I have a working SCE environment, with about 150 clients. And 3 clients (laptops) have installed non approved updates, I think by connecting directly to the MS servers. I looked in the event logs and I can see the 2 updates, being installed. (Internet Explorer 8 for Windows XP and KB890830). Neither of these is set to approve and no other client installed them. On one client I checked the windowsupdate.log for the time around when this happened and I will put it below to see if anyone can see what went wrong. Basically Im wounding if there is something that if the client cant connect to the WSUS server set via GP for too long will it set itself back to the MS Update server? Or is there some setting I need to set to stop this? This is the first time this has ever happened in about 3 years with this setup running. *********************** 2009-06-09 07:30:45:000 1244 1fc AU Forced install timer expired for scheduled install 2009-06-09 07:30:45:000 1244 1fc AU UpdateDownloadProperties: 1 download(s) are still in progress. 2009-06-09 07:30:45:000 1244 1fc AU WARNING: Failed to change download properties of call, error = 0x80070057 2009-06-09 07:30:45:000 1244 1fc AU Setting AU scheduled install time to 2009-06-10 01:00:00 2009-06-09 07:30:45:000 1244 1fc AU AU deferring detection until wake-up from hibernation 2009-06-09 07:30:45:000 1244 1304 DnldMgr *********** DnldMgr: Regulation Refresh [Svc: {9482F4B4-E343-43B6-B170-9A65BC822C77}] *********** 2009-06-09 07:30:45:000 1244 1304 DnldMgr Contacting regulation server for 1 updates. 2009-06-09 07:30:45:015 1244 1304 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab: 2009-06-09 07:30:45:031 1244 1304 Misc Microsoft signed: Yes 2009-06-09 07:30:45:046 1244 1304 DnldMgr Regulation server path: http://update.microsoft.com/v6/UpdateRegulationService/UpdateRegulation.asmx. 2009-06-09 07:30:45:859 1244 1fc AU Triggering Online detection (non-interactive) 2009-06-09 07:30:55:750 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:30:55:750 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:30:55:750 1244 1304 DnldMgr FATAL: Failed to contact the server with 0x8024402c. 2009-06-09 07:30:55:750 1244 1304 PT + Last proxy send request failed with hr = 0x80072EE7, HTTP status code = 0 2009-06-09 07:30:55:750 1244 1304 PT + Caller provided credentials = No 2009-06-09 07:30:55:750 1244 1304 PT + Impersonate flags = 0 2009-06-09 07:30:55:750 1244 1304 PT + Possible authorization schemes used = 2009-06-09 07:30:55:750 1244 1304 PT WARNING: GetUpdateDownloadInformation failure, error = 0x8024402C, soap client error = 5, soap error code = 0, HTTP status code = 200 2009-06-09 07:30:57:750 1244 1304 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab: 2009-06-09 07:30:57:750 1244 1304 Misc Microsoft signed: Yes 2009-06-09 07:30:57:765 1244 1304 DnldMgr Regulation server path: http://update.microsoft.com/v6/UpdateRegulationService/UpdateRegulation.asmx. 2009-06-09 07:31:16:562 1244 1fc AU ############# 2009-06-09 07:31:16:562 1244 1fc AU ## START ## AU: Search for updates 2009-06-09 07:31:16:562 1244 1fc AU ######### 2009-06-09 07:31:16:562 1244 1fc AU <<## SUBMITTED ## AU: Search for updates [CallId = {6E2108E6-3F31-4D9B-9E0F-97387783A178}] 2009-06-09 07:31:28:515 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:28:515 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:28:515 1244 1304 DnldMgr FATAL: Failed to contact the server with 0x8024402c. 2009-06-09 07:31:28:515 1244 1304 PT + Last proxy send request failed with hr = 0x80072EE7, HTTP status code = 0 2009-06-09 07:31:28:515 1244 1304 PT + Caller provided credentials = No 