Hi Lawrence,
Thank you for your reply. Please be patient with me - I am having trouble
trying to understand why WSUS 'just worked' on one SBS 2003 Premium Edition
SP1, ISA 2004 and does not work another virtually identical server (the one
in question). Also please assume my skills in this area are modest. Please
see my responses embedded in your post:
Cheers,
Bill
Post by Lawrence Garvin (MVP)Post by Bill GliddenGiven that this WSUS is installed on a SBS 2003 server which is also an
OWA server does the SSL issue apply in my situation?
This is extremely critical information, and it would have been helpful if
you'd included it in the original post.
I did - my orginal post was in the sbs newsgroup and kj crossposted to this
one and then Athif picked it up. So not all of the information exists in
both newsgoups. Sorry if this has caused confusion.
Post by Lawrence Garvin (MVP)Post by Bill Glidden'403' errors are caused by proxy servers and firewalls blocking access to
the requested resource, usually as a result of a deny rule, or the
absence of an allow rule.
I have checked the ISA 2004 access rules on both servers and they are
vitually identical - both have a SBS Microsoft Update Sites Access Rule
which allow access from all protected networks to Microsoft Error reporting
and System Policy Allowed Sites. There are no explicit rules on either
server allowing access to the WSUS site. One works the other does not.
Post by Lawrence Garvin (MVP)Then, I'm going to point you to the report from the CDT about your proxy
Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy
w2ksvr1:8080
User IE ProxyByPass
<local>
User IE AutoConfig URL Proxy
http://w2ksvr1:8080/array.dll?Get.Routing.Script
User IE AutoDetect
AutoDetect in use
1. You're using AutoDetect. WinHTTP doesn't pick up autodetect settings.
I have since disabled AutoDetect and still get the same error:
VerifyWUServerURL() failed with hr=0x80072ee5
Post by Lawrence Garvin (MVP)2. The output is quite plain that WinHTTP is not using a proxy server at
all.
I don't understand your point here.
Here is the output from a PC attached to the working SBS2003/WSUS server
mentioned above:
WSUS Client Diagnostics Tool
Checking Machine State
Checking for admin rights to run tool . . . . . . . . . PASS
Automatic Updates Service is running. . . . . . . . . . PASS
Background Intelligent Transfer Service is running. . . PASS
Wuaueng.dll version 5.8.0.2469. . . . . . . . . . . . . PASS
This version is WSUS 2.0
Checking AU Settings
AU Option is 4: Scheduled Install . . . . . . . . . . . PASS
Option is from Policy settings
Checking Proxy Configuration
Checking for winhttp local machine Proxy settings . . . PASS
Winhttp local machine access type
<Direct Connection>
Winhttp local machine Proxy. . . . . . . . . . NONE
Winhttp local machine ProxyBypass. . . . . . . NONE
Checking User IE Proxy settings . . . . . . . . . . . . PASS
User IE Proxy
GLIDDEN-SBS2K3:8080
User IE ProxyByPass
<local>
User IE AutoConfig URL Proxy
http://GLIDDEN-SBS2K3:8080/array.dll?Get.Routing.Script
User IE AutoDetect
AutoDetect in use
Checking Connection to WSUS/SUS Server
WUServer = http://glidden-sbs2k3:8530
WUStatusServer = http://glidden-sbs2k3:8530
UseWuServer is enabled. . . . . . . . . . . . . . . . . PASS
Connection to server. . . . . . . . . . . . . . . . . . PASS
SelfUpdate folder is present. . . . . . . . . . . . . . PASS
Press Enter to Complete
Post by Lawrence Garvin (MVP)3. The proxy server you have your client directed to /IS/ the same machine
as the WSUS server, which, you tell us in another post is the SBS2003
server!
(a) Why do you have IE configured to talk to the proxy server on the
SBS2003 system?
Do you mean IE on the SBS2003 server itself? If so, it is not - only on the
client PCs which is the way SBS configures clients' IE by default. It does
not stop WSUS from working on the other system mentioned above.
Post by Lawrence Garvin (MVP)(b) If WinHTTP is not talking to that proxy server, are you sure it can
get to the WSUS service otherwise?
I'm getting more confused here. I know I can open http://w2ksvr1/wsusadmin
from any client PC. Is this what you mean?
Post by Lawrence Garvin (MVP)(c) You cannot 'clone' the IE settings to WinHTTP, because of the proxy
URL, which WinHTTP will not be able to deal with (assuming you need the
proxy).
Sorry. I don't know what you mean.
Post by Lawrence Garvin (MVP)(d) I'm guessing, because of the use of the proxy, that you're still
running ISA2000 on this SBS2003 system. (If so, any reason you've not
applied SP1 and upgraded to ISA2004?) (If I'm wrong in my assumption, then
just ignore this note. I'm merely making a semi-educated guess.)
As mentioned above and in previous posts I am running SP1 and ISA 2004.
Post by Lawrence Garvin (MVP)By definition, the SBS2003 server running ISA cannot talk to any external
device unless first a rule is created to permit the "Local Host" to
communicate with that external device.
Also, unless you've configured sufficient rules to permit the SBS2003 to
talk to its own WSUS server without going through the proxy, you'll need
to use the proxycfg.exe utility to properly configure the WinHTTP proxy
client.
I certainly did not have to do this on virtually identical SBS2003 server
mentioned above. See why I am tearing my hair?
Post by Lawrence Garvin (MVP)Finally, your error has changed. Now the CDT is giving you a '2ee5' error
which is an invalid URL error.
Post by Bill GliddenChecking Connection to WSUS/SUS Server
WUServer = http://w2ksvr1:8530
WUStatusServer = http://w2ksvr1:8530
The URL certainly looks valid -- which brings us back to the proxy server.
Does the /proxy/ server consider this as a valid URL?
The 'invalid URL' has always been the error where clientdiags bails. I'm
sure if I could find out why this happens, this thing could work. How do I
check whether the /proxy/ considers this vaild or not?
Post by Lawrence Garvin (MVP)--
Lawrence Garvin, M.S., MVP-Software Distribution
Everything you need for WSUS is at
http://technet2.microsoft.com/windowsserver/en/technologies/featured/wsus/default.mspx
And, eveything else is at
http://wsusinfo.onsitechsolutions.com
...