New Year resolution: banish automatic updates

Topic

New Reply

	WOODY’S WINDOWS[/size][/font] New Year resolution: banish automatic updates[/size]
	By Woody Leonhard The usual year-end dearth of technology news seems to bring out poorly considered stories — even from well-know sites. Case in point: I ran across an article — published by a site that should know better — extolling the virtues of “software’s auto-update era,” most notably Microsoft’s automatic patch update system. I couldn’t more strongly disagree.[/size]

---

The full text of this column is posted at WindowsSecrets.com/2011/01/06/06 (paid content, opens in a new window/tab).

Columnists typically cannot reply to comments here, but do incorporate the best tips into future columns.[/td]

[/tr][/tbl]

Reply | Quote

Replies

With millions of PCs around the world infected with bad stuff largely because they are not updated, I think this article sends the wrong message. Yes, there are bad updates, but considering the total number, they are very few. Of course, no business user should simply accept MS updates without a proper change control and QA process – that goes without saying. And for savvy users such as Windows Secrets readers, they have probably long since set AU to “Download and notify”, and that’s why they read Windows Secrets – to get early warning of any problems before they install. But for all other users, in particular, non-technical home users, we really shouldn’t be giving them any hint of an excuse not to keep their systems fully patched. Zero-day exploits are now almost the norm.

Regards – Philip

Reply | Quote

With millions of PCs around the world infected with bad stuff largely because they are not updated, I think this article sends the wrong message.

@Philip –

Sorry, I don’t agree. Microsoft’s research shows that most PCs are infected via social engineering. There are plenty of 0days running around, too.

It’s very unusual that people get infected because they wait a week or two to install updates. As soon as Metasploit and the like make an infection vector easy to use, I recommend that people patch. No reason to patch before then.

Reply | Quote

I guess the point of the article is not to stop patching, but to stop patching automatically. The advice given is to patch only after getting info from several sources (identified in the article) that the patches are safe. I guess there is bit of histrionics in it, but there is no advice not to patch.

I have my systems configured to notify when there are patches and I apply them myself. With so many millions of Windows users, it’s more or less bound to happen that some patches are problematic. Windows with no patches doesn’t work for some users in some situations, so it’s not surprising that some patches cause issues with some systems.
Even with notify, I usually do not wait for Windows Secrets. Lucky or not, I have never had to uninstall Windows patches in all the years they exist (and I have 5 PCs, at the moment, running XP, Vista and Windows 7). So, as always, read and decide what’s best for you, with the clear understanding that not patching can be actually very dangerous, but waiting a couple days for feedback on patches may not be that bad.

Regards

Rui

Reply | Quote

I usually do not wait for Windows Secrets. Lucky or not, I have never had to uninstall Windows patches in all the years they exist (and I have 5 PCs, at the moment, running XP, Vista and Windows 7).

I agree with this. I think Woody’s no-auto-patch doctrine for Windows is just too extreme, even for experienced users. Like the above poster, I’ve used auto-patch for years with no problems. It’s convenient and over all those years has saved me lots of time compared to researching each patch to make sure it’s problem-free, then manually applying it. Should a patch screw up, I have an image backup of C: no more than a week old.

Reply | Quote

I agree with this. I think Woody’s no-auto-patch doctrine for Windows is just too extreme, even for experienced users. Like the above poster, I’ve used auto-patch for years with no problems. It’s convenient and over all those years has saved me lots of time compared to researching each patch to make sure it’s problem-free, then manually applying it.

@Ralph –

That’s exactly why I developed the MS-DEFCON system. Check out the AskWoodysite.

Reply | Quote

When I upgraded to Windows 7 I decided to act like less of a geek and more like your average user and let Windows update run automatically. We run three computers in our house and I can say that I’ve never had a problem surface due to an update. I appreciate Woody’s point of view but don’t feel that his point need be made by casting aspersions on those who use the automatic option. Having used computers since my first ‘286’ I feel that computers are finally getting closer to refrigerators in the amount of daily care they need, and that’s a good thing. Automatic updates are part of this progress.