2009-06-09 07:31:28:515 1244 1304 PT + Impersonate flags = 0 2009-06-09 07:31:28:515 1244 1304 PT + Possible authorization schemes used = 2009-06-09 07:31:28:515 1244 1304 PT WARNING: GetUpdateDownloadInformation failure, error = 0x8024402C, soap client error = 5, soap error code = 0, HTTP status code = 200 2009-06-09 07:31:30:515 1244 1304 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\wuredir.cab: 2009-06-09 07:31:30:531 1244 1304 Misc Microsoft signed: Yes 2009-06-09 07:31:30:531 1244 1304 DnldMgr Regulation server path: http://update.microsoft.com/v6/UpdateRegulationService/UpdateRegulation.asmx. 2009-06-09 07:31:30:578 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:30:578 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:30:578 1244 1304 DnldMgr FATAL: Failed to contact the server with 0x8024402c. 2009-06-09 07:31:30:578 1244 1304 PT + Last proxy send request failed with hr = 0x80072EE7, HTTP status code = 0 2009-06-09 07:31:30:578 1244 1304 PT + Caller provided credentials = No 2009-06-09 07:31:30:578 1244 1304 PT + Impersonate flags = 0 2009-06-09 07:31:30:578 1244 1304 PT + Possible authorization schemes used = 2009-06-09 07:31:30:578 1244 1304 PT WARNING: GetUpdateDownloadInformation failure, error = 0x8024402C, soap client error = 5, soap error code = 0, HTTP status code = 200 2009-06-09 07:31:30:578 1244 1304 DnldMgr WARNING: Server call failed, using default regulation. 2009-06-09 07:31:30:578 1244 1304 DnldMgr * Regulation call complete. 0x8024402c 2009-06-09 07:31:30:578 1244 1304 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 07:31:30:578 1244 1304 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 07:31:30:593 1244 1304 Agent ************* 2009-06-09 07:31:30:593 1244 1304 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates] 2009-06-09 07:31:30:593 1244 1304 Agent ********* 2009-06-09 07:31:30:593 1244 1304 Agent * Online = Yes; Ignore download priority = No 2009-06-09 07:31:30:593 1244 1304 Agent * Criteria = "IsHidden=0 and IsInstalled=0 and DeploymentAction='Installation' and IsAssigned=1 or IsHidden=0 and IsPresent=1 and DeploymentAction='Uninstallation' and IsAssigned=1 or IsHidden=0 and IsInstalled=1 and DeploymentAction='Installation' and IsAssigned=1 and RebootRequired=1 or IsHidden=0 and IsInstalled=0 and DeploymentAction='Uninstallation' and IsAssigned=1 and RebootRequired=1" 2009-06-09 07:31:30:593 1244 1304 Agent * ServiceID = {9482F4B4-E343-43B6-B170-9A65BC822C77} 2009-06-09 07:31:30:593 1244 1304 Agent * Search Scope = {Machine} 2009-06-09 07:31:30:593 1244 1304 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\Default\wuident.cab: 2009-06-09 07:31:30:593 1244 1304 Misc Microsoft signed: Yes 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <https://ses.domain.local:8531/selfupdate/wuident.cab>. error 0x8024402c 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x8024402c 2009-06-09 07:31:30:640 1244 1304 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x8024402c 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <https://ses.domain.local:8531/selfupdate/wuident.cab>. error 0x8024402c 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x8024402c 2009-06-09 07:31:30:671 1244 1304 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x8024402c 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <https://ses.domain.local:8531/selfupdate/wuident.cab>. error 0x8024402c 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x8024402c 2009-06-09 07:31:30:703 1244 1304 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: Send failed with hr = 80072ee7. 