WSUS Drivers Best Practices

Hello,
I am configuring WSUS on our network (Server 2012), and have a couple concerns regarding Driver updates.
I would like the machines connected be able to update their drivers when necessary.
It is important to note that for the Update Files and Languages, I do not plan to update the files locally, but rather have them download from the MS Update Servers.
What I want to avoid is a reporting nightmare.
For example, I do not want my reporting to come back and say:
Group A does not need 1,226 updates.
What are your thoughts on Driver updates via WSUS?

Similar Messages

WSUS - NAC Best Practice

Hello every one,
I'm making a Demo of NAC in both IB and OOB VG enviroments. I'm trying to add a WSUS policy to be checked on the client machines. The firs I tried Take around 5 min every time I log in. I understand this happens because I using the severity option when I configure the requirement. If I use the the Cisco Rules option will this be faster?
Is there a site I can consult to see what the Pre-Configured rules check for.
Can anybody tell me a good configuration for this requirement knowing this is a demo and I just want it to work.
Thanks in advance.

For new deployments of Cisco NAC Appliance, by default all traffic from the trusted to the untrusted network is allowed, and traffic from the untrusted network to the trusted network is blocked for the default system roles (Unauthenticated, Temporary, Quarantine) and new user roles you create. This allows you to expand access as necessary for traffic sourced from the untrusted network.

Best Practice for SUP and WSUS Installation on Same Server

Hi Folks,
I have a question, I am in process of deploying SCCM 2012 R2... I was in process of deploying Software Update Point on SCCM with one of the existing WSUS server installed on a separate server from SCCM.
A debate has started with of the colleague who says that the using remote WSUS server is recommended by Microsoft because of the scalability security that WSUS will be downloading the updates from Microsoft and SCCM should be working as downstream
server to fetch updates from WSUS server.
but according to my consideration it is recommended to install WSUS server on the same server where SCCM is installed... actually it is recommended to install WSUS on a site system and you can used the same SCCM server to deploy WSUS.
please advice me the best practices for deploying SCCM and WSUS ... what Microsoft says about WSUS to be installed on same SCCM server OR WSUS should be on a separate server then the SCCM server ???
awaiting your advices ASAP :)
Regards, Owais

Hi Don,
thanks for the information, another quick one...
the above mentioned configuration I did is correct in terms of planning and best practices?
I agree with Jorgen, it's ok to have WSUS/SUP on the same server as your site server, or you can have WSUS/SUP on a dedicated server if you wish.
The "best practice" is whatever suits your environment, and is a supported-by-MS way of doing it.
One thing to note, is that if WSUS ever becomes "corrupt" it can be difficult to repair and sometimes it's simplest to rebuild the WSUS Windows OS. If this is on your site server, that's a big deal.
Sometimes, WSUS goes wrong (not because of ConfigMgr)..
Note that if you have a very large estate, or multiple primary site servers, you might have a CAS, and you would need a SUP on the CAS. (this is not a recommendation for a CAS, just to be aware)
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Best practice on drivers update

How to update driver?
There are so many different types mode of computers. update drives with inf or exe?

You can do it with two ways:
Application model
Package / Program
I don't know is there really a 'best practice' though. The driver updating itself is done with this neat little utility called devcon.exe (more info on the syntax it uses here:
http://msdn.microsoft.com/en-us/library/windows/hardware/ff544746%28v=vs.85%29.aspx). For the correct version of the utility, you need to download Windows Driver Kit for the correct version of Windows you will be deploying the updated drivers to (http://msdn.microsoft.com/en-US/windows/hardware/gg454513).
Devcon is used for the .inf file updates, for the .exe packaged drivers you simply run the .exe silently. Jörgen has done an excellent sample on this with the application model:
http://ccmexec.com/2013/10/update-a-device-driver-configuration-manager-2012/

WSUS with SCCM 2012 - Products Missing, and Best Practices

Good morning all
I am integrating SCCM with WSUS, and I have a few questions regarding products. I've noticed when running through the "Add site system roles wizard" in SCCM 2012 console that when I go to "Products" it does NOT list a few major
products, such as office 2013, sql server 2013, exchange 2013, etc.
Am I missing something? I'm sure I am...what do I need to do?
Also, if there are any other gotchas or best practices you all can point me in the right direction as far as managing SCCM / WSUS together i'd be greatly appreciated.
Thanks so much!

