Rollout start and client availability

Hi Folks -  Noticed a little confusion from our blog post yesterday regarding the Windows Update Agent Update availability.  Last night's blog post was to give you some lead time before we started rolling out and making our standalone WUA update available.   We are on schedule to start the rollout Monday, 11/3/08.  Hope this helps and sorry for any confusion.

The MU Team

Windows Update Agent Update rolling out over the next couple of months

Hi everyone,

Over the next couple of months we’ll be rolling out another infrastructure update to the Windows Update agent (client code). This update makes it possible for users to install more than 80 updates at the same time. For more information about this update, please refer to KB949104 (section referring to the 7.2.6001.788 update).

As we blogged about in July, we need to periodically update the client code to provide improvements in reliability and service quality. For more information on infrastructure updates, take a look at our Upcoming Updates to Windows Update July blog post.  If you’d like more information about Windows Update, and how the service works, please review the newly launched Windows Update information on windows.com.

Thanks,

- The MU Team

Windows Live OneCare category coming soon

Updated 10/30/08 :  WSUS admins will be seeing a new product category under the Windows Live product family in the future.  The new product category will be Windows Live OneCare. 

Thank you,

The MU Team

Critical Security Update Released Today

Hello,  

Microsoft has released a critical security update today, 10/23/2008 and made this update available via all update distribution channels.   For more information see:  Microsoft Security Bulletin MS08-067.

Windows Update and Automatic Reboots

Windows Update plays an essential role in keeping your computer safe, and in order to do that, it sometimes has to reboot your computer.  In this blog post, we want to help clarify how WU reboots your machine (including key differences between XP and Vista behavior), why it does it, and how you can change your WU settings to better fit your needs.

Automatic Rebooting

The goal of Windows Update is to always keep your computer as safe and secure as possible.  Therefore, if you decided that Windows Update should Install updates automatically, an automatic system reboot may be a part of the process.  Choosing any other option will disable automatic reboots, but we do recommend that you keep automatic updates enabled!

Why does Windows Update sometime require a reboot?  Well, some updates require access to files currently in use by your system.  Windows Update does not know if or when those files will be available to use, so your system requires a reboot to avoid any conflicts. For security-related updates, your computer is unsafe before that reboot occurs: it is vulnerable to attacks which exploit the issue(s) fixed by the update requiring a reboot.  

For that reason, when Windows Update automatically installs an update that needs a reboot, it proceeds with an automatic reboot.  In order to make the updating process more convenient for you by preventing disruptions to your work, WU defaults to installing updates (and subsequently rebooting your computer) at 3:00AM.  Additionally, if updates are installed while you happen to be using the computer, and a reboot is required, Windows Update notifies you with this dialog:

The center countdown timer  starts at 5 minutes.  You can Restart now, or Postpone the reminder by 10 minutes, 1 hour, or 4 hours (In Windows XP, you can postpone for 10 minutes).  

There is one exception – a system administrator can deny your rebooting privileges.  For user accounts without rebooting privileges, Windows Update disables the Restart now button.  You can still Postpone, or your system will automatically reboot after 5 minutes.

Update Deadlines

A system administrator can configure some computers behind a Windows Server Update Services (WSUS) server with update deadlines.  When reaching a deadline, Windows Update begins an automatic install of those updates based on settings determined by the system administrator.

This deadline-based automatic install behaves identically to a Windows Update automatic install.  Therefore, if one or more of the deadline updates requires a reboot, Windows Update presents the same dialog box to you with the same options and conditions.  However, if a deadline update requires a reboot, then the reboot cannot be postponed – the Postpone button in the dialog will be disabled.

Policies to Change Automatic Rebooting Behavior

Two group policies allow you to configure how Windows Update handles automatic reboots.  In order to edit these policies, you must own Windows XP Professional, Windows Vista Business, or Windows Vista Ultimate.  The Group Policy Editor is not available in Home Windows versions.

