ACS and Windows Updates

Should Windows Updated be allowed to install updates as they come out on a Windows 2003 server running ACS 4.1?

Joseph
I do not think that anyone can say that fixes from Microsoft will never break something in ACS. There is the possibility but it is certainly not common.
I firmly believe that the risk that you would be exposed to by not applying fixes to known Microsoft vulnerabilities is very much greater than the risk that a Microsoft fix will break ACS. I agree with JG that you are better off to apply the fixes from Microsoft to your ACS server.
HTH
Rick

Similar Messages

Windows Firewall and Windows Update (Win 8.1)

Since Windows Vista I have always been using the Windows Firewall with "blocked outgoing traffic". As this is not the default setting, some basic windows services seem not to be included as firewall rules on the outgoing side.
My Problem is with the Windows Update:
On Windows Vista and 7 it was sufficient to create a rule for "wuauserv".
On Windows 8.1 however this seems not to be enough. The UI gives me error code 80240438 and the WindowsUpdate.log shows the following lines:
2014-06-14   20:11:08:150   952   538   IdleTmr   WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover) started; operation # 2044; does use network; is at background
priority
2014-06-14   20:11:08:151   952   538   WS   WARNING: Nws Failure: errorCode=0x803d0010
2014-06-14   20:11:08:151   952   538   WS   WARNING: Original error code: 0x80072efd
2014-06-14   20:11:08:151   952   538   WS   WARNING: Fehler bei der Kommunikation mit dem Endpunkt bei "https://fe2.update.microsoft.com/v6/ClientWebService/client.asmx".
2014-06-14   20:11:08:151   952   538   WS   WARNING: Fehler beim Senden der HTTP-Anforderung.
2014-06-14   20:11:08:151   952   538   WS   WARNING: Der Remoteendpunkt konnte nicht erreicht werden.
(.... and a lot of similar WARNING lines)
2014-06-14   20:11:12:921   952   538   IdleTmr   WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover, operation # 2044) stopped; does use network; is at background
priority
If I create a rule for the whole svchost.exe, the update works fine. Giving all services internet access is however not an option for me. Could you please tell me through which service(s) except wuauserv Windows Update performs its network activities?

Windows 8 upgraded to 8.1 on a Gateway SX2370.  Purchased Sep. 2013.
As of Dec. 28, 2014 I have not gotten ANY windows defender updates and windows update has not been working at all. When I go to my start screen and type "update" Windows update still shows in the list, only now when I click on it, it brings
up a blank window and can only be closed by right clicking the tab on the taskbar. I cannot max or minimize the window either.
Up until Dec. 28th it was working perfectly, notifying me when updates were available, almost everyday for windows defender.
I have tried everything I could find to fix this, even a complete restore, with recovery media made for Win 8.1 and Win 8. Still no windows updates, of anything. To top it off as of Jan. 22, 2015 the Diagnostic Policy Service has stopped and I am denied
access when I try restarting it.
Windows XP was great until MS stopped support. Vista sucked, near as bad as Millenium or 2000. I never tried windows 7 instead going for windows 8, being the most recent version when I could afford a new PC. Adapting to win 8-8.1 was no easy task.
I'm not a tech guru, but I've owned & used windows from Dos 6.0, '95, '98, '98SE, Millenium, XP, XP home & Pro (sp1-2 & 3) and still have the installation/restore CDs for all of them. Even taught myself how to write the recovery
console directly from the hard drive of XP, OEM or full MS versions without using the CDs & now I'm using Windows 8 - 8.1. Getting rid of the recovery console was a BIG mistake in my opinion.
At one time I had a multi-boot system of win.95, 98, 98SE, Mill., XP home sp2 and XP Pro sp3 on a 1.5 TB self built system. Microsoft told me it was impossible, until I allowed two tech support reps remote access for 5 min.. Which also lead to me being
blocked from most MS websites &?suggestions windows forums for 3 years.
But so far, this failure of windows updates and the Diagnostic policy Service in Windows 8.1 has got me stumped. Can ANYONE give me a quick simple way to correct this? Please?
Thanks for reading this and any help or suggestions anyone has to offer. GOD bless you all and my thanks to every military person, their families and veterans for my freedom.

