Issues with the M$ Update site.

[Jay Bollyn]

John,

A couple of my guys have been using the MS update site all business day CDT (8/18 and 8/19), not having any problems, other than the usual slowness.

I have been thinking about this worm. To date, I have not worried much about MS CU because we have a good firewall and NAV Corporate Edition. I have changed my mind about this, because we have laptops that are used both at home and in the office. A laptop could get infected outside the firewall, and bring the worm into the intranet.

This particular worm is quite benign, but the next thing might be much worse. As admins, we have to assume that.

We are going to use a server to push the MS CU down to the clients. Running around to client PCs is really the pits.

Here is a thread I authored you might find interesting:

http://forums.itrc.hp.com/cm/QuestionAnswer/1,,0x07e5d7e82f6a854fb4d4283ba7a6dbd1,00.html

:-) Jay

[Norman_21]

John,

I thought to put my $0.2 for it's been in my mind. Instead of running among the workstations, install the NAV Corp Edition version 8.x in the Sever as following:

1. Symantec System Center.
2. NAV Snap-in.
3. Live update 1.6 administartion
4. NAV Corp Edition.

At the Clients side, install :

1. NAV Corp Edition for clients and select "Managed" option.

Once you update the NAV Definition file at the Server all the clients will be updated automatically!

Here is a documents:
http://service1.symantec.com/SUPPORT/ent-security.nsf/9d94c8571a91ba4788256bf3007f62b5/e4dc25506b68e7fb88256c060077f101?OpenDocument

All the best!!


Once you

[John Collier]

Jay,

I appreciate the link to your previous thread, but I have to admit that I have already seen it and read all of the information that you had offered there.

I have to agree with you on several of your points and I would do whatever it took to get that individual patch out to every PC ASAP. It was done here and we have had almost no problems on the core network {Knock on wood!!} while our remote locations have been hit pretty hard.

What I am seeing right now confuses me. You and Latif say that you have been able to successfully connect to and update software from the M$ Update site over the last couple days while myself and others are all reporting that we can???t manage to get the site to work properly for us (I have even found references to this on the Windoze message boards).

What is different between your setup and ours? Why are you able to make it work when I (and others like me) can???t seem to do so?

I have tried to do this for machines with NT4, Win2000, and XP and all of them have failed.

Any thoughts on what the difference might be?

[Norman_21]

John,

Sorry for my big mouth. However, the reason why you getting a probelm with some other floks while we don't, is because of Your internet GATEWAY. Who is your ISP, how do you connect to the internet. You might need to do some studies about that.
Also, you can install the GPO to apply the patch instead of running around all the Workstations.

Best of the Best.
Your Friend!

[Perignon]

Hi all,

I'd say no sweat! Just keep having an eye to what some hot-fixes could do to your preferred configuration. For example, I discovered that security settings put to outlook had been re-enforced "in my back", I guess after a critical update downloaded from the MS site.

Everything is now working fine again.

Hope this odd experience can help.
Alain.

[Jay Bollyn]

John,

I agree with Xman that this is probably a problem with your connection to the MS site, rather than the MS site itself. I suggest VisualRoute, there is a 15-day free trial available for download here:

http://download.com.com/3000-2172-10016565.html

VR is basically a fancy graphical traceroute utility. It is very useful for problems like this.

http://orion.neiu.edu/~jbollyn/scrn-cap/visualroute-windows-update.jpg

If you run VR from your office, look especially for routers in the "%Loss" column.

Ont thing you might try is connect directly to the MS IP addr 81.52.248.97.

:-) Jay

[John Collier]

Latif,

Let???s examine the theory that you have put forth.

Who is our ISP? How do we connect to the I-net?

Well, this corporation has approx 3 T3s (give or take one) that are dedicated for I-net traffic. Those T3???s go directly through the local telco and then straight into one of the worldwide long distance carriers. While I don???t have much faith in the local part, I feel a bit more at ease with the big one. I???m pretty sure that they are the ones that my traceroutes always identify as our first outside hop from here (the actual first hop from our firewall hits something that simply resolves to an IP address starting with 12.41.x.x so I can???t be completely sure of that).

I can???t think that everybody that has started gripe sessions with both M$ and others over this issue are all using just one company to connect to the update site. I have heard that there is some issue with the M$ servers constantly changing IP addresses which causes some problems with the DNS servers in some ISPs and M$ is supposed to be ???working with some of the ISPs to ???resolve??? this issue??? but I can???t really think that I can even blame the individual ISPs for a problem of that nature. After all, wouldn???t it be M$???s responsibility to keep these IPs somewhat stable to avoid such issues (if that is indeed what is causing this, that is)?

The issue isn???t with applying a patch for this latest little worm. That has been addressed and is no longer a issue at this time. All I want is for the update site to allow me (us) to actually apply the patches that it identifies our machines need.

I would like to know why some of you seem to be able to do this and the rest of us can???t. What is the logic and how do we resolve this?

Why can I connect to the site, get told what updates I need, yet still not be able to apply them? How will some of these tracerout tools help me to solve this? If I couldn???t connect at all to the update site, then it would make more sense to try them. As it is, I guess I just don???t see it???

Am I just being too dense?

[Jay Bollyn]

John,

I don't think you are being dense :-)

Based on your original post, it sounds like the problem is in the download, here is a quote from your root post:

"...but the download and subsequent installation fails within seconds."

We all know it takes time for a proper complete download from the MS site.

If you think that this might be some kind of DNS problem, I suggest link to a specific MS IP address, as I mentioned before. This of course takes DNS completely off the list of suspects.

:-) Jay

[Ron Kinner]

Thought I'd chime in here. We have had no problem with the windowsupdate site. I put Win4K SP4 on a computer Monday night without any problem. Put IE6SP1 on the same computer the next morning. Worked as expected.

Assuming the ISP is not the source of the problem and eliminating the site itself leaves only your local firewall and network as culprits. You might check for duplex mismatches, errors on the routers etc. If it uses ftp to get the download to you then it would probably fail unless you set your IE to use Passive FTP (in the Tools/Internet Options/Advanced section).

Have you tried going to the catalog and downloading the software you need, then installing it locally? (You have to personalize the windowsupdate page to see the catalog.)

Ron

[Jay Bollyn]

I think anyone who is responsible for administration of multiple Windows clients should be looking at pushing down Critical Updates from a server. Relying on windows update is a joke; this is painfully obvious. We have all had problems similar to John's. Since there is a new CU every 10 days or so, this is clearly a job for a server.

I just authored a root post on this topic, would appreciate any comments posted there:

http://bizforums.itrc.hp.com/cm/QuestionAnswer/1,,0x2ad16fc82347594ca444e23e25ed35ff,00.html

:-) Jay