Silent Clients

Microsoft.Windows.Server.UpdateServices.2012.Server.SilentClientsState (UnitMonitor)

Knowledge Base article:

Summary

Clients should check in with the server on a regular basis for updates.

Resolutions

Client computers are not reporting status to the WSUS server.

Possible resolutions include:

Review the application event log and resolve any issues related to the IIS, SQL, and WSUS server.

Check connectivity from the client computer to the WSUS server and debug any issue found.

Open a command window.
Verify the client computer has a valid IP address: type ipconfig /all
Verify the client computer can reach the WSUS server: type ping <:server name or IP address>
Verify the client computer can reach the WSUS HTTP server: type http://<servername>/selfupdate/iuident.cab. This will return with the option to download the cab file.
Verify that the Automatic Update (AU) client is running: type net start wuauserv
Verify the AU client is configured properly: type Reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
If the reg query returns an error, the AU Group Policy has not been sent to this client computer or the client computer has not been configured for a non-domain environment. This has to be corrected before the next step. See http://go.microsoft.com/fwlink/?LinkID=41777.
Verify WUServer and WUStatusServer are pointing to the WSUS server and port number (for example, http://<wsusservername or IP address>/<port number>)

Reset the Automatic Updates client by stopping the Automatic Updates client service and forcing a reset.

Open a command window.
Type Reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
Verify WUServer and WUStatusServer are pointing to the WSUS server and port number (for example, http://<wsusservername or IP address>/<port number>)
Type gpupdate /force (if client machine is configured via domain policy).
Type wuauclt.exe /resetauthorization /detectnow
Wait 10 minutes for a detection cycle to finish before verification.
Open the file <windir>\SoftwareDistribution\ReportingEvents.log in a text editor.
Check the latest entry in the log file for "Success Software Synchronization Agent has finished detecting items."

Additional

Verify client computer and server status

Check the server

Open a command window.
Type cd <WSUSInstallDir>\Tools
Type wsusutil checkhealth
Type eventvwr
Review the Application log for the most recent events from source Windows Server Update Services and event id 10010.

Go to the client computer and do the following

Open the <windir>\SoftwareDistribution\ReportingEvents.log file in a text editor.
Check the latest entry in the log file for "Success Software Synchronization. The agent has finished detecting items."

Element properties:

Target

Microsoft.Windows.Server.UpdateServices.2012.Server

Parent Monitor

Microsoft.Windows.Server.UpdateServices.2012.Server.ClientRollup

Category

AvailabilityHealth

Enabled

True

Alert Generate

True

Alert Severity

Error

Alert Priority

Normal

Alert Auto Resolve

True

Monitor Type

Microsoft.Windows.3SingleEventLog3StateUnitMonitorType

Remotable

True

Accessibility

Public

Alert Message

Silent Clients

Suspicious silent clients state

RunAs

Default

Source Code:

<UnitMonitor ID="Microsoft.Windows.Server.UpdateServices.2012.Server.SilentClientsState" Accessibility="Public" Enabled="true" Target="Microsoft.Windows.Server.UpdateServices.2012.Server" ParentMonitorID="Microsoft.Windows.Server.UpdateServices.2012.Server.ClientRollup" Remotable="true" Priority="Normal" TypeID="Windows!Microsoft.Windows.3SingleEventLog3StateUnitMonitorType" ConfirmDelivery="false">

  <Category>AvailabilityHealth</Category>

  <AlertSettings AlertMessage="Microsoft.Windows.Server.UpdateServices.2012.Server.SilentClientsState.AlertMessage">

    <AlertOnState>Warning</AlertOnState>

    <AutoResolve>true</AutoResolve>

    <AlertPriority>Normal</AlertPriority>

    <AlertSeverity>Error</AlertSeverity>

  </AlertSettings>

  <OperationalStates>

    <OperationalState ID="SilentClientsError" MonitorTypeStateID="FirstEventRaised" HealthState="Error"/>

    <OperationalState ID="SilentClientsWarn" MonitorTypeStateID="SecondEventRaised" HealthState="Warning"/>

    <OperationalState ID="SilentClientsOK" MonitorTypeStateID="ThirdEventRaised" HealthState="Success"/>

  </OperationalStates>

  <Configuration>

    <FirstComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</FirstComputerName>

    <FirstLogName>Application</FirstLogName>

    <FirstExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Windows Server Update Services</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>13032</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </FirstExpression>

    <SecondComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</SecondComputerName>

    <SecondLogName>Application</SecondLogName>

    <SecondExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Windows Server Update Services</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>13031</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

      </And>

    </SecondExpression>

    <ThirdComputerName>$Target/Host/Property[Type="Windows!Microsoft.Windows.Computer"]/NetworkName$</ThirdComputerName>

    <ThirdLogName>Application</ThirdLogName>

    <ThirdExpression>

      <And>

        <Expression>

          <SimpleExpression>

            <ValueExpression>

              <XPathQuery>PublisherName</XPathQuery>

            </ValueExpression>

            <Operator>Equal</Operator>

            <ValueExpression>

              <Value>Windows Server Update Services</Value>

            </ValueExpression>

          </SimpleExpression>

        </Expression>

        <Expression>

          <RegExExpression>

            <ValueExpression>

              <XPathQuery>EventDisplayNumber</XPathQuery>

            </ValueExpression>

            <Operator>MatchesRegularExpression</Operator>

            <Pattern>^(13030|501|10000)$</Pattern>

          </RegExExpression>

        </Expression>

      </And>

    </ThirdExpression>

  </Configuration>

</UnitMonitor>