Hi all,

We wanted to let you know that a new version of the Windows Update Agent is being released on Windows Update over the next couple of months. Because WSUS and Windows Update both use the same Windows Update Agent, this means that WSUS-managed end-user who navigates to WU to perform an interactive sync will receive an updated version of WUA as this new agent is rolled out over the next few months. Machines who's end-users don't explicitly navigate to WUA to perform an interactive scan will continue to use the existing version of WUA. This will result in a mixture of WUA versions in most corporate environments. Because WUA is backwards compatible, machines that recieve the newer agent will continue to work just fine with WSUS.

You can read more about this change in the Windows Update blog at http://blogs.technet.com/mu/archive/2008/07/03/upcoming-update-to-windows-update.aspx.

-Marc Shepard

WSUS Program Manager Lead

Hi everyone,

Windows XP Service Pack 3 (SP3) was made available to Windows Server Update Services this morning, classified as a service pack.  It includes previously released updates and hotfixes to Windows XP and creates a new baseline for servicing.  For more information about what's changed and how to deploy, see the Windows XP Service Pack 3 Overview.

One thing you may be aware of, if you happen to be managing any clients running Microsoft Dynamics Retail Management System, is an incompatibility Microsoft Dynamics RMS has with Windows XP SP3.  To address the problem, we’ve added a filter to help prevent Windows XP SP3 from being installed on clients managed by WSUS and will make a fix available soon (more info here).

-Cecilia Cole

WSUS Program Manager

A few people on the microsoft.public.windows.server.update_services newsgroup mentioned concern over a flood of ATI Radeon Graphic Card updates. There were close to 4000 sync'ed recently to their WSUS 3 and WSUS 2 servers, and there was worry that something strange had happened.

Short answer: It's fine, though unpleasant to look at.

Here's some more background, partially from Bobbie Harder and with additional material from the rest of the product team.  We'll give you the technical backgrounder, and then some tips and tricks for dealing with large numbers of items in the UI.

As a reminder, the newsgroups are really the best place to discuss issues, provide feedback, and get help from the community and MVPs.  Responses to blog posts are occasionally read, but eventually get drowned in automated spam. 

Technical backgrounder

Yes you will see the meta data synched for 3976 versions of this driver, one for every unique hardware ID that it supports
on Vista.  That said, Keep in mind only metadata is synched down. The binaries are not synchronized until the driver is approved.  But dont worry
about having to cross reference every supported HW type that needs this driver in your environment.  Just do a bulk approve ( via multiselect and
approve) and the clients which need a particular driver and the correct detection logic will do the right thing.

Also be assured that we really only have about 8MB total binary size for all these updates.  All but 2 of the updates reference the binaries of primary
packages for x86 & x64 so you will not be downloading 4MB x 3976.  By all means dont just bulk decline these unless your positive you don't have this
type of card in your environment.  WSUS only synchs critical drivers and this is one.  Hope this helps.

We are changing the publishing process for the future btw so that multiple HWIDs will be associated to one update in the future.  thnks - Bobbie

UI Tips and Tricks

There are a couple of methods in the WSUS 3 UI that can help you manage the complexity you're hitting with this group of updates.

Right click the Updates view and create a new view.  You can create views to specifically include, or exclude this kind of driver.

Right click in an updates view, and choose Group By, and group by the update name.  Since these updates have the same name, they'll be grouped together in one bunch that you can expand or collapse.  On my machine, you'll see there are 3,982 items.  Once grouped, you can select the group header and do bulk operations like approve or decline.

-- matthew

Good morning folks!

I wanted to bring to your attention the fact that on 03/18 , Windows Vista SP1 was made available for Windows Vista systems in English, French, German, Spanish, and Japanese.

For WSUS users, the Standalone Package of the Service Pack and its prerequisites will be available on the MU Catalog Tuesday March 25 but before that, there are a few things to take into consideration:

-      This process applies to WSUS 3.0 RTM and SP1 servers only.

-      If you are running your WSUS server on a Windows 2003 Server, you will first need to download and install the WinTrustVerify update (KB 938759) on that server.

