Considering the number of updates that are pushed out through Windows Update every year, this service is quite reliable. Nevertheless, sometimes Windows Update does not work properly. Due to the complexity of a modern operating system, many possible causes for Windows Update errors exist. In this article, I list the most common troubleshooting tips related to Windows Update errors. Since the Windows Update Agent is the client for the Windows Server Update Services (WSUS), these tips can also be used if you are working with WSUS to deploy updates in your network.

Download the Windows Update Agent (WUA)

As a Windows component, the Windows Update Agent (WUA) is also updated through Windows Update. But if Windows Update errors occur, you should check if you really have the latest version. You can determine the WUA version by checking the properties of wuaueng.dll in %SystemRoot%\system32\. As of this writing, the current file version is 7.5.7601.17514 for Windows 7 and 7.4.7600.226 for Windows Vista and Windows XP. If you don’t have the latest WUA version, you can download the Windows Update Agent here and then install it manually. Even if your Windows Update Agent is up to date, you could check out whether reinstalling WUA solves your problem.

Reset Windows Update Agent components

Reinstalling the WUA is sometimes not possible because Windows recognizes that the latest version is already installed. In this case, resetting the WUA components can help with some Windows Update errors. Resetting Windows Updates components means registering the Background Intelligent Transfer Service (BITS) files and a few other things. The whole procedure is a bit long-winded. The fastest way is to just click the "Fix it" link (preferably in Internet Explorer) on this support page. Note that Windows 7 is not listed in the Applies To section on the page. However, when I ran Fix-it-MSI, it appeared to work properly on Windows 7 as well. The Fix-it wizard will ask if you want to run the aggressive options. Aggression is always the last resort in problem solving, so you had better skip this option at your first try.

Install Windows updates manually

Occasionally, particular Windows updates fail to install. It can be quite annoying if the same update is offered again and again, especially when reboots are required. In those cases, you can try installing the update manually. First, you have to find out the KB number of the update with the Windows Update user interface (type Windows Update in Start Search in Vista and Windows 7, or press F1 on the Windows XP desktop). Then, you have to search the corresponding download page in Microsoft’s Download Center; or, just google the KB article, which is often faster. If you can’t find a download page for the update, you can try the WSUS Offline Update Generator.

Windows updates are usually MSU or EXE files, which means that you can just double-click the files to install the update. If you want to run the update on multiple machines in a batch a file, you can also use the wusa command (wusa.exe file-name.msu) In some cases, it can also be helpful to extract the MSU file first with the expand command and then install the Windows update package with Package Manager (pkgmgr.exe). More information about this procedure can be found here, and all Package Manager options are listed here.

Install the Windows update in Safe Mode

If an update is still stubborn, you can try booting up in Safe Mode (press F8 before Windows starts) and install the update again. If an application is interfering with the update’s setup program, then this could solve your Windows Update problem. However, when I tried installing a Windows update in Safe Mode the Windows Update Standalone Installer failed with the error message: Installer encountered an error: 0×80080005. Since this Microsoft KB article also recommends installing updates in Safe Mode, this might have been an issue with the update I tried. Note that starting the Windows Installer service in SafeMode, didn’t solve the problem. Another option is to install the update with Package Manager (see solution above). This should also work in Safe Mode.

Remove malware that blocks Windows updates

One of the reasons why an update often can’t be installed is because malware is blocking it. Usually, this update closes a security hole that the malware requires. In this case, you can try getting the latest signatures for your antivirus program. If this doesn’t help, you can boot up the Trinity Rescue Kit or UBCD4Win and run an antivirus program from there to get rid of the malware.

Windows Update is still not working? Then you can find more troubleshooting tips for Windows Update errors here and here.

• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)
• Remote Reboot X – The ultimate WSUS companion tool (2)

When Steve Ballmer raves “we are all in,” he probably means that most of the things we do with computers nowadays are in one way or another connected to the cloud, and that means most computer programs assume that your computers have Internet access.

This is also true of Microsoft’s update service. Even if your clients don’t have direct Internet access, they need a network connection to your WSUS server, which in turn must be connected to Microsoft Update. In some environments, for security reasons, computers must not have any kind of Internet connection, whether direct or indirect. Sometimes computers have no broadband access and can’t be updated through online update or WSUS. This is where the free tool WSUS Offline Update comes in.

