tragiccode / tragiccode-wsusserver Goto Github PK

when specifying:
include_management_console => false,
the DSC module still does a Test-TargetResource for windowsresource 'UpdateServices-UI', this feature is not available in core.the code should be updated so that when setting include_management console to false, it does not run that check which causes the module to fail.

For me, when i push to origin ( since i cannot fork my own repo ) i get 2 branches built. One is the PR merged into master and the other is the branch itself. I don't want the branch itself to build since the pr merged into master is a CI build and more accurate.

There doesn't seem to be an existing method to configure the proxy settings. For those with devices behind firewalls, this would be a helpful enhancement to have (included before the initial sync).

$config = (Get-WsusServer).GetConfiguration()
$config.ProxyName = ${proxy_name}
$config.ProxyServerPort = ${proxy_port}
$config.UseProxy = $true
$config.Save()

I've had a failed sync at some point in time. After which a lot of syncs started to fail. After checking the code I have found a tiny bug in the 'wsus-config-update-initial-synchronization' exec unless statement.
On line 350 of the config.pp file it retrieves the 0th element of the GetSynchronizationHistory, which is the most recent synchronization. I propose to change this to the -1th element which is the oldest element. This would prevent the initial sync to be run on every puppet run.

Hello,

I run the new 1.1.4 version of your module and get an issue when I select "Windows 2008 R2" as a product on my puppetfile.

Here is my code:
products => [
'Windows Server 2008 R2',
'Windows Server 2012 R2',
'Windows Server 2016',
'Windows Server 2019',
'Microsoft Defender Antivirus',
'Microsoft SQL Server 2012',
'Microsoft SQL Server 2016',
'Microsoft SQL Server 2017',
'Microsoft SQL Server 2019',
'Windows Server Manager – Windows Server Update Services (WSUS) Dynamic Installer',
],

All other products worked fine if I put a comment or delete "Windows Server 2008 R2" line.

But the fact is that the issue avoid the execution of the update classification:
update_classifications => [
'Critical Updates',
'Definition Updates',
'Security Updates',
'Service Packs',
'Update Rollups',
'Updates',
'Upgrades',
],

And the puppet agent finished with 1 failure.

Windows events application logs returned error and last _run report log noticed this error:

logs:

• level: notice
  message: "Invalid product name supplied - Windows Server 2008 R2\r"
  source: "/Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/returns"
  R
  It's like the Windows Server 2008 R2 isn't present at all on my wsuserver.

When I run the following PS command:

(Get-WsusServer).GetUpdateCategories() | Where-Object {$_.Title -contains "Windows Server 2008 R2"}

Type : Product
ProhibitsSubcategories : True
ProhibitsUpdates : False
UpdateSource : MicrosoftUpdate
UpdateServer : Microsoft.UpdateServices.Internal.BaseApi.UpdateServer
Id : fdfe8200-9d98-44ba-a12a-772282bf60ef
Title : Windows Server 2008 R2
Description : Windows Server 2008 R2 Category
ReleaseNotes :
DefaultPropertiesLanguage :
DisplayOrder : 2147483647
ArrivalDate : 5/24/2019 8:10:39 AM

I could see that 2008 R2 is present on my update categories.

Do you have a solution for that or noticed a similar issue?
Regards.

Hello, would it be possible to make this module compatible with version 5.1.0 or higher of the stdlib module? Being compatible with 4.x only it closes the door to many other modules I have been interested in using. I have not yet tried to force version 5.1.0 to see if it breaks anything in wsusserver however.

was commented out to test faster.

Key config params:
UseProxy
ProxyName
ProxyServerPort

Optional params:
AnonymousProxyAccess
ProxyUserName
ProxyUserDomain
ProxyPassword
HasProxyPassword
AllowProxyCredentialsOverNonSsl

To add the ability to configure email notifications:
$ws = Get-WsusServer
$ws.GetEmailNotificationConfiguration()