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: SendRequest failed with hr = 80072ee7. Proxy List used: <(null)> Bypass List used : <(null)> Auth Schemes used : <> 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: WinHttp: SendRequestUsingProxy failed for <https://ses.domain.local:8531/selfupdate/wuident.cab>. error 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation MakeRequest failed. error 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: WinHttp: SendRequestToServerForFileInformation failed with 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: WinHttp: ShouldFileBeDownloaded failed with 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Misc WARNING: DownloadFileInternal failed for https://ses.domain.local:8531/selfupdate/wuident.cab: error 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Setup FATAL: IsUpdateRequired failed with error 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Setup WARNING: SelfUpdate: Default Service: IsUpdateRequired failed: 0x8024402c 2009-06-09 07:31:30:734 1244 1304 Setup WARNING: SelfUpdate: Default Service: IsUpdateRequired failed, error = 0x8024402C 2009-06-09 07:31:30:734 1244 1304 Agent * WARNING: Skipping scan, self-update check returned 0x8024402C 2009-06-09 07:31:30:734 1244 1304 Agent * WARNING: Exit code = 0x8024402C 2009-06-09 07:31:30:734 1244 1304 Agent ********* 2009-06-09 07:31:30:734 1244 1304 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates] 2009-06-09 07:31:30:734 1244 1304 Agent ************* 2009-06-09 07:31:30:734 1244 1304 Agent WARNING: WU client failed Searching for update with error 0x8024402c 2009-06-09 07:31:30:734 1244 9cc AU >>## RESUMED ## AU: Search for updates [CallId = {6E2108E6-3F31-4D9B-9E0F-97387783A178}] 2009-06-09 07:31:30:734 1244 9cc AU # WARNING: Search callback failed, result = 0x8024402C 2009-06-09 07:31:30:734 1244 9cc AU # WARNING: Failed to find updates with error code 8024402C 2009-06-09 07:31:30:734 1244 9cc AU ######### 2009-06-09 07:31:30:734 1244 9cc AU ## END ## AU: Search for updates [CallId = {6E2108E6-3F31-4D9B-9E0F-97387783A178}] 2009-06-09 07:31:30:734 1244 9cc AU ############# 2009-06-09 07:31:30:734 1244 9cc AU AU setting next detection timeout to 2009-06-09 17:31:30 2009-06-09 07:31:30:734 1244 9cc AU Setting AU scheduled install time to 2009-06-10 01:00:00 2009-06-09 07:31:33:468 1244 1304 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 07:31:33:468 1244 1304 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:07:00:562 1244 9e8 AU AU received install approval from client for 2 updates 2009-06-09 08:07:00:562 1244 9e8 AU ############# 2009-06-09 08:07:00:562 1244 9e8 AU ## START ## AU: Install updates 2009-06-09 08:07:00:562 1244 9e8 AU ######### 2009-06-09 08:07:00:562 1244 9e8 AU # Initiating manual install 2009-06-09 08:07:00:562 1244 9e8 AU # Approved updates = 2 2009-06-09 08:07:00:578 1244 9e8 AU <<## SUBMITTED ## AU: Install updates / installing updates [CallId = {ED662807-0020-45CB-8408-2FE39F473772}] 2009-06-09 08:07:00:578 1244 c60 Agent ************* 2009-06-09 08:07:00:578 1244 c60 Agent ** START ** Agent: Installing updates [CallerId = AutomaticUpdates] 2009-06-09 08:07:00:578 1244 c60 Agent ********* 2009-06-09 08:07:00:578 1244 c60 Agent * Updates to install = 2 2009-06-09 08:07:00:578 1244 c60 Agent * Title = Windows Malicious Software Removal Tool - May 2009 (KB890830) 2009-06-09 08:07:00:578 1244 c60 Agent * UpdateId = {F14A9C2A-00B4-4CB0-AE59-301548EB7B84}.100 2009-06-09 08:07:00:578 1244 c60 Agent * Bundles 1 updates: 2009-06-09 08:07:00:593 1244 c60 Agent * {72EC66D5-413B-49F9-ADF5-44C8408FBC2B}.100 2009-06-09 08:07:00:593 1244 c60 Agent * Title = Internet Explorer 8 for Windows XP 2009-06-09 08:07:00:593 1244 c60 Agent * UpdateId = {FE76BC49-1BAC-470A-8007-C6D87207E0BE}.103 2009-06-09 08:07:00:593 1244 c60 Agent * Bundles 1 updates: 2009-06-09 08:07:00:625 1244 c60 Handler Attempting to create remote handler process as DOMAIN\Dave in session 0 2009-06-09 08:07:00:859 1244 c60 DnldMgr Preparing update for install, updateId = {72EC66D5-413B-49F9-ADF5-44C8408FBC2B}.100. 