JukEboX's questions

I have a main domain with Microsoft Specific admin templates. When I go to make changes in my child domain those templates don't show up on the child domain domain controller. Why don't they pass those templates down as part of replication and where do I put the admin templates on the child domain so I can edit those settings?

I did try adding a folder called PolicyDefinitions to C:\Windows\SYSVOL\SYSVOL\DOMAIN on the child domain DC but when I load the GPO the only admin templates it sees with that folder in it is the new admin templates and none of the default ones. Are they hiding somewhere or do they refer to the top?

I have issued myself an enrollment agent certificate from my CA on COMPUTER1. I have used this certificate to enroll for certificates on behalf of others. I work in other areas, and we got network connection to my second location. I exported the Enrollment Agent certificate from COMPUTER1 and imported it to the Personal Store of the machine on COMPUTER2. This shows as installed in the store just as it does on COMPUTER1. When I go to enroll on behalf with my same credentials as COMPUTER1, when I get to the Select Enrollment Agent certificate it finds, NO certificates on COMPUTER2 even though it shows up in the store.

Does anyone know how to fix this or do I need to issue myself an Enrollment Certificate on COMPUTER2 as well?

I am setting up user accounts for MAB (Mac Authentication Bypass) devices on my network. In GPO I have made an OU for the device accounts to be created with block inheritance so that the password policy is not applied to the device accounts. The password policy does apply to the Domain Controller. When I go to make the account for the device the username/password must be the mac address of the device. Problem is even with the block inheritance set on the OU when I got to make the user account in that OU it still enforces the password policy. Without turning the policy with the password policy off, is there a way to make the user account for the MAB deivce?

I am trying to add SPN entries for my SQL server but SQL server is running under an NT Authority account like SYSTEM or LOCAL SERVICE.

When I put in the setspn code it says it can't find the user. Is this possible to do? Trying to run the following:

setspn -L MSSQLSvc/SQLSERVER1 "NT AUTHORITY\LOCAL SERVICE"

I have a software that is used for monitoring user logins. In the software it uses a SAMR request to get user groups for allowing users in an out of the machine. When the software reaches out with a SAMR request for the groups it looks like it is getting blocked by the Domain Controller. I think maybe from the firewall because if I install it on the Domain Controller, it succeeds.

How can I test the SAMR request and see if I can get logging on it or what Firewall rules do I need to create to allow SAMR to be allowed to complete?

I am running a Parent/Child domain for a number reasons. I have a printer server that accessed the Parent domain on VLAN 2 and the Development domain on VLAN 3. The printers are on VLAN 2 and users on VLAN 2 print without a problem through the print server. For the printers users on VLAN 2 and VLAN 3 have "Print" permission. VLAN 3 computers are pushed the printers through GPO and like VLAN 2 print jobs are sent 2 the printer server to print out.

Issue we are having is when users on VLAN 3 print it shows up in their queue but the job says "Access Denied". I can't find out why they are getting access denied if they have print ability.

I can't find what permission they need. Any idea why they can't print?

Print Server is Windows Server 2019. Clients are Windows 10 & Windows 11.

THE SETUP

The following image is understood as such:

• VLAN 10 (192.168.4.X) is a management VLAN connecting servers and equipment together.
• VLAN 20 (192.168.10.X) is a production VLAN used by users for software development.
• Top DC is a Parent Domain Controller serving DNS requests for the management network VLAN 10.
• Top Server is a Member Server supplying file shares for the management network (VLAN 10) and the Production Network (VLAN 20)
• Child DC is a Child Domain Controller under the Parent Domain forest and acts as a DNS server for the production level environment serving DNS requests for VLAN 20.
• Top DC and Top Server are members of the parent domain and have a NIC for the production network to allow for file shares and other services.

THE PROBLEM Child client is trying to access the file share for Top DC using UNC path \TOP-DC over the production VLAN. When doing so it is unable to connect. Child client is able to ping the address for TOP-DC (192.168.10.11) without an issue. Child Client can access Top Server using UNC path \TOP-SERVER over the production VLAN without an issue. Because the TOP-DC is not accessible by UNC I checked the Child DC DNS Server and the Parent DC DNS server.

The Parent DNS server shows the A record for the Top DC VLAN 20 address in the Top Domain Zone. The Child DNS server shows the same A record in the copy of the Top Domain-Zone. So as I understand it the A record is in the DNS so it should resolve.