The portable tool is easy to use and has a self-explanatory user interface. The WSUS Offline Update generator allows you to specify what updates are downloaded. For Windows XP and Windows Server 2003, you can configure the languages you want to include in the update package. WSUS Offline Update also supports Windows Vista, Windows 7, and Server 2008 (R2); enables you to include service packs and Microsoft Security Essentials; and allows you to update Office XP, Office 2003, Office 2007, and Office 2010.

WSUS Offline Update can create an ISO image, which you can burn on a CD/DVD. USB sticks are also supported. If you don’t select one of these options, WSUS Offline Update will just create an executable, the WSUS Offline Update Installer, which you can find in the folder ..\wsusoffline\client.

Note that the tool’s homepage begins with a German introduction. You will find the English translation just below this introduction. The user interface of WSUS Offline Update is in English.

WSUS Offline Update

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)
• Remote Reboot X – The ultimate WSUS companion tool (2)

If you want to update Windows computers with Microsoft’s patch management solution, WSUS, you have to add them to your WSUS infrastructure. In an Active Directory network, this can be done through Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Update). To add workgroup computers to WSUS, you have to set the corresponding Registry settings manually. Microsoft’s free WSUS ClientManager for Workgroups helps you with this task.

The GUI tool allows you to point a specific client to a WSUS server and add it to a WSUS group. You can also configure update frequency and boot delay, enable auto install for mirror updates, disable reboot for logged-in users, and allow non-admins to install updates.

Once you have configured your WSUS settings, you have to click “Activate WSUS.” The WSUS ClientManager will write the settings to the Registry. It will also create a REG file with the corresponding settings. To add multiple workgroup computers to your WSUS server, you only have to run this REG file on each PC.

You can also use the WSUS ClientManager to remove Windows PCs from a WSUS environment. The tool will also create the corresponding REG file for this task.

WSUS ClientManager for Workgroups

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)
• Remote Reboot X – The ultimate WSUS companion tool (2)

If Windows ever rebooted your PC during your lunch break while an important task was still running or you forgot to save data in an open application, then you understand the full extent of this problem. Modern applications are able to prevent Windows from rebooting, but this doesn’t always work.

In my view, a computer should never ever automatically restart without explicit confirmation from the user. If security measures can destroy the work of users, then the bad guys have already won. No Windows update is important enough to delete a whole morning’s work of your boss.

And if a new dangerous computer worm is really threatening your PCs, then network-wide restarts have to be managed and controlled by humans, not computers.

There are two ways to turn off automatic Windows Update reboots. You can let users choose when to install updates or you can disable auto-restarts.

Let users choose when to install Windows updates

You can configure Automatic Updates to only automatically download the latest update but let users choose when to install them. This configuration can be set through the Control Panel applet Windows Update (type Windows Update at the Start Search prompt) or through Group Policy (Computer Configuration\Administrative Templates\Windows Components\Windows Update\Configure Automatic Updates).

Windows will then inform users about new available updates. If a user doesn’t install them right away, Windows will do so when the user shuts down the computer. The disadvantage of this method is that this also prevents the installation of updates that don’t require a restart if the user ignores the message from Windows Update.

However, there is a Group Policy setting for allowing the installation of these unproblematic updates: Computer Configuration\Administrative Templates\Windows Components\Windows Update\Allow Automatic Updates immediate installation. If this setting is enabled, Windows Updates automatically installs updates that neither interrupt Windows services nor restart Windows.

Turn off automatic reboots

But the best option is simply to turn off automatic reboots with this Group Policy setting: Computer Configuration\Administrative Templates\Windows Components\Windows Update\No auto-restart with logged on users for scheduled automatic update installations. I recommend using this setting network-wide because it will reduce the number of angry help desk calls significantly.

I only covered the three Windows Update settings that I consider most important. I recommend also having a look at the other Group Policy settings at Computer Configuration\Administrative Templates\Windows Components\Windows Update. You might find something that is worthwhile configuring in your environment.

