Automatic Update client tends to update from WindowsUpdate rather than SUS.

Automatic Update client tends to update from WindowsUpdate rather than SUS.


In this Article, I will explain why Automatic Update client tends to update from WindowsUpdate rather than SUS.


CASE 1: This actually started with V5 version of Windows Update & with Windows XP SP# 2. This is actually normal. That said, it means,

C:\Windows\Windows Update.log refers to V4 version of Windows Update &

C:\Windows\WindowsUpdate.log refers to V5 version of Windows Update.

That means, C:\Windows\WindowsUpdate.log (without the space) refers to V5 & C:\Windows\Windows Update.log log (with the space). 

If you have V5 version of Windows Update, make sure the following registry values exist. If they don’t exist, then create them.

Navigate to the following location by opening REGEDIT from Command Prompt;

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]

“SusServerVersion” = REG_DWORD: 0x00000001 (1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update]

“ConfigVer” = REG_DWORD: 0x00000001 (1)

***NOTE: If these values are not present, a V5 client tends to update from WindowsUpdate rather than SUS.

In my workstation, it looks something like:

C:\Documents and Settings\User>Reg query “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update”



    SusServerVersion  REG_DWORD       0x1

    AUState               REG_DWORD      0x2

    NextDetectionTime REG_SZ            2004-10-06 05:54:40

    ConfigVer             REG_DWORD      0x1

    LastWaitTimeout    REG_SZ            2004.10.07 01:23:20


CASE 2: Sometimes in WindowsUpdate.log you may see that even after configuring Automatic Updates to use SUSServer, it goes to as shown below;


02-03 11:47:29-0000    804    634     PT: Using ServerID {9482F4B4-E343-43B6-B170-9A65BC822C77}

2005-02-03      11:47:29-0000    804    634     PT:

Using server URL

2005-02-03      11:47:29-0000    804    634    

URL for server is


This is because of a registry value, ODFFileURL REG_SZ , which is pointing to;


C:\>Reg query “HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update”









You have to DELETE the following “ODFFileURL REG_SZ” registry value from “HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion­\WindowsUpdate\Auto Update”


Restart the machine which will also restart the Automatic Update Services. Now, force the update detection and monitor the logs. 


CASE 3: When the Automatic Update Client polls a SUS server, several scripts are run on the SUS server to retrieve user configuration settings including the SUS server content store URL. If the content store URL cannot be retrieved because of a race condition or because the client hard disk is full, the Automatic Update Client computer is routed to the Windows Update Web site. The configuration settings may be partially written or not written at all.


A supported hotfix is now available from Microsoft, but it is only intended to correct the problem that this article describes. Apply it only to systems that are experiencing this specific problem.;en-us;892311 

Happy Reading!
Mohammed Athif Khaleel
Windows Server Update Services Wiki
Save the Internet. Keep all Systems Patched


[This posting is provided “AS IS” with no warranties and confers no rights.]

Leave a Reply

Your email address will not be published. Required fields are marked *