When on the Child Client I do an Nslookup. It will resolve Child DC DNS as it should. It also finds the VLAN 20 record in the copy of the Top Level Zone.

So why does it not resolve? If I go onto the Top DC and do an ipconfig /flushdns and ipconfig /registerdns the record comes back..... But only temporarily. Maybe 6-12 hours later the records disappears again. Why does it keep disappearing and how do I make it stay?

I am running a Windows Server 2019 as a DC running DHCP. I am running a single scope running through a NIC to handle addresses for our small network. I am being asked to add a second DHCP scope so it can manage IPs on another network using a second NIC already installed to ports on a separate VLAN than the existing one. Our system does not have any routers in it and only uses level 2 network switches Cisco C9300-24Ts.

• NIC #1: 192.168.1.10 [VLAN 10] (Exisiting)
• NIC #2: 192.165.5.10 [VLAN 20] (New)

The existing NIC and DHCP scope work great without an issue. The New Scope I set up for NIC 2 is running but when I connect to ports on that VLAN that that NIC is served from I don't get an address.What am I missing? Did I do something wrong?

These 2 NICs are connected to 2 separate isolated networks.

I have a Windows Server 2019 running as a WSUS server. I just rebuilt it because of some database connection issues moving from one server to another. SO this is a fresh install. This is not connected to the internet as I exported the data from one machine and imported it to this one. After the import I ran the Clean-WSUS script from Adam. I approved 3 updates.

Now the Download Status says 0.00MB or 531.00MB.

Its been like that for half an hour now and it still doesn't see the files. I have moved over the content to the content folder but it still isn't seeing it. Anything I can check to see why it isn't seeing the content?

Logs are showing there is SOAP errors ErrorCode=InvalidCookie on some of the virtual pools like ClientAuth a few others.

UPDATE 1 Found this in teh Software Distribution Log.

2020-02-20 14:45:14.214 UTC Warning w3wp.183    SoapUtilities.CreateException   ThrowException: actor = http://WSUS-SERVER:8530/ClientWebService/client.asmx, ID=e37f37f0-72c8-4184-ba99-1abfd451e4fa, ErrorCode=InvalidCookie, Message=, Client=?
2020-02-20 14:50:10.581 UTC Warning w3wp.517    SoapUtilities.CreateException   ThrowException: actor = http://WSUS-SERVER:8530/ClientWebService/client.asmx, ID=f0c77d21-4a7b-49f8-9cb1-7c22e25dc0d8, ErrorCode=ConfigChanged, Message=, Client=0f080754-49b3-46f1-ab1e-c318bfe38998
2020-02-20 14:50:17.831 UTC Info    w3wp.1220   ThreadEntry ThreadPoolWorkQueue.Dispatch
2020-02-20 14:50:17.831 UTC Warning w3wp.1220   DBConnection.OnReceivingInfoMessage  The join order has been enforced because a local join hint is used.
2020-02-20 14:50:17.847 UTC Info    w3wp.201    ThreadEntry TimerQueue.FireNextTimers
2020-02-20 14:50:17.847 UTC Warning w3wp.201    DBConnection.OnReceivingInfoMessage  The join order has been enforced because a local join hint is used.
2020-02-20 15:11:48.047 UTC Warning w3wp.554    SoapUtilities.CreateException   ThrowException: actor = http://WSUS-SERVER:8530/ClientWebService/client.asmx, ID=e83449d7-7a9e-4104-9eed-e632b6a6a495, ErrorCode=ConfigChanged, Message=, Client=3aee7b99-3cc6-47a6-8a86-c0056488f3a6
2020-02-20 15:13:27.902 UTC Info    w3wp.1469   ThreadEntry ThreadPoolWorkQueue.Dispatch
2020-02-20 15:13:27.902 UTC Warning w3wp.1469   DBConnection.OnReceivingInfoMessage  The join order has been enforced because a local join hint is used.
2020-02-20 15:20:49.611 UTC Warning w3wp.656    UnencryptedCookieData.Deserialize   Argument exceptioninvalid header
Parameter name: bytes
2020-02-20 15:20:49.626 UTC Warning w3wp.656    EncryptionHelper.DecryptData    Argument exceptionMicrosoft.UpdateServices.Internal.Authorization.LoggedArgumentException: invalid header
Parameter name: bytes
   at Microsoft.UpdateServices.Internal.Authorization.UnencryptedCookieData.Deserialize(Byte[] bytes)
   at Microsoft.UpdateServices.Internal.Authorization.EncryptionHelper.DecryptData(Byte[] cookieData)
Parameter name: cookieData
2020-02-20 15:20:49.626 UTC Warning w3wp.656    SoapUtilities.CreateException   ThrowException: actor = http://WSUS-SERVER:8530/ClientWebService/client.asmx, ID=1313dd75-59e9-4db0-a18f-bf59e7d7ca52, ErrorCode=InvalidCookie, Message=, Client=?