Do not use WSUS Console to manage the updates. All you things you can finish is in the SCCM Console. Refer to the link posted by Jason.
Juke Chou
TechNet Community Support

Best practices to share 4 printers on small network running Server 2008 R2 Standard (service pack 1)

Hello,
I'm a new IT admin at a small company (10-12 PCs running Windows 7 or 8) which has 4 printers. I'd like to install the printers either connected to the server or as wireless printers (1 is old enough to require
a USB connection to a PC, no network capability), such that every PC has access to each printer.
Don't worry about the USB printer - I know it's not the best way to share a printer, but it's not a critical printer; I just want it available when its PC is on.
I've read a lot about the best way to set up printers, including stuff about group policy and print server, but I am not a network administrator, and I don't really understand any of it. I'd just like to install
the drivers on the server or something, and then share them. Right now all the printers do something a little different: one is on a WSD port, two has a little "shared" icon, one has the icon but also a "network" icon... it's very confusing.
Can anyone help me with a basic setup that I can do for each printer?
p.s. they all have a reserved IP address.
Thanks,
Laura

may need to set print server... maybe helpful.
http://www.techiwarehouse.com/engine/9aa10a93/How-to-Share-Printer-in-Windows-Server-2008-R2
http://blogs.technet.com/b/yongrhee/archive/2009/09/14/best-practices-on-deploying-a-microsoft-windows-server-2008-windows-server-2008-r2-print-server.aspx
http://joeit.wordpress.com/2011/06/08/how-do-i-share-a-printer-from-ws2008-r2-to-x86-clients-or-all-printers-should-die-in-a-fire/
Best,
Howtodo

(Request for:) Best practices for setting up a new Windows Server 2012 r2 Hyper-V Virtualized AD DC

Could you please share your best practices for setting up a new Windows Server 2012 r2 Hyper-V Virtualized AD DC, that will be running on a new WinSrv 2012 r2 host server. (This
will be for a brand new network setup, new forest, domain, etc.)
Specifically, your best practices regarding:
the sizing of non virtual and virtual volumes/partitions/drives,
the use of sysvol, logs, & data volumes/drives on hosts & guests,
RAID levels for the host and the guest(s),
IDE vs SCSI and drivers both non virtual and virtual and the booting there of,
disk caching settings on both host and guests.
Thanks so much for any information you can share.

A bit of non essential additional info:
We are small to midrange school district who, after close to 20 years on Novell networks, have decided to design and create a new Microsoft network and migrate all of our data and services
over to the new infrastructure . We are planning on rolling out 2012 r2 servers with as much Hyper-v virtualization as possible.
During the last few weeks we have been able to find most of the information we need to undergo this project, and most of the information was pretty solid with little ambiguity, except for
information regarding virtualizing the DCs, which as been a bit inconsistent.
Yes, we have read all the documents that most of these posts tend point to, but found some, if not most are still are referring to performing this under Srvr 2008 r2, and haven’t really
seen all that much on Srvr2012 r2.
We have read these and others:
Introduction to Active Directory Domain Services (AD DS) Virtualization (Level 100),
Virtualized Domain Controller Technical Reference (Level 300),
Virtualized Domain Controller Cloning Test Guidance for Application Vendors,
Support for using Hyper-V Replica for virtualized domain controllers.
Again, thanks for any information, best practices, cookie cutter or otherwise that you can share.
Chas.

Best Practices for Setting up a Windows 2012 R2 STD Domain Controller in a Remote Site

So I'm looking for an article or writeup similar to the "Adding Domain Controllers in Remote Sites" TechNet article but for Windows Server 2012 STD R2. Here is my scenario:
1. I want to setup the domain controller at Site A where the primary domain controller is located. The primary domain controller is Windows Server 2008 R2.
2. Once the DC is setup I plan on leaving it on our network for a few days before shipping it to remote Site B for installation
Other key items:
1. The remote Site B will have a different IP range than Site A but will be connected to Site A via a single VPN tunnel. All the DCs that replicate with each other are on the same domain.
2. The 2012 DC that I setup for Site B (same domain in same forest) will be a DHCP, DNS, and WSUS server all replicating to the primary DC at Site A
Questions:
1. What items can I setup while it's at Site A without effecting or conflicting with the existing network and domain controller? Can I setup a scope once the DHCP role is added?
2. All of our DCs replicate through Sites and Services, do I have to manually add this to our primary DC for the new DC going to remote Site B? Or when does this happen automatically when I promote the DC?
All and all I'm just looking for a list of Best Practices for 2012 or a Step by Step Guide. Any help would be appreciated.