I wonder what Fred Langa would have to say about this.

Jim

Reply | Quote

I have followed Ask/woody for many years, and his advice is usually timely and accurate. Several times, if I had not waited until he gave the all-clear, I could have had some serious issues with my Windows XP laptop. My newer, Windows 7 laptop is not as fussy, partly because I loaded up the XP machine with security software, and I have kept my Windows 7 machine limited to Microsoft Security Essentials and the Windows 7 Firewall.

Conflicts with third-party software are difficult to predict until MS patches are out in the wild for a few days, or even a couple of weeks. Sometimes the howls and screams happen after third-party applications are updated, not when MS releases its updates. With so many variables running around, it is useful to wait for expert advice before applying any patches. For third-party applications, we don’t have the equivalent of Woody Leonhard, Susan Bradley and others here at Windows Secrets. But if my third-party application fails, I usually can still run Windows and one or another of my browsers. If Windows or Internet Explorer fails, I may be out of luck or at the mercy of Microsoft Tech Support.

I have had Windows XP patching issues and security program conflicts which have completely bricked my Windows XP laptop on several occasions. And Microsoft Support messed around with my Networking settings so badly that I had to reinstall the Client for Microsoft Networks. This happened when MS Tech Support was trying to fix a botched Microsoft Windows Critical Security Patch for Windows XP. They even said I would have to flash my BIOS (on a six year old laptop!) and update my motherboard drivers! So much for Microsoft tech support! (By the way, there are no BIOS updates for obsolete WinBook laptops, and MS tech support din not even know that!)

My point is, even with warnings and ears to the ground, sometimes a Microsoft Patch causes a bad reaction in a specific computer, especially heavily patched older models. But with the advice of Woody Leonhard and Susan Bradley and others, some of these disasters can be avoided. Sure, not all patches cause problems on all computers, but if you are the one-in-a-million who gets the Blue Screen of Death, this is small comfort as you go through the often incompetent Microsoft Support process. Finally, you will probably end up reinstalling Windows and sending the offending patch (if it can be identified) to “Hide Forever” status. Follow AskWoody.com, and you can often avoid all that hassle.

And remember, even though the odds of one MS patch messing up one computer being very low, with thousands of Windows XP patches over the years, applied to hundreds of millions of computers, something, somewhere is certain to go horribly wrong. I can personally attest to that.

Thanks, Woody, for all the warnings which have saved my bacon over the years. Keep up the good work.

One last thing — I have never been harmed by NOT applying a MS patch as soon as it came out. Woody tells us when a patch MUST be applied right away, and this is rare. So he does not have us wait on ALL MS parches — only the ones for which there are no known immediate threats, which usually means all the current patches. The sky is not falling every Second Tuesday — there is time to wait and see who screams. Taking everything Microsoft throws at us as soon as it is offered is about as sensible as flashing my BIOS every week when Toshiba sends me an “urgent alert” e-mail that they have yet another BIOS tweak available. The risk of updating is actually greater than the risk of staying put. At least for awhile.

-- rc primak

Reply | Quote

Mr. Leonhard states, “I recommend that you set Windows to Notify but don’t download, using these steps:…”

I would respectfully have to disagree with Mr. Leonhard’s recommendation. According to Microsoft’s own information:

“If you turn on the Update Services, in order for them to properly function some software components on your system that make up or are directly related to the Update Services will need to be updated from time to time. These updates must be performed before the service can check for, download, or install other updates. These required updates fix errors, provide ongoing improvements, and maintain compatibility with the Microsoft servers that support the service. If the Update Services are turned off, you will not receive these updates.

“Update Services are “turned on” if you choose one of the following settings: (i) install updates automatically, (ii) download updates automatically and choose whether to install them, or (iii) receive notifications about updates and choose whether to download and install them. Windows Update service is “turned on” and set to “install updates automatically” when you choose the recommended option during Windows Out Of Box Experience (OOBE) setup.

“