Notice it says InvalidCookie for amy of the virtual app pools. I have also torn down WSUS and IIS and rebuilt them and it still gets this error.

I have 2 Windows Server 2016 servers. Recently when I login with my Domain Administrator account and run an installer I get the 2503 and 2502 errors. I have to run a command prompt as an administrator to launch the installer and the program installs.

The error I get is

ShellExecuteEx failed; code 8235
A referral was returned from the server.

I have had this problem on a Windows 10 machine but did a reset to it and the problem went away. I can't do that on these domain controllers.

To get anything done I have to use the command line as an admnistrator trick. I can't even use the Control panel to uninstall a program through programs and features without making a special shortcut for it. Any idea how I can fix this?

I am trying to install a number of items that are MSI files from Microsoft suchs as SQLTypeCLRs.msi and SharedComponents.msi for SQL Server. When I try and install these I get errors 2502 & 2503 and it fails with a call runtime error. If I open a Command Prompt in Administrator mode and then start the MSI from that command line then it will run as adminsitrator. It's almost as though it doesn't try to access UAC. And you can't right click and click "Run As Administrator" on the file. Is there a way to fix this so it runs MSIs as Administrator so I don't keep getting these errors? I am getting this on my 2 Windows Server 2016 boxes.

I am simply tryihg to install new software that comes to me as MSIs and not EXEs.

Error 2503.Called RunScript when not marked in progress.

Error 2502.Called InstallFinalize when no install in progress.

I upgraded out Domain Controllers and Servers from Windows Server 2008 R2 to Windows Server 2016 via Windows Server 2012. Before the process of each jump:

From Windows Server 2008 R2 to Windows Server 2012 R2 From Windows Server 2012 R2 to Windows Server 2016

I successfully ran /forestprep & /domainprep without an issue on both Domain Controllers.

After the upgrades I went over to my Active Directory to check the functional level and it still says Windows Server 2008 R2.

Why would this be? I am upgrading all my Windows 7 machines to Windows 10. I have a few machines still running Windows 7 Embedded but I don't think that would effect the level. I am a little confused. Do I need to now upgrade the Domain Funcational level once more now that the upgrade is complete?

I have 2 domain controllers running Server 2016 and all using Static DNS records. When domain joined computers connect to the network they show as being connected to an Unidentified Network instead of a Domain network. In most cases I have to disable the adapter and re-enable it to get the Domain back. Is there anything I can do to fix this or where to even troubleshoot to figure out why it isn't seeing the domain first?

Doing some testing on our test environment with the 1809 update. This system is not Internet and only gets updates from WSUS. I have tried to stop the services and rename the SoftwareDistribution folder but that didn't help either. I have done the troubleshooter but that doesn't do anything. I have set Delivery Optimization to Simple (99).

I am stopping the attempt to try to connect to the Internet using this GPO setting:

Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not connect to any Windows Update Internet locations 

After running powershell command (New-Object -ComObject 'Microsoft.Update.ServiceManager').Services

I get the result Windows Server Update Service IsDefautlAUService = True

Patched with the 11-2018 update from 2018.11.13 to 17763.134

I have done a Windows Reset on 1809 to see if that fixes the issue but it just shows the same problem. System will not check WSUS for updates and says it cannot connect. It will not even reregister with WSUS since we are set with Client-Side Targetting.

This is what the error show me at the moment.

This is my current log. Trying to find out what the error is with the LoadHistoryEventsFromRegistry. Microsoft has no information on these issues.