Hi,
Thanks for your posting.
When you install AD DS in the hub or staging site, disconnect the installed domain controller, and then ship the computer to the remote site, you are disconnecting a viable domain controller from the replication topology.
For more and detail information, please refer to:
Best Practices for Adding Domain Controllers in Remote Sites
http://technet.microsoft.com/en-us/library/cc794962(v=ws.10).aspx
Regards.
Vivian Wang

Best practice for managing a Windows 7 deployment with both 32-bit and 64-bit?

What is the best practice for creating and organizing deployment shares in MDT for a Windows 7 deployment that has mostly 32-bit computers, but a few 64-bit computers as well? Is it better to create a single deployment share for Windows 7 and include both
versions, or is it better to create two separate deployment shares? And what about 32-bit and 64-bit versions of applications?
I'm currently leaning towards creating two separate deployment shares, just so that I don't have to keep typing (x86) and (x64) for every application I import, as well as making it easier when choosing applications in the Lite Touch installation. But I know
each deployment share has the option to create both an x86 and x64 boot image, so that's why I am confused.

Supporting two task sequences is way easier than supporting two shares. Two shares means two boot media, or maintaining a method of directing the user to one or the other. Everything needs to be imported or configured twice. Not to mention doubling storage
space. MDT is designed to have multiple task sequences, why wouldn't you use them?
Supporting multiple task sequences can be a pain, but not bad once you get a system. Supporting app installs intelligently is a large part of that. We have one folder per app install, with a wrapper vbscript that handles OS detection. If there are separate
binaries, they are placed in x86 and x64 subfolders. Everything runs from one folder via the same command, "cscript install.vbs". So, import once, assign once, and forget it. Its the same install package we use for Altiris, and we'll be using a Powershell
version of it when we fully migrate to SCCM.
Others handle x86 and x64 apps separately, and use the MDT app details to select what platform the app is meant for. I've done that, but we have a template for the vbscript wrapper and its a standard process, I believe its easier. YMMV.
Once you get your apps into MDT, create bundles. Core build bundle, core deploy bundle, Laptop deploy bundle, etcetera. Now you don't have to assign twenty apps to both task sequences, just one bundle. When you replace one app in the bundle, all TS'es are
updated automatically. Its kind of the same mentality as active directory. Users, groups and resources = apps, bundles and task sequences.
If you have separate build and deploy shares in your lab, great. If not, separate your apps into build and deploy folders in your lab MDT share. Use a selection profile to upload only your deploy side to production. In fact I separate everything (except
drivers) into Build and deploy folders on my lab server. Don't mix build and deploy, and don't mix Lab/QA and production. I also keep a "Retired" folder. When I replace an app, TS, OS, etcetera, I move it to the retired folder and append "RETIRED - " to the
front of it so I can instantly spot it if it happens to show up somewhere it shouldn't.
To me, the biggest "weakness" of MDT is its flexibility. There's literally a dozen different ways to do everything, and there's no fences to keep you on the path. If you don't create some sort of organization for yourself, its very easy to get lost as things
get complicated. Tossing everything into one giant bucket will have you pulling your hair out.

Best practice for designing a print enviroment?

Greetings,
If there is a better location for this, please let me know.
Goal:
Redesign and redeploy my print enviroment with best practices in mind.
Overview: VMWare enviroment running 2008 R2, with ~200 printers. I have a majority of HP printers ranging from 10 years old to brand new. Laserjets, MFPs, OfficeJets, etc.. etc.. in addition to Konica, Xerox, and Savin copiers. Many of our printer models aren't support in 2008, let alone x64.
Our future goals include eprint services, as well as a desire to manage print quality, and consumition levels through something like Web Jetadmin.
Presently we have a 2003 x86 server running our very old printers and until 6 months ago the rest on a single 2008r2 x64 server. We ended up not giving it the attention of detail it needed and the drivers became very cluttered, this lead to a single UPD PCL6 update that ended up corrupting several drivers across the UPD PCL 5 and 6 spectrum. At that time we brought up a second 2008r2 server and began to migrate those affected. In some instances we were forced to manually delete the drivers off of the clients system32->Spool->Driver and reinstall.
I haven't had much luck finding good best practice information and figured I'd ask. Some documents I came across suggested that I should isolate a Universal driver to a single server, such as 3 servers for PCL5, PCL6, and PS. Then there is the need to deal with my various copiers.
I appreciate your advice, thank you!
This question was solved.
View Solution.

