{"id":277,"date":"2016-05-03T13:32:05","date_gmt":"2016-05-03T11:32:05","guid":{"rendered":"https:\/\/darkvoice.dyndns.org\/blog\/?p=277"},"modified":"2016-09-11T20:57:07","modified_gmt":"2016-09-11T18:57:07","slug":"detect-duplicate-susclientids-on-wsus-side","status":"publish","type":"post","link":"https:\/\/ms07.de\/blog\/?p=277","title":{"rendered":"Detect duplicate SusClientIds on WSUS side"},"content":{"rendered":"<p>In a large environment with many active directory domains and some servers which are not domain members, it is difficult to find all duplicate SusClientIds. Remote registry queries are not an option because there are many systems in protected networks behind firewalls.<\/p>\n<p>So I decided to use the IIS Failed Request Log to detect duplicate SusClientIds.<\/p>\n<h3>Install IIS Tracing<\/h3>\n<p>Start the Server-Manager and install the following role service:<br \/>\nTracing (under World Wide Web Services &#8211; Health and Diagnostics &#8211; Tracing)<\/p>\n<h3>Enable Failed-Request Tracing<\/h3>\n<ol>\n<li>Open the <strong>Internet Information Services (IIS) Manager<\/strong><\/li>\n<li>In the <strong>Connections <\/strong>pane, expand the machine name, expand <strong>Sites<\/strong>, and then click on the Site, where WSUS runs.<\/li>\n<li>In the <strong>Actions<\/strong> pane, under <strong>Configure<\/strong>, click <strong>Failed Request Tracing\u2026<\/strong><\/li>\n<\/ol>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-281 size-full\" src=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestSettings.png\" alt=\"FailedRequestSettings\" width=\"376\" height=\"215\" srcset=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestSettings.png 376w, https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestSettings-300x172.png 300w\" sizes=\"auto, (max-width: 376px) 100vw, 376px\" \/><\/p>\n<ul>\n<li>Select the <strong>Enable<\/strong> check box.<\/li>\n<li>Set <strong>Maximum number of trace files<\/strong> to [number of WSUS clients x 5]<\/li>\n<\/ul>\n<h3>Configure Failed Request Tracing Rule<\/h3>\n<ol>\n<li>Double-click <strong>Failed Request Tracing Rules<\/strong>.<\/li>\n<li>In the <strong>Actions<\/strong> pane, click <strong><strong>Add&#8230;<\/strong><\/strong><br \/>\n<h3><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-284 size-full\" src=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule1.png\" alt=\"FailedRequestRule1\" width=\"298\" height=\"270\" \/><\/h3>\n<\/li>\n<li>In the <strong>Add Failed Request Tracing Rule<\/strong> wizard, on the <strong>Specify Content to Trace<\/strong> page, select <strong>Custom <\/strong>and enter the value <strong>ReportingWebService.asmx<\/strong>. Click <strong>Next<\/strong>.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-285 size-full\" src=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule2.png\" alt=\"FailedRequestRule2\" width=\"337\" height=\"306\" srcset=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule2.png 337w, https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule2-300x272.png 300w\" sizes=\"auto, (max-width: 337px) 100vw, 337px\" \/><\/li>\n<li>On the <strong>Define Trace Conditions<\/strong> page, select the <strong>Status code(s)<\/strong> check box and enter <strong>200<\/strong> as the status code to trace. Click <strong>Next<\/strong>.<img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-287 size-full\" src=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule3.png\" alt=\"FailedRequestRule3\" width=\"429\" height=\"305\" srcset=\"https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule3.png 429w, https:\/\/ms07.de\/blog\/wp-content\/uploads\/2016\/05\/FailedRequestRule3-300x213.png 300w\" sizes=\"auto, (max-width: 429px) 100vw, 429px\" \/><\/li>\n<li>On the <strong>Select Trace Providers <\/strong>page, under <strong>Providers<\/strong>, select the <strong>WWW Server<\/strong> check box. Under <strong>Areas<\/strong>, select the <strong>Compression <\/strong>check box and clear all other check boxes. Compression is not what we are looking for, but it is required to select at least one Area.<\/li>\n<li>Under <strong>Verbosity<\/strong>, select <strong>Verbose<\/strong>.<\/li>\n<li>Click <strong>Finish<\/strong>.<\/li>\n<\/ol>\n<h3>Analyze Logfiles<\/h3>\n<p>After some logging (minimum 24h) in the Path <strong>C:\\inetpub\\logs\\FailedReqLogFiles\\W3SVC[xxxxxxxxx] <\/strong>are many new xml-files are created. This is the work directory for the following steps.<\/p>\n<p>To analyze this files, I wrote the script\u00a0<strong>get-susclientids.ps1<\/strong> to get a list of all IPs and SusClientIds.