Procedure for importing the Vista SP1 standalone package into a WSUS 3.0 server

1.                  Make sure KB 938759 has been installed on the server. If it has not been installed, the subsequent steps to import of Vista SP1 will fail.

2.                  Open the WSUS Administrator console, then expand the Update Services node, then the node for the WSUS Server.

3.                  Right-click the Updates node and select “Import Updates” which will open the Microsoft Update Catalog web site in a new browser window.

4.                  In the Microsoft Update Catalog site, search for “Vista SP1” and click Search.

5.                  In the Microsoft Update Catalog results, choose the option to "Add" the following packages into the download basket:

6.                  To import the Windows Vista Service Pack 1 Standalone packages, Add “Windows Vista Service Pack 1 – Standalone (x86)” and/or “Windows Vista Service Pack 1 – Standalone (x64)”

7.                  Once the packages are selected, click the ‘View basket’ option.

8.                  Confirm the selections then click “Import” to import the selected packages and any prerequisites into the WSUS Server.  Once complete, click "Close" to close the Import Progress window and close the Microsoft Update Catalog site in the browser.

9.                  In the Windows Service Update Services administrator console, confirm the appropriate packages and prerequisites are available.

Note: for details on the Windows Vista Service Pack 1 and Service Pack 1 Standalone versions, please read the Windows Vista Service Pack 1 Deployment Guide.

To learn about know caveats when upgrading to Windows Vista Service Pack 1, please read KB 948343.

Also, for more details on this release, check out the Windows Vista Service Pack 1 TechNet site.

Please, note that even though this update is only available on the MU catalog site now, it will eventually be released to WSUS as a Service Pack, so it will flow to WSUS servers at a future date. Details on how this will work will be provided in an upcoming KB.

Thank you.

Cecilia Cole

WSUS Program Manager

I am very pleased to announce that WSUS 3.0 SP2 Beta is available today, January 26, via the Connect Site. All you have to do is sign in to your Connect account or sign up now in order to participate in the Beta program.

WSUS 3.0 SP2 Beta Overview

New Windows Server and Client Version Support

·       Integration with Windows Server® 2008 R2

·       Support for Windows 7® client

·       Support for the BranchCache feature on Windows Server® 2008 R2

WSUS Beta Feature Improvements and Fixes

Auto-Approval Rules

·       New functionality lets you specify the approval deadline date and time.

·       You can now apply a rule to all computers or to specific computer groups.

Update Files and Languages

·       This release provides improved handling of language selection on downstream servers. A new warning dialog appears when you download updates only for specified languages.

Cross-Version Compatibility

·       The user interface is compatible between Service Pack 1 and Service Pack 2 for WSUS 3.0 on both the client and the server.

Software Updates

·       Stability and reliability fixes for the WSUS server, such as support for IPV6 addresses greater than 40 characters.

·       The approval dialog now sorts computer groups alphabetically by group name.

·       Computer status report sorting icons are now functional in x64 environments.

·       Fixed setup issues with database servers running Microsoft® SQL Server® 2008.

Thank you very much in advance for your participation. Your feedback is greatly appreciated.

Regards,

Cecilia Cole

WSUS Program Manager

Have you checked out our homepage lately?  Who says you can't get something for nothing?

http://www.microsoft.com/technet/windowsserver/wsus/default.mspx

We are thrilled to announce that WSUS 3.0 has released today April 30th and
is avaialble now on the Microsoft Download Center.
Full information, documentation, samples and links to the bits can be found
here:  http://www.microsoft.com/wsus.

The WSUS Product Team is proud to announce that WSUS 3.0 SP2 is now available! Get it today!

We recommend installing SP2 on all existing and new installations of WSUS.

WSUS 3.0 SP2 supports the latest operating systems including Windows Server® 2008 R2 and Windows 7 clients. WSUS 3.0 SP2 is more robust and features significant improvements in client performance, reliability, and increased server usability and reliability.