To use the Group Policy Editor, follow these directions for both Windows XP and Windows Vista: http://support.microsoft.com/kb/307882

In Windows Vista, there is another way to access the Group Policy Editor:

·         Click Start

·         Select Control Panel

·         Type Group Policy into the search box

·         Click Edit Group Policy, the only result that appears

Once inside the Group Policy Editor:

·         Expand Local Computer Policy

·         Expand Computer Configuration

·         Expand Administrative Templates

·         Expand Windows Components

·         Finally, select Windows Update.

The Group Policy Editor with related Windows Update policies looks like this:

With Automatic Updates enabled, the two following policies help you configure automatic reboot behavior.

No auto-restart with logged on users for scheduled automatic updates installations

If you set this policy to Enabled, then your system will never automatically reboot when a user is logged on to it.  After Windows Update automatically installs updates that require a reboot, it presents all logged-on users with the following dialog box:

With this policy Enabled, Windows Update never automatically reboots your system, so there is no 5 minute timer.  You can Restart now, or Postpone the reminder by 10 minutes, 1 hour, or 4 hours (In Windows XP, you can postpone for 10 minutes).

Not Configured is the default policy setting and uses the 5 minute timer.  Disabled works identically to the Not Configured setting.

 Delay Restart for scheduled installations

This policy allows you to change the initial timer for automatic reboots.  If you set this policy to Disabled or Not Configured, the default setting, then Windows Update uses the default wait time of 5 minutes.  However, if you set the policy to Enabled, it asks you to enter a number which sets the initial wait time. 

For example, if you set the number to 15, Windows Update presents the following dialog after it finishes automatically installing an update that requires a reboot:

Notice how the text following “Restarting in:” began with a 15 minute timer instead of a 5 minute timer.  Other behavior remains the same.

There are a lot of tools available to help you set up Windows Update to act how you want it to.  We hope that this blog post will help you to do so!  If you want some more in-depth detail about how Windows Update works, the Microsoft Update team just posted a white paper on TechNet.

We’ll be paying attention to your comments, so please give us your feedback!

Thanks,

-WU Client Team

A New Resource about Windows Update is Available

Hi Everyone -

Want  to better understand updating behavior and what Microsoft is trying to do with Windows Update? We've created a whitepaper called Windows Update Explained, which provides information about how Windows Update works, including how to check for, download, and install updates.  It also talks about reboots, the information Windows Update collects in order to operate, and security protections in Windows Update.  And there's a little bit about WSUS, and pointers to how you can customize it, for all your IT Professionals out there.

Here's a snippet to get you started:

"In spite of their high cost and the headaches they cause, many security breaches are easily avoidable. The security fixes are available, but users don’t get them installed quickly enough (or at all).

Have you ever wondered what Microsoft is doing to help? Or did you know that Microsoft® Windows® Update is an important part of the solution, but weren’t sure exactly what it does or how it works. If so, this paper is for you…"

Interest piqued? Go check out Windows Update Explained over on the TechNet Update Management Center today and let us know your feedback. 

-MU Team

IE 8.0 Beta 2 on WU

For all you WU users who happen to be running Internet Explorer 8 Beta 1 on a Windows XP or Windows Server 2003 system, we wanted to let you know that today we’re releasing IE8 Beta 2 to Windows Update so that getting the latest Beta is super easy and convenient for you (note IE8 Beta 2 will be made available to WU users running Windows Vista at a later date).  If you have Automatic Updates turned on, Windows Update will automatically download IE8 Beta 2 and notify you when it is ready for install.  You’ll then have the option to proceed with or postpone installation. 

You can read more about the IE8 Beta and upgrade options here. 

Thanks!

-MU Team

New Product Families - Windows 7

Things to Know about Windows Search 4.0 installation...

Windows Search 4.0 has been available on WU for a few weeks now, and we've been getting some questions about installation failures and error code 0x643.  We've done some investigation and found out that the installation failure in this case may actually be caused by the computer configuration, which in most cases can be easily changed to allow for successful installation and functionality of Windows Search 4.0.  

In this case, when WS4.0 runs under Windows Server 2003 or Windows XP, it requires Terminal Services to be running. By default, Terminal Services are set to start automatically in Windows XP and Windows Server 2003; however, system administrator or third-party software may have chosen to disable them. In order to enable installation and subsequent functionality of Windows Search 4.0 on your machine, you need to have Terminal Services running first.