<\/p>\n<pre>$list = @()\r\nForeach ($file in (Get-ChildItem *.xml)){\r\n\u00a0\u00a0\u00a0 $entry = New-Object -TypeName PSObject\r\n\u00a0\u00a0\u00a0 $filecontent = Get-Content $file.name\r\n\u00a0\u00a0\u00a0 $SCIline = ($filecontent | ? { $_ -like \"*;&amp;lt;Sid&amp;gt;*\"})\r\n\u00a0\u00a0\u00a0 $remoteaddrline = ($filecontent | ? { $_ -like \"*&lt;Data Name=\"\"RemoteAddress\"\"&gt;*\"})\r\n\u00a0\u00a0\u00a0 $remoteaddr = $remoteaddrline.Substring($remoteaddrline.IndexOf(\"\"\"RemoteAddress\"\"&gt;\")+16,$remoteaddrline.Length-36)\r\n\u00a0\u00a0\u00a0 If($SCIline -and $SCIline.IndexOf(\";&amp;lt;Sid&amp;gt;\") -gt 0){\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Add-Member -InputObject $entry -MemberType NoteProperty -Name RemoteAddr -Value $remoteaddr\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Add-Member -InputObject $entry -MemberType NoteProperty -Name SusClientId -Value $SCIline.substring($SCIline.IndexOf(\";&amp;lt;Sid&amp;gt;\")+12,36)\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 If(@($list | ? { $_.remoteaddr -eq $remoteaddr }).count -lt 1){\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $list += $entry\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }\r\n\u00a0\u00a0\u00a0 }\r\n}\r\n$list | export-csv -path susclientids.csv\r\n<\/pre>\n<p>The result can be queried with this command:<br \/>\nImport-Csv .\\susclientids.csv<\/p>\n<p>Example output:<\/p>\n<pre>RemoteAddr\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SusClientId\r\n----------\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -----------\r\n10.0.0.1   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\r\n10.0.0.2    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 ffffffff-0000-1111-2222-333333333333\r\n10.0.0.7   \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee<\/pre>\n<h3>Finding Duplicates<\/h3>\n<p>To find duplicate SusClientIds I wrote the script <strong>get-duplicate.ps1<\/strong>:<\/p>\n<pre>$duplicates = Import-Csv .\\susclientids.csv | sort susclientid | group susclientid | ? { $_.count -gt 1}\r\n$list = @()\r\nforeach ($duplicateSCI in $duplicates){\r\n\u00a0\u00a0\u00a0 foreach ($system in $duplicateSCI.Group){\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $entry = New-Object -TypeName PSObject\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Add-Member -InputObject $entry -MemberType NoteProperty -Name RemoteAddr -Value $system.remoteaddr\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 try {\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $fqdn = ([System.Net.Dns]::GetHostEntry($system.remoteaddr).Hostname)\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 } catch {\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $fqdn = \"\"\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 }\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Add-Member -InputObject $entry -MemberType NoteProperty -Name FQDN -Value $fqdn\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Add-Member -InputObject $entry -MemberType NoteProperty -Name SusClientId -Value $system.SusClientId\r\n\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 $list += $entry\r\n\u00a0\u00a0\u00a0 }\r\n}\r\n$list<\/pre>\n<p>Example output:<\/p>\n<pre>RemoteAddr\u00a0\u00a0\u00a0\u00a0 FQDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 SusClientId\r\n----------\u00a0\u00a0\u00a0\u00a0 ----\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 -----------\r\n10.0.0.1\u00a0\u00a0\u00a0 \u00a0\u00a0 host1.domain.com \u00a0 aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee\r\n10.0.0.7\u00a0\u00a0\u00a0\u00a0\u00a0  host7.domain.com\u00a0  aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee<\/pre>\n<p>Now it&#8217;s time to <a href=\"https:\/\/gallery.technet.microsoft.com\/scriptcenter\/Reset-WSUS-Authorization-2e26d1b0\">reset <\/a>the SusClientId on the listed systems.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In a large environment with many active directory domains and some servers which are not domain members, it is difficult to find all duplicate SusClientIds. Remote registry queries are not an option because there are many systems in protected networks behind firewalls. So I decided to use the IIS Failed Request Log to detect duplicate [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-277","post","type-post","status-publish","format-standard","hentry","category-windows"],"_links":{"self":[{"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/277","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=277"}],"version-history":[{"count":23,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/277\/revisions"}],"predecessor-version":[{"id":313,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=\/wp\/v2\/posts\/277\/revisions\/313"}],"wp:attachment":[{"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=277"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=277"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ms07.de\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=277"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}