Announcement

Collapse
No announcement yet.

Nobody can install windows updates

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Nobody can install windows updates

    Like the Title says nobody can install winodws updates. Thats not entirely true. I can if I log in with my user id but I'm domain admin but thats the only user id that can. I think this is a group policy issue but I'm not sure because I have not found it yet. I dont even use group policy that much in our domain. I have checked the default policies and see nothing that would do this. If I wanted to could I delete/remove all policies in effect and start fresh with new ones and see if that fixes the problems. If thats an option whats the best way of doing this?

    Thanks,
    Chris

  • #2
    Re: Nobody can install windows updates

    How many PCs do you have in your domain? WSUS may be a good way to go.
    1 1 was a racehorse.
    2 2 was 1 2.
    1 1 1 1 race 1 day,
    2 2 1 1 2

    Comment


    • #3
      Re: Nobody can install windows updates

      Check your event logs and more importantly, check the file %systemroot%\WindowsUpdate.log. This log file contains verbose information on the Windows Update process whether you're using the Windows Update website, WSUS, or SUS. The log file should point you in the right direction as far as what is failing and why.

      Note that for Windows Update to work properly, the following services need to be configured as shown:
      Automatic Updates = Automatic Startup
      Background Intelligent Transfer Service (BITS) = Manual Startup

      I don't suspect your services are the problem since Administrators can install updates. If either of the above services were disabled, Administrators would not be able to install updates.

      Another suggestion: Enable system auditing for all failure events, as well as file system auditing (ie on C:\ ) for all failure events. After users fail to install updates, check the Security Event Log for failure events.

      Jas
      Last edited by jasonboche; 27th May 2006, 16:38.
      VCDX3 #34, VCDX4, VCDX5, VCAP4-DCA #14, VCAP4-DCD #35, VCAP5-DCD, VCPx4, vEXPERTx4, MCSEx3, MCSAx2, MCP, CCAx2, A+
      boche.net - VMware Virtualization Evangelist
      My advice has no warranties. Follow at your own risk.

      Comment


      • #4
        Re: Nobody can install windows updates

        Originally posted by biggles77
        How many PCs do you have in your domain? WSUS may be a good way to go.

        There is about 30 - 35 pc's in the Domain all running XP. WUS is what I was thinking of doing as soon as I can figure out whats stopping the installation of the updates. I forgot to mention earlier that not only am I the domain admin the only one who can get a successfull install but you cant even do it if your logged in a local admin on the box. It works fine if I take the box out of the domain but once its in Im screwed again.

        Cheers,
        Chris

        Comment


        • #5
          Re: Nobody can install windows updates

          Originally posted by jasonboche
          Check your event logs and more importantly, check the file %systemroot%\WindowsUpdate.log. This log file contains verbose information on the Windows Update process whether you're using the Windows Update website, WSUS, or SUS. The log file should point you in the right direction as far as what is failing and why.

          Note that for Windows Update to work properly, the following services need to be configured as shown:
          Automatic Updates = Automatic Startup
          Background Intelligent Transfer Service (BITS) = Manual Startup

          I don't suspect your services are the problem since Administrators can install updates. If either of the above services were disabled, Administrators would not be able to install updates.

          Another suggestion: Enable system auditing for all failure events, as well as file system auditing (ie on C:\ ) for all failure events. After users fail to install updates, check the Security Event Log for failure events.

          Jas
          Are you saying to log into all the boxes and check their event logs?
          I forgot to mention earlier that not only am I the domain admin the only one who can get a successfull install but you cant even do it if your logged in a local admin on the box. It works fine if I take the box out of the domain but once its in Im screwed again.

          Cheers,
          Chris

          Comment


          • #6
            Re: Nobody can install windows updates

            Originally posted by cholubaz
            Are you saying to log into all the boxes and check their event logs?
            Each machine will have its own log file. But.... start with one machine and work the problem out with that one.

            There's an extremely high probability that whatever is wrong with one machine is the same problem that is impacting all machines, assuming your machines are configured consistently. Apply the fix for the first machine to the remaining machines and chances are you've licked it. Use GPOs where possible to automate things.

            Jas
            VCDX3 #34, VCDX4, VCDX5, VCAP4-DCA #14, VCAP4-DCD #35, VCAP5-DCD, VCPx4, vEXPERTx4, MCSEx3, MCSAx2, MCP, CCAx2, A+
            boche.net - VMware Virtualization Evangelist
            My advice has no warranties. Follow at your own risk.

            Comment


            • #7
              Re: Nobody can install windows updates

              Assuming you don't have an Update Error, look in C:\windows\windowsupdate.log for any errors (as well as the Event Viewer) on one machine as Jason suggests, you could also try changing the users permissions in the Windows Update key in the registry to Full Control FOR THAT KEY ONLY. User should then be able to manually update through IE.

              See bottom of the attached image for the key location.

              WindowsUpdate

              Install WSUS asap.
              Last edited by biggles77; 28th May 2006, 17:15.
              1 1 was a racehorse.
              2 2 was 1 2.
              1 1 1 1 race 1 day,
              2 2 1 1 2

              Comment

              Working...
              X