2009-06-09 08:07:01:234 6008 1250 Misc =========== Logging initialized (build: 7.2.6001.788, tz: -0800) =========== 2009-06-09 08:07:01:234 6008 1250 Misc = Process: C:\WINDOWS\system32\wuauclt.exe 2009-06-09 08:07:01:234 6008 1250 Misc = Module: C:\WINDOWS\system32\wuaueng.dll 2009-06-09 08:07:01:234 6008 1250 Handler ::::::::::::: 2009-06-09 08:07:01:234 6008 1250 Handler :: START :: Handler: Command Line Install 2009-06-09 08:07:01:234 6008 1250 Handler ::::::::: 2009-06-09 08:07:01:234 6008 1250 Handler : Updates to install = 1 2009-06-09 08:10:23:656 6008 1250 Handler : Command line install completed. Return code = 0x00000000, Result = Succeeded, Reboot required = false 2009-06-09 08:10:23:656 6008 1250 Handler ::::::::: 2009-06-09 08:10:23:656 6008 1250 Handler :: END :: Handler: Command Line Install 2009-06-09 08:10:23:656 6008 1250 Handler ::::::::::::: 2009-06-09 08:10:23:671 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:10:23:671 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:10:23:671 1244 c60 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:10:23:671 1244 c60 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:10:23:671 1244 f3c AU >>## RESUMED ## AU: Installing update [UpdateId = {F14A9C2A-00B4-4CB0-AE59-301548EB7B84}, succeeded] 2009-06-09 08:10:23:812 1244 c60 DnldMgr Preparing update for install, updateId = {8E38CE36-9FA2-4BCD-A64A-FB30C3F6C3DE}.103. 2009-06-09 08:10:24:531 6008 280 Handler ::::::::::::: 2009-06-09 08:10:24:531 6008 280 Handler :: START :: Handler: Command Line Install 2009-06-09 08:10:24:531 6008 280 Handler ::::::::: 2009-06-09 08:10:24:531 6008 280 Handler : Updates to install = 1 2009-06-09 08:10:28:671 1244 df8 Report REPORT EVENT: {01422973-BAB0-436D-9E3D-F1A109FC13F8} 2009-06-09 08:10:23:671-0800 1 183 101 {F14A9C2A-00B4-4CB0-AE59-301548EB7B84} 100 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Windows Malicious Software Removal Tool - May 2009 (KB890830) 2009-06-09 08:10:55:843 4980 1234 Misc =========== Logging initialized (build: 7.2.6001.788, tz: -0800) =========== 2009-06-09 08:10:55:843 4980 1234 Misc = Process: d:\9bea45121117d7c5bfac8a63\update\iesetup.exe 2009-06-09 08:10:55:843 4980 1234 Misc = Module: C:\WINDOWS\system32\wuapi.dll 2009-06-09 08:10:55:843 4980 1234 COMAPI ------------- 2009-06-09 08:10:55:843 4980 1234 COMAPI -- START -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:10:55:843 4980 1234 COMAPI --------- 2009-06-09 08:10:55:859 1244 df8 Agent ************* 2009-06-09 08:10:55:859 1244 df8 Agent ** START ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:10:55:859 1244 df8 Agent ********* 2009-06-09 08:10:55:859 1244 df8 Agent * Online = Yes; Ignore download priority = No 2009-06-09 08:10:55:859 1244 df8 Agent * Criteria = "IsInstalled=0 and Type='Software' and CategoryIDs contains '5312e4f1-6372-442d-aeb2-15f2132c9bd7'" 2009-06-09 08:10:55:859 1244 df8 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} 2009-06-09 08:10:55:859 4980 1234 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:10:55:859 1244 df8 Agent * Search Scope = {Machine} 2009-06-09 08:10:56:015 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:10:56:031 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:10:56:640 