Trying to identify why a client patched a day after it's scheduled time. WUA off by GPO, 2/3 patches not in sccm repository.

Hi All,
I have one machine in a collection 33 that apparently patched and rebooted a day after it's scheduled patch window.  This client normally patches the 3rd Sunday of every month.  I have 2 reboot task sequences to make sure the client is ready to
receive patches and another later on after patches should have installed to insure the machine is compliant.  Both task sequences went off when they were supposed to, but yesterday the server (w2k8 r2 standard) patched 3 updates and rebooted.  Automatic
updates is disabled by GPO.  So I'm pretty sure it wasn't that.  What's vexing me is that two of the three patches are not in the sccm repository nor in the update list.  So I think I can safely say that those two didn't come from sccm
doing it's own thing.  Least I would think at least.  I see in the windows update log the three patches and their time stamps.  What I need to be able to determine is why would sccm patch this client the following day.  Is this a wmi issue? 
Is there something in a particular log I should be looking for? 
Any direction would be great.  Thanks!
HS

Hi Mark,
That crossed my mind as well.  One of the three patches was in the repository but I checked 3 times for the other two and they are not there, so it made me consider someone manually doing it.  I did check the security log, but I was finding tons
of system account logons or other processes we have said up to log in.  I didn't find a user login.  I'm assuming based on this small snippet from the windowsupdate.log that it is config agent doing the updates. The first update I have in the repository,
the last two are not there.  If someone can direct me to what I should be looking for that would be great.
2014-05-19 11:27:39:801  912 19c8 Agent ** START **  Agent: Installing updates [CallerId = CcmExec]
2014-05-19 11:27:39:801  912 19c8 Agent *********
2014-05-19 11:27:39:801  912 19c8 Agent   * Updates to install = 1
2014-05-19 11:27:39:804  912 19c8 Agent   *   Title = Security Update for Internet Explorer 11 for Windows Server 2008 R2 for x64-based Systems (KB2961851)
2014-05-19 11:28:50:533  912 19c8 Agent ** START **  Agent: Installing updates [CallerId = CcmExec]
2014-05-19 11:28:50:533 1928 1bfc COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = CcmExec]
2014-05-19 11:28:50:533  912 19c8 Agent *********
2014-05-19 11:28:50:533  912 19c8 Agent   * Updates to install = 1
2014-05-19 11:28:50:537  912 19c8 Agent   *   Title = Cumulative Security Update for Internet Explorer 11 for Windows Server 2008 R2 for x64-based Systems (KB2929437)
2014-05-19 11:34:56:539  912 19c8 Agent ** START **  Agent: Installing updates [CallerId = CcmExec]
2014-05-19 11:34:56:540 1928 1a1c COMAPI <<-- SUBMITTED -- COMAPI: Install [ClientId = CcmExec]
2014-05-19 11:34:56:540  912 19c8 Agent *********
2014-05-19 11:34:56:540  912 19c8 Agent   * Updates to install = 1
2014-05-19 11:34:56:543  912 19c8 Agent   *   Title = Security Update for Windows Server 2008 R2 x64 Edition (KB2912390)

Similar Messages

  • I am trying to get space on an external hard drive which has some old time machine back up files that I do not need but can not eliminate, even by going into the time machine, clicking on the backup file to be eliminated and using the drop down eliminate

    I am trying to get space on an external hard drive which has some old time machine back up files that I do not need but can not eliminate, even by going into the time machine, clicking on the backup file to be eliminated and using the drop down menu with the gear box symbol to eliminate

    I cannot find this 300GB "Backup" in the Finder, only in the Storage info when I check "About This Mac".
    You are probably using Time Machine to backup your MacBook Pro, right? Then the additional 300 GB could be local Time Machine snapshots.  Time Machine will write the hourly backups to the free space on your hard disk, if the backup drive is temporarily not connected. You do not see these local backups in the Finder, and MacOS will delete them, when you make a regular backup to Time Machine, or when you need the space for other data.
    See Pondini's page for more explanation:   What are Local Snapshots?   http://pondini.org/TM/FAQ.html
    I have restarted my computer, but the information remains the same. How do I reclaim the use of the 300GB? Why is it showing up as "Backups" when it used to indicate "Photos"? Are my photos safe on the external drive?
    You have tested the library on the external drive, and so your photos are save there.  
    The local TimeMachine snapshot probably now contains a backup of the moved library.  Try, if connecting your Time Machine drive will reduce the size of your local Time Machine snapshots.

