geekmungus

Reset WSUS ClientBeen working on WSUS and have setup a WSUS server. However started to get a problem whereby the computers were appearing on WSUS and reporting their status then disappearing. I noticed that they were disappearing and being replaced by another computer.

It turns out that when a machine is ghosted and then sysprep’ed it doesnt reset the WSUS id, which is a unique ID that WSUS uses to track the computer. So i’ve been able to come up with a script that can be run manually or via a script (GPO) on startup to reset this ID and make it talk properly to WSUS. Note this also sorted problems with Virtual Machines that have been cloned too.

Set oShell = CreateObject(”WScript.Shell”)

sRegKey = “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate”
pRegKey = “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections”

‘ suppress error in case values does not exist
On Error Resume Next

‘ check for marker
sIDDeleted = oShell.RegRead( sRegKey & “\IDDeleted”)

‘ to be sure values is only deleted once, test on marker
If sIDDeleted <> “yes” Then

‘ delete any WinHttpSettings registry entry (interferes with WSUS)
oshell.RegDelete pRegKey & “\WinHttpSettings”

‘ delete values
oShell.RegDelete sRegKey & “\AccountDomainSid”
oShell.RegDelete sRegKey & “\PingID”
oShell.RegDelete sRegKey & “\SusClientId”

‘ Stop and start the Automatic updates service
oShell.Run “%SystemRoot%\system32\net.exe stop wuauserv”, 0, True
oShell.Run “%SystemRoot%\system32\net.exe start wuauserv”, 0, True

‘ Run wuauclt.exe with resetauthorization
sCmd = “%SystemRoot%\system32\wuauclt.exe /resetauthorization /detectnow”
oShell.Run sCmd, 0, True

‘ create marker
oShell.RegWrite sRegKey & “\IDDeleted”, “yes”

End If

Note: this should be copied and saved as a .vbs file. I’ve also attached it as a file to this post, needs to be renamed though!

Reset WSUS Client Script

This is what would be needed in your hosts configuration to monitor using check_icmp rather than check_ping.

define service{
use                     generic-service ; Inherit values from a template
host_name               SWITCH    ; The name of the host the service is associated with
service_description     PING            ; The service description
check_command           check_icmp!40.0,10%!100.0,40%  ; The command used to monitor the service
normal_check_interval   5               ; Check the service every 5 minutes under normal conditions
retry_check_interval    1               ; Re-check the service every minute until its final/hard state is determined
}

This is what would be needed in the commands.cfg

# ‘check-host-alive’ command definition
define command{
command_name    check_icmp
command_line    $USER1$/check_icmp -H $HOSTADDRESS$ -w $ARG1$ -c $ARG2$ -p 2
}

This makes the assumption its going to do two pings, otherwise turn “-p 2″ into $ARG3$ instead!

I have the following problem when trying to install nsclient++ onto a Windows 2003 Server SP2 (note this is a member server).

Using a local administrator account on the server trying to install the install completes but the service does not get registered trying to manually register gives this error:

C:\Program Files\NSClient++>nsclient++ -install e NSClient++.cpp(212) Service installation failed: Unable to install service.5: Access is denied.
RESOLUTION

I ran “FileMon” tool from SysInternals which installing the service, and found access denied errors. But permissions where not the problem. It turned out that Sophos Anti-Virus thought the “Nsclient++.exe” was a virus. Once I authorised the nsclient++.exe file in Sophos the service could install and run fine.