• Troubleshooting Group Policy – Part 6: Common problems (0)
• Troubleshooting Group Policy – Part 5: Active Directory problems (0)
• Troubleshooting Group Policy – Part 4: Client problems (0)
• Troubleshooting Group Policy – Part 3: Group Policy not applied? (0)
• Troubleshooting Group Policy – Part 2: Test and deploy (1)

One of the disadvantages of WSUS is that clients can only pull updates. With WuInstall , you can push urgent updates to clients at your convenience. This lets you control exactly when Windows clients and servers receive specific updates.

Actually, WuInstall also pulls the updates from a WSUS server or Windows Update. However, since the updates are installed whenever you run the command on a client, you can write a script that centrally forces machines to download and install updates immediately. Thus, essentially, you can push Windows updates to clients with WuInstall.

The problem with this procedure is that, depending on the size of your network, quite a few machines will start downloading updates simultaneously. If you have no WSUS server, then your Internet connection might get clogged.

WuInstall’s new cache feature allows you to download Windows updates to a network share. Clients can then get their updates from this central location. This procedure is particularly useful for branch offices where you have no local WSUS server. Even though WuInstall works perfectly with WSUS, this new caching feature also allows you to replace WSUS with your own script-based patch management software.

This command caches the updates to a central network share:

wuInstall /install_cache \\your_server\network_share

This not only downloads the updates but also installs them on the client where you run the command. If you run the same command on a second client, it will check first whether the updates are already available on the network share. If they are, it will just start with the installation. If they are not, it will download them first to the cache, so other clients can get them from there in the future.

WuInstall offers quite a few command options that let you control which updates will be pushed to clients. If you use these options together with the new cache feature, WuInstall will only download the corresponding updates. Hence, if you have different patch management rules for the computers in your network, the cache will only contain the updates that have been required at least once. I think this an efficient way to manage updates.

The WuInstall documentation describes the main features of this nifty patch management command. The WuInstall Pro page gives you an overview of the new features. Please note that there is also a free version of WuInstall that doesn’t offer the new caching feature.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• Remote Reboot X – The ultimate WSUS companion tool (2)

Remote Reboot X is very useful for sys admins to install updates on MANY remote computers simultaneously and then reboot them all with real-time monitoring.

The tool works in conjunction with WSUS, so if you have a WSUS server (or use Microsoft’s update server) but need precise control over when your computers install the updates and reboot, you can use my tool to handle the process.  So, for example, I have about 150 servers that need to be updated and rebooted once per month, but I only have a 1-hour maintenance window.  I’m able to load the list of 150 servers into my tool and initiate the updates installation and reboot on all machines simultaneously while monitoring the status in real-time.

If there is a problem either with installing an update or rebooting any of the machines (sometimes a machine might hang on reboot, for example), I learn about it immediately and can address it right away. To my knowledge there is no other tool that provides this degree of control.

The tool does not pull updates from WSUS to push to remote servers.  My tool simply tells the remote servers to install updates that they have already downloaded, or if they have not been downloaded it can initiate both the download and installation process.

Specific recommendations for best ways to use this tool are explained on my website, but generally speaking admins should use Group Policy to tell their machines to download but not install updates from WSUS. Then the updates are ready and waiting for the admin to initiate at his/her convenience using Remote Reboot X.

Update: The tool is no longer free and is now called Batchpatch.

Remote Reboot X

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

Its publisher, hs2n, is now raffling off five licenses for WuInstall 1.2 Pro, each worth US $250. It authorizes to use the tool for 50 clients and 5 servers. Non-commercial institutions may run WuInstall 1.2 Pro on an unlimited number of machines. Please note that a former version of WuInstall can be found on the 4sysops list of free Windows administration tools. The new version, however, includes quite a few important new features.

If you want to have the chance to win a WuInstall 1.2 Pro license please send an email with the subject line “WuInstall” to:

The deadline is July 1, 2009. It would be great, if you answer the following question:

What feature do you miss most in WuInstall?

So how does WuInstall outwit Murphy? Actually, it is quite simple. It doesn’t leave it up to the Windows Update client to choose the appropriate time for installing updates. Instead it allows you to decide on a time that suits you best. You could, for example, create a batch script and place it on your desktop, which would allow you to check for the latest updates with just a mouse click. However, this method is a bit risky, because you might neglect installing updates after a while. And, of course, this is not the preferred method for end users.