Administrators will see improvements in several areas including:

Reports

·       New Update and Computer Status reports provide the ability to report on only the updates you’ve approved for installation. You can run these reports from the WSUS console or use the API to incorporate this functionality into your own reports.

Auto-Approval Rules

·       Auto-approval rules now include the ability to specify the installation deadline date and time for all computers or specific computer groups.

Update Files and Languages

·       Improved handling of language selection for downstream servers includes a new warning dialog that appears when you decide to download updates only for specified languages.

Easy Upgrade

·       WSUS 3.0 SP2 can be installed as an in-place upgrade from earlier versions of WSUS and will preserve all of your settings and approvals. The user interface is compatible between WSUS 3.0 SP1 and SP2 on the client and the server.

Software Updates

·       Stability and reliability fixes for the WSUS server, such as support for IPV6 addresses.

·       The approval dialog now sorts computer groups alphabetically by group name.

·       Computer status report sorting icons are now functional in x64 environments.

·     A new release of Windows Update Agent is included with WSUS 3.0 SP2 that provides improvements in reliability and faster client scan times, the ability to perform ‘scoped’ scans, improved update organization, more clarity on update value and behavior, plus improved display of imaged machines.

Operating Systems Supported by WSUS 3.0 SP2

Server

·       Windows Server 2008 R2

·       Windows Server 2008 SP1 or later

·       Windows Server 2003 SP2 or later

Client

·       Windows 7 client

·       Windows Server 2008 R2

·       Windows Server 2008 SP1 or later

·       Windows Server 2003 SP2 or later

·       Windows Vista

·       Windows XP Professional

·       Windows XP Professional SP1

·       Windows XP Professional SP2

·       Windows XP Professional SP3 or later

·       Windows 2000 SP4

For more information about WSUS 3.0 SP2 including documentation and download instructions, see:

1.       Windows Server Update Services 3.0 SP2 Dynamic Installer for Server Manager (KB972493)

2.       Windows Server Update Services 3.0 SP2 (KB972455)

Additional information

For more information about this release visit us at our Windows Server Update Services page.

The Product Team would like to thank you for your support throughout Beta and RC of this release. Thank you for making WSUS a better product!

Regards,

Cecilia Cole

WSUS PM

Hi all,

Anyone who added "Drivers" to their WSUS synchronization options may have noticed a large number of driver updates showing up in their WSUS server recently, and the majority of them have the same title. We wanted to let you know what's going on and what we are doing about it.

First lets talk about the root cause. Drivers can target one or more hardware IDs, and we have a limitation in our data-model so that each "update" can only support a single hardware ID. What that means is that a single driver is often implemented as multiple updates, all with the same title. What happened recently is a few drivers were released to WSUS that supported a very large number of hardware IDs.

It turns out the proper fix for this is not simple; it involves changes to WSUS, WUA, WU, and our driver publishing pipeline to allow a single driver update to support multiple hardware IDs. We have made a number of these changes already, but all this won't come online until some time after the next WSUS release. A number of folks have asked "can't you just do some quick change to the WSUS UI to group them together" and unfortunately that is an even more complex change to make (although in the WSUS 3 UI update view, we do have a "group by" feature that allows one to at least group the updates by title - but that's only a small part of update handling).

In the short term, we will be making some publishing policy changes to ensure that drivers with a large number of hardware IDs don't flow to WSUS through WSUS/MU server synch. This doesn't mean the drivers won't be available to WSUS - they can still be imported from the MU catalog site (from the WSUS 3 UI, go to the "Updates" node and select "import..."). It's just that they won't flow automatically and surprise those who have added drivers to their synch options.

-Marc Shepard

WSUS Lead Program Manager

Hello WSUS Admins,

We just wanted to give you a heads-up that today we published 3 updates released by the Office team to address customer issues opening Office 2003 documents protected with Active Directory Rights Management Service (AD RMS) or Rights Management Services (RMS). The update is available through Microsoft Update and to WSUS as a Critical Update. For more information about this update, please refer to the Office Sustained Engineering blog.

Thanks all!