ACS and Windows Domain / AD

Hi All,
In my environment there are two Windows Domain - Doamin A and B. ACS is configured on member server in domain B and hence Windows Authentication for users in Domain B is working fine. However I'm unable to see domain A in Configure Domain List on ACS server in Windows Domain configuration menu.
Please note, there is one way trust between domain A and B with Domain A trusting Domain B.
Is there a way I can use the same instance of ACS to authenticate the users in Domain A as well? If YES, can you please guide me with some pointers - thanks.
I'm using ACS and Windows AD elements to authenticate users for SSL Web VPN on ASA 5540.
Apprecaite quick help on this.
-Satishcp

Unfortunatley we are not using the Cisco Secure ACS Appliances, rather its ACS Ver 3.3 running on Windows 2000 Server (member server in Domain B).
My guess Remote Agents for Windows / Solaris works with Appliances alone.

Downloaded latest Itunes and Windows Update and everything fell apart

Okay, I dl'd the latest Itunes and Windows Update today and turned off my computer. When I came back and turned it on, it became really slow and the style for all the "windows headings" turned "gray classic theme." I tried running Itunes and a box comes up saying that I "Do not have access to change the Catalyst Control," my ATI driver I think (x1300). Then it says that I can't run Itunes because the audio is configured wrong. I go to my Audio settings in the "control panel" and everything is grayed out except the hardware choices. I clicked on their properties (SigmaTel Audio), but nothing would come up for 45 minutes. I am barely running in VGA mode and cannot access the internet connections in IE, thus barring me from Microsoft's updates. Sorry if it's hard to understand, but I'm ****** because I can't listen to all the new stuff I bought on Itunes yesterday Does anyone have any clues or ideas?

Take a look at this link, http://support.apple.com/kb/TS1369

Scheduler and windows update unavailable / unresponsive,

Issue:
Windows Update & Task Scheduler stop working, RDP then fails and a day later the system eventually becomes completely unresponsive and require a reboots to resolve, servers are needing to be rebooted every week on average.
Environment:
Server 2012: all receive same windows updates and have the same running services and applications installed,
all mirror images of DB01
DB01*Displaying Symptoms mentioned below
DB02*fine
DB03*fine
Non Microsoft Services running:
EMC Backup Agent
AVG Antivirus
Enterprise Recon Node - Ground labs
GFI LanGuard 11
BMC Server Automation Agent
WMware Tools Service
Link to Warnings Link to Errors
Symptoms:
Windows Update is not working
(stuck in stopping state, accessing via control panel is unresponsive)
Task Scheduler not working
it shows a stop sign / busy sign (Service is running, cannot see or create scheduled tasks)
RDP eventually stops working.
Above 3 services are started by the same instance (PID) of svchost.exe , killing the svchost.exe instance that started scheduler and windows update services also kills RDP and is not a solution.
Event Logs:
Warnings - https://drive.google.com/file/d/0B4FtPRuE-MzqdFExQi1EdFpQdEk/edit?usp=sharing
Errors - https://drive.google.com/file/d/0B4FtPRuE-MzqMGZzckRwMnFNWGc/edit?usp=sharing

Hi Fraser,
Thank you for your update and patience.
After going through the logs you provided, please check my findings below.
===============================================
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          9/3/2014 6:55:47 AM
Event ID:      201
Level:         Warning
User:          SYSTEM
Description:
A connection to the Windows Metadata and Internet Services (WMIS) could not be established.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          8/31/2014 11:37:33 PM
Event ID:      200
Level:         Warning
User:          SYSTEM
Description:
A connection to the Windows Update service could not be established.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        Microsoft-Windows-DeviceSetupManager
Date:          15/08/2013 1:51:01 p.m.
Event ID:      202
Level:         Warning
User:          SYSTEM
Description:
The Network List Manager reports no connectivity to the internet.
Log Name:      System
Source:        DistributedCOM
Date:          9/3/2014 3:10:41 AM
Event ID:      10029
Level:         Error
User:          SYSTEM
Description:
The activation of the CLSID {E60687F7-01A1-40AA-86AC-DB1CBF673334} timed out waiting for the service wuauserv to stop.
Log Name:      Microsoft-Windows-DeviceSetupManager/Admin
Source:        DeviceSetupManager
Date:          9/1/2014 7:26:06 AM
Event ID:      121
Level:         Error
User:          SYSTEM
Description:
Driver install failed, result=0x80072EE2 for devnode 'TERMINPUT_BUS\UMB\2&2C22BCC9&0&SESSION1MOUSE0'
===========
As per my research, those events which related to Device Setup Manager generated because Device Setup Manager just goes out and pings windows update
every night to see if any devices that are installed and set up to use Windows Update to update the corresponding drivers.
Currently, I suggest we make sure the drivers on your server are all up to date via Device Manager. Meanwhile, please try setting up the Windows Update settings from
installing update automatically to manually installing updates. Then restart the server to monitor the issue.
After all the above, if the issue persists, could you please help collect the following information?
=====================================
1. Run the following command and upload the system information.
msinfo32 /nfo      C:\SYSSUM.NFO /categories +systemsummary
2. Does the issue still occur in Clean Boot mode?
If you have any questions or additional information, feel free to let me know.
Thanks for your time.
Best regards,
Sophia Sun
Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Dns_probe_finished_no_iternet and windows update errors

