Windows Update had been a standard of security that was heavily relied upon by scores of Windows users for decades. Applying the once monthly updates became a mandatory ritual that most all Windows owners followed.  Windows Update is by default automatic. For all those decades it worked largely flawlessly.

Unfortunately, the quality of Windows Updates has fallen off badly.  This has given rise to numerous defective updates that cause a whole range of problems.  Many updates are re-issued, some many times over.

Coincident with this falloff in quality, starting just after Microsoft ended Windows 7 development (December 31, 2014) and began security-only “support,” Microsoft changed the objectives of these updates from primarily security-only, to feature-related along with security.  The “features” often contain(ed) changes to Windows 7 that some owners did (do) not want.  At first they could selectively reject specific updates.  October 2016, Microsoft changed the way it assembled updates in a way that no longer allows people to be selective. They call this new type of update “Roll-ups”.  These Roll-ups are an all or nothing kind of deal, that includes all manner of “updates” that are largely unpublished. There is a way to get just the security updates, but it is complex and fraught with problems unless you are a serious technician.  Therefore out of reach of most people.

Best advice is to set Windows Update setting to “Never check for updates.”  Unfortunately, that means Windows Update no longer works automatically, but requires the user to manage the update process.  However, this is the only way to take control of the situation.  Enterprise IT folks have always done it this way.

If you really must continue to update, in spite of my advice to not do so,  do NOT do updating until the day before the next cycle begins on the 2^nd Tuesday of the month. That allows time for most of the erroneous updates to get fixed. Woody Leonhard, a tech writer extraordinaire, operates a web site, which does an excellent job of advising on Windows Update.  It features his MS-DEFCON rating system that tells you when NOT to update, and when to do so.  There is even a section on his web site www.askwoody.com, that specifically deals with Windows 7 updating.

The security-only crowd (Woody calls them Group B) was popular at first but by June of 2017, that strategy fell apart because defects in security only updates got fixed in the “roll-up updates.”  So, that made security only updating impractical for all but the most technically competent.

Woody’s recommendation is that Windows 7 owners should stick to Group A, which just accepts all Microsoft roll-up updates and simply allows whatever changes Microsoft decides to make.

Another group, Group W, of which I am a member, simply does no further updating.   That group has decided the risk of not applying updates that could immunize your system from some disease, hacker or virus is a lesser risk than applying updates and allowing your system to become something you would not buy if you had a choice, or risk having defective Microsoft updates fouling your working system.  Of course this strategy includes some other choices that become far more critical:  A very good antivirus program, switching to a browser that will be updated and therefore be more secure, and the acceptance that the January 2020 date that Microsoft has set for the end of updates for Windows 7, has already come.

At this date, I support 122 Windows 7 systems, and have for 16 years now.  None of these are enterprise systems, just home PCs.  All systems have a major Anti-virus product that I have selected.  Most have switched to Chrome browsers, which no longer requires the security problem prone Adobe Reader, Adobe Flash Player or Java.  These three programs are needed by Internet Explorer, but not by Chrome, and are a common hacker/virus attack vector.  The fact is that the Chrome browser is now in use by more than 2/3’s.   None of these systems have versions of Microsoft Office any more recent than 2010.   None of these systems has had Microsoft updates since May, 2017. That is 30 months now.  Not a single one of them has had a problem of any kind.  In fact, my support activities have fallen off by at least 75% as these systems have become so stable and reliable that problems just do not occur.  Most of my work is now hardware maintenance.

When I re-build a system, I follow a very specific process of updating.  Note well that I do not apply any updates after May 2017:

Please remember to do a very complete backup of your data.  Use the Windows Easy Transfer tool (part of Windows &) to create a special file that includes most of your data and all the myriads of settings you have done to personalize your system.  Be prepared to re-install application programs that you want.

• Use a Win7 install disk with SP1.  This disk need only match the product type (home, pro, etc.) an bitness (32 or 64) of your Microsoft Product Key
• Select Custom, not Upgrade
• Switch to advanced and Delete all partitions. Only one logical partition – C:, which will be created by the installer.
• After install, install network drivers if not installed already. Then activate.

Do NOT install anything until all Windows Updating is completed.  Not even antivirus.

• Set Windows Update to Never
• Download and install either one or two updates manually.  ***Note exception below if not starting with SP1 disk.  In most cases only the first (KB3138612) of these is needed.  If that produces a result that says the update is not appropriate for your computer, you need to first install the 2nd of these (KB3020369), then install the first (KB3138612).  Choose the one that is for your machine — 32 bit (X86) or 64 bit (X64).

KB3138612 

32 bit,

https://www.microsoft.com/en-us/download/details.aspx?id=51208

64 bit

,https://www.microsoft.com/en-us/download/details.aspx?id=51212

KB3020369:

32 bit

https://www.microsoft.com/en-us/download/details.aspx?id=46827

64 bit

https://www.microsoft.com/en-us/download/details.aspx?id=46817

• Switch from Windows-only updates to Microsoft updates
• Reset Windows Update setting to Never
• Start Windows Update
• When a list of updates is offered (likely nearly 200 or so), refuse the following updates by right-clicking on them and choosing hide

Anything labeled Roll-up, with the exception of .net roll-ups

Any update that is NOT described as “Security” whose issue date is later than December 31, 2014.  That is the date Windows 7 development ended.