This forum is focused on consumer level products. For your question you may have better results in the HP Enterprise forum here.
Bob Headrick, HP Expert
I am not an employee of HP, I am a volunteer posting here on my own time.
If your problem is solved please click the "Accept as Solution" button ------------V
If my answer was helpful please click the "Thumbs Up" to say "Thank You"--V

Best practice to initialize my instruments

I wonder what is the best practice to initilize instruments on test stand.
i have a vi that will ready a INI configuration file and map my instruments and will output a cluster(DMM, Scope, etc..)
so when starting the sequence on pre UUT i will load that ini file and pass it to some local variables.(dmm, scope, function generator etc..).
the question is here. is it better to initialize every instrument on the sequence one by one, or is it better to make a vi and initialize everything on one vi.
or do a call to a sequence where i initialize all step by step?
just some random thoughts but i wonder what is the best practice.

I initialize each instrument in a special sequence in TestStand. Seems a little easier to maintain my drivers that way. It is also a little cleaner than doing a state machine or sequence everything with an error cluster in LabVIEW.
Of course, I also have each instrument with its own routine to read the configuration file and initialize the driver/instrument. So I just have to pass the configuration file around inside of TestStand.
There are only two ways to tell somebody thanks: Kudos and Marked Solutions
Unofficial Forum Rules and Guidelines

Kernel: PANIC! -- best practice for backup and recovery when modifying system?

I installed NVidia drivers on my OL6.6 system at home and something went bad with one of the libraries. On reboot, the kernel would panic and I couldn't get back into the system to fix anything. I ended up re-installing the OS to recovery my system.
What would be some best practices for backing up the system when making a change and then recovering if this happens again?
Would LVM snapshots be a good option? Can I recovery a snapshot from a rescue boot?
EX: File system snapshots with LVM | Ars Technica -- scroll down to the section discussing LVM.
Any pointers to documentation would be welcome as well. I'm just not sure what to do to revert the kernel or the system when installing something goes bad like this.
Thanks for your attention.

There is often a common misconception: A snapshot is not a backup. A snapshot and the original it was taken from initially share the same data blocks. LVM snapshot is a general purpose solution which can be used, for example, to quickly create a snapshot prior to a system upgrade, then if you are satisfied with the result, you would delete the snapshot.
The advantage of a snapshot is that it can be used for a live filesystem or volume while changes are written to the snapshot volume. Hence it's called "copy on write (COW), or copy on change if you want. This is necessary for system integrity to have a consistent data status of all data at a certain point in time and to allow changes happening, for example to perform a filesystem backup. A snapshot is no substitute for a disaster recovery in case you loose your storage media. A snapshot only takes seconds, and initially does not copy or backup any data, unless data changes. It is therefore important to delete the snapshot if no longer required, in order to prevent duplication of data and restore file system performance.
LVM was never a great thing under Linux and can cause serious I/O performance bottlenecks. If snapshot or COW technology suits your purpose, I suggest you look into Btrfs, which is a modern filesystem built into the latest Oracle UEK kernel. Btrfs employs the idea of subvolumes and is much more efficient that LVM because it can operate on files or directories while LVM is doing the whole logical volume.
Keep in mind however, you cannot use LVM or Btrfs with the boot partition, because the Grub boot loader, which loads the Linux kernel, cannot deal with LVM or BTRFS before loading the Linux kernel (catch22).
I think the following is an interesting and fun to read introduction explaining basic concepts:
http://events.linuxfoundation.org/sites/events/files/slides/Btrfs_1.pdf

Best Practice for Installation of Both Leopard and Aperture 2 upgrade.

