Hi Folks - 

I wanted to get back to you with more information and guidance around the Windows Desktop Search (WDS) issue and the results of our investigation today.   

As you know, Windows Desktop Search was published last February 07, as an optional update that was only applicable to systems which had WDS previously installed. Then on Tuesday of this week we revised that update package to be applicable (but still optional) to Windows XP SP2 and Windows Server 2003 SP1+ systems which did not have WDS installed. Unfortunately, in revising this update, the decision to re-use the same update package had unintended consequences to our WSUS customers.  Namely many of you who had approved the initial update package for a limited number of machines, had Tuesdays' WDS revision 105 automatically install on all clients because of the expanded applicability scope and because by default, WSUS is set to automatically approve update revisions.  We sincerely regret the inconvenience this has caused and extend a sincere apology to all impacted customers.

For those of you who want to uninstall the WDS update revision released Tuesday of this week, this can be done via

1.  Add/remove programs

2. Invoking spunisnts: %windir%\$NtUninstallKB917013$\spuninst\spuninst.exe /q /promptrestart

3. Using System Restore on Windows XP (not available on Windows Server 2003). This option will leave some software on the machine, but the invocation effectively removes WDS 3.01.  This should only be used for conditions where the /noback switch was used.

I want you to know we are working now to correct the issue and have temporarily suspended the distribution of the Windows Desktop Search through WSUS.  The current package will remain available through the Microsoft Download Center. We will make a new package available for WSUS in the near future, but not as an update revision, so that you can rely on predictable update behavior with auto-approval settings.   We are also working on improving our internal publishing processes to ensure this does not happen again in the future. 

Again, our sincere apologies for this publishing process error. 

Bobbie Harder

Program Manager, WSUS

Some customers have reported that update package for KB917013 was being deployed to WSUS clients without having approved the update for installation on their WSUS servers.   The original update release, released February 2007 as an optional update, was only applicable on systems which had a version of Windows Desktop Search installed. The recent update Revision 105, had the applicability logic expanded to be applicable to all systems regardless if a prior version of Windows Desktop Search was installed,  IF of course, approved in the WSUS Administrative UI or via Administrator-set auto-approval rules.

The initial update would have only been installed  if the update had been either auto, or manually approved, and if the applicability criteria was met on the client (that WDS was installed).  For some customers,  because the original update was approved for install,  but because of the previous applicability rules to apply only to clients which had WDS installed, the update was not actually installed. 

So what happened with this revision and why did it seemingly deploy itself to all systems in my environment?  WSUS by default is set to auto-approve update revisions to minimize administrative overhead and make sure distribution “just works”.  Keeping  in mind,  revisions are only titled as such, when metadata or applicability rules of an update package change, never the binaries.  Revisions are also of course only auto-approved via this setting, if the original update is approved.

With the expanded applicability rules, and the WSUS default setting to auto-approve new revisions, it may have appeared as if this update was deployed without approval.   The initial version of the update would have had to have been approved, and the “auto-approve revisions” option on (by default) in order for this revision to have also been approved and deployed.

To Recap:

• The initial February 2007 release had to be purposely checked/approved by WSUS admin s sfor distribution, because it was an Optional update. 
•  All subsequent metadata-only revisions to that WSUS admin approved February 2007 release would then also be automatically approved for distribution. 
• The initial February approval is retained throughout the life of the update, regardless of revision.

That said,  We will be tightening the criterea for Revisions so that auto-approval  of revision behaivors are more predictable and of similar scope as the originial approved update, as we appreciate the confusion this behaivor caused. 

Thanks as always for your feedback to make our product s and processes work for our customers.

Bobbie Harder

PM, WSUS