I think the best way is to run WuInstall in a shutdown script. You can easily configure this for all of the desktops in your network by using Group Policy. This way, updates will be installed whenever a shutdown is initiated. Users don’t have to wait until the update process is finished, and won’t be bothered by reboot requests later. As you can see, using WuInstall doesn’t give Murphy much of a chance to prove his law.

The downside of this method is that very urgent updates are not installed immediately, but only at the end of a work day. In my opinion, however, installing updates once a day is enough, as long as your PCs are protected from Internet worms by a firewall. I think the small amount of risk is justifiable if you take the improved productivity of your users into account. By the way, another way to lessen the impact of the update process is to turn off automatic Windows Update reboot prompts .

Of course, initiating Windows updates at suitable times is not the only way to use WuInstall. I suppose it is most often used in scripts. If you want to create your own patch management solution that not only encompasses Microsoft products but also covers third-party applications. With WuInstall, you can manage Windows updates and you can use the MSI’s or MSTs of third-party software to update them with just one shutdown script.

WuInstall 1.1 basically only allowed you to install all available updates. The main new feature of WuInstall 1.2 Pro is that you can now decide what kind of updates you want to install. Most important is the ability to limit installations according to severity levels (critical, important, moderate, or low) and classifications (critical updates, updates, update rollups, security updates, service packs, or feature packs).

In addition, you can now search for product names in updates, and even use regular expressions to find specific patches. Another nice feature is that you can temporarily bypass WSUS. This can be useful if you want to check for the availability of a certain patch that has not yet been downloaded to your WSUS server. This is the complete list of WuInstall 1.2 Pro’s command line options:

Usage:

WuInstall.exe [/search | /download | /install | /help ] [/reboot [nseconds]] [/match "regex"] [/nomatch "regex"] [/criteria "criteria"] [/severity severity_level]  [/classification update_classification] [/product "product_name"] /bypass_wsus

Features:

/search -> Searches only for available updates

/download -> Searches and downloads updates

/install -> Searches and downloads and installs update

/reboot [nseconds] -> Forces a reboot with a delay of nseconds after executing WuInstall. If nothing is specified, the delay is 10 seconds by default

/criteria “query string” -> searches for updates, which match the query string. For query strings see http://msdn.microsoft.com/en-us/library/aa386526(VS.85).aspx. The default criteria is “IsInstalled=0 and Type=’Software’”

/match “regexp” -> searches for updates which match the search string (no regular expressions posible so far!)

/nomatch “regex” -> searches updates that DONT match regex (regular expressions supported!)

/matchfile file -> searches updates that match one of the match expressions in file (regex supported!)

/nomatchfile file -> searches updates that DONT match any of the match expressions in file (reges supported!)

/severity  severity_level -> updates that match severity level(s) severity_level: C=Critical I=Important M=Moderate L=Low U=Unknown

/classification update_classification -> updates matching certain classification(s) update_classification: C – Critical Updates, U – Updates, R – Update Rollups, S – Security Updates, E – Service Packs, F – Feature Packs

/product “product_name” -> search updates for a certain product (Windows XP, Office 2007, SQL Server 2005, …)

/bypass_wsus -> if a WSUS is used, switches off the WSUS server before executing WuInstall commands, and then switches WSUS on again afterwards

/autoaccepteula -> automatically accepts eula on every update

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

WuInstall is a command line tool for Windows, which enables you to install Windows-updates for a certain workstation in a controlled way by using a command line script instead of the standard Windows update functionality.

It can be used by administrators for updates on many workstations using scripts or for users who do not want to us the automatic Windows upates.

WuInstall uses the windows update API and is written in C++. It searches either on the Microsoft – Update – Server or at the internal WSUS-Sever (depending on system configuration) for currently available updates for the current workstation and can also download and/or installs these updates. It is roughly comparable with a simplified apt-get command like in Linux.

WuInstall

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

Secunia has some tools similar to Belarc Advisor which you might want to take a look at.