I have windows 8 and have been having problems lately. Whenever windows wants to do an update and I wait for too long the internet goes out and displays the error message dns_probe_finished_no_internet. there are very few times when it happens and windows
does not need to update.
Another problem is that when I do go to restart the computer for the windows update only to have it say that it failed and tries again in a few hours. I tried updating them individually but none of them worked.
I have also tried to restart the dns client in services, but it won't work anymore.
I tried looking this up but any solution I have found hasn't worked. Can someone please help me, I'm at the end of my wits with this.

Hello Dieya105,
To avoid misunderstanding, do you mean receive error message‘dns_probe_finished_no_internet’ when you use Windows update or in browser?
Please share us a screenshot for better analyzation.
Have you run all the command ”netsh int ip reset, ipconfig /flushdns, netsh winsock reset” I mentioned in my last reply?
If the error code is in browser, please run the command ping 8.8.8.8 and ping
www.bing.com and check if you receive the normal respond.
Please take a look at the following thread similar to this issue.
http://en.kioskea.net/forum/affich-770260-dns-probe-finished-no-internet
I suggest you to use antivirus software to scan for the malware.
Please note: Since the website is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
Best regards,
Fangzhou CHEN
Fangzhou CHEN
TechNet Community Support

ACS and Windows Server

I have installed ACS 5.2 on a machine and I am trying to integrate with that Windows Server 2003 ( Active Directory ) . On the ACS when i do test connection it shows me sucess but when i save the setting it gives me Time error . I kept the clock and timezone of Active Directory and ACS server as same but still it gives me error . I read on one of the blog that it is better to configure NTP on a router and then sync both the devices with same NTP .
Is it necessary to configure NTP or manual config should also work ?

I have ran into issues like what you are seeing without using NTP. I would suggest setting up NTP and having ACS and your servers sync to that.
Sent from Cisco Technical Support iPhone App

ACS and Windows 2000 user database communication port

Could my Windows 2000 SP4 + ACS v3.23 can install any new Windows 2000 service pack ?
I'm affraid to infect ACS Service.
So, I want to install firewall on this server to block malicious traffic.
However, my ACS used external user database Windows 2000 for authentication.
Who can tell me What protocols or port list they are communication?
I have to avoid these traffic on my firewall.

Hi cheng
I think you can install any servie pack without problem and the SP4 is the latest one for WIN2000 and you server already has this SP
For your second question you need to specify many protocols according to your active directory config in this link you can find a list of this protocols and the best way is to make debug or logging or use a siniffer to know the exactly protocols flow between your ACS and AD server
http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx
Best Regards

Problem with Clean Access Agent and Windows Updater

I have a problem with a laptop when using Cisco Clean Access Agent. The agent keeps directing the laptop to get updates from the Windows Update site, but when I have connected the laptop via cable, windows updates tells me there are no updates either essential or optional. The laptop is a Sony VIVO VGN-FJ270 running XP Home Edition SP2 and the Clean Access Agent is version 4.0.2.1
Any help is appreciated!!

Verify the allowed hosts in CCA agent.
Try these link:
http://www.cisco.com/en/US/products/ps6128/tsd_products_support_series_home.html
http://www.cisco.com/en/US/products/ps6128/products_qanda_item09186a00803b7a81.shtml

HP recovery manager and windows update

Hi,
I am having two problems:
1. I have been having problem with my Recovery Manager, everytime I try to start it, it gives an error window "HP recovery manager has stopped working" and then it shuts the Recovery Manager down. Please advise.
2. In the past I would run the Windows update through the Recovery Manager, but since the Recovery Manager was down, I would just go run the Windows update from the Control Panel. But now even the Windows update cannot be started too. It will just get stuck at the icon without further action when I double click on it. Please help.
This question was solved.
View Solution.