  • Last night I downloaded the latest Word update. Today the first Word document crashed and I lost 45 minutes of work in spite of having saved the document numerous times. Why is Word crashing the day after a safety update? I have Office 2008 for Mac

    Last night I downloaded the latest Word update. Today the first Word document crashed and I lost 45 minutes of work in spite of having saved the document numerous times. Why is Word crashing the day after a safety update? I have Office 2008 for Mac

    One way to test is to Safe Boot from the HD, (holding Shift key down at bootup), run Disk Utility in Applications>Utilities, then highlight your drive, click on Repair Permissions, Test for problem in Safe Mode...
    PS. Safe boot may stay on the gray radian for a long time, let it go, it's trying to repair the Hard Drive
    Reboot, test again.
    If it only does it in Regular Boot, then it could be some hardware problem like Video card, (Quartz is turned off in Safe Mode), or Airport, or 3rd party add-on, Check System Preferences>Accounts>Login Items window to see if it or something relevant is listed.
    Check the System Preferences>Other Row, for 3rd party Pref Panes.
    Also look in these if they exist, some are invisible...
    /private/var/run/StartupItems
    /Library/StartupItems
    /System/Library/StartupItems
    /System/Library/LaunchDaemons
    /Library/LaunchDaemons
    Open Console in Applications>Utilities, check the system log for the date/time of the last problem  & next startup for clues.

  • I have a MacBook Pro running 10.7.2.  I am trying to import photos from my older Canon EOS-1D for the first time since my OS upgrade.  iPhoto does not see the camera nor does Image Capture.  IC says there is not a camera connected.  Cable is known good.

    I have a MacBook Pro running 10.7.2.  I am trying to import photos from my older Canon EOS-1D for the first time since my OS upgrade.  iPhoto does not see the camera nor does Image Capture.  IC says there is not a camera connected.  Cable is known good.  Has something changed?  Thanks!

    If neither iPhoto not IC can seethe card it might suggest an issue with the card or the ports on the camera/mac.
    Try reformat the card, change the ports and/or use a USB Card Reader.

  • Why are previous patches not included in major releases ?

    I will be attempting to raise a TAR for this but I think it is sufficiently serious to also raise in public.
    In forms 10.1.0.2 I am encountering a serious intermittent problem which EXACTLY matches the symptoms of Bug 3018714.
    Alledgedly it is fixed by 6i patchset 17
    ... and by 9.0.2.3 patch 3882050
    ... and by 9.0.4 patchset 1
    And now the bug has reappeared in the next major release.
    Why keep producing major releases which bring back previous bugs ?
    Doing it once is bad enough, but how can 3 times be acceptable ?
    Also the bug has not been revised for nearly a year and there is no mention of the latest release.
    Would be nice to hear from Grant on this one.

    Jan
    Are you saying the Sun JRE and Jinit are now the same ? Or are you saying we should no longer use Jinitiator. Do sun have a JRE which is preferable to the jinit which comes with 10gr2 ?
    kndwds
    We started web deployment on 6i then went to 10g then 10gR2 and saw the problem in each of those versions.
    As for progress on the TAR. Guess what. They want a test case based on the scott/tiger schema. What a surprise ! Not very helpful for a problem which appears seemingly at random and cannot be reproduced at will. Don't they realise that real applications are far more complicated than anything mr Scott ever dreamed of.

  • Why can't I print coupons after downloading coupon printer time after time?

    Why can't I print coupons after downloading coupon printer several times?

    Likely because the people writing the coupon printing software aren't very good at what they do.
    If you can provide a bit more details as to what doesn't work, that might narrow it down.

  • Why Are Reader Patches Not Combined?

    It is so very inconvenient to have to patch Adobe Reader multiple times, especially when first installing.  Additionally, it takes great effort to determine which patches are already applied so that the correct one(s) can be added.  Patches should be cumulative so that the latest one can be applied to any previous major version, e.g., 8.17 ca be applied to any 8.x Reader.
    I think this is a no-brainer.  Businesses have hundreds or thousands of clients to take care of, and Adobe is doing a poor job of addressing the corporate customer.
    TIA,
    Russell

    This is a User to User forum. We cannot answer for Adobe's practices. But you can put in a request here:
    https://www.adobe.com/cfusion/mmform/index.cfm?name=wishform

  • Why do some patches not work with looping?