    InitializeSus
2018/12/07 07:30:59.6145871 5316  76    IdleTimer       Non-AoAc machine.  Aoac operations will be ignored.
2018/12/07 07:30:59.6146719 5316  76    Agent           WU client version 10.0.17763.107
2018/12/07 07:30:59.6149469 5316  76    Agent           SleepStudyTracker: Machine is non-AOAC. Sleep study tracker disabled.
2018/12/07 07:30:59.6150268 5316  76    Agent           Base directory: C:\WINDOWS\SoftwareDistribution
2018/12/07 07:30:59.6179939 5316  76    Agent           Datastore directory: C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb
2018/12/07 07:30:59.6190270 5316  76    DataStore       JetEnableMultiInstance succeeded - applicable param count: 5, applied param count: 5
2018/12/07 07:31:00.1001631 5316  76    DataStore       Service 3DA21691-E39D-4DA6-8A4B-B43877BCB1B7 added
2018/12/07 07:31:00.1188537 5316  76    DataStore       Service 9482F4B4-E343-43B6-B170-9A65BC822C77 added
2018/12/07 07:31:00.1202710 5316  76    DataStore       Data store successfully created
2018/12/07 07:31:00.1254989 5316  76    Shared          UpdateNetworkState Ipv6, cNetworkInterfaces = 0.
2018/12/07 07:31:00.1260950 5316  76    Shared          UpdateNetworkState Ipv4, cNetworkInterfaces = 1.
2018/12/07 07:31:00.1307344 5316  76    Shared          Network state: Connected
2018/12/07 07:31:00.5661308 5316  76    Agent           Created new random SusClientId 5ee99c27-c788-4ed7-910d-be7ecefcb4d3. Old Id: none.
2018/12/07 07:31:00.5753449 5316  76    Misc            *FAILED* [8024000C] LoadHistoryEventFromRegistry completed
2018/12/07 07:31:00.5756015 5316  76    Shared          UpdateNetworkState Ipv6, cNetworkInterfaces = 0.
2018/12/07 07:31:00.5756166 5316  76    Shared          UpdateNetworkState Ipv4, cNetworkInterfaces = 1.
2018/12/07 07:31:00.5756276 5316  76    Shared          Power status changed
2018/12/07 07:31:00.5819017 5316  76    Agent           WU client refresh cache for DisableWUAccess policy: 1
2018/12/07 07:31:00.5819073 5316  76    Agent           Initializing global settings cache
2018/12/07 07:31:00.5819100 5316  76    Agent           WSUS server: http://WSUS.DOMAIN.460i:8530
2018/12/07 07:31:00.5819125 5316  76    Agent           WSUS status server: http://WSUS.DOMAIN.460i:8530
2018/12/07 07:31:00.5819151 5316  76    Agent           Alternate Download Server: http://IWSUS.DOMAIN.460i:8530
2018/12/07 07:31:00.5819167 5316  76    Agent           Fill Empty Content Urls: No
2018/12/07 07:31:00.5819186 5316  76    Agent           Target group: Update Testing
2018/12/07 07:31:00.5819207 5316  76    Agent           Windows Update access disabled: Yes
2018/12/07 07:31:00.5819227 5316  76    Agent           Do not connect to Windows Update Internet locations: Yes
2018/12/07 07:31:00.5999439 5316  76    Agent           Initializing Windows Update Agent
2018/12/07 07:31:00.6001722 5316  76    Agent           CPersistentTimeoutScheduler | GetTimer, returned hr = 0x80248007
2018/12/07 07:31:00.6001826 5316  76    Agent           CPersistentTimeoutEvent | Resubscribe, no existing/cached timer for Id=29A863E7-8609-4D1E-B7CD-5668F857F1DB.
2018/12/07 07:31:00.6001961 5316  76    Agent           Adding timer: 
2018/12/07 07:31:00.6002034 5316  76    Agent               Timer: 29A863E7-8609-4D1E-B7CD-5668F857F1DB, Expires 2018-12-08 12:31:01, not idle-only, not network-only
2018/12/07 07:31:00.6017327 5316  76    IdleTimer       IdleTimer::NetworkStateChanged. Network connected? Yes
2018/12/07 07:31:00.6152671 5316  2732  DownloadManager HandleScavengeSandboxTask: Cleaning up sandboxes.
2018/12/07 07:31:00.6337411 5316  2732  DownloadManager PurgeExpiredFiles::Found 0 expired files to delete.
2018/12/07 07:31:00.6337679 5316  2732  DownloadManager PurgeExpiredUpdates: Found 0 non expired updates.
2018/12/07 07:31:00.6337761 5316  2732  DownloadManager PurgeExpiredUpdates: Found 0 expired updates.
2018/12/07 07:31:00.6446587 5316  2732  DownloadManager Received power state change notification: Old: <unknown>; New: AC.