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:10:56:656 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:10:56:671 1244 df8 PT +++++++++++ PT: Starting category scan +++++++++++ 2009-06-09 08:10:56:671 1244 df8 PT + ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx 2009-06-09 08:11:19:921 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:11:19:937 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:11:20:046 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:11:20:062 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:11:20:062 1244 df8 PT +++++++++++ PT: Synchronizing server updates +++++++++++ 2009-06-09 08:11:20:062 1244 df8 PT + ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx 2009-06-09 08:11:21:906 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:11:21:921 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:11:22:046 1244 df8 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\WuRedir\9482F4B4-E343-43B6-B170-9A65BC822C77\muv3wuredir.cab: 2009-06-09 08:11:22:046 1244 df8 Misc Microsoft signed: Yes 2009-06-09 08:11:22:062 1244 df8 PT +++++++++++ PT: Synchronizing extended update info +++++++++++ 2009-06-09 08:11:22:062 1244 df8 PT + ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77}, Server URL = https://update.microsoft.com/v6/ClientWebService/client.asmx 2009-06-09 08:11:22:468 1244 df8 Agent * Added update {CAF80F85-2FED-4907-BE2B-72FAFF0BF808}.100 to search result 2009-06-09 08:11:22:468 1244 df8 Agent * Found 1 updates and 4 categories in search; evaluated appl. rules of 46 out of 53 deployed entities 2009-06-09 08:11:22:468 1244 df8 Agent ********* 2009-06-09 08:11:22:468 1244 df8 Agent ** END ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:468 1244 df8 Agent ************* 2009-06-09 08:11:22:484 4980 944 COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:484 4980 944 COMAPI - Updates found = 1 2009-06-09 08:11:22:484 4980 944 COMAPI --------- 2009-06-09 08:11:22:484 4980 944 COMAPI -- END -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:484 4980 944 COMAPI ------------- 2009-06-09 08:11:22:859 4980 1234 COMAPI ------------- 2009-06-09 08:11:22:859 4980 1234 COMAPI -- START -- COMAPI: Download [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:859 4980 1234 COMAPI --------- 2009-06-09 08:11:22:859 4980 1234 COMAPI - Forced: No; Download priority: 3 2009-06-09 08:11:22:859 4980 1234 COMAPI - Updates in request: 1 2009-06-09 08:11:22:859 4980 1234 COMAPI - ServiceID = {9482F4B4-E343-43B6-B170-9A65BC822C77} 2009-06-09 08:11:22:875 4980 1234 COMAPI <<-- SUBMITTED -- COMAPI: Download [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:875 1244 df8 DnldMgr ************* 2009-06-09 08:11:22:875 1244 df8 DnldMgr ** START ** DnldMgr: Downloading updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:22:875 1244 df8 DnldMgr ********* 2009-06-09 08:11:22:875 1244 df8 DnldMgr * Call ID = {62990FC7-7EA9-4719-A912-50A0F3DA1075} 2009-06-09 08:11:22:875 1244 df8 DnldMgr * Priority = 3, Interactive = 1, Owner is system = 0, Explicit proxy = 1, Proxy session id = -1, ServiceId = {9482F4B4-E343-43B6-B170-9A65BC822C77} 2009-06-09 08:11:22:875 1244 df8 DnldMgr * Updates to download = 1 2009-06-09 08:11:22:875 1244 df8 Agent * Title = Update for Internet Explorer 8 Dynamic Installer Compatibility View List for Windows XP (KB971180) 2009-06-09 08:11:22:875 1244 df8 Agent * UpdateId = {CAF80F85-2FED-4907-BE2B-72FAFF0BF808}.100 2009-06-09 08:11:22:875 1244 df8 Agent * Bundles 1 updates: 2009-06-09 08:11:22:875 1244 df8 Agent * {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100 2009-06-09 08:11:23:015 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:23:015 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:23:015 1244 df8 DnldMgr *********** DnldMgr: New download job [UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100] *********** 2009-06-09 08:11:23:015 1244 df8 DnldMgr * Queueing update for download handler request generation. 