SendSyncNotification             : True
SendStatusNotification           : True
StatusNotificationRecipients     : {}
SyncNotificationRecipients       : {}
StatusNotificationFrequency      : Weekly
StatusNotificationTimeOfDay      : 01:33:23
SmtpServerRequiresAuthentication : False
SmtpHostName                     : 
SmtpPort                         : 25
SmtpUserName                     :
SenderDisplayName                : 
SenderEmailAddress               : 
EmailLanguage                    : en
LastModifiedTime                 : 01/01/1753 12:00:00 AM
LastModifiedBy                   :
HasSmtpUserPassword              : False
SupportedEmailLanguages          : {en, ja, zh-cn, zh-tw...}
UpdateServer                     : Microsoft.UpdateServices.Internal.BaseApi.UpdateServer

The documentation lists the below as the format to remove an approval rule

wsusserver::approvalrule { 'Default Automatic Approval Rule':
    ensure => 'absent'
}

This doesn't work, as at catalog creation an error occurs about required parameters, namely the requirements are:

wsusserver::approvalrule { 'Default Automatic Approval Rule':
    ensure          => 'absent',
    classifications => [],
    products        => [],
    computer_groups => [],
  }

It would be good to not need the classifications, products and computer_groups for rule removal

Thanks

When setting 'Windows 10, version 1903 and later' in the products list it will only choose 'Windows 10' in the WSUS approval rules

        wsusserver::approvalrule { 'Automatic Approval for all Updates Rule':
                ensure          => 'present',
                enabled         => true,
                classifications => $classifications,
                products        => ['Windows 10, version 1903 and later', 'Windows 10 and later drivers'],
                computer_groups => ['AutoApproval']
        }

We should replace the wsusserver::approvalrule with a formalized type and provider in order to allow for:

1.) More efficient puppet runs. Execs are not performant
2.) Improve maintability by getting rid of execs along with all the other problems they introduce.

I think there are some maintenance tasks that could be implemented as puppet tasks in the module. These tasks are the following:

1. Manual Synchronization
2. Server Cleanup Wizard

Here is an example i found if creating a puppet task using powershell scripts:
https://github.com/SeanTecha/powershell_tasks/blob/master/tasks/set_executionpolicy.ps1

The problem lies within the unless block. It is checking the value of "synchronize_automatically". So if you want to change your time of day you will have to flip the value of synchronize_automatically to get the unless block to exit with 1. The unless block should be re-written to check for the difference in time using $wsusSubscription.SynchronizeAutomaticallyTimeOfDay

      unless    => "\$wsusSubscription = (Get-WsusServer).GetSubscription()
                    if (\$wsusSubscription.SynchronizeAutomatically -eq \$${synchronize_automatically}) {
                      Exit 0
                    }
                    Exit 1",

hi,

what happen if after installation someone add products using management tool ?
does your module will uncheck it at next puppet agent run ?

regards

hi

can we choose between WID, local SQL Server or remote SQL Server ?

regards

It seems that the update_classifications, dosent work, its creates a no config on the update_classifications i wsus server.
is this a bug ?
im running it on a windows 2016

Hello,
on a non English (in my case German) Windows the powershell provider for computer target groups does not recognize that the built in groups already exist as their names are different from the English ones and then fails to create it. The debug log looks like this:

Debug: json parsed computer target groups are [{"id"=>"a0a08746-4dbe-4a37-9adf-9e7652c0b421", "name"=>"Alle Computer"}, {"id"=>"b73ca6ed-5727-47f3-84de-015e03f6a88a", "name"=>"Nicht zugewiesene Computer"}]
Debug: Checking if All Computers exists
Debug: Creating All Computers
Debug: Executing: 'C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe (Get-WsusServer).CreateComputerTargetGroup('All Computers')
'
Error: Execution of 'C:/Windows/System32/WindowsPowerShell/v1.0/powershell.exe (Get-WsusServer).CreateComputerTargetGroup('All Computers')
' returned 1: Ausnahme beim Aufrufen von "CreateComputerTargetGroup" mit 1 Argument(en):  "Eine Gruppe mit diesem Namen existiert bereits."

Replacing the English group names with the German ones in built_in_computer_target_groups.pp fixes the problem for me, so a solution might be to allow custom arrays instead of ['All Computers', 'Unassigned Computers'].

Thanks in advance!

Supported DSC module: https://forge.puppet.com/modules/puppetlabs/dsc_lite

Using native powershell commands Get-WindowsFeature and Install-WindowsFeature would do the trick as well.

