You use Microsoft Windows Server Update Services (WSUS) 3.0 to deploy software updates and hotfixes to computers that are in your organization. However, some computers do not receive updates from the WSUS server. This problem occurs if the computers have Microsoft Office 2003 or components of Office 2003 installed.
This problem affects Microsoft Windows Server Update Services 3.0 and Windows Server Update Services 3.0 Service Pack 1 (WSUS 3.0 SP1). However, in some circumstances, the following products may also be affected:
- Windows Small Business Server 2003 (Windows SBS) that has had the WSUS component upgraded from WSUS 2.0 to WSUS 3.0
- System Center Essentials 2007
- System Center Configuration Manager 2007
For more information, see the advisory.
When this problem occurs, a message that resembles the following message is logged in the Automatic Updates log file (%windir%\WindowsUpdate.log) on the affected computer:
This message is logged during the detection phase.
Also, a message that resembles the following message is logged in the WSUS log file (%ProgramFiles%\Update Services\Log Files\SoftwareDistribution.log) on the WSUS computer:
To locate this message, search the WSUS server for the ID that is obtained from the client log.
This problem occurs because a recent revision to a Microsoft Office 2003 Service Pack 1 (SP1) update causes some WSUS 3.0 servers to incorrectly synchronize the revised update with the update’s approvals. When the affected client computers communicate with such a server, the Web service is unable to process the approvals. Therefore, the detection is unsuccessful.
We recommend that you upgrade to WSUS 3.0 SP1 and receive update 954960. If you do not want to upgrade to WSUS 3.0 SP1 at this time, follow the procedure in this section to manually reset the approvals to a consistent state on the WSUS server.
- On the WSUS Administration console, in the Updates list, locate the Office 2003 Service Pack 1 update.
- Confirm that the update is Declined. If the update is not declined, right-click the update, and then click Decline.
- Approve the update. To do this, right-click the update, click Approve, and then click OK. Do not make any changes to the approval settings in the Approve Updates dialog box.
- Decline the update. To do this, right-click the update, and then click Decline.
- Computers should now successfully complete detection against the WSUS server and receive any applicable updates. To verify that a computer can synchronize:
- Open a command prompt.
- Type the following command:
- Press ENTER.
- Review the WindowsUpdate.log file to verify that the synchronization is successful. You may have to run the detectnow command two times. Some customers reported that the first synchronization fails but that successive synchronizations succeed.
- If you have a hierarchy of WSUS servers, repeat this procedure on each server. Start with the top-level server. If any of the servers is a replica child server, change it to be autonomous by using the Options/Update Source and Proxy Server dialog box. Follow the procedure steps, and then change the autonomous server back to a replica child server.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.