2009-06-09 08:11:23:015 1244 df8 DnldMgr Generating download request for update {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100 2009-06-09 08:11:23:125 1244 df8 Handler Windows Patch download for UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}: selected action is download full-file. 2009-06-09 08:11:23:125 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:23:125 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:23:125 1244 df8 DnldMgr *********** DnldMgr: New download job [UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100] *********** 2009-06-09 08:11:23:265 1244 df8 DnldMgr * BITS job initialized, JobId = {E738C099-F864-484B-B60B-98D60F88AF44} 2009-06-09 08:11:23:390 1244 df8 DnldMgr * Downloading from http://download.windowsupdate.com/msdownload/update/software/updt/2009/05/ie8-windowsxp-kb971180-x86-enu_93d0bf4a5366367b866c840ca8ff0143f5bf90ab.exe to C:\WINDOWS\SoftwareDistribution\Download\4cc8ba6ca78a5000b34c3522c5721cab\IE8-WindowsXP-KB971180-x86-ENU.exe (full file). 2009-06-09 08:11:23:484 1244 df8 Agent ********* 2009-06-09 08:11:23:484 1244 df8 Agent ** END ** Agent: Downloading updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:23:484 1244 df8 Agent ************* 2009-06-09 08:11:27:468 1244 df8 Report REPORT EVENT: {25BCDCD0-7AE2-4E15-98BF-6075F54437EF} 2009-06-09 08:11:22:468-0800 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 Windows Internet Explorer 8 Set Success Software Synchronization Windows Update Client successfully detected 1 updates. 2009-06-09 08:11:30:468 1244 175c DnldMgr BITS job {E738C099-F864-484B-B60B-98D60F88AF44} completed successfully 2009-06-09 08:11:30:703 1244 175c Misc Validating signature for C:\WINDOWS\SoftwareDistribution\Download\4cc8ba6ca78a5000b34c3522c5721cab\IE8-WindowsXP-KB971180-x86-ENU.exe: 2009-06-09 08:11:30:734 1244 175c Misc Microsoft signed: Yes 2009-06-09 08:11:30:734 1244 175c DnldMgr Download job bytes total = 0, bytes transferred = 512368 2009-06-09 08:11:30:734 1244 175c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:30:734 1244 175c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:30:734 1244 175c DnldMgr *********** DnldMgr: New download job [UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100] *********** 2009-06-09 08:11:30:734 1244 175c DnldMgr * Queueing update for download handler request generation. 2009-06-09 08:11:30:734 1244 175c DnldMgr Generating download request for update {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100 2009-06-09 08:11:31:078 1244 175c Handler Windows Patch download for UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}: selected action is download full-file. 2009-06-09 08:11:31:515 1244 175c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:31:515 1244 175c DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:11:31:515 1244 175c DnldMgr *********** DnldMgr: New download job [UpdateId = {C9CC6351-C1A3-4834-B540-27DC190CDD18}.100] *********** 2009-06-09 08:11:31:515 1244 175c DnldMgr * All files for update were already downloaded and are valid. 