Hi WSUS Admins,

Soon you will see a new product category family called PlayReady PC Runtime for Windows Media Center.  Associated updates for the PlayReady PC Runtime will not be made available to WSUS for synchronizing as they are available only to Windows Media Player via the Windows Update API (WUAPI).  You will see the product family, however not the associated product categories or updates.  For additional information see:   PlayReady.

Thank you,

The WSUS team

WSUS Admins:

On April 15^th the Office Genuine Advantage (OGA) notifications update (KB949810) was inadvertently published to WSUS servers for approximately twenty-four hours. This update was intended for Microsoft Office users in the pilot countries of Italy, Spain, Turkey and Chile, but because of WSUS publication, it became available to WSUS managed clients inside and outside of these intended countries.  This update has since been removed from WSUS.  For servers which synchronized the OGA update package, the package required a EULA acceptance before it could be made available to WSUS managed clients, via either manual approval, or auto-approval rules.   OGA notifications are designed to alert customers who are using non-genuine software, and are thus more vulnerable to activation exploits and the risks of counterfeit. As such, this update was marked critical for WSUS.

We are available to offer full assistance if you have problems or questions related to this issue, via your regular support channels.  Customers who want to learn more about OGA notifications can reference the online KB Article.  Customers who require support should submit  a Technical Support Request for Microsoft Genuine Advantage Issues.  

The following instructions enable WSUS administrators to setup WSUS to  install WSUS 3.0 SP1 through Window Server 2008 SP1 Server Manager. The following update packages are used to upgrade previous versions of WSUS only and are not part of this discussion:

Windows Server Update Services 3.0 SP1 (KB948014)

Windows Server Update Services 3.0 SP1 for x64-based Systems (KB948014)

On the WSUS server, the admin must enable the Updates and Feature Packs classifications,  select two new product categories, approve the update that upgrade Server Manager, and approve the package Windows Server Update Services 3.0 SP1 Dynamic Install for Windows Server 2008 (KB948014) (there’s one for x86 and one for x64).   This specific WSUS package is targeted at Windows Server 2008 that DON’T have WSUS installed.  This package will only install via Server Manager.

Deployment and/or usage scenarios

·         Scenario A: Installing both KB940518 and KB948014 from WSUS

1.       Windows Server 2008 SP1 is offered the KB940518 update.  Installing this update on Windows Server 2008 SP1 updates Server Manager (SM) to manage or install the WSUS Role via its UI.

2.       After successfully installing KB940518, the administrator can install the WSUS role using SM Add Role which uses the WUA APIs to download WSUS in a “hidden” product category.  When SM launches the WSUS setup UI, the administrator can follow the WSUS setup UI to complete the installation.

3.       After the installation succeeded, SM will need to be restarted to show the WSUS MMC Snap-in UI.

·         Scenario B: Installing KB940518 after KB948014 has been installed

1.       WSUS 3.0 SP1 has been installed on the Windows Server 2008 SP1 machine.

2.       Administrator installs KB940518 update for SM.

3.       Following restart of SM, WSUS is detected as installed by SM and can be managed within the SM UI/WSUS Snap-in.

WSUS Admin workflow

The workflow below will enable scenarios A & B described above.  The following must be enabled or approved for end-to-end functionality.  Note, enabling the classifications below WSUS will get updates in these classification for all categories, not just the categories specified below.

Product classifications needed:

a.       Updates

b.      Feature Packs

Categories that are needed

1.       Windows Server 2008 Server Manager – Windows Server Update Services (WSUS) Dynamic Installer category is a container for WSUS updates mentioned previously.  These updates are “hidden” such that user will never see a notification or be downloaded by WUA.  These updates can only be download via the WUA APIs – Server Manager is using this method to download and start the install of WSUS.

2.       Windows Server 2008 Server Manager Dynamic Installer category enables Windows Server 2008 Server Manager to dynamically discover and install when new updates are available for SM.