This is more the fault of MS and their crappy naming conventions but the 'wsus-config-update-products' does not select Windows Server 2019 correctly. The reason is because MS stupidly has two products listed with the name "Windows Server 2019". You can see this if you run the command (Get-WsusServer).GetUpdateCategories() | where { $_.Type -eq 'Product' } | findstr /i 2019

You will see there is a Windows Server 2019 with description "Category for Windows Server 2019" as well as a second one with description "Windows Server 2019 (RS5 Server) and above". The exec routine chooses the first one, but when looking in the WSUS Management Console the desired product is not checked off as it actually uses the other Windows Server 2019 product with the second description.

Hey there,

I see where you have implemented the synchronize_time_of_day functionality below, however, when setting synchronize_time_of_day to something other than the default '03:00:00' it does not modify the sync time. I'm not sure the idempotency logic allows for it to be run unless synchronize_automatically is changed.

Thanks!

On a new server 2016 and a 2019 install, this just fails to work.

class { 'wsusserver':
package_ensure => 'present',
include_management_console => true,
service_manage => true,
service_ensure => 'running',
service_enable => true,
wsus_directory => 'D:/WSUS',
join_improvement_program => false,
sync_from_microsoft_update => true,
update_languages => ['en'],
products => [
'Windows Server 2016'
],
update_classifications => [
'Windows Server 2016'
],
targeting_mode => 'Client',
host_binaries_on_microsoft_update => false,
synchronize_automatically => true,
synchronize_time_of_day => '04:00:00', # 3AM ( UTC ) 24H Clock
number_of_synchronizations_per_day => 4,
trigger_full_synchronization_post_install => true,
}

Wouldn't you also be specifying the values for update_classifications as security, Critical Updates?

hi, i'm not sure but it looks like your module don't allow us to create child target group isn't it ?

example:

• PROJECT-X

• PROJECT-X_PROD
• PROJECT-X_DEV

• PROJECT-A

• PROJECT-A_PREPROD
• PROJECT-A_QUAL

regards

Hello guys,

I use the last 1.1.4 module and I noticed that when I select "Windows Server 2016 and Windows Server 2019" as products on my puppetfile, I have got two additionnal"non wanted" products selected on my WSUS Products console:
Developper Tools, Runtimes, and Redistribuables / Windows Server 2016
Developper Tools, Runtimes, and RedistribuablesWindows Server 2019

Do you know how to fix that issue?
Thanks a lot for your time, I appreciate.
Regards.

Summary
#10 implemented the ability to configure email notifications in WSUS. Unfortunately, authentication configuration was excluded. It would be beneficial to get this implemented as i'm sure many others would not like their email server being used with no authentication setup.

Hi!

Noticed you're missing a license file for this repo.

Here's an example: https://github.com/puppetlabs/puppetlabs-wsus_client/blob/master/LICENSE

Would you be able to add one to this? Looking forward to using this repo!

I am new to puppet so I need some advice. In my /root/.puppetlabs/bolt/modules/wsusserver/manifests I have several manifests already in place; approvalrule.pp built_in_computer_target_groups.pp config.pp init.pp install.pp params.pp service.pp, do I add the code to one of these or create a new one. I apologize for my noobieness.

Hello,
When i run the module without making a lot of changes, here is the error that appears :

`Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: Unhandled exception caught:
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: At line:24 char:21
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: + ...             $currentEnabledProductFamilies = ($wsusServerSubscription ...
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: +                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: System.Management.Automation.PropertyNotFoundException: The property 'Title' cannot be found on this object. Verify
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless: that the property exists.
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless:    at CallSite.Target(Closure , CallSite , Object )
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless:    at System.Dynamic.UpdateDelegates.UpdateAndExecute1[T0,TRet](CallSite site, T0 arg0)
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless:    at System.Management.Automation.Interpreter.DynamicInstruction`2.Run(InterpretedFrame frame)
Debug: /Stage[main]/Wsusserver::Config/Exec[wsus-config-update-products]/unless:    at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
Debug: STDERR: The variable '$LASTEXITCODE' cannot be retrieved because it has not been set.
At line:1 char:5
+ if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+     ~~~~~~~~~~~~~
Error: 'function Invoke-WsusCategoryConfig {`

After the whole function is displayed with the parameters (I attach the txt bellow).
The options are well set but the other modules don't launch because of this error.

error.txt
My PP File : install.txt

Thanks in advance.