While working on a custom DSC (Desired State Configuration) resource that forces the Windows Update Agent to opt-in to Microsoft Update, I found a major caveat with my previous blog post about configuring a proxy per machine with DSC.
My server wouldn’t opt-in to Microsoft Update (MU) and when it tried, it last ~20 seconds which is an excessive amount of time. Under my user account, the registration takes less than a second.
Here’s the code I’m using inside the DSC resource and at command prompt.
(New-Object -ComObject Microsoft.Update.ServiceManager).
AddService2('7971f918-a847-4430-9279-4a52d1efe18d',7,"");
I couldn’t understand why and started a procmon trace.
The WindowsUpdate.log file acknowledged that it lasts 20 seconds and indicated that it doesn’t use the proxy set per machine :(
The procmon trace indicated that the Windows Update service was looking for the WinHttpSettings value and couldn’t find it
My bad :(
That’s what I actually set in my DSC configuration as I set the WinHttpSetting as absent.
To fix it, I duplicated the DefaultConnectionSettings item and set the exact same value for the WinHttpSettings item
And now the registration is back to normal:
I also found a second problem while reading the verbose output when applying the DSC configuration :(
[ Start Test ] [[Registry]ProxyAddressPerMachineDefaultConnectionSettings]
VERBOSE: [MyComputerName]: [[Registry]ProxyAddressPerMachineDefaultConnectionSettings] Registry key value ‘HKLM:\software\microsoft\windows\currentversion\internet settings\connections\DefaultConnectionSettings’ of type ‘Binary’ does not contain data ‘46000000040000000300000015…0′
The DSC Test-TargetResource function always returned false because the registry value set in the first place was somehow “autocorrected”.
The fact that the Test-TargetResource always returns false isn’t normal.
I recommended in my original post to extract the value from the registry like this:
$regkey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"
-join (
(Get-ItemProperty -Path $regkey -Name DefaultConnectionSettings).DefaultConnectionSettings |
Foreach-Object { '{0:X2}' -f $_ })
…which is the wrong way and the root cause of the above behavior I described.
My bad :( Sorry about that.
I fixed my issue by capturing correctly the hexadecimal value from the registry :D
$regkey = "HKLM:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"
-join (
(Get-ItemProperty -Path $regkey -Name DefaultConnectionSettings).DefaultConnectionSettings |
Foreach-Object { '{0:X1}' -f $_ })
.