Updates that need to be approved dependent on your environment

a.       The WSUS binaries used the in updates listed below are the same as those described in KB948014 and available on the Microsoft Download Center (http://www.microsoft.com/downloads/details.aspx?FamilyID=f87b4c5e-4161-48af-9ff8-a96993c688df&DisplayLang=en).  Note: Since the update is targeted at Windows Server 2008 that don’t have the WSUS role installed, these machines will report that the update “is needed”.

1.       Windows Server Update Services 3.0 SP1 Dynamic Install for Windows Server 2008 x64 Edition (KB948014)

2.       Windows Server Update Services 3.0 SP1 Dynamic Install for Windows Server 2008 (KB948014)

b.      The following Server Manager updates needs to be approved:

1.       Update for Windows Server 2008 Server Manager (KB940518)

2.       Update for Windows Server 2008 Server Manager x64 Edition (KB940518)

More Information

3.       More information on updates associated with these categories can be found at: http://support.microsoft.com/kb/940518 - “An update is available that integrates Windows Server Update Services (WSUS) 3.0 into Server Manager in Windows Server 2008”

4.        http://support.microsoft.com/kb/948014/en-us -“Description of the Windows Server Update Services 3.0 Service Pack 1 package”

Thanks.

Cecilia Cole

WSUS Program Manager

Hi WSUS Admins:

We’ve noticed some confusion about the recently released updates for Microsoft .NET Framework 3.5 SP1.  So, let’s see if we can help clarify the differences in the packages.  These updates apply to x86 and x64 computers.  The detailed update descriptions describe both the platform and OS architecture that apply for each of the updates. You’re also likely wondering about the differences in the update titles. Here are the differences:

1.      The update titled “Microsoft .NET framework 3.5 Family Update (KB959209)” updates computers already running .NET Framework 3.5 SP1 with the latest compatibility fixes.  So, if you only want to update existing .NET Framework 3.5 SP1 computers with the latest fixes, then approve these packages.

2.      The update titled “Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update (KB951847)” will upgrade computers with .NET Framework 2.0, 3.0, 3.5 to the latest version of the .NET Framework 3.5 SP1, and will also apply KB959209 (#1 above). If you want to upgrade/update all of your computers to the latest version of the .NET Framework and apply the latest compatibility fixes, then approve these packages.

If  you know you only need the latest compatibility fixes for 3.5 SP1, then we recommend you only approve the Microsoft .NET framework 3.5 Family Update (KB959209).   Otherwise, we recommend that you approve the second update.

Thanks,

The WSUS team

For more information on WSUS 3.0 SP1, please refer to KB 948014.

Thank you!

WSUS Team

Hi WSUS admins,

In the next couple of days, we are adding a new product family to your WSUS server -Forefront Code named Stirling -Beta.  The  Forefront Code named Stirling -Beta product family will include updates for all Forefront Code named Stirling -Beta products, including Service Packs, Optional updates, Definition updates and Critical or Security updates. For additional information on Forefront Code named Stirling -Beta Products see: http://www.microsoft.com/forefront/stirling. These updates will be available through the Microsoft Update Site, and making it available (depending on your settings) via Automatic Update, and to Windows Server Update Services (WSUS). 

We recommend WSUS administrators having The  Forefront Code named Stirling -Beta deployments in their corporation; select this new product family to synchronize associated update classifications of your choice.  Additionally, The Forefront Code named Stirling -Beta updates will be available from the Microsoft Update Catalog http://catalog.update.microsoft.com.

Thank you.

WSUS Team

Today the WSUS with SP1 package was published to the MU servers and is available for synchronization to WSUS servers!  Released to the Microsoft Download Center last week, as of today the WSUS with SP1 package is also available via WSUS.

Released as a full product package, at approximately 160MBs, the package will either upgrade an existing WSUS system to SP1, or on a new system, install both WSUS and SP1. 

For more  information about WSUS SP1, and to find out more about how to update computers running Windows Vista Beta 2, see the WSUS product pages here.

WSUS Admins, Happy New Year!!

I wanted to provide some guidance on the prerequisite update (KB935509) for Windows Vista Service Pack 1 because it’s a little different than the typical content we release.  You may have read about on the Windows Vista team blog. 