2018/12/07 07:31:00.6446609 5316  2732  DownloadManager Power state changed from <unknown> to AC.
2018/12/07 07:32:12.5240857 5660  9008  ComApi          IUpdateServiceManager::AddService2
2018/12/07 07:32:12.5240922 5660  9008  ComApi          Service ID = {7971f918-a847-4430-9279-4a52d1efe18d}
2018/12/07 07:32:12.5240988 5660  9008  ComApi          Allow pending registration = Yes; Allow online registration = Yes; Register service with AU = Yes
2018/12/07 07:32:12.5302886 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '117CAB2D-82B1-4B5A-A08C-4D62DBEE7782'.
2018/12/07 07:32:12.5302932 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:32:12.5302982 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '855E8A7C-ECB4-4CA3-B045-1DFA50104289'.
2018/12/07 07:32:12.5303011 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:32:12.5303077 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '7971F918-A847-4430-9279-4A52D1EFE18D'.
2018/12/07 07:32:12.5303106 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:32:12.5313973 5316  9004  Agent           Failed to retrieve SLS response data for service 117cab2d-82b1-4b5a-a08c-4d62dbee7782, error = 0x8024500c
2018/12/07 07:32:12.5314154 5316  9004  Agent           *FAILED* [8024500C] Caller Service Recovery failed to opt in to service 117cab2d-82b1-4b5a-a08c-4d62dbee7782 (cV: GdfTDldxRUyC9aLL.1)
2018/12/07 07:32:12.5316674 5316  9004  Agent           Failed to retrieve SLS response data for service 855e8a7c-ecb4-4ca3-b045-1dfa50104289, error = 0x8024500c
2018/12/07 07:32:12.5316725 5316  9004  Agent           *FAILED* [8024500C] Caller Service Recovery failed to opt in to service 855e8a7c-ecb4-4ca3-b045-1dfa50104289 (cV: GdfTDldxRUyC9aLL.2)
2018/12/07 07:32:12.5318996 5316  9004  Agent           Failed to retrieve SLS response data for service 7971f918-a847-4430-9279-4a52d1efe18d, error = 0x8024500c
2018/12/07 07:32:12.5319045 5316  9004  Agent           *FAILED* [8024500C] Caller UpdateOrchestrator failed to opt in to service 7971f918-a847-4430-9279-4a52d1efe18d (cV: GdfTDldxRUyC9aLL.3)
2018/12/07 07:32:12.5319174 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '7971F918-A847-4430-9279-4A52D1EFE18D'.
2018/12/07 07:32:12.5319205 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:32:12.5322116 5660  9008  ComApi          Deferred service opt-in
2018/12/07 07:32:12.5366676 5660  9008  ComApi          *FAILED* [800704C6] CheckNetworkCostForCostPolicy
2018/12/07 07:33:57.7948349 5660  9008  ComApi          IUpdateServiceManager::AddService2
2018/12/07 07:33:57.7948410 5660  9008  ComApi          Service ID = {7971f918-a847-4430-9279-4a52d1efe18d}
2018/12/07 07:33:57.7948479 5660  9008  ComApi          Allow pending registration = Yes; Allow online registration = Yes; Register service with AU = Yes
2018/12/07 07:33:57.7984642 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '117CAB2D-82B1-4B5A-A08C-4D62DBEE7782'.
2018/12/07 07:33:57.7984751 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:33:57.7984884 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '855E8A7C-ECB4-4CA3-B045-1DFA50104289'.
2018/12/07 07:33:57.7984960 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:33:57.7985083 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '7971F918-A847-4430-9279-4A52D1EFE18D'.
2018/12/07 07:33:57.7985156 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
2018/12/07 07:33:57.7993250 5316  9004  Agent           Failed to retrieve SLS response data for service 117cab2d-82b1-4b5a-a08c-4d62dbee7782, error = 0x8024500c
2018/12/07 07:33:57.7993472 5316  9004  Agent           *FAILED* [8024500C] Caller Service Recovery failed to opt in to service 117cab2d-82b1-4b5a-a08c-4d62dbee7782 (cV: H4qkYaccI0S+sZ8U.1)
2018/12/07 07:33:57.7999318 5316  9004  Agent           Failed to retrieve SLS response data for service 855e8a7c-ecb4-4ca3-b045-1dfa50104289, error = 0x8024500c