You can check the status of Terminal Services on your system and start the service, if needed, from the Start menu by clicking Run and entering “services.msc”.   Locate Terminal Services – if the status of the service isn’t “Started”, right-click the service, click Properties, set startup type to Automatic, click Apply and then click Start. Now you can restart the installation of Windows Search 4.0 if it was failing before due to Terminal Services not running on the PC.

More information on how to manage services running on your PC is available here and KB940157 provides more information about Windows Search 4.0 and its prerequisites.

 - Hope this is helpful-

Reminder - Windows Search 4 coming to WU soon...

Hi everyone –

Thought I’d drop a line and remind you that we’re planning to release Windows Search 4.0 (KB940157) via Windows Update sometime in late July.  Windows Search 4.0 updates previous versions of Search in Windows Vista SP1, Windows XP SP2 and Windows XP SP3, Windows Server 2003 SP2, Windows Server 2008, and Windows Home Server.   

Windows XP users will see Windows Search 4.0 available as an Optional update, which means you must visit the Windows Update Web site to install it.  Windows Vista users with SP1 installed will see the update as a Recommended update.  This means that, if a Windows Vista user has set their machine to automatically install updates, Windows Search 4.0 will automatically install on PCs running Windows Vista SP1.  The release of Windows Search 4.0 to Windows Update will be gradual for these users.  If you’re running Windows Vista SP1, and you would like to install it right away, you can go to the Windows Update control panel and install it manually once it is made available.

One thing you should note: In order to make search functionality more efficient and reliable, the Windows Search team updated the structure of the search index in this release.  This requires re-indexing users’ data. The re-indexing occurs in the background after the installation is completed and a reboot has been performed.  The cool part? Windows Search will release most of the requested resources and slow down the indexing process as soon as it detects mouse or keyboard activity, or when another application requires computer resources.

 If your organization is running Windows Vista Service Pack 1, has no update management solution, and would like to postpone the installation of Windows Search 4.0, the Windows Search team has provided guidance on how to do so here.

And, if you’d like to find out more about Windows Search 4.0, check out the Windows Experience Blog.

Upcoming Update to Windows Update

Hi everyone,

I'd like to let you know that, beginning at the end of this month and continuing over the next few months, we’ll be rolling out an infrastructure update to the Windows Update agent (client).  I wanted to take this opportunity to provide some background on the update and discuss the value these updates bring to you. 

How Windows Update Keeps Itself Up-to-Date

Occasionally, we must update the infrastructure of Windows Update in order to ensure a high level of service quality, reliability, and operation.  As part of this process, we update both the back-end infrastructure that supports the service as well as the client side code (i.e. the Windows Update agent, or client).

So what are we doing this time? Well, this particular update won’t really change the way the client looks or feels to you, but you may notice some improvements in the length of time it takes Windows Update to scan for updates and how quickly you’ll receive signature updates.  For example, in this update, we’ve invested heavily in reducing the amount of time it takes the Windows Update agent to scan to see if new updates are available.  In this case, we’ve seen some instances of the scan times on some machines decreasing almost 20 percent.

Settings 101

Before we dive into how Windows Update issues the infrastructure updates, let’s review some information about different changes you can make to your personal Windows Update settings.  We recommend that you install Important + Recommended updates (in Windows Vista) or High Priority updates (in Windows XP) automatically; these options are presented when you set up Windows.  After initial setup, if you would like to change your settings, go to the Windows Update application in Windows Vista or the Automatic Updates Control Panel in Windows XP.  There you can select from 4 settings:  (1) Automatically Download and Install; (2) Download Only (updates are downloaded but the user chooses whether and when to install them); (3) Check for Updates (no updates are downloaded and you’re notified that updates are available for download and install); and (4) Off.  See Figures 1 and 2 below.

    Figure 1: Windows Vista Windows Update Control Panel                  

 Figure2: Windows XP Automatic Updates Control Panel

What does this mean for you?

