I had an issue last night where a server lost Secure Channel Connection to the PDC Emulator (NETLOGON Event IDs 5719 and 5783). All tests to test the secure channel via PowerShell were failing. (i.e. nltest or Test-ComputerSecureChannel cmdlets) The server essentially needed to be rebooted. I had a dumb dumb in my brain and forgot to check to see if there were any pending Windows Updates, because those need to be installed at the proper time and to a schedule. So, when I ran the following command to reboot:
1 | shutdown.exe /r /t 000 /c "Rebooting DC01 Due To NETLOGON Errors" |
The Windows Updates were installed inadvertently which could have caused even more issues if they were NOT approved or caused another failure on the server. TO NOT DO THIS IN THE FUTURE, remember to run the following command to shut off the Windows Update Service BEFORE initiating the reboot of the server:
1 2 3 4 5 | net stop wuauserv OR Stop-Service wuauserv |
But, the deed was done. NOW, I had to find out quickly what updates WERE installed via PowerShell so that I could alert the proper folks and give them a heads up on possible issues. Luckily, the server did NOT have any issues and the initial problem with NETLOGON was resolved. Here is the command I ran to find out the installed hotfixes filtered by today’s date:
1 | wmic qfe where "InstalledOn = '2/26/2019'" list full |
Here was the Output:
Caption=http://support.microsoft.com/?kbid=4480960
CSName=DC01
Description=Security Update
FixComments=
HotFixID=KB4480960
InstallDate=
InstalledBy=NT AUTHORITY\SYSTEM
InstalledOn=2/26/2019
Name=
ServicePackInEffect=
Status=
Caption=http://support.microsoft.com/?kbid=4480965
CSName=DC01
Description=Security Update
FixComments=
HotFixID=KB4480965
InstallDate=
InstalledBy=NT AUTHORITY\SYSTEM
InstalledOn=2/26/2019
Name=
ServicePackInEffect=
Status=
Since there were no issues, I was able to resolve the incident. I did notify the account team though of the inadvertent installation so that they could revert the changes if necessary.
Remember, troubleshooting to resolution is a methodical process, and when in an enterprise environment, you MUST be aware of all factors of change process, even when the resolution is a simple reboot of the affected server.
HAPPY TROUBLESHOOTING!
I LOVE COMMENTS! THANKS FOR READING!
References:
Methods of generating installed updates via PowerShell
Check Windows Update History via PowerShell
Disable or Bypass Windows Update Installation During Reboot/Shutdown of a Server