I've finally bought the bullet and purchased both Leopard and Aperture 2.0 upgrade. I've tried searching for a best practice to install both, but haven't been able to find one--only trouble shooting type stuff. Any suggestions, things to avoid, etc would be greatly appreciated. Even a gentle shove to a prior thread would be helpful. . . .
Thanks for pointing me in the right direction.
Steve

steve hutchcraft wrote:
I've tried searching for a best practice to install...
• First be really sure that all your apps work well with 10.5.3 before you leave 10.4.11, which is extraordinarily stable.
• Immediately prior to and immediately after every installation of any kind (OS, apps, drivers, etc.) got to Utilities/Disk Utility/First Aid, and Repair Permissions. Repairing Permissions is not a problem fixer per se, but anecdotally many folks with heavy graphics installations (including me) who follow that protocol seem to maintain better operating environments under the challenge of heavy graphics than folks who do not diligently do so.
• When you upgrade the OS do a "clean install."
• RAM is relatively inexpensive and 2 GB RAM is limiting. I recommend adding 4x2 GB RAM. One good source is OWC: http://www.owcomputing.com/.
• After you do your installations check for updates to the OS and/or Aperture, and perform any upgrades. Remember to Repair Permissions immediately prior to and immediately after the upgrade installations.
• If you are looking for further Aperture performance improvement, consider the Radeon HD 3870. Reviews at http://www.barefeats.com/harper16.html and at http://www.barefeats.com/harper17.html.
Good luck!
-Allen Wicks

Best practice for moving from a G5 to a new Mac with SL

I am receiving my new iMac today (27") and am very excited
However I want to move over using the best practices to assure that I remain excited and not frustrated
My initial thoughts are to boot it up and doe the initial set up - to move my iPhoto library over and to use migration assistance to move the rest of my data files
Then to install all of the extra software that I can find the packages for from the original installation disks
And then finally to use migration assistant again to move over any software that I can not find original disks for (I've moved from Mac to Mac to Mac over and over and some of the software goes back to OS 9 (and won't run anymore I guess)
Is this a good way
OR
will I mess up doing it this way
OR
am I spending far too much time worrying about moving old problems over and would be better off to just turn MA loose and let it do its thing form the beginning?
BTW - mail crashes a lot on my existing system - pretty much everything else seems ok - except iPhoto is slow - hoping that the new Intel dual core will help that
LN