    In playing around with the Looper, I've stumbled across a couple of patches that don't work with it: Clean Stereo Chorus and Dream Sequence. No signal seems to make it to the Looper. Any idea why this would be? I'm just scratching the surface of MainStage and don't really understand all the routing and such. Could there be something in these patches that routes them around the Looper somehow?

    My question got me thinking about the routing, so I looked at the difference between patches that work and patches that don't. Sure enough, patches that do work have Loopback in one of the Send slots. So I added that to one of the patches that wasn't working. But when I click on the little circle beside the send (which I assume has something to do with the level), it shows "-∞". A patch that works, on the other hand, displays "+0.0". I can't figure out how to adjust that, though, and I don't know why some patches aren't set up for Loopback.

  • Why is CS6 patch not as good as CS3?

    I recently upgraded from Photoshop CS3 to CS6.
    The patch tool did not appear to work as well in CS4 or CS5 and CS6 appears just as bad.
    I've attached an image showing (from left to right) a patch using:
    CS3;
    CS6 Normal;
    CS6 Content Aware.
    CS3 is MUCH better.  Anyone had the same experience?

    What happens when you try to patch the middle frame in your screenshot?
    This what i get in cs6. Does your result look markedly different?
    (patch tool Normal and set to source without transparent)
    before
    after

  • Why is the new ios7 alarm clock snooze button right beside the off botton? Seriously have we not been here before

    New ios7 alarm snooze button right beside off button. This will cause me problems . Will hit off a often as I hit snooze. Taught this was sorted on ios6 .

    My daughter has had her Razr for about 9 months now.  About two weeks ago she picked up her phone in the morning on her way to school when she noticed two cracks, both starting at the camera lens. One goes completely to the bottom and the other goes sharply to the side. She has never dropped it and me and my husband went over it with a fine tooth comb. We looked under a magnifying glass and could no find any reason for the glass to crack. Not one ding, scratch or bang. Our daughter really takes good care of her stuff, but we still wanted to make sure before we sent it in for repairs. Well we did and we got a reply from Motorola with a picture of the cracks saying this was customer abuse and that it is not covered under warranty. Even though they did not find any physical damage to back it up. Well I e-mailed them back and told them I did a little research and found pages of people having the same problems. Well I did not hear from them until I received a notice from Fed Ex that they were sending the phone back. NOT FIXED!!! I went to look up why and guess what there is no case open any more for the phone. It has been wiped clean. I put in the RMA # it comes back not found, I put in the ID #, the SN# and all comes back not found. Yet a day earlier all the info was there. I know there is a lot more people like me and all of you, but they just don't want to be bothered so they pay to have it fix, just to have it do it again. Unless they have found the problem and only fixing it on a customer pay only set up. I am furious and will not be recommending this phone to anyone. And to think I was considering this phone for my next up grade! NOT!!!!

  • HT204053 I tried to make a purchase with my apple id after changing the experiration date on my credit card and it does not work

    I tried to make a purchase from the app store ( the French app store using my French apple ID and credit card) , i had just changed the experition date for my credit card and it did not work, should I do anything else?
    Thanks

    Then you should contact them:
    http://www.apple.com/emea/support/itunes/contact.html

  • Why have emails been automatically deleted after a period of time?

    emails of more than about a month old have disappeared and cannot be located.
    In Mail Preferences it is possible to dictate when Sent emails can be deleted. How is same done for received emails?

    There is no setting in Mail for deleting messages from your In box, or any other mailbox other than Sent, Junk and Trash, on a timed basis.  If you're seeing that kind of behavior routinely, it has to be something your mail server is doing.  Who is your e-mail provider?
    Alternately, after a second read, you could have also meant that there was a one-time event that caused everything older than a month to be lost.  Again, that's not normal, but if that's the case, let us know for some other suggestions.

  • Why is getting patches so slow

    We have a patch proxy setup to speed up installation of patches.
    But it struck me that downloading a patch for the first time to cache it is surprisingly slow.
    So I looked into it and observed that patch 113886-34 which was downloading at the time had taken 40 minutes to download about 25 Megs (of the 45 meg patch size). A speed which worked out at about 10k per second.
    So as a comparison I manually downloaded the jar file from sunsolve and it came through at about 300k per second.
    So why is downloading patches through smpatch update and a local patch proxy 30 times slower than downloading them manually.?