There’s a personal edition of Secunia Personal Software Inspector (PSI) which is free and a business edition with network scanning features. The company is quite well known around EU for their website and security bulletins so I thought I should mention them ..

This util is quite new. I like it better than Belarc

From the publisher’s site

The Secunia PSI is the FREE security tool that is designed with the sole purpose of helping you secure your computer from software vulnerabilities. Software vulnerabilities affect all applications installed on your computer, from the Operating System down to your email client, office application, instant messaging, and so on.

Programs such as anti-virus, personal firewall, and anti-spyware are good measures of protection, but they will NOT protect you from the threat of software vulnerabilities – despite what many of them promise!

Secunia collects, evaluates, verifies, and analyses security information from public mailing lists, security and vendor websites, coordinated vulnerability reports, and internal research. We have served customers, partners, and users since 2002.

To help you secure your computer from software vulnerabilities, we kindly offer you to download the FREE Secunia PSI today, it will scan your computer for installed software and determine if any applications lack security updates.

Secunia Personal Software Inspector

• FREE: PhoneFactor – Mobile phone based two-factor authentication (1)
• How to disable USB drive use in an Active Directory domain (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• Four fast ways to improve security in SQL Server 2008 R2 (12)
• Managed Service Accounts in Windows Server 2008 R2 (7)

The Belarc Advisor builds a detailed profile of your installed software and hardware, missing Microsoft hotfixes, anti-virus status, CIS (Center for Internet Security) benchmarks, and displays the results in your Web browser. All of your PC profile information is kept private no your PC and is not sent to any web server.

• Operating Systems: Runs on Windows Vista, 2003, XP, 2000, NT 4, Me, 98, and 95.
• Browsers: Requires IE 3 or Netscape 3, and higher versions. Also runs on Opera, Mozilla, and Firefox.
• File size: 1642 KB.
• License: The license associated with this product allows for free personal use only. Use on multiple PCs in a corporate, educational, military or government installation is prohibited. See the license agreement for details.

Belarc Advisor

• FREE: PhoneFactor – Mobile phone based two-factor authentication (1)
• How to disable USB drive use in an Active Directory domain (0)
• Service Account best practices – Part 2: Least Privilege implementation (0)
• FREE: EMCO Network Software Scanner – Audit installed programs (0)
• Raffle: ManageEngine Desktop Central – Part 2: Features (2)

These are certainly interesting numbers. The article also explains why the downtime of Windows Server 2003 went up. It seems as if there were more Windows updates in 2007 requiring reboots. Hence, one cannot conclude that Windows Server 2003 systems are crashing more often than Linux systems.

However, downtime is downtime. These results match more or less with my own experience. Most of our servers don’t reboot, automatically. So I am quite aware of the downtimes of our Windows servers. I am even a little surprised that the average downtime was only increased by 25%. I’d say that the number of reboots was much higher than in 2006.

With every new operating system version, Microsoft promised to reduce the number of required reboots. Thus far, it seems to me that they were unable to keep this promise. Let’s see if it will be better with Windows Server 2008.

However, I am not sure if these results really speak for Linux. I think, the main reason why the number of reboots increased is because Microsoft is more serious about security than before. So the patches come faster and therefore reboots are more frequent. There have been quite a few studies that show that Microsoft is patching faster than Linux distros. Usually, Linux vendors reject those statistics. I never found their arguments convincing though.

One thing is for sure. The number of patches will go down with Windows Server 2008, simply because Microsoft’s developers value security more than ever. There is already a significant difference between Vista and Windows XP. The number of security updates in the first year after Vista’s release was almost twice as high for Windows XP. This does not only mean that Vista is more secure than XP, it also implies that the costs for patch management are higher with XP.

Since Vista and Server 2008 share about 70% of their code, it is quite probable that we will see a similar development in the server field. I even expect that the difference between Windows Server 2003 and Server 2008 is bigger than with XP and Vista. Many of the teething troubles of Vista RTM were fixed in Vista SP1. Thus, the reliability of Server 2008 should benefit from these improvements, too.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

Dunn also describes a workaround that fixes this problem. Basically, you have to install the old version of Windows Update which can be downloaded via this KB article. Please check out the article on Windows Secrets for more details. Notice that you only need to do this if you used the XP recover function. I guess Microsoft meanwhile is aware of this bug and will deliver a patch soon.