Looking for ideas on how to get my clients to call back to my WSUS server. Also this "service" I can't find information on. From what I can tell its a link to a web connection to on online WU. Any help is appreciated of if anyone can tell me any information on how WSUS uses these service IDs or what these FAILUREs are is helpful.

UPDATE 1: Here is the latest I have found. WSUS server shows that the 1809 update was the last update the systems needed to install. The Update installed and the computer restarted and since, NONE of them have checked in. As you can see by the screenshot below.

The registry from the effected computers shows that the service IDs that the issues are coming from show up in the pending registry key. Not sure what that means. The machine this Screenshot was taken from I removed from WSUS and cleared the WSUS ID registry key and attempted to reconnect it. The WSUS server has yet to see this computer yet but the log is getting the same errors. See the screenshot below.

The failed Service IDs:

     2018/12/07 07:32:12.5302886 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '117CAB2D-82B1-4B5A-A08C-4D62DBEE7782'.
    2018/12/07 07:32:12.5302932 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
    2018/12/07 07:32:12.5302982 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '855E8A7C-ECB4-4CA3-B045-1DFA50104289'.
    2018/12/07 07:32:12.5303011 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
    2018/12/07 07:32:12.5303077 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '7971F918-A847-4430-9279-4A52D1EFE18D'.
    2018/12/07 07:32:12.5303106 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]
    2018/12/07 07:32:12.5313973 5316  9004  Agent           Failed to retrieve SLS response data for service 117cab2d-82b1-4b5a-a08c-4d62dbee7782, error = 0x8024500c
    2018/12/07 07:32:12.5314154 5316  9004  Agent           *FAILED* [8024500C] Caller Service Recovery failed to opt in to service 117cab2d-82b1-4b5a-a08c-4d62dbee7782 (cV: GdfTDldxRUyC9aLL.1)
    2018/12/07 07:32:12.5316674 5316  9004  Agent           Failed to retrieve SLS response data for service 855e8a7c-ecb4-4ca3-b045-1dfa50104289, error = 0x8024500c
    2018/12/07 07:32:12.5316725 5316  9004  Agent           *FAILED* [8024500C] Caller Service Recovery failed to opt in to service 855e8a7c-ecb4-4ca3-b045-1dfa50104289 (cV: GdfTDldxRUyC9aLL.2)
    2018/12/07 07:32:12.5318996 5316  9004  Agent           Failed to retrieve SLS response data for service 7971f918-a847-4430-9279-4a52d1efe18d, error = 0x8024500c
    2018/12/07 07:32:12.5319045 5316  9004  Agent           *FAILED* [8024500C] Caller UpdateOrchestrator failed to opt in to service 7971f918-a847-4430-9279-4a52d1efe18d (cV: GdfTDldxRUyC9aLL.3)
    2018/12/07 07:32:12.5319174 5316  9004  Agent           *FAILED* [80248014] GetServiceObject couldn't find service '7971F918-A847-4430-9279-4A52D1EFE18D'.
    2018/12/07 07:32:12.5319205 5316  9004  Agent           *FAILED* [80248014] Method failed [CAgentServiceManager::GetServiceObject:1902]

Based on this article by Microsoft 2 of the IDs are MU (Microsoft Update) and Store. The WSUS ID (3DA21691....) Does not show up as pending nor does it have a key in there to even be checked.

The Group Policy setting show I have disabled all connection to the outside world since this system is not connected to the Internet.

Finally there is the proof they are not pulling updates as updates from January have been approved and have yet to be pulled. They are not counting as needing them yet as the machines haven't check in in months.

Still in search of more information to see why the systems are not connecting to the WSUS server. I have not made any firewall changes or configuration changes after the 1809 update so the update clearly broke communication.

Trying to get my domain to show the last successful login by users on their Windows 7 machines. I have enabled the following Group Policy Setting:

Computer Configuration| Policies | Administrative Templates | Windows Components | Windows Logon Options | Display information about previous logons during user logon

When users login they get this message:

Security policies on this computer are set to display information about the last interactive logon. Windows could not retrieve this information. Please contact your network administrator for assistance

And then prevents users from logging in.

It works fine on my Server 2008 R2 machines but not my Windows 7. I have Googled for an answer to this question but people just trying to disable the setting. I want to get it working. Has anyone got this working or had this issue?

