We're working in an educational lab environment with quite a large number of different software installed. Randomly we will get a computer that has a completely full hard drive because there are files being written to the temp directory every hour.
After digging in the windowsupdate.log, it shows WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013 being written to the log around the same time these temp files are being created. I'm somewhat of a noob when it comes to this kind of stuff so any help is greatly appreciated! I have read through a couple other forum topics regarding this but they don't match what issues we're having (with the temp files being rewritten).
The windowsupdate.log looks like this:
2014-05-02 10:04:57:094 444 fc4 AU #############
2014-05-02 10:04:57:094 444 fc4 AU ## START ## AU: Search for updates
2014-05-02 10:04:57:094 444 fc4 AU #########
2014-05-02 10:04:57:095 444 fc4 AU <<## SUBMITTED ## AU: Search for updates [CallId = {CDEBD2E8-91FA-4835-8845-F4B0B36C879F}]
2014-05-02 10:04:57:095 444 19a4 Agent *************
2014-05-02 10:04:57:095 444 19a4 Agent ** START ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-05-02 10:04:57:095 444 19a4 Agent *********
2014-05-02 10:04:57:095 444 19a4 Agent * Online = Yes; Ignore download priority = No
2014-05-02 10:04:57:095 444 19a4 Agent * Criteria = "IsInstalled=0 and DeploymentAction='Installation' or IsPresent=1 and DeploymentAction='Uninstallation'
or IsInstalled=1 and DeploymentAction='Installation' and RebootRequired=1 or IsInstalled=0 and DeploymentAction='Uninstallation' and RebootRequired=1"
2014-05-02 10:04:57:095 444 19a4 Agent * ServiceID = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7} Managed
2014-05-02 10:04:57:095 444 19a4 Agent * Search Scope = {Machine}
2014-05-02 10:04:57:173 444 19a4 Setup Checking for agent SelfUpdate
2014-05-02 10:04:57:174 444 19a4 Setup Client version: Core: 7.6.7600.256 Aux: 7.6.7600.256
2014-05-02 10:04:57:174 444 19a4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\wuident.cab:
2014-05-02 10:04:57:192 444 19a4 Misc Microsoft signed: Yes
2014-05-02 10:04:57:222 444 19a4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\wuident.cab:
2014-05-02 10:04:57:226 444 19a4 Misc Microsoft signed: Yes
2014-05-02 10:04:57:227 444 19a4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2014-05-02 10:04:57:231 444 19a4 Misc Microsoft signed: Yes
2014-05-02 10:04:57:233 444 19a4 Misc Validating signature for C:\WINDOWS\SoftwareDistribution\SelfUpdate\wsus3setup.cab:
2014-05-02 10:04:57:236 444 19a4 Misc Microsoft signed: Yes
2014-05-02 10:04:57:265 444 19a4 Setup Determining whether a new setup handler needs to be downloaded
2014-05-02 10:04:57:265 444 19a4 Setup SelfUpdate handler is not found. It will be downloaded
2014-05-02 10:04:57:265 444 19a4 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256"
2014-05-02 10:04:58:152 444 19a4 Setup Setup package "WUClient-SelfUpdate-ActiveX~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2014-05-02 10:04:58:153 444 19a4 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2014-05-02 10:04:58:176 444 19a4 Setup Setup package "WUClient-SelfUpdate-Aux-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2014-05-02 10:04:58:177 444 19a4 Setup Evaluating applicability of setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256"
2014-05-02 10:04:58:202 444 19a4 Setup Setup package "WUClient-SelfUpdate-Core-TopLevel~31bf3856ad364e35~amd64~~7.6.7600.256" is already installed.
2014-05-02 10:04:58:202 444 19a4 Setup SelfUpdate check completed. SelfUpdate is NOT required.
