We're running WSUS 3.2.7600.226. I have an odd problem where everytime I scan for updates against WSUS it tells me there is 1 important update available and then immediately changes to "There are no updates available for your computer".
If there's more than one update available I see "x important updates are available" and then immediately changes to "x-1 important updates are available".
Looking at the WindowsUpdate.log it appears to be a (faulty?) definition update for Microsoft Forefront Client Security.
Here's the REPORT EVENT's from the log in question when I ran a few "Check for Updates" in succession:
--
2013-06-12 11:28:59:387 484 1068 Report REPORT EVENT: {B88B59A4-98D1-4654-9118-8FB69BE95B10} 2013-06-12 11:28:59:387+0100 1 188 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on 14 June 2013 at 16:00: - Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0)
2013-06-12 11:29:08:045 484 1068 Report REPORT EVENT: {4BDCE1B1-414F-4701-B8AF-0C4A90A1A72A} 2013-06-12 11:28:59:621+0100 1 183 101 {1C0FA82A-12BD-402E-AF2A-5533213FE49A} 100 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0)
2013-06-12 11:29:08:061 484 1068 Report REPORT EVENT: {6DC5DB75-DE2C-46A2-A769-92F8BF38B9A2} 2013-06-12 11:29:08:045+0100 1 188 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on 14 June 2013 at 16:00: - Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.151.2012.0)
2013-06-12 11:29:16:282 484 1068 Report REPORT EVENT: {A154C5FE-00AE-4B46-82C4-8FC386331D5A} 2013-06-12 11:29:08:232+0100 1 183 101 {634D9D17-F015-425B-AC0B-A9FCD8065ADE} 200 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.151.2012.0)
2013-06-12 11:29:16:298 484 1068 Report REPORT EVENT: {6E2026A5-9B53-4CBD-8BF1-01E05197296E} 2013-06-12 11:29:16:298+0100 1 188 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on 14 June 2013 at 16:00: - Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0)
2013-06-12 11:29:24:472 484 1068 Report REPORT EVENT: {91621E57-07C6-410E-B354-4CCC3877B797} 2013-06-12 11:29:16:454+0100 1 183 101 {1C0FA82A-12BD-402E-AF2A-5533213FE49A} 100 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0)
2013-06-12 11:29:24:488 484 1068 Report REPORT EVENT: {E598FE7A-2600-4FB2-80A8-3A3B71278A21} 2013-06-12 11:29:24:488+0100 1 188 102 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Content Install Installation Ready: The following updates are downloaded and ready for installation. This computer is currently scheduled to install these updates on 14 June 2013 at 16:00: - Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.151.2012.0)
2013-06-12 11:29:29:495 484 1068 Report REPORT EVENT: {39339AC3-C9C8-41E3-8166-A051618CFDE2} 2013-06-12 11:29:24:722+0100 1 183 101 {634D9D17-F015-425B-AC0B-A9FCD8065ADE} 200 0 AutomaticUpdates Success Content Install Installation Successful: Windows successfully installed the following update: Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.151.2012.0)
--
Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0) was released on the 26/06/2012
and Definition Update for Microsoft Forefront Client Security - KB977939 (Definition 1.151.2012.0) was released on 11/06/2013.
So it appears the AU client thinks it needs 1.129.469.0 and immediately installs it. Then on the next scan it needs 1.151.2012.0 and installs that ... and repeats.
Looking at WSUS most of the definition updates on our server have expired automatically. We have 7 Definition Update for Microsoft Forefront Client Security that are still valid and approved for install. 6 of these were released in the last 3 days and supersede and\or are superseded by other definition updates. Only 1 (Microsoft Forefront Client Security - KB977939 (Definition 1.129.469.0)) does not have any supersedence information.
Before I go ahead and decline it, does anyone know if there's something special this update is bringing to the party? All our (recent) synchronisations have gone through successfully. Is this possibly corrupt metadata for this patch on our WSUS server or, heaven forbid, on Microsoft's servers? If so, can we correct it?
Thanks,
Mark.