I am looking to replace 2 servers with one server and run the original servers as virtual machines. I am looking to use Windows Server 2016 as the hardware server and the VMs also running Windows Server 2016. I am wondering about the math that goes into the amount of memory and CPUs I need for each VM that the hardware server should have. Currently both servers run 8 CPUs and 48GB or RAM. I done some research and they are saying to have 4 extra cores besides each VM to run the hardware server. Many hardware manufacturers only look like I will be able to run 2 or 3 Virtual Servers on them. Is my math or understanding wrong or is there a rule of thumb to calculation the amount of CPUs and RAM to run virtual servers on a hardware server.

I am trying to apply a service through GPO Computer Management Preferences. I have an option that states "Apply Once And Never Apply Again".

Searching on this option comes up with this information:

If the Apply once and do not reapply option is selected, it changes this behavior, so the preference extension applies the results of the preference item to the user or computer only once. This option is useful when you do not want the results of a preference item to reapply.

Source: Apply once and do not reapply - What exactly this GPO setting means?

I want to know does this apply per computer when it restarts? Does that mean if I did a GPUpdate it will not reapply and try to start the service unless I put in an item to delete the RunOnce registry entry? I guess I am asking if the do once and not run again mean it only runs once ever unless you do a registry change?

I have a Windows Server 2016 running WSUS (WID Database). The nodes on my system are all Windows 10 Professional. They are configured through group policy to check the Server 2016 for updates. The nodes and server are not behind a proxy in anyway.

Based on the WSUS Console it shows all the nodes are checking in when I press "Check for Updates". When you look on the node it throws the following message:

There were some problems installing updates, but we'll try again later. If you keep seeing this and want to search the web or contact support for informaiotn, this may help: (0x8024401c)

I have googled this error and I have found little information or none at all for this error. I have tried all of the suggestions I could find but nothing has resolved this issue. What I can make out of the last .ELT file when I open it with word is:

There was an error communicating with the endpoint at http://FQDN:8530/ClientWebService/client.asmx. There was an error receiving the HTTP reply. The operation did not complete within the time allotted.

When I do a Get-WindowsUpdateLog in PowerShell I just get a long list of updates it can't find. No actual communication information.

I can get to that link if I put it in to a browser and the firewall is not blocking WSUS. What am I missing? Can anyone supply me with any other information. I am also still learning how to actually read ELT files using the correct procedure.

EDIT 1: Attempting to run the Characters and WDK10 on the client to interpret the ELT files better.

EDIT 2: Running the tracefmt.exe tool gives me the following Error:

Cannot Open logfile for reading

This happens on everyone. I do see from TraceView from the SDK tool kit that all the events show system times and No Format Information found. Is it connected and not getting this data or is it just looking for all these updates?

Trying to deploy printers to Windows 7 x64 computers for NON-ADMIN users. Server is a 2008R2 running Print Management. 3 Printers are HP LaserJets installed on the print server.

I have used Print Management and used "Deploy With Group Policy" and the printers are deploying when I login as an admin. When I login as a user they are not there.

I have checked the following policy settings:

Computer Configuration\Policies\Administrative Templates\Printers Point and Print Restrictions
User Configuration\Policies\Administrative Templates\Printers\Point and Print Restrictions
Computer Configuration\Policies\Administrative Templates\System\Driver Installation\Allow non-administrators to install drivers for these devices setup classes

Under USER RIGHTS ASSIGNMENT only Adminstrators can load and unload drivers.

I have applied these settings to the computers and still no printers for non-admins.

I have also tried most fixes on this search: Google

Can anyone help me figure out what I am doing wrong? Group policy should be applying the printer to computers for NON-ADMIN users on login to the computer.

I have a unique server setup and before you say anything, yes I know RDC isn't the best way to remote to a server but these are the constraints I have to deal with. Anyway I have a network of 4 servers 2 being used as domain controllers. Recently I am getting an error from 2 of the servers that are not domain controllers when I remote to them:

Upon doing some research it states that my Terminal Services have been out of licensing for 120 days. This is where I get confused. NEVER have I had a licensing server running on any of my machines. All the RDC connections to work stations and Domain Controllers work without a problem; it seems to be just these 2 servers. It was working earlier this week and this just randomly started happening.

Servers are running Windows Server 2008 R2 and is just for databases etc. Is there a way to get my RDC back without installing a Licensing Server since I didn't have one before and things were working or doing the Registry Stop gap of resetting the 120 days?

Thanks.