     Any update that is labeled Security that is  dated after  September, 2016

Any Office update whose issue date is later than May 2017, displayed on the right

                You do not want any optional updates

*** If you cannot find an SP1 install disk, the step where the 2 specific updates (KB3138612 and KB3020369) described and linked above does not get done until the updating process installs SP1.

• Install any missing drivers, using drivers downloaded only from the OEM support page.

Install the following Security-only updates for October 2016 through May 2017. 

You can find an excellent guide on this topic at:

https://web.archive.org/web/20170812061720/https://www.askwoody.com/forums/topic/2000003-ongoing-list-of-group-b-monthly-updates-for-win7-and-8-1/

You do not need to restart until all these updates are completed.  When you do restart, it may take a while to process it and get back to your desktop screen

• October, 2016 KB3192391:

64 bit:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2016/10/windows6.1-kb3192391-x64_8acd94d8d268a6507c2852b0d9917f4ae1349b6c.msu

32 bit:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2016/10/windows6.1-kb3192391-x86_a9d1e3f0dea012e3a331930bc1cd975005827cb6.msu

• November, 2016 KB3197867

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2016/11/windows6.1-kb3197867-x64_6f8f45a5706eeee8ac05aa16fa91c984a9edb929.msu

32 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2016/11/windows6.1-kb3197867-x86_2313232edda5cca08115455d91120ab3790896ba.msu

• December, 2016 KB3205394

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2016/12/windows6.1-kb3205394-x64_71d0c657d24bc852f074996c32987fb936c07774.msu

32bit:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2016/12/windows6.1-kb3205394-x86_e477192f301b1fbafc98deb94af80c6e94231e54.msu

• January, 2017 KB3212642

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/01/windows6.1-kb3212642-x64_f3633176091129fc428d899c93545bdc7821e689.msu

32 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/01/windows6.1-kb3212642-x86_d5906af5f1f0dc07a5239311b169619ce255ab12.msu

• February, 2017.  There were no updates this month
• March, 2017 KB4012212

64 bit:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x64_2decefaa02e2058dcd965702509a992d8c4e92b3.msu

32 bit:

http://download.windowsupdate.com/d/msdownload/update/software/secu/2017/02/windows6.1-kb4012212-x86_6bb04d3971bb58ae4bac44219e7169812914df3f.msu

• April, 2017 KB4015546

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows6.1-kb4015546-x64_4ff5653990d74c465d48adfba21aca6453be99aa.msu

32 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/03/windows6.1-kb4015546-x86_a753365290d940872860776113f226436a18ca9b.msu

• May, 2017 KB4019263

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows6.1-kb4019263-x64_d64d8b6f91434754fdd2a552d8732c95a6e64f30.msu

32 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows6.1-kb4019263-x86_e978e662d844d13ccf726944c39e4b678159bcde.msu

• May, 2017 IE update KB4018271

64 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/04/ie11-windows6.1-kb4018271-x64_7c8d8beb9999d65c8db17001c697e82a9a0bb1d1.msu

32 bit:

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/04/ie11-windows6.1-kb4018271-x86_3eb0c93394fca87f3de52ae200a57e1770e741d6.msu

Microsoft Office:  install in the usual fashion, then run Windows Update again.  Do NOT install any Windows update of any kind.  Un-check each and every one of them.  Then carefully go through the Office Updates offered.  Simply select the first with one click, look to the right for the date of issuance.  If that date is later than Mayy, 2017, un-check it.  Then proceed to the update process.  In other words, you only want office updates that were offered prior to June 2017.

After Windows 7, system drivers and all updates are installed and any stable applications like Microsoft Office are installed and updated, and before any data or dynamic applications are installed such as antivirus software, create a system image.  It will take 3 or 6 DVD +Rs (not -Rs) and about an hour.  When you are done you will have a very nice bit of insurance.  Should you ever again need to re-build a corrupted system or replace a hard drive, you will have a precise duplicate of your system as it is at this point.  You can restore that image to a hard drive in 20 to 60 minutes.  Creation of System Image is found in your menu under Maintenance, Backup and Restore.

Another great feature about creating the image is that you do not need an install disk or a product key to do the re-install the next time, all your drivers will be installed and you will have saved yourself all the time you put in this time, and have a complete functioning system.

You will, in fact, have a final-state Windows 7 installation which could run on this particular computer as long as the computer hardware itself holds up and the software  you prefer is still usable. Your system will already be activated and you will not need an install disk or Microsoft Product Key again.  In fact, Microsoft could evaporate, and your Windows 7 system would still function just fine, even if you had to install a new hard drive.

I emphasize the need for PLUS R DVD blanks.  Do not use the more common MINUS R DVD blanks.

• Install software, ending with antivirus software.
• Then copy your data into the newly created system.