Windows Server Update Service and SVCHOST running at 99% of CPU

Well, this is a real big one, just about everyone who is running a big network and using WSUS will know about this one. Today I had numerous calls from users about their PCs running slowly. Probably this has just happened since I got time Monday to sit down with WSUS and make sure all the updates were approved for installation (Since we reinstalled WSUS on a member server that had been turned into a DC, some of the older updates were not approved for installation). But some of our users have been reporting this problem since mid April.

Basically SVCHOST.EXE is running the automatic updates scan, while this is pretty normal, it's said there are some bugs in the Windows Update Agent and other bits that are causing this problem. If your PC is idle or working normally, type wuauclt /detectnow at a command prompt or using the Run command from the Start menu and you will see it happen pretty quickly. SVCHOST.EXE will have an instance visible in Task Manager that is using maybe 50,000 - 100,000 KB of memory and high CPU utilisation.

There are several fixes depending on circumstances. Microsoft has said the patches will be released to WSUS on 22 May. The major one is the WSUS 3.0 Client Agent. If you want to download and install this manually on your PCs I recommend you create a restore point first. There will also be the WSUS 3.0 Server coming out in a few months which will also improve the situation.

Vista Business is unimpressive so far!

Last week I obtained an evaluation version of Windows Vista Business Edition (requires activation in 30 days). I try it out first of all in a VPC2007 virtual machine, where it installs successfully, but runs quite slowly. Buoyed by this success, I decide to try it on an actual machine. A one-year-old Intel D915GAG motherboard equipped PC with 512MB of RAM is selected. The existing XP system partition of 20 GB is duly joined by another of the same size for Vista's use in a dual boot config. A DVD is burned from the ISO image and the PC is booted from it.

The installation goes without a hitch. I download and install EasyBCD off a USB key to edit the boot configuration to make XP continue to boot as default OS with a short boot menu delay to allow Vista to be selected when needed. I then join the machine to our domain and assign it to an OU of its own to prevent anyone else except me from logging onto it (configured through Group Policy).

It is soon after this that the "fun" starts. Through several different boots, messages come up telling me that subsystems have failed (Spooler) or that processes (Rundll32) have quit unexpectedly. Or that "the parameter is incorrect" when attempting to run applications or control panel applets. And all this on the bare vanilla OS install, apart from the EasyBCD software previously mentioned.

A search of Microsoft's website yields few clues, but third party sites are found to contain a lot of information on all three problems. It seems the Spooler problems may be compatibility issues with our local XP drivers for our printers. All computers on the domain get a list of network printers pushed down by the Print Management policy on the WS2003R2 domain controller. However, I still have no idea how to fix "the parameter is incorrect" when running something as simple as a desktop shortcut, or an application from the search bar, and I'm unimpressed to get "access denied" messages when I'm logging on as a Domain Administrator.

So far, I will not be recommending early changeover for any school to Vista Business. The suggested path to follow is to either invest a lot of time fixing the problems as they occur, or (preferably) wait until enough significant issues are patched, maybe even Service Pack 1. I expect we will be offered laptops with Vista Business installed in six months, and we will then have to make a decision on whether it is worthwhile supporting. We already have offers of laptops running Vista Home Basic, and have to decide whether to keep that and wait for VB, or wipe and install XP Pro instead.

WDS, RIS and WIM

Right now I'm working on my second RIPREP image. Even though we have WDS, we will still be using RIPREP (legacy) images for a while, probably until Vista rolls into town. I have, however, started looking at the transition, installing Business Desktop Deployment 2007 and Windows Automated Installation Kit on my desktop. Since we don't have SMS, this would be a "Lite Touch Installation" scenario for BDD (in the Vista install jargon).

Let's take a quick look at the new Windows Image (WIM) based installation system for Windows Vista. Some of the important components and features of this system are:

• Componentised OS installs. Vista has a Package Manager (like most Linux distros) and changes to an image can be made fairly easily to apply updates, service packs, drivers and so on. You can also customise what is in the installation that you are setting up.
• Setup is WinPE based. There is no text-mode installation any more. This means text-mode network card drivers aren't needed for WDS installs.
• HAL restrictions on images are removed. Vista installation can detect and install the correct HAL. This means fewer images are needed for different hardware configurations.
• WIM imaging is file-based rather than sector based as tools such as Ghost are. This means an image doesn't run into problems with disk size or partitioning differences.

Let's also look briefly at how WDS works with existing Windows XP and new Windows Vista installations:

• WDS does not support RIS images natively. However it can deploy Sysprepped images of Windows XP computers.
• WDS is much more robust and easier to configure/support than RIS.
• WDS will offer different functionality depending on which version of Server it is installed on. "Longhorn" Server will only support the native mode, whereas legacy/mixed modes are available on Server 2003.

Steps for creating a WDS image of Windows XP in summary are:

• Set up the reference machine with the operating system and software
• Run the new version of Sysprep which is available for WDS.
• After Sysprep is finished, the PC must be PXE booted for the image capture process. You provide information for naming and identifying the image much as you would with RipRep.

I expect we are going to start using Vista much sooner than I originally planned; the reason being that with 20 odd laptops coming in, it will be to our advantage to image them as other schools do. However the timeframe at this stage is likely to be rather cramped; I'm expecting to get started on the transitional steps of learning about the new technologies fairly soon.