2009-06-09 08:11:31:531 4980 944 COMAPI >>-- RESUMED -- COMAPI: Download [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:31:531 4980 944 COMAPI - Download call complete (succeeded = 1, succeeded with errors = 0, failed = 0, unaccounted = 0) 2009-06-09 08:11:31:531 4980 944 COMAPI --------- 2009-06-09 08:11:31:531 4980 944 COMAPI -- END -- COMAPI: Download [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:31:531 4980 944 COMAPI ------------- 2009-06-09 08:11:32:765 4980 1234 COMAPI ------------- 2009-06-09 08:11:32:765 4980 1234 COMAPI -- START -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:765 4980 1234 COMAPI --------- 2009-06-09 08:11:32:781 1244 df8 Agent ************* 2009-06-09 08:11:32:781 1244 df8 Agent ** START ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:781 1244 df8 Agent ********* 2009-06-09 08:11:32:781 1244 df8 Agent * Online = No; Ignore download priority = No 2009-06-09 08:11:32:781 1244 df8 Agent * Criteria = "IsInstalled=0 and Type='Software' and CategoryIDs contains '5312e4f1-6372-442d-aeb2-15f2132c9bd7'" 2009-06-09 08:11:32:781 1244 df8 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} 2009-06-09 08:11:32:781 1244 df8 Agent * Search Scope = {Machine} 2009-06-09 08:11:32:781 4980 1234 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:968 1244 df8 Agent * Found 0 updates and 3 categories in search; evaluated appl. rules of 14 out of 23 deployed entities 2009-06-09 08:11:32:968 1244 df8 Agent ********* 2009-06-09 08:11:32:968 1244 df8 Agent ** END ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:968 1244 df8 Agent ************* 2009-06-09 08:11:32:984 4980 944 COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:984 4980 944 COMAPI - Updates found = 0 2009-06-09 08:11:32:984 4980 944 COMAPI --------- 2009-06-09 08:11:32:984 4980 944 COMAPI -- END -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:11:32:984 4980 944 COMAPI ------------- 2009-06-09 08:11:36:515 1244 df8 Report REPORT EVENT: {85C69226-9D34-4210-B680-4F0244262ABE} 2009-06-09 08:11:31:515-0800 1 162 101 {CAF80F85-2FED-4907-BE2B-72FAFF0BF808} 100 0 Windows Internet Explorer 8 Set Success Content Download Download succeeded. 2009-06-09 08:18:23:375 4980 1234 COMAPI ------------- 2009-06-09 08:18:23:375 4980 1234 COMAPI -- START -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:23:375 4980 1234 COMAPI --------- 2009-06-09 08:18:23:390 1244 df8 Agent ************* 2009-06-09 08:18:23:390 1244 df8 Agent ** START ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:23:390 1244 df8 Agent ********* 2009-06-09 08:18:23:390 1244 df8 Agent * Online = No; Ignore download priority = No 2009-06-09 08:18:23:390 1244 df8 Agent * Criteria = "IsInstalled=0 and Type='Software' and CategoryIDs contains '5312e4f1-6372-442d-aeb2-15f2132c9bd7'" 2009-06-09 08:18:23:390 4980 1234 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:23:390 1244 df8 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} 2009-06-09 08:18:23:390 1244 df8 Agent * Search Scope = {Machine} 2009-06-09 08:18:24:437 1244 df8 Agent * Added update {CAF80F85-2FED-4907-BE2B-72FAFF0BF808}.100 to search result 2009-06-09 08:18:24:437 1244 df8 Agent * Found 1 updates and 4 categories in search; evaluated appl. rules of 14 out of 23 deployed entities 2009-06-09 08:18:24:453 1244 df8 Agent ********* 2009-06-09 08:18:24:453 1244 df8 Agent ** END ** Agent: Finding updates [CallerId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:24:453 1244 df8 Agent ************* 2009-06-09 08:18:24:468 4980 944 COMAPI >>-- RESUMED -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:24:468 4980 944 COMAPI - Updates found = 1 2009-06-09 08:18:24:468 4980 944 COMAPI --------- 2009-06-09 08:18:24:468 4980 944 COMAPI -- END -- COMAPI: Search [ClientId = Windows Internet Explorer 8 Setup Utility] 2009-06-09 08:18:24:468 4980 944 COMAPI ------------- 2009-06-09 08:18:45:437 6008 280 Handler : Command line install completed. Return code = 0x00000bc2, Result = Succeeded, Reboot required = true 2009-06-09 08:18:45:453 6008 280 Handler ::::::::: 2009-06-09 08:18:45:453 6008 280 Handler :: END :: Handler: Command Line Install 2009-06-09 08:18:45:453 6008 280 Handler ::::::::::::: 2009-06-09 08:18:45:453 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:18:45:453 1244 df8 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:18:45:453 1244 c60 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:18:45:453 1244 c60 DnldMgr Regulation: {9482F4B4-E343-43B6-B170-9A65BC822C77} - Update A18CC936-DA41-421F-9AD9-303D806EC128 is "Defaults" regulated and can NOT download. Sequence 1111 vs AcceptRate 0. 2009-06-09 08:18:45:453 1244 f3c AU >>## RESUMED ## AU: Installing update [UpdateId = {FE76BC49-1BAC-470A-8007-C6D87207E0BE}, succeeded] 2009-06-09 08:18:45:484 1244 c60 DnldMgr Preparing update for install, updateId = {59F2C8ED-7296-4B6D-AE37-FD4B31E43575}.100. 2009-06-09 08:18:46:265 7336 1cb4 COMAPI ------------- 2009-06-09 08:18:46:265 7336 1cb4 COMAPI -- START -- COMAPI: Search [ClientId = <NULL>] 2009-06-09 08:18:46:265 7336 1cb4 COMAPI --------- 2009-06-09 08:18:46:265 1244 df8 Agent ************* 2009-06-09 08:18:46:265 1244 df8 Agent ** START ** Agent: Finding updates [CallerId = ] 2009-06-09 08:18:46:265 1244 df8 Agent ********* 2009-06-09 08:18:46:265 1244 df8 Agent * Online = No; Ignore download priority = No 2009-06-09 08:18:46:265 1244 df8 Agent * Criteria = "IsAssigned=1" 2009-06-09 08:18:46:265 1244 df8 Agent * ServiceID = {00000000-0000-0000-0000-000000000000} 2009-06-09 08:18:46:265 1244 df8 Agent * Search Scope = {Machine} 2009-06-09 08:18:46:265 7336 1cb4 COMAPI <<-- SUBMITTED -- COMAPI: Search [ClientId = <NULL>]

Hi Chrisitian, On the problematic client, please run "regedit" to open registry editor, and navigate to this key: HKLM\SOFTWARE\Policies\Microsoft\windows\windows update\ The data of WUServer and WUStatusServer should be the FQDN of your SCE server like this: http://<SCE server FQDN>:<port> If the data is incorrect, please open a command prompt and run "gpudpate /refresh" to update group policy setting.

I assume these clients were connecting to SCE for updates at one time? What could be going on is that the systems in question are losing contact with the SCE Server and then are being redirected to MS Update by the "Windows Update Roaming rule, which is a "by design" behavior implemented in one of the system MPs loaded during installation. This rule runs a script to check WSUS connectivity from the client. If no connection for 6 hours, it redirects the client to MS Update. You might look to disable this rule. It's bit me in the past as well.Pete Zerger, MVP-MOM | http://www.systemcenterforum.org

That is exactly what is happening... where is that set? Is it GP? Ive never heard of that before... but I don't want my clients to ever "fall back" to the MS servers if my SEC server is offline.

Christian,The script that is run is called WindowsUpdateRoaming.vbs (you can find it on any client if you search in under %programfiles%) and it is triggered by a rule called Microsoft.SystemCenter.Essentials.WindowsUpdateRoaming.To turn off this rule, open the console, select the autoring space and expand "Management Pack Objects". Select the "rules" node and here you can search for "Microsoft.SystemCenter.Essentials.WindowsUpdateRoaming". Now, right click on it (doen't matter witch one) and make you override.Bjrn Axell MVP - Advisec ABhttp://blog.advisec.comBjrn Axell MVP - Advisec AB http://blog.advisec.com