This incident confirms what I have said earlier about silent updates. If a patch breaks other functions, you might search for ages until you find the cause. It is hard to understand how this could have happened, especially since Microsoft knows that its opponents are only waiting for such incidents. However, I disagree with Dunn’s claim in this Computerworld article:

It’s part of the whole problem with the silent update, and all part of the pattern of Microsoft’s sloppiness. They’re keeping us out of the loop. They’re not working well with the IT community.

There are 79,000 people working at Microsoft. To allege that all or most of them show “a pattern of sloppiness” is just unfair, in my opinion. I know it always goes down well to say such things about “Microsoft”. You always get a lot of applause for it in Apple blogs and OSS forums. Whoever is responsible for this at Microsoft certainly made a big mistake and it’s okay to blame him or her for this “sloppiness”. I wished that such smart IT professionals as Scott Dunn would just stick to concrete technical criticism instead of joining in the forum chatter.

That said, I still think that Nate Clinton and the Windows Update team, should find a way to change this behavior of Windows Update. Technically, this shouldn’t be a big deal. What this incident really shows is that silent updates are always a very bad idea.

• The evolution of Microsoft certification (2)
• What does the ‘R2′ mean in Windows Server 2008 R2? (1)
• Windows 8: The PC is dead, long live the PC (5)
• Windows Server 2008 Certification – A quick guide (0)
• Chromebooks – Eight disadvantages – Part 4: Usability and cloudability (3)

If I understood it right, then his main point is that Windows Update itself had to be updated to work properly in the future. But this doesn’t explain at all why users haven’t been notified in advance about this. If Microsoft can replace system files, then it should also be possible to notify users about the update.

It is not that I mistrust Microsoft. Of course, I would always let them update Windows. These are just bad manners. I simply want to know if something will be changed on my PC and if it is only because it would help me pin down the cause of system problems later.

I really don’t understand why Microsoft is so insensitive about such issues. Some people think that Microsoft is only successful because of their marketing. I wonder, however, how it is possible that a company with such a bad image can survive at all. It must have something to do with their products.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

There are two different kinds of SHV policies with respect to updates. One is called “Automatic Updates” and the other one “Security Update Protection“. The latter offers two other options: “Windows Update” and “Windows Server Update Services“. And below that you will find this: “Note: Clients may always get their updates from Microsoft Update“. What the hell is the difference between Automatic Updates and Security Update Protection using Windows Update? And what’s about Microsoft Update? Isn’t that another update service? If you are confused now, then you should read ahead. If not, then you are released for today.

The most important difference is the one between Windows Update and Microsoft Update. Windows Update allows you to patch Windows and Microsoft Update patches Windows and some other Microsoft applications (Microsoft Office, SQL Server, Exchange). In Windows XP/2003 you only can use Microsoft Update if you have the latest Windows Update Agent installed. You can do this thru Windows Update configuration which you can find in the Help and Support Center. Microsoft Update is then enabled by default, but you can disable it by clicking on “Change settings”. In Vista, you can change this setting in the Control Panel under System. Okay, that’s easy, so far.

But what is “Automatic Updates” then? Windows Update and Microsoft Update are also Web sites where you can download updates manually. “Automatic Updates” is not another service, it just means that the Windows Update Agent schedules the download updates automatically, regardless of whether you are using Windows Update or Microsoft Update.

However, “Automatic Updates” can mean something else sometimes. In Windows XP/2003 it is the name of the service of the Windows Update Agent. Now guess how this service is called in Windows Vista and Windows Server 2008? Its name is “Windows Update”. Note that this Windows Update service not only downloads from Windows Update but also from Microsoft Update. So sometimes “Windows Update” and “Automatic Updates” just refer to the same thing, i.e. to the Windows Update Agent service.

To come back to my starting point, why does NAP distinguish between Automatic Updates and Windows Update?

If you enable Security Update Protection, it just means that the NAP client is compliant if it got the latest security updates installed, regardless if they were downloaded from a WSUS server, Microsoft’s patch management solution, from Windows Update or Microsoft Update. However, you can also restrict the possible download source to Windows Update or WSUS.