Anytime the Windows Update agent is turned on, Windows Update will take care of updating itself.  Windows Update is considered “on” when anything other than “Never check for updates” or “Turn off Automatic Updates” is selected.  What this means is that if you’ve selected “install updates automatically,” the update to the Windows Update client will install automatically.  You may also notice that Windows Update will also automatically download and install updates necessary for the Windows Update client to function properly if you’ve chosen a different setting, like setting 2 (“Automatically Download Updates”) or setting 3 (“Automatically Check for Updates”).  This is done in order to ensure that a system will continue to notify the user about available updates. 

The Windows Update client does not download or install infrastructure updates if the user has selected setting 4 (“Off”).  In other words, if a Windows Vista user selects “Never check for updates,”( or if a Windows XP user selects “Turn off Automatic Updates”), the user will not receive Windows Update client infrastructure updates unless they choose to manually install it from Windows Update.

Windows Update has been keeping itself up-to-date this way for many years, and while these infrastructure updates are important to maintain the quality of the Windows Update service, they aren’t that frequent (they usually occur about once a year).

Why does Windows Update need to self update?

You may be wondering why this process is different from other updates you’ve come to expect from Windows Update.  The reason Windows Update issues infrastructure updates in this way is to ensure that users are able to successfully check for updates and/or receive expected notifications.  If Windows Update wasn’t able to do this, it may cause some users to believe that they have all of the latest security updates even though there was no installation and/or notifications of updates. To avoid a false sense of security, the Windows Update client automatically checks for and installs any available infrastructure updates anytime a system uses the Windows Update service, independent of the settings for how it handles updates.

I hope this information was useful in helping you understand infrastructure updates, and that you have the time you need to prepare for the update. 

We continue to be confident in the value Windows Update offers.  For more information about infrastructure updates, please refer to KB946928.  If you’d like more information about Windows Update, and how the service works, please review the newly launched Windows Update information on windows.com.

We look forward to hearing your feedback.

Thanks,

Michelle Haven

Product Mgr., WIndows Update

Reminder - Windows Vista SP1 RC Builds Expire soon!

Quick reminder for all of you out there who helped test Windows Vista SP1 and may still be running  Release Candidate builds (any build less than 6.0.6001.18000).  The RC builds will expire on June 30th - so if you happen to running one, be sure to uninstall it before the end of the month.   More info is available in the  SP1 Forum.

Thanks,

-MU Team

Announcing New Office Sustained Engineering Blog for all Office update information

Hi all,

If you use Microsoft Office, a great new resource has recently come online to help you understand how Office updates work. The Office Sustained Engineering blog features release announcements, known issues, explanations of update behavior, and other information about Office updates. If you work with Office updates, it’s worth monitoring this page for the latest info, such as the recent announcement that Office 2007 SP1 will be delivered through Automatic Updates starting in mid-June. Check it out!   

Hope this is helpful, 

The MUTeam 

More on Windows XP Service Pack 3...

We'd like to provide more information and address reports you may have heard about  "continuous reboot loops" occurring upon the update to Windows XP SP3. 

After investigation, we’ve determined this problem occurs on AMD-based machines with Windows XP images that were originally captured by an OEM on an Intel-based machine.   The problem is a registry value, present on images created w/ Intel processors, that causes a driver (intelppm.sys) to load at boot.  When intelppm.sys attempts to load on an AMD-based system upon the install of SP3, it causes a blue screen and the continuous reboot.  We’re planning to add a filter to prevent Windows Update from offering SP3 to affected systems and are investigating a fix. Any customers affected by this issue should contact Microsoft Customer Support Services for assistance. More information is available in KB88372 and here.

On a related note, we've heard a few questions about SP3’s distribution.  To clarify our earlier post, SP3 is currently available as a High Priority update on the Windows Update website.  This means that if you go to WU and do an express or custom install - you should see SP3 listed.  We’re planning to begin automatic distribution (via AU) of SP3 sometime in early summer.

Hope this is helpful,

-MU Team

Early heads-up for Office 2007 SP1 Automatic Update availability

Hi folks;

Just wanted to give you an early heads up.  Office 2007 SP1 will be available to Automatic Update in mid-June.  For all the details, see the Office Sustained Engineering Blog post here. 

Thanks!

The MU Team