    Well, which one should it be ?
    By default, I have:
    patchpro.patch.source https://getupdates1.sun.com/
    Once in a while it complains due to a connection reset (it's a slow link on our end as well at this point but still)
    Since I have several systems with the same hardware, I've tried to set up a patch server. That one points to:
    Patch source URL: https://getupdates1.sun.com/solaris/
    But I also pointed to (as the instructions mention) to getupdates.sun.com
    At that time, I pointed the clients to:
    patchpro.patch.source http://xxx.xxx.xxx:3816/solaris/
    Yesterday afternoon all I would get where connection resets. Now it starts to download a couple of patches but eventually it dies.
    But I also noticed that some have it set to:
    patchpro.patch.source - https://updateserver.sun.com/solaris/
    So, which one should it be, a) for a direct connection and b) for the patch server.
    All boxes are solaris 10, and the ones I've tested do have the latest (rev. 8) update manager patch.
    Note that we have a SunSpectrum silver contract, so I'm not sure if we should be pointing this to somewhere else instead...
    Even with our slow link, I never have problems downloading patches via RHN for our other servers... I thought after 1.5 years this would be 'useful'
    In any case, smpatch get output is:
    patchpro.backout.directory - ""
    patchpro.baseline.directory - /var/sadm/spool
    patchpro.download.directory - /var/sadm/spool
    patchpro.install.types - rebootafter:reconfigafter:standard
    patchpro.patch.source http://xxx.xxx.xxx:3816/solaris/ https://getupdates1.sun.com/
    patchpro.patchset - current
    patchpro.proxy.host - ""
    patchpro.proxy.passwd **** ****
    patchpro.proxy.port - 8080
    patchpro.proxy.user - ""

  • 9.2.0.6 client patch on XP - services conflict

    Just downloaded the 9.2.0.6 .zip from MetaLink and tried to run the setup.exe to patch a client machine. The installer (10.1.0.3.0) reports this error:
    Certain files which need to be reinstalled by Oracle Universal Installer are being used by one or more running services.
    It then lists 30 services! I had no problems with any previous 9i client patches.
    I have seen a few suggested workarounds (renaming directories, renaming .dlls in /bin, etc.), but none has worked.
    Any suggestions to get this patch applied?

    Set all relevant services to "Manual" startup. Then
    reboot and try installing the patch. This generally
    works for me. Don't forget to set all services to
    "Automatic" startup when you are done.
    Hope this helps.
    Kailash.

  • Client machine force reboot after apply window patch updated

    I found all of client machines will force reboot after window patching updated via SCCM 2012. Have any options in SCCM 2012 can let users to choose reboot their machine after patching ? likely WSUS, users can suspend the reboot request. Pls advice.

    The notification will happen automatically if ConfigMgr installs updates that require a reboot but a reboot is not initiated so there's nothing additional you need to do.
    Note however that allowing users to choose this instead of forcing it is generally bad practice because the updates aren't truly installed until the reboot happens and there have been a couple of updates of the years that cause flakiness until the system
    is rebooted also.
    Why not allow the users to install the updates when they want up until a deadline and then force the reboot at the deadline (if one hasn't already been performed)? This gives the user the control over the process but also forces it to happen if the user
    neglects performing it.
    Jason | http://blog.configmgrftw.com

Maybe you are looking for

  • ITunes is failing to open run on my PC last 2 days.

    iTunes is failing to run on my PC last  2 days. I repaired and reinstalled iTunes but still get the message it failed to install - error 7 and windows error 5 I now seem to be going in circles. can anyone help? We also seem to be getting another mess

  • Live updating smart playlists not actually updating

    Apparently, this was a common complaint back in 2007. Well, I am still having this problem. iPhone 4, iOS 4.3.3 I have a static playlist filled with music called "MUSIC". I have a smart playlist "DYNAMIC" that references "MUSIC", which filters only s

  • Using advanced math functions in plugins

    I have an application built in LabVIEW 8.5 that calls external VIs as PlugIns. Normally adding any subVIs of these PlugIns in the same directory as the plugin is located in (or a sub-directory of that) will enable the plugin to execute (I have severa

  • Best config for init.ora

    Hi, I am using OS:win 2k8 server 32 bit Oracle Database:11g EE 11.2.0.1.0 RAM: 8GB Like to now what is the best config parmaters for a OLTP with maximum of 100 users at the time When i use the DBCA command i got the template of init.ora where i am no

  • Contacts from iphone

    How do I get my contacts from my iPhone to my new MacBook Pro?