Hi @yawbus ,
Thank you for visiting the HP Support Forums and Welcome. I have looked into your issue about your HP ENVY TouchSmart 15 Notebook and issues with the HP Recovery manager not working correctly. Here is a link to the HP Support Assistant if you need it. Just download and run the application and it will help with the software and drivers on your system at the time of purchase that might need updating.
If that does not fix the issue you might have to install the Recovery manager from here.
You can do a system restore. System restore will help if something automatically updated and did not go well on the Notebook.
When performing a System restore please note remove any and all USB devices. Disconnect all non-essential devices as they can cause issues.
I would be happy to assist if needed. How Do I Find My Model Number or Product Number?
Please let me know.
Thanks.
Please click “Accept as Solution ” if you feel my post solved your issue, it will help others find the solution.
Click the “Kudos, Thumbs Up" on the bottom to say “Thanks” for helping!

Cisco Secure ACS and Windows NLB

Hi,
I have two ACS servers and have been trying unsuccessfully to setup Windows NLB for them. I can successful setup the NLB but ACS won't respond on the clustered IP. Other services running on the clustered IP will respond so I believe the NLB is working correctly.
Has anyone had any success with ACS and Microsoft NLB? I can?t find any documentation to suggest that they are incompatible but I think this may be the case.
Thanks,
Neil

Neil,
ACS is not tested with NLB but if cluster hosts are attempting to communicate with the ACS using their clustered IP then ACS should reply.
Do you see any hits on acs ? If you sniff the acs interface, what is the source IP address ? Is it clustered ip or clustered host IP ??
Also on acs --->Network configuration add aaa client with host IP and clustered ip . Now see if acs responds to NLB.
Regards,
~JG

Same issue Network Discovery not working and Windows Update not working

I've read the threads.
This is a Vista Ultimate upgrade. My OOOOH My I have clocked 8 hours
Everything was working before. I tried all of the recommended services turning on restarting.
Also, ran into the problem of my memory being eaten. Suspected cause hibernate mode, which I had to disable. Scott Hasselman blog recommended the fix which is a cheap work around that limits machines functionality!!
I'm and IT Engineer specializing in MS product lines since Windows 1.0. MFC foundation classes etc.. What is the real problem ?
I don't have the NetBIOS over tcp/ip in my services?
I figure that the cost of my time and other individuals pays for the OS four times over. Give me a Microsoft developer subscription or something to make me happy. This is my development machine and I'm loosing time and money.
FYI, Just upgraded my second machine to Windows 8.1 OMG !!2 Hours to upgrade after the download. I loose my configuration settings. I required to have a Windows Live whatever account!!! This is not the way to compete and keep customers.
Windows XP has been by far the best deployment experience. I need a Knowledge base that gives solutions , not a troubleshooting scenario that does or does not work!!
Please , don't tell me to go and by a OEM Surface I cannot recommend this to my clients.
Thank You

Hi,
If it worked previously, a quick solution is to run System Restore and get back to the previous status when the issue didn’t occur.
What is System Restore?
http://windows.microsoft.com/en-us/windows7/What-is-System-Restore
When you turn on network discovery, do you get any error prompt?
Please check if you have any error message about network discovery in event viewer.
Open Event Viewer
http://windows.microsoft.com/en-US/windows7/Open-Event-Viewer
What information appears in event logs (Event Viewer)?
http://windows.microsoft.com/en-US/windows7/What-information-appears-in-event-logs-Event-Viewer
Please use Windows Live SkyDrive (http://www.skydrive.live.com/) to upload the Error logs to a public folder and share the URLs with us.
Also, please temporarily turn off your firewall and all the security programs for a test.
As far as I know, Network discovery requires that the DNS Client, DNS Client, Network Connections, Network Location Awareness, Remote Procedure Call (RPC), Function Discovery
Resource Publication, TCP/IP Netbios helper, SSDP Discovery, and UPnP Device Host services are started and set to automatic.
You should check again if you have started all these services.
Regarding the update issue, I suggest you try the following suggestions.
1. Temporarily disable firewall and antivirus program to test the issue.
2. Open the Windows Update troubleshooter
http://windows.microsoft.com/en-US/windows7/Open-the-Windows-Update-troubleshooter
3. Reset Windows Update components
http://support.microsoft.com/kb/971058
You may follow the steps from the link below to fix the issue.
Windows Update Not Working.
http://support.microsoft.com/kb/555989
You may also see the common Windows Updates troubleshooting guide.
Fix Microsoft Windows Update Issues
http://support.microsoft.com/kb/906602
Hope it helps.
Regards,
Blair Deng
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Text disappear after flash and windows update

