Score:-1

DC cannot find WSUS server

de flag

We have a domain controller which is stuck in OOBE because it cannot update from WSUS and does not appear in the WSUS console.

When running nslookup wsusservername on the DC we get the following response:

C:\Windows\system32>nslookup wsusservername
Server: dc002.(domain).local
Address: 172.16.164.xx
*** dc002.(domain).local can't find wsusservername: Non-existent domain

All servers are in the same domain.

Doing some research on this error suggests looking at the following:

  • DNS reverse lookup zone 64.16.172.in-addr.arpa contains correct PRT record for the WSUS server
  • DNS forward lookup zone for the domain contains correct A record for the WSUS server
  • I can ping the WSUS server successfully from the DC
  • DNS servers are configured correctly on the NICs of the DC and WSUS servers.
  • Other servers have been patched successfully earlier this month.
  • Configured Group Policy Objects are all applying correctly as per gpresult /r
  • Registry entries are pointing to the WSUS server (HKLM/SOFTWARE/Policies/Microsoft/Windows/WindowsUpdate).

It should be noted here that running the following command failed with this message:

C:\Windows\system32>reg query HKLM/SOFTWARE/Policies/Microsoft/Windows/WindowsUpdate
ERROR: Invalid key name.
Type "REG QUERY /?" for usage.

Yet this key quite clearly appears in the registry editor - I'm unsure if this is related to the overall problem or something else entirely.

When checking IIS on the WSUS box, the configured ports are 80 for HTTP and 8531 for HTTPS and the GPO applied to the OU containing the problematic DC specifies port 80. This is also reflected in the registry.

This is turning into a right head-scratcher so any help would be greatly appreciated!

cn flag
The REG command returns the error due to Windows uses backslashes, not forward slashes. Windows and AD also do not need PTR records.
Rich M avatar
de flag
@GregAskew Schoolboy error on my part there! Can you explain why PTR records are not needed please?
cn flag
I don't know, but it isn't related to why the DNS server you are using is not resolving a name.
Rich M avatar
de flag
@GregAskew - Not sure I agree, what you're saying is Windows and AD don't need IP address to resource name resolution, as this is precisely what PTR records and RLZs are for?
Score:0
de flag

The Reverse Lookup Zone for the subnet the problematic DC is on is completely missing from DNS!

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.