Migration Assistant is not a general file moving tool. MA will migrate your Applications and Home folders transferring only your third-party applications. MA will transfer any application support folders required by your applications, your preferences, and network setup. You do not have a choice of what will be migrated other than the above. MA cannot determine whether anything transferred is compatible with Snow Leopard. I recommend you look at the following:
A Basic Guide for Migrating to Intel-Macs
If you are migrating a PowerPC system (G3, G4, or G5) to an Intel-Mac be careful what you migrate. Keep in mind that some items that may get transferred will not work on Intel machines and may end up causing your computer's operating system to malfunction.
Rosetta supports "software that runs on the PowerPC G3, G4, or G5 processor that are built for Mac OS X". This excludes the items that are not universal binaries or simply will not work in Rosetta:
Classic Environment, and subsequently any Mac OS 9 or earlier applications
Screensavers written for the PowerPC
System Preference add-ons
All Unsanity Haxies
Browser and other plug-ins
Contextual Menu Items
Applications which specifically require the PowerPC G5
Kernel extensions
Java applications with JNI (PowerPC) libraries
See also What Can Be Translated by Rosetta.
In addition to the above you could also have problems with migrated cache files and/or cache files containing code that is incompatible.
If you migrate a user folder that contains any of these items, you may find that your Intel-Mac is malfunctioning. It would be wise to take care when migrating your systems from a PowerPC platform to an Intel-Mac platform to assure that you do not migrate these incompatible items.
If you have problems with applications not working, then completely uninstall said application and reinstall it from scratch. Take great care with Java applications and Java-based Peer-to-Peer applications. Many Java apps will not work on Intel-Macs as they are currently compiled. As of this time Limewire, Cabos, and Acquisition are available as universal binaries. Do not install browser plug-ins such as Flash or Shockwave from downloaded installers unless they are universal binaries. The version of OS X installed on your Intel-Mac comes with special compatible versions of Flash and Shockwave plug-ins for use with your browser.
The same problem will exist for any hardware drivers such as mouse software unless the drivers have been compiled as universal binaries. For third-party mice the current choices are USB Overdrive or SteerMouse. Contact the developer or manufacturer of your third-party mouse software to find out when a universal binary version will be available.
Also be careful with some backup utilities and third-party disk repair utilities. Disk Warrior 4.1, TechTool Pro 4.6.1, SuperDuper 2.5, and Drive Genius 2.0.2 work properly on Intel-Macs with Leopard. The same caution may apply to the many "maintenance" utilities that have not yet been converted to universal binaries. Leopard Cache Cleaner, Onyx, TinkerTool System, and Cocktail are now compatible with Leopard.
Before migrating or installing software on your Intel-Mac check MacFixit's Rosetta Compatibility Index.
Additional links that will be helpful to new Intel-Mac users:
Intel In Macs
Apple Guide to Universal Applications
MacInTouch List of Compatible Universal Binaries
MacInTouch List of Rosetta Compatible Applications
MacUpdate List of Intel-Compatible Software
Transferring data with Setup Assistant - Migration Assistant FAQ
Because Migration Assistant isn't the ideal way to migrate from PowerPC to Intel Macs, using Target Disk Mode, copying the critical contents to CD and DVD, an external hard drive, or networking
will work better when moving from PowerPC to Intel Macs. The initial section below discusses Target Disk Mode. It is then followed by a section which discusses networking with Macs that lack Firewire.
If both computers support the use of Firewire then you can use the following instructions:
1. Repair the hard drive and permissions using Disk Utility.
2. Backup your data. This is vitally important in case you make a mistake or there's some other problem.
3. Connect a Firewire cable between your old Mac and your new Intel Mac.
4. Startup your old Mac in Target Disk Mode.
5. Startup your new Mac for the first time, go through the setup and registration screens, but do NOT migrate data over. Get to your desktop on the new Mac without migrating any new data over.
If you are not able to use a Firewire connection (for example you have a Late 2008 MacBook that only supports USB:)
1. Set up a local home network: Creating a small Ethernet Network.
2. If you have a MacBook Air or Late 2008 MacBook see the following:
MacBook (13-inch, Aluminum, Late 2008) and MacBook Pro (15-inch, Late 2008)- Migration Tips and Tricks;
MacBook (13-inch, Aluminum, Late 2008) and MacBook Pro (15-inch, Late 2008)- What to do if migration is unsuccessful;
MacBook Air- Migration Tips and Tricks;
MacBook Air- Remote Disc, Migration, or Remote Install Mac OS X and wireless 802.11n networks.
Copy the following items from your old Mac to the new Mac:
In your /Home/ folder: Documents, Movies, Music, Pictures, and Sites folders.
In your /Home/Library/ folder:
/Home/Library/Application Support/AddressBook (copy the whole folder)
/Home/Library/Application Support/iCal (copy the whole folder)
Also in /Home/Library/Application Support (copy whatever else you need including folders for any third-party applications)
/Home/Library/Keychains (copy the whole folder)
/Home/Library/Mail (copy the whole folder)
/Home/Library/Preferences/ (copy the whole folder)
/Home /Library/Calendars (copy the whole folder)
/Home /Library/iTunes (copy the whole folder)
/Home /Library/Safari (copy the whole folder)
If you want cookies:
/Home/Library/Cookies/Cookies.plist
/Home/Library/Application Support/WebFoundation/HTTPCookies.plist
For Entourage users:
Entourage is in /Home/Documents/Microsoft User Data
Also in /Home/Library/Preferences/Microsoft
Credit goes to Macjack for this information.
If you need to transfer data for other applications please ask the vendor or ask in the Discussions where specific applications store their data.
5. Once you have transferred what you need restart the new Mac and test to make sure the contents are there for each of the applications.
Written by Kappy with additional contributions from a brody.
Revised 1/6/2009
In general you are better off reinstalling any third-party software that is PPC-only. Otherwise update your software so it's compatible with Snow Leopard.
Do not transfer any OS 9 software because it's unsupported. You can transfer documents you want to keep.
Buy an external hard drive to use for backup.