If you check Automatic Updates in the NAP configuration, it only means that the Windows Update Agent is set to download updates automatically no matter if the download source is Windows Update, Microsoft Update or your local WSUS server. Note that even if Automatic Updates is activated, the client might not have the latest updates installed, for example if it wasn’t online for some time.

In my view, Microsoft’s terminology is quite confusing. Why not just one Update service and one term for it? Well, I hope that after blogging about it, I won’t get confused again about this.

• Microsoft Exam 70-640 – DNS Zones – Overview (2)
• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)

However, I really wonder why you need IE and an ActiveX control for such a simple application. Imagine Google working with IE only after you install an ActiveX control.

Don’t get me wrong. I am not really an advocate for open web standards. If you have to break an open web standard because of a useful feature, then it is quite okay with me. Why should MS turn down a good feature, just because the standard doesn’t allow it? Should they wait for the sluggish W3C or their competitors until they finally all support this feature? As a Firefox user I have no problem launching IE if I get a nice feature for it in return. After all the IE Tab add-on allows me to display a web page using the IE rendering engine within Firefox with just a mouse click.

But in this case, I don’t understand Microsoft. I don’t see any reason why one should need IE for a simple search box. Rest assured that this will annoy many supporters of open web standards. Anyway, you can check out Jeff’s Connected Corner for other complaints about this new Microsoft service. You might also want to leave a comment in the Microsoft Update Product Team blog.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

Ryan found this line in the executive summary of this security bulletin:

This important update resolves two privately reported vulnerabilities in addition to other security issues identified during the course of the investigation.

He calls this “silently fixing a vulnerability” which surely is an exaggeration. After all, Microsoft admitted that they fixed something. But he forwards two arguments why this practice is questionable:

Microsoft’s official stance is that disclosing flaws will make it easier for the bad guys to write exploits. Ryan’s counter argument is this:

On the other hand, white hat hackers warn that silent fixes is a dangerous practice because exploit writers already have the tools to reverse-engineer a Microsoft patch to find all the silently fixed issues.

This argument contains a logical flaw which is typical for security experts. It is only valid if “exploit writers” is supposed to mean “all exploit writers”. However, reverse-engineering is not a piece-of-cake. Not every bad guy has these tools and not everyone knows how to use them. And maybe even more important, it takes more time until the exploit is ready if the “black hat hacker” doesn’t have a detailed description of the security bug. Hence, administrators will have more time to patch their systems.

However, there is another argument which seems to disprove this point:

The problem, according to security research professionals, is that Microsoft keeps a tight lid on the details of those internally discovered issues, a move that makes it difficult for an IT administrator to make an informed patch deployment decision.

There certainly is some truth in that. Some administrators only install those patches which seem to be dangerous enough for them. So if Microsoft doesn’t give them the details of a bug, they might just neglect this patch which in turn makes it easier for the bad guys.

But if I were a “security research professional” I would recommend to administrators installing any security patch no matter how dangerous it would seem to be and would recommend to Microsoft to make it clear in their bulletins that this is an important security patch even though the details remain unpublished.

Imagine this: Ferrari finds a serious flaw in the anti-theft system of your new red pride. Do you want them to publish the trick in all newspapers? Or would you rather have Ferrari call you to bring your runabout to the garage? You might say that the bad guys will find this bug anyway, sooner or later. The point is do you want Ferrari to tell the kids next door how to go for a spin with your red darling before you have the chance to get things fixed?

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

For one, Symantec is one of Microsoft’s competitors, so you wouldn’t expect them to court the Redmond guys. Secondly, Symantec is a company selling mostly security-related products for Windows. It is simply not in their interest to proclaim that Windows is a secure operating system. Why do you think are they so nervous about Vista?

This study, however, is not about Vista since it used data from the second half of 2006. Symantec’s researchers found that Windows had less vulnerabilities and was patched the fastest among the competing operating systems. The average patch development time of the 39 Windows vulnerabilities was 21 days. Second was Red Hat Linux with an average of 58 days for a sample set of 208 vulnerabilities. The third place goes to Apple with 66 days for a sample set of 43 vulnerabilities. It is interesting to note that the average patch development time was increased for all software vendors. Please, check page 40 in this PDF for further information.