2014-05-02 10:05:48:581 444 19a4 PT +++++++++++ PT: Synchronizing server updates +++++++++++
2014-05-02 10:05:48:581 444 19a4 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://kc-is-wsus3.kc.umkc.edu:8531/ClientWebService/client.asmx
2014-05-02 10:10:28:799 444 19a4 Agent WARNING: Failed to evaluate Installed rule, updateId = {189A8F50-0C3A-4FDF-8BC2-BC23A3EB11FB}.101, hr = 80242013
2014-05-02 10:10:35:605 444 19a4 PT +++++++++++ PT: Synchronizing extended update info +++++++++++
2014-05-02 10:10:35:605 444 19a4 PT + ServiceId = {3DA21691-E39D-4DA6-8A4B-B43877BCB1B7}, Server URL = https://kc-is-wsus3.kc.umkc.edu:8531/ClientWebService/client.asmx
2014-05-02 10:10:35:773 444 19a4 PT WARNING: Cached cookie has expired or new PID is available
2014-05-02 10:10:35:773 444 19a4 PT Initializing simple targeting cookie, clientId = 7c26867c-36eb-4974-9d3c-820755370fd5, target group = W - SCE-Lab-Pre-Deploy, DNS
name = kc-sce462lab-22.kc.umkc.edu
2014-05-02 10:10:35:773 444 19a4 PT Server URL = https://kc-is-wsus3.kc.umkc.edu:8531/SimpleAuthWebService/SimpleAuth.asmx
2014-05-02 10:12:26:966 444 19a4 Agent * Added update {6A803F4E-EB80-4920-B093-3D205E02126E}.200 to search result
2014-05-02 10:12:26:966 444 19a4 Agent * Found 1 updates and 84 categories in search; evaluated appl. rules of 3734 out of 6523 deployed entities
2014-05-02 10:12:27:002 444 19a4 Agent *********
2014-05-02 10:12:27:002 444 19a4 Agent ** END ** Agent: Finding updates [CallerId = AutomaticUpdates]
2014-05-02 10:12:27:002 444 19a4 Agent *************
2014-05-02 10:12:27:053 444 f24 AU >>## RESUMED ## AU: Search for updates [CallId = {CDEBD2E8-91FA-4835-8845-F4B0B36C879F}]
2014-05-02 10:12:27:053 444 f24 AU # 1 updates detected
2014-05-02 10:12:27:053 444 f24 AU #########
2014-05-02 10:12:27:053 444 f24 AU ## END ## AU: Search for updates [CallId = {CDEBD2E8-91FA-4835-8845-F4B0B36C879F}]
2014-05-02 10:12:27:053 444 f24 AU #############
2014-05-02 10:12:27:054 444 f24 AU Successfully wrote event for AU health state:0
2014-05-02 10:12:27:054 444 f24 AU Featured notifications is disabled.
2014-05-02 10:12:27:054 444 f24 AU AU setting next detection timeout to 2014-05-02 16:05:00
2014-05-02 10:12:27:054 444 f24 AU Setting AU scheduled install time to 2014-05-02 20:00:00
2014-05-02 10:12:27:054 444 f24 AU Successfully wrote event for AU health state:0
2014-05-02 10:12:27:081 444 f24 AU Successfully wrote event for AU health state:0
2014-05-02 10:12:32:024 444 19a4 Report REPORT EVENT: {8F15B04F-12BC-4CF7-810D-75CFDD0F7FD2} 2014-05-02 10:12:27:000-0500 1 147 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Software Synchronization Windows
Update Client successfully detected 1 updates.
2014-05-02 10:12:32:024 444 19a4 Report REPORT EVENT: {F32FE3DE-27A0-40C5-A09A-99DA13685AAA} 2014-05-02 10:12:27:001-0500 1 156 101 {00000000-0000-0000-0000-000000000000} 0 0 AutomaticUpdates Success Pre-Deployment Check Reporting
client status.
2014-05-02 10:12:32:026 444 19a4 Report CWERReporter finishing event handling. (00000000)
2014-05-02 10:22:30:125 444 19a4 Report Uploading 2 events using cached cookie, reporting URL = https://kc-is-wsus3.kc.umkc.edu:8531/ReportingWebService/ReportingWebService.asmx
2014-05-02 10:22:30:168 444 19a4 Report Reporter successfully uploaded 2 events
CBS Looks like this:
...