Exchange Best Practices Analyzer and Event 10009 - DCOM

We have two Exchange 2010 SP3 RU7 servers on Windows 2008 R2
In general, they seem to function correctly.
ExBPA (Best Practices Analyzer) results are fine. Just some entries about drivers being more than two years old (vendor has not supplied newer drivers so we use what we have). Anything else has been verified to be something that can "safely be ignored".
Test-ServiceHealth, Test-ReplicationHealth and other tests indicate no problems.
However, when I run the ExBPA, it seems like the server on which I run ExBPA attempts to contact the other using DCOM and this fails.
Some notes:
1. Windows Firewall is disabled on both.
2. Pings in both directions are successful.
3. DTCPing would not even run so I was not able to test with this.
4. Connectivity works perfectly otherwise. I can see/manage either server from the other using the EMC or EMS. DAG works fine as far as I can see.
What's the error message?
Event 10009, DistributedCOM
"DCOM was unable to communiate with the computer --- opposite Exchange server of the pair of Exchange servers--- using any of the configured protocols."
This is in the System Log.
This happens on both servers and only when I run the ExBPA.
I understand that ExBPA uses DCOM but cannot see what would be blocking communications.
I can access the opposite server in MS Management Consoles (MMC).
Note: the error is NOT in the ExBPA results - but rather in the Event Viewer System Log.
Yes, it is consistent. Have noticed it for some time now.
Does anyone have any idea what could be causing this? Since normal Exchange operations are not affected, I'm tempted to ignore it, but I have to do my "due diligence" and inquire.
Please mark as helpful if you find my contribution useful or as an answer if it does answer your question. That will encourage me - and others - to take time out to help you.

Hi David,
I recommend you refer the following article to troubleshoot this event:
How to troubleshoot DCOM 10009 error logged in system event
Why this happens:
Totally speaking, the reason why DCOM 10009 is logged is that: local RPCSS service can’t reach the remote RPCSS service of remote target server. There are many possibilities which can cause this issue.
Scenario 1:
The remote target server happens to be offline for a short time, for example, just for maintenance.
Scenario 2:
Both servers are online. However, there RPC communication issue exists between these two servers, for example: server name resolvation failure, port resources for RPC communication exhaustion, firewall configuration.
Scenario 3:
Even though the TCP connection to remote server has no any problem, but if the communication of RPC authentication gets problem, we may get the error status code like 0x80070721 which means “A security package specific
error occurred” during the communication of RPC authentication, DCOM 10009 will also be logged on the client side.
Scenario 4:
The target DCOM |COM+ service failed to be activated due to permission issue. Under this kind of situation, DCOM 10027 will be logged on the server side at the same time.
Event ID 10009 — COM Remote Service Availability
Resolve
Ensure that the remote computer is available
There is a problem accessing the COM Service on a remote computer. To resolve this problem:
Ensure that the remote computer is online.
This problem may be the result of a firewall blocking the connection. For security, COM+ network access is not enabled by default. Check the system to determine whether the firewall is blocking the remote connection.
Other reasons for the problem might be found in the Extended Remote Procedure Call (RPC) Error information that is available in Event Viewer.
To perform these procedures, you must have membership in Administrators, or you must have been delegated the appropriate authority.
Ensure that the remote computer is online
To verify that the remote computer is online and the computers are communicating over the network:
Open an elevated Command Prompt window. Click Start, point to
All Programs, click Accessories, right-click
Command Prompt, and then click Run as administrator. If the
User Account Control dialog box appears, confirm that the action it displays is what you want, and then click
Continue.
At the command prompt, type ping, followed by a space and the remote computer name, and then press ENTER. For example, to check that your server can communicate over the network with a computer named ContosoWS2008, type
ping ContosoWS2008, and then press ENTER.
A successful connection results in a set of replies from the other computer and a set of
ping statistics.
Check the firewall settings and enable the firewall exception rule
To check the firewall settings and enable the firewall exception rule:
Click Start, and then click Run.
Type wf.msc, and then click OK. If the
User Account Control dialog box appears, confirm that the action it displays is what you want, and then click
Continue.
In the console tree, click Inbound rules.
In the list of firewall exception rules, look for COM+ Network Access (DCOM In).
If the firewall exception rule is not enabled, in the details pane click
Enable rule, and then scroll horizontally to confirm that the protocol is
TCP and the LocalPort is 135. Close Windows Firewall with Advanced Security.
Review available Extended RPC Error information for this event in Event Viewer
To review available Extended RPC Error information for this event in Event Viewer:
Click Start, and then click Run.
Type comexp.msc, and then click OK. If the
User Account Control dialog box appears, confirm that the action it displays is what you want, and then click
Continue.
Under Console Root, expand Event Viewer (Local).
In the details pane, look for your event in the Summary of Administrative Events, and then double-click the event to open it.
The Extended RPC Error information that is available for this event is located on the
Details tab. Expand the available items on the Details tab to review all available information.
For more information about Extended RPC Error information and how to interpret it, see Obtaining Extended RPC Error Information (http://go.microsoft.com/fwlink/?LinkId=105593).
Best regards,
Niko Cheng
TechNet Community Support

WSUS Drivers Best Practices

Similar Messages

Maybe you are looking for