Of course, you’ll find lots of refutations in the coming weeks about this study. (internetnews.com has already some of them.) One weak point certainly is that the Windows vulnerabilities were often more severe. The other question is can such data be used at all to decide which operating is more secure? It is a matter of fact that there is much more malware for Windows than for any other OS, for example. When it comes to security, the only interesting figure is, how often organization registered security breaks for the different operating systems.

Nevertheless, the Symantec data is interesting since it is another proof that Microsoft is making progress with respect to security. I’m already curious about the next study that will include Vista. Do you remember the times before Windows NT? All IT professionals made jokes about the stability of Microsoft’s operating systems. These critics are either quite now or started to bash MS because of security. What’s next? Microsoft’s Internet execution sucks?

• The evolution of Microsoft certification (2)
• What does the ‘R2′ mean in Windows Server 2008 R2? (1)
• Windows 8: The PC is dead, long live the PC (5)
• Windows Server 2008 Certification – A quick guide (0)
• Chromebooks – Eight disadvantages – Part 4: Usability and cloudability (3)

I’m not a friend of web interfaces, in general. I don’t even like to read my mail using a web browser. The web is great for publishing, but web browsers were not build to run applications and, especially, not as frontends for server management tools. That’s my personal view. So, you can just imagine that I liked to hear that WSUS gets an MMC-based user interface now.

Microsoft says that WSUS also offers improved performance and reliability. However, we did not have problems ever with WSUS 2, with respect to this. We are using WSUS to patch about 550 computers at the moment. So I suppose that the improved performance is only relevant for bigger organizations.

It seems that WSUS 3.0 still lacks one essentials feature, though. It doesn’t allow you to patch third party products. This is the only reason, I can think of, to switch to another patch management solution.

Windows Connected discusses some of WSUS 3.0 UI improvements. Please, also check out the WSUS team blog for more information.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

The rising popularity of the web enticed many vendors of administration tools to introduce web-based user interfaces. Usually, the argument was “interoperability”. This means I could use a Linux box or even a Mac to manage my WSUS server, for example. Now, I ask you, which Windows administrator is doing this? I think the real reason is that many software vendors just wanted to be en vogue. A web-based interface is just “cool”.

Well, in my view, it just makes work slow. Web browsers are great for displaying web pages. Web browsers are also good to work with very simple web-based applications. I am a great fan of Web 2.0, Ajax and all this stuff. However, a web browser is not an operating system. Therefore, a web browser is not suitable to manage complex applications. Ajax is nice, but compared to the possibilities of a full blown OS it is just a little toy.

It seems that Microsoft realized this now. Hopefully, this will persuade other software vendors, to value functionality over the general web and Ajax hype.

If you want to know more WSUS 3.0 Beta 2, you should check out this and this article at Windows Connected.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)

Did it ever happen to you that your computer rebooted during lunch break and you still had some unsaved files open? Windows Update usually asks for permission to reboot after installing updates. If you don’t respond within a certain time, it will make this decision for you.

I think, Microsoft chose this as the default setting because many don’t shut down their computers at all. In my view enforcing reboots in such a rude way is not a good idea, though. The question is if your users will loose data more often because of malware using unfixed security holes or because of the enforced reboots of Windows Update.

To this dilemma, I recommend advising users to turn off their computers over night. This not only saves energy, it also improves security since the computers in your network are not always online. You can then set the reboot relaunch timeout to 24 hours. This way, nobody will loose data because of enforced reboots, assuming of course that they’re following the company’s guidelines.

As you probably are a system administrator, you know already that messing with the Registry can cause serious damage to a Windows system if you don’t know what you are doing.

• Windows Update errors – A troubleshooting guide (2)
• FREE: WSUS Offline Update – Update Windows and Office without an Internet connection (1)
• FREE: WSUS ClientManager for Workgroups – Add computers to a WSUS server (0)
• Turn off automatic Windows Update reboots (10)
• WuInstall – Push Windows updates to clients from a central cache (0)