This update, which will be released on Tuesday, is a prerequisite for installing Windows Vista Service Pack 1 on Windows Vista Ultimate and Enterprise editions.   Even if you don't plan on installing the service pack for awhile, you may still want to test and deploy this update.  Not only does it make improvements to the boot loader, but it's also required prior to installing the two upcoming prerequisites for SP1.  The two upcoming prerequisites will have an updated installer technology which will increase performance and reduce failures for the installation of updates, which are great improvements to make even if you choose to wait to deploy SP1. 

Deploying this update and one of the upcoming prerequisites will also eliminate one reboot once you are ready to deploy SP1, which will be available in the first quarter of 2008. In fact, we're distributing the update during this Tuesday's release  in an effort to reduce customer pain associated with multiple reboots.

To learn more about this specific update, see KB article number  KB935509.

One more thing, remember that you can find information on the content released through Windows Update and Microsoft Update from the following site: http://technet.microsoft.com/en-us/wsus/default.aspx

 Thank you!

 Cecilia Cole

WSUS Program Manager

Hi Folks-

Just wanted to let you know - today is the day two updates will be available to you to assist in your management and deployment of WSUS 3.0.

First ,we are making an update available for WSUS 2.0 SP1, which will create a 3.0 "self update tree" on your WSUS 2.0 /SP1 servers.  The self-update tree update contains the code for the WSUS 3.0 client.  That means, once this update is approved and installed on your WSUS 2.0 SP1 server, 2.0 clients "mapped" to that server will be "self updated" to the 3.0 client the next time the client 'checks in' with the WSUS 2.0 SP1 server.  The server remains WSUS 2.0 SP1, while the clients are able to update themselves from the server, to the 3.0 version.   We did this to ensure customers had a distributable method to update their clients and realize  new performance optimizations, but still manage the plan and timing to upgrade the servers to WSUS 3.0.  This update is classified as a critical update for all server categories on which WSUS 2.0 SP1 is supported, with the exception of SBS R2.

Additionally, WSUS 3.0 will available via WSUS today, classified as an "update" and targeted at Windows 2003 SP1 for WSUS 2.0, WSUS 2.0 SP1 products.  There will be 2 updates since 3.0 now natively supports x64bit. They are:

Windows Server Update Services 3.0 (KB935524)
Windows Server Update Services 3.0 for x64-based Systems (KB935524)

Again, this update will be classified as an “update” targeted at Windows 2003 SP1 for WSUS 2.0 and WSUS 2.0 SP1.   Also the update will be used to upgrade WSUS 3.0 RC to RTM on the Windows 2003 server. 

Hope this helps and happy updating!

-Bobbie Harder

Hi WSUS Admins: 

Just a friendly reminder, the latest Silverlight update rollup was released today. So if you have Silverlight deployed in your environment make sure you validate and approve it to continue Silverlight’s serviceability in your managed environment. If you haven’t deployed Silverlight yet, you can sync feature packs and approve Silverlight for distribution to your managed computers.

Silverlight is a technology used by developers to provide both a browsing experience and Internet service interactions. Clients will  always need to have the latest version of Silverlight in order to access the broadest number of Web sites and services.  Clients with direct web access and administrative rights on their computer can get these updates by navigating to a Silverlight Website, but you can choose to deploy Silverlight through WSUS, ensuring that the client always has the most secure, stable, and functional version of Silverlight installed.

For more information on Silverlight click here.

Cecilia Cole

WSUS Program Manager

Hi WSUS Admins,
 
There is a new product category being added to the WSUS Products and Classifications dialog under the product family “Expression”. The new product category is for Expression Web 3.

The Expression Web 3 product category will include updates for Expression Web 3, including service packs, incremental and cumulative updates.
 
For additional information on the Expression product family, see http://www.microsoft.com/expression.
 
Microsoft will also be releasing a service pack for Expression Web 3 in the coming months. Expression Web 3 Service Pack 1 contains significant fixes and improvements in publishing, SuperPreview, file management, extensibility, and other areas of the program.
 
Thanks!
 
The WSUS Team