Fix client machines not appearing in WSUS Console

Depending on your imaging method some clients may not show up on your WSUS console, and refuse to check for updates. Since starting my new job I’ve seen this occur on machines which have been imaged with a non-sysprepped image. I quickly whipped up a script to reset some settings and forcing the machine to contact your WSUS server and retrieve a new Client Id and thus show up in your console.

Dim objShell, strKeyPath, strValueName,strComputer

set objShell = wscript.createObject("wscript.shell")

const HKEY_LOCAL_MACHINE = &H80000002

strComputer = "."

Set objWMIService = GetObject("winmgmts:\\" & strComputer & "\root\cimv2")
Set objRegistry = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")

strKeyPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate"
strValueName = "SUSClientIdReset"


objRegistry.GetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, dwValue
IF (dwValue = "1") Then
            'do nothing
      Else
            objRegistry.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"SusClientId"
            objRegistry.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,"SusClientIdValidation"

   Set colServiceList = objWMIService.ExecQuery ("Select * from Win32_Service where Name = 'wuauserv'")

   For Each objService in colServiceList
     If objService.State = "Running" Then
     objService.StopService()
     Wscript.Sleep 10000
     objService.StartService()
     End If
   Next
        objShell.Run("wuauclt /resetauthorization /detectnow ")
   	Wscript.Sleep 10000   
        objShell.Run("wuauclt /r /reportnow")

        'Set reg value for SUSClientIdReset for checking against later.
   	dwValue = "1"
        objRegistry.SetStringValue HKEY_LOCAL_MACHINE, strKeyPath, strValueName, dwValue
End If

Run that on the effected machine with Admin Rights and the client will eventually appear in your WSUS Console.

As for the cause, the master image was joined to the domain and tested. During that time received group policy settings which included WSUS and contacted the server settings it’s clientId.

Hope that helps.

Configuring SharePoint 2007 to accept blocked file types

One of my clients using SharePoint 2007 were uploading some files to their site recently and got the following error:

The following file(s) have been blocked by the administrator

By going through Central Administration, I was able to unblock the file and allow them to upload the particular file to the library they were wanting uploading to. After opening up Central Admin, Click on the Operations Tab and look at the Security Configuration Section. Under it you will see Blocked File types (Forth Down), click on it. This by default selects your default site, if required change this. You will now have a large list showing all of the blocked file extensions, allowing you to add and remove them from the list.

In this case we wanted to allow MSI files so they could deploy a setup file through SharePoint as a storage point should users need to re-install. Remove the offending file type and click OK which takes you back to the operations page.

Simple as that, now going back into your SharePoint site, you can see that the file type has now been allowed and can be uploaded to the libraries you are using under the site it was enabled for.

Check to see if your KMS can be contacted

Sometimes when deploying computers in our organisation, they don’t see our KMS server and automatically activate (even though they are told to do so via our unattend.xml). 9 times out of 10 it’s the client itself having issues just talking to your KMS server. To check and see if you can contact it, you can perform a DNS lookup for the KMS Host. Open a command prompt window and type in the following:

nslookup -type=srv _vlmcs._tcp.<FQDN>

replacing the <fqdn> with your fully qualified domain name. It will look up the DNS record which the Software Licensing service checks to contact a KMS host. From here you can try and ping the machine using the above DNS entry.

You can also use some other commands on the KMS host to ensure that it is working correctly and accepting clients and activating them. Opening an elevated command prompt window on your host machine you can use the following:

slmgr /dli
slmgr /dlv

These two commands will show you detailed information about your KMS host machine such as the number of failed/successful activations as well as client counts.

BackupExec unable to read or write to the Database

Today when checking one of the servers I manage, I got an error when opening up the BackupExec 12.5 management console. The error was “Unable to read or write to the Database” which I found a bit puzzling. I checked to make sure SQL Server which hosted the BE database was running, and it was.

After having a quick look in the Application Event Log, I found an error relating to the issue I was experiencing. Event ID: 33152.  Thankfully the fix for this error is quite simple.

Open up the Backup Exec Services Manager and click on Stop All Services. Now open up the SQL Server Configuration Manager and restart the instance of SQL Server hosting your Backup Exec database. Once it restarts, return to the Backup Exec Services Manager and click on Start All Services to start them all up again. Once they’re up, open the management console.  If all went well it should now log you in successfully and show you the current status of your server.

Letting Exchange accept Mail from other domains

One of the usual things I perform as an IT Consultant is maintenance and configuration tasks on Exchange. One of the most requested tasks is accepting e-mail for more than one domain. Most of my clients run Windows SBS Server 2008 which comes with Exchange 2007. In this article I will walk through accepting mail from other domains.

Firstly, open up the management console, expand Organization Configuration, click on Hub Transport and finally select the Accepted Domains tab. Now under the Actions for Hub Transport click New Accepted Domain…

The New Accepted Domain window now pops up. Configure it with your new domain.  The domain must be yours and  its MX record configured to point to your exchange server. After you enter your domain, there are three options to tell exchange how to handle mail. Authoritative Domain tells the exchange server to accept ALL e-mail for this domain, if a user doesn’t exist then an NDR is generated and sent to the sender. The Internal and External relay options are handy, if you have multiple domains with multiple exchange servers, you can choose the Internal Relay option, which will look for other exchange servers under the forest for your entire organisation.

The third option is the External Relay. This is useful for those domains which you don’t ‘own’.  A prime example are franchise companies. Which may have one e-mail for a particular store or location, allowing you to send and receive for that domain to users not on your exchange server.

And That’s it. Simply ensure that the domain’s MX Record is pointing to your server, or if you are using the SBS POP3 Connector this will now properly process e-mails for that particular domain.