SUS Querey

Mossess

I have SUS running, but it appears that the client has to be at the very least a local Admin for the updates to deploy.

My key settings seem ok, I think?
Anyone got any ideas?

Key Name: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Class Name: <NO CLASS>
Last Write Time: 7/21/2004 - 1:57 PM
Value 0
Name: NoAutoUpdate
Type: REG_DWORD
Data: 0x0

Value 1
Name: AUOptions
Type: REG_DWORD
Data: 0x4

Value 2
Name: NoAutoRebootWithLoggedOnUsers
Type: REG_DWORD
Data: 0x1

Value 3
Name: RescheduleWaitTime
Type: REG_DWORD
Data: 0x1

Value 4
Name: ScheduledInstallDay
Type: REG_DWORD
Data: 0x0

Value 5
Name: ScheduledInstallTime
Type: REG_DWORD
Data: 0x4

Value 6
Name: UseWUServer
Type: REG_DWORD
Data: 0x1

Capt'n Midnight

This is a working Reg file to compare with
- run on local pc as Admin once then updates at 3am
I prefer to use IP rather than name so no DNS/WINS worries.

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate]
"WUServer"="http://192.168.x.y/&quot;
"WUStatusServer"="http://192.168.x.y/&quot;

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU]
"RescheduleWaitTime"=dword:0000003B
"NoAutoRebootWithLoggedOnUsers"=dword:00000001
"NoAutoUpdate"=dword:00000000
"AUOptions"=dword:00000004
"ScheduledInstallDay"=dword:00000000
"ScheduledInstallTime"=dword:00000003
"UseWUServer"=dword:00000001

Mossess

Is there any way to get it to run without being an Admin?

Capt'n Midnight

An admin needs to click on the reg file once - after that it autoupdates if the services are running. - You can even use AT / PSEXEC & REG.EXE to do remote admin additions to the reg so you don't even to go to the PC. But you do need to have admin rights since you're making changes to the OS.

Mossess

I have the changes made as an admin. Everything seems OK. I log out, check back at different intervels to see if the updates have taken effect, nothing. Then if I log back in as an Admin, after 5 minutes it pops up saying updates are ready to be installed. Very strange.
I'm beging to think I might have to splash out on something like LanGuard?

de8o

from what I understand of AUOption when it is set to 4.

If an admin logs in the balloon will appear, or as one of my workmates likes to call it, the microsoft sick parrott appears.

However if a non-admin is logged in they won't get the sick parrott and the install will happen at the scheduled time.

a good site to check is
SUSSERVER.COM

Mossess

Been checking that site, can't see what I'm doing wrong. I've run Microsoft Baseline Security Analyzer against the PC before applying registry update, then after. Then 12 hours after, then over 24 hours after. No changes. If a Sys admin logs in however it goes ahead.

de8o

Is the machine logged in at 4 am? Try changing this to something like 17 or something more suitable. Restart services or reboot.

Capt'n Midnight

Don't forget you need to have service packs installed for it to work
2000 Sp3 / XP Sp1

If not then download the Client from..
www.microsoft.com/windowsserversystem/sus/default.mspx

Mossess

Some are on, some are off, I'm thinking that either way after reboot it should, in theory, start the downloads. They are fairly well Serviced packed as it is. nothing below SP4. I've got it on about 90 to 100 pc's so I'm lost at this stage.

I think it might be time to bite the bullet and spend a grand on LANGuard!

Capt'n Midnight

Copy the patch to the PC and the remote execute it using various options.
The painfull bit of this is that microsoft were fond of using different syntax on earlier patches.

[php]net view | Find "\\">List
for /F "delims=\ " %%i in (list) do call Patch.bat %%i[/php]

REM Patch.bat
psinfo \\%1 -h >

REM to apply reg settings 
psexec \\%1 cmd /c reg.exe import Patch.reg

psexec -i -c \\%1 Windows2000-KB835732-x86-ENU.EXE /passive /p
psexec -i -c \\%1 WindowsNT4Workstation-KB835732-x86-ENU.EXE -m -z

REM to apply XP SP2 
xcopy xpsp2.exe \\%1\c$\*.* /D /Y
soon \\192.168.10.%1 65 /interactive c:\xpsp2.exe /passive /O /F

shutdown \\%1 /R /Y /C /t:99