Hi,
I'm living a strange exprerience from the last windows software update (after i update even flash, to ensure that there was not a compatibility problem) , i can't display some fonts if I choose the option "anti-alias for reliability" , for example for the joeHand 2 , but the text came out again if I choose "bitmap" or "use device fonts" as display option.
This seams a problem with this particular font, but appears only after an automatic windows update, and is not valid for every font.
Someone resolve/had a similar problem?
Thank you
Riccardo

Hello everyone,
Please read this TechNote for information on how this issue can be fixed.
Regards,
Suhas Yogin

Why is the SCUP and Windows Update updates different

I have an issue I cannot find an answer for. I am using the installation of WSUS within SCCM 2012 R2. I have selected all of the products associated to what is in our environment. I have downloaded and advertised all of the updates, security patches, definitions
etc... Once the updates are all installed on test machines, I run Windows Update from online. The list still shows updates and fixes in which I should have been downloading.
Does anyone know why this is?

That is often the case. Have you analysed the results? You might find that these updates are superseded or expired. The same thing happens if you use Microsoft Baseline Security Analyser. You can't read the results out of context.
By the way, you're not actually talking about SCUP. That is something different (System Center Updates Publisher). It's for integrating 3rd party updates with ConfigMgr.
Gerry Hampson | Blog:
www.gerryhampsoncm.blogspot.ie | LinkedIn:
Gerry Hampson | Twitter:
@gerryhampson

SCCM and Windows Update Client Configuration

Hello,
I am in the process of migrating SCCM 2007 client over to a new SCCM 2012 R2 site.
I deleted the AD site from 2007 and added it to 2012 and the client is pushed via Client Push. The client upgrades fine and things go well but
I run into a little problem after the client is installed.
Basically it seems to be an issue with how SCCM interacts with and controls Windows Update settings on the SCCM client. I ran into a somewhat of a major issue that caused
all (or many) of the newly upgraded clients to go the internet to download updates from Microsoft shortly after the move from the 2007 site and client upgrade to 2012. This was because the client (or at least the ones I checked) had their WU settings to “Always
download and install” (or something similar). Obviously, expected behavior with this setting, but the question is how did it get this way?
Does SCCM control any of these settings? I know it take over the WSUS settings, etc, but I didn’t think it does anything with the WU client itself.
From my understanding the WU client settings are done via GPO (local or domain) or WU setting and SCCM does not control these settings.
I’m not looking for you to solve the problem, because it’s quite tedious, I’m just hoping that someone can lead me in the right direction to find out what if any WU settings
are controlled or changed by SCCM 2007 or 2012.
Thanks
Angelo
Angelo

Thanks for the extra info, Idan. I should probably admit that I am an AD admin and SCCM is handled by someone else in my department. My main issue with the LocalGPO is the Event 1096 corruption that causes all admin template settings to revert
to defaults - currently happening on over 100 workstations in our environment. 100% of these problems are caused by LocalGPO corruption and nothing else. And we will pursue resolution of this issue with Microsoft because we agree that resolving
this problem is the primary goal.
But for the sake of understanding: We don't have any non-domain members that need to be managed by SCCM. If we had a policy stating "no SCCM client configurations resulting in a LocalGPO file are to be implemented in production - all are
to be done via Domain Group Policy," is it possible to eliminate the LocalGPO entirely? Or will there always be a LocalGPO file regardless of whether or not there are settings visible from it in a gpresult report? We would not need to match
SCCM configurations in Domain Group Policy because we would not make any changes to the SCCM client resulting in a LocalGPO file at all. The slow link detection is not of concern to us because none of these settings that would not apply in this case
are SCCM-managed via LocalGPO (as far as I know):
http://blogs.technet.com/b/musings_of_a_technical_tam/archive/2012/02/27/gpos-and-slow-link-detection.aspx
Another reason why I would prefer to do these settings in Domain Group Policy is that we have Advanced Group Policy Management installed in our environment, which is subject to our Change/Release process. We can track the changes being made to clients
much more easily when they are done via AGPM. Any changes that we want to make via SCCM client could be tested first to see how LocalGPO is effected, and then those changes could be made via Domain Group Policy instead in production.
Given this info, I'm still struggling to understand why it is recommended to implement anything via SCCM client configurations resulting in a LocalGPO file. So far, the only compelling reason is that management of non-domain members is not possible
via Domain Group Policy, but that doesn't apply to our environment. Is it recommended mostly for ease of administration, so that an SCCM admin doesn't need to work with another tool (Domain Group Policy)? Any extra reasoning for this recommendation
that anyone can provide is much appreciated!

ACS and Windows Updates

Similar Messages

Maybe you are looking for