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB2736422~31bf3856ad364e35~amd64~~6.1.1.0,
ApplicableState: 112, CurrentState:112
2014-05-02 10:10:31, Info CBS Session: 30369304_2832267668 initialized by client WindowsUpdateAgent.
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB2862152~31bf3856ad364e35~amd64~~6.1.1.1, ApplicableState:
112, CurrentState:112
2014-05-02 10:10:31, Info CBS Session: 30369304_2832297671 initialized by client WindowsUpdateAgent.
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB2852386~31bf3856ad364e35~amd64~~6.1.1.3, ApplicableState:
112, CurrentState:112
2014-05-02 10:10:31, Info CBS Session: 30369304_2832447686 initialized by client WindowsUpdateAgent.
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB947821~31bf3856ad364e35~amd64~~6.1.31.0, ApplicableState:
112, CurrentState:0
2014-05-02 10:10:31, Info CBS Session: 30369304_2832457687 initialized by client WindowsUpdateAgent.
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB2647753~31bf3856ad364e35~amd64~~6.1.4.0, ApplicableState:
112, CurrentState:112
2014-05-02 10:10:31, Info CBS Session: 30369304_2832557697 initialized by client WindowsUpdateAgent.
2014-05-02 10:10:31, Info CBS Read out cached package applicability for package: Package_for_KB2584146~31bf3856ad364e35~amd64~~6.1.1.3, ApplicableState:
112, CurrentState:112
2014-05-02 10:12:20, Info CBS Failed to create backup log cab. [HRESULT = 0x80070001 - ERROR_INVALID_FUNCTION]
2014-05-02 10:20:31, Info CBS Reboot mark refs incremented to: 1
2014-05-02 10:20:31, Info CBS Scavenge: Starts
2014-05-02 10:20:31, Info CSI 00000009@2014/5/2:15:20:31.518 CSI Transaction @0x405f50 initialized for deployment engine {d16d444c-56d8-11d5-882d-0080c847b195}
with flags 00000002 and client id [10]"TI6.0_0:0/"
2014-05-02 10:20:31, Info CBS Scavenge: Begin CSI Store
2014-05-02 10:20:31, Info CSI 0000000a Performing 1 operations; 1 are not lock/unlock and follow:
Scavenge (8): flags: 00000017
2014-05-02 10:20:31, Info CSI 0000000b Store coherency cookie matches last scavenge cookie, skipping scavenge.
2014-05-02 10:20:31, Info CSI 0000000c ICSITransaction::Commit calling IStorePendingTransaction::Apply - coldpatching=FALSE applyflags=7
2014-05-02 10:20:31, Info CSI 0000000d Creating NT transaction (seq 2), objectname [6]"(null)"
2014-05-02 10:20:31, Info CSI 0000000e Created NT transaction (seq 2) result 0x00000000, handle @0xf8
2014-05-02 10:20:31, Info CSI 0000000f@2014/5/2:15:20:31.995 CSI perf trace:
CSIPERF:TXCOMMIT;12099
2014-05-02 10:20:31, Info CBS Scavenge: Completed, dis
2014-05-02 10:20:31, Info CSI 00000010@2014/5/2:15:20:31.996 CSI Transaction @0x405f50 destroyed
2014-05-02 10:20:32, Info CBS Reboot mark refs: 0
2014-05-02 10:20:32, Info CBS Idle processing thread terminated normally
2014-05-02 10:20:32, Info CBS Ending the TrustedInstaller main loop.
2014-05-02 10:20:32, Info CBS Starting TrustedInstaller finalization.
2014-05-02 10:20:32, Info CBS Ending TrustedInstaller finalization.
I'm afraid there is coming conflicting with a piece of software installed on the system but am unsure where to even begin.
Any help greatly appreciated! Thoughts?