
events to the ReportingEvents.log file.
Can you please email me a zip file containing complete copies of the
%windir%\WindowsUpdate.log
%windir%\SoftwareDistribution\ReportingEvents.log
and an export of the registry key at
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.
to
l a w r e n c e a t e f o r e s t d o t c o m

Lawrence Garvin

2005-08-15 15:28:15 UTC

Permalink

I apologize..... I just scrolled down the whole thread and realized I
entered the wrong domain name.... I have /no/ idea why I made that error....

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Post by Lawrence Garvin
Under normal circumstances this would have been sufficient logging,
but
I'm
noting a significant deficiency of reporting events or even a call to the
ReportingEventService. In fact, it looks like the WUA isn't even recording
events to the ReportingEvents.log file.
Can you please email me a zip file containing complete copies of the
%windir%\WindowsUpdate.log
%windir%\SoftwareDistribution\ReportingEvents.log
and an export of the registry key at
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.
to
l a w r e n c e a t e f o r e s t d o t c o m

Unee

2005-08-15 18:36:52 UTC

Permalink

Lawrence I have tried multiple times to email these files to you. I'll assume

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Unee

2005-08-15 21:37:26 UTC

Permalink

I will forward to the .net email address...

Post by Unee
Lawrence I have tried multiple times to email these files to you. I'll assume

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Lawrence Garvin

2005-08-15 22:12:12 UTC

Permalink

You would need to remove the "nospam" subdomain marker from the swbell.net
email address.

The eforest.com is my mistake, as I gave it to you incorrectly. the correct
domain is eforest.net.

Either address will work, but I see that I have received the files at the
eforest.net address. I'll take a look at them this evening.

Post by Unee
Lawrence I have tried multiple times to email these files to you. I'll assume

Post by Lawrence Garvin
I did not receive the files. If you'd like to try again, I'll be happy to
look at them.

Post by Unee
I have emailed the files you've requested. Thanks!!

Post by Lawrence Garvin
Under normal circumstances this would have been sufficient logging,
but
I'm
noting a significant deficiency of reporting events or even a call to the
ReportingEventService. In fact, it looks like the WUA isn't even recording
events to the ReportingEvents.log file.
Can you please email me a zip file containing complete copies of the
%windir%\WindowsUpdate.log
%windir%\SoftwareDistribution\ReportingEvents.log
and an export of the registry key at
HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.
to
l a w r e n c e a t e f o r e s t d o t c o m

Lawrence Garvin

2005-08-16 13:15:17 UTC

Permalink

I've confirmed that you're not getting reporting from the client due to a
fault at the client.

But I've never seen the fault before, so I don't have specific details on
how to fix it.

The error is logged in the WindowsUpdate.log as follows:
2005-08-11 15:43:37-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 6f0 InitReportingComponents failed: 8024f002

The WindowsUpdateAgent has something seriously corrupted. It is not logging
events to the ReportingEvents.log, and it's not making any calls to the
ReportingWebService.asmx web service on the WSUS server.

I would suggest the following things (but understand these are just
ideas.... )

(1) Download the WindowsUpdateAgent20-x86.exe package and install this using
the /force switch to ensure you have the latest, and all, components of the
WUA installed. Then force a detection and see if events are added to the
ReportingEvents.log file and/or calls to ReportingWebService.asmx appear in
the WindowsUpdate.log file.

If not....
(2) Shutdown the Automatic Update service.
Create a temp directory C:\wuatemp
Move the following files into the temp directory:
%windir%\SoftwareDistribution\DataStore\Datastore.edb
%windir%\SoftwareDistribution\DataStore\Logs\edb*.*
%windir%\SoftwareDistribution\ReportingEvents.log
%windir%\WindowsUpdate.log

Remove all files and folders from the
%windir%\SoftwareDistribution\Download folder
Remove all files from the %windir%\SoftwareDistribution\EventCache
folder

Restart the Automatic Updates service
Force a detection with 'wuauclt /detectnow' if one does not
automatically initiate within 3 minutes.

Post by Unee
I have emailed the files you've requested. Thanks!!

Unee

2005-08-16 14:39:14 UTC

Permalink

Thanks for all your help!! I'll give what you've suggested a try...

Post by Lawrence Garvin
I've confirmed that you're not getting reporting from the client due to a
fault at the client.
But I've never seen the fault before, so I don't have specific details on
how to fix it.
2005-08-11 15:43:37-0500 1512 6f0 Detection success event regulation is
disabled
2005-08-11 15:43:37-0500 1512 6f0 CEventNamespaceDefinition::Init failed =
8024f002.
2005-08-11 15:43:37-0500 1512 6f0 InitReportingComponents failed: 8024f002
The WindowsUpdateAgent has something seriously corrupted. It is not logging
events to the ReportingEvents.log, and it's not making any calls to the
ReportingWebService.asmx web service on the WSUS server.
I would suggest the following things (but understand these are just
ideas.... )
(1) Download the WindowsUpdateAgent20-x86.exe package and install this using
the /force switch to ensure you have the latest, and all, components of the
WUA installed. Then force a detection and see if events are added to the
ReportingEvents.log file and/or calls to ReportingWebService.asmx appear in
the WindowsUpdate.log file.
If not....
(2) Shutdown the Automatic Update service.
Create a temp directory C:\wuatemp
%windir%\SoftwareDistribution\DataStore\Datastore.edb
%windir%\SoftwareDistribution\DataStore\Logs\edb*.*
%windir%\SoftwareDistribution\ReportingEvents.log
%windir%\WindowsUpdate.log
Remove all files and folders from the
%windir%\SoftwareDistribution\Download folder
Remove all files from the %windir%\SoftwareDistribution\EventCache
folder
Restart the Automatic Updates service
Force a detection with 'wuauclt /detectnow' if one does not
automatically initiate within 3 minutes.

Post by Unee
I have emailed the files you've requested. Thanks!!