We looked through our reports and found that it was often the same patch people were failing on.  Throughout the semester it happened on 10 or 15 patches.  Our solution was to grab the errored patches by hand, throw them in a batch script, and point the user to our "troubleshooting cca" page on a failure.  Here's what our page looks like:

http://helpdesk.conncoll.edu/cca/

Fixed the problem 99% of the time when the user followed the steps.  A previous poster talked about the bits fixer...this batch script fixes, again, 99% of windows update problems:

http://helpdesk.conncoll.edu/tools/windowsupdate.bat

Regards,

Alex Lanstein
Senior Software Engineer, Transitional Data Services
Help Desk/Network Junkie, Connecticut College
Chief Coffee Drinker, LBCCHosting
860-625-4277
[log in to unmask]



-----Original Message-----
From: Cisco Clean Access Users and Administrators on behalf of William Doyle
Sent: Fri 1/12/2007 11:30 AM
To: [log in to unmask]
Subject: Re: Windows Update not agreeing with Clean Access
 
Do a google search for Bits Fix.

Running it sometimes helps.

Bill


At 08:14 AM 1/12/2007, you wrote:
>We recently made our 'Windows Updates Required' rule mandatory using 
>the Cisco supplied pr_ hotfixes rule. We have a small number of 
>Windows users (mainly XP, MCE XP) that are failing the Cisco checks, 
>yet Windows Update is stating the machine is patched. I have a case 
>open with the TAC to try and find a solution. Right now the only 
>solution we have found is to re-apply each patch CA complains about. 
>But some times there are many and it's very tedious!
>
>I assume others have run into the same situation. Would anyone be 
>willing to share their solution? Is there a quick way to re-apply 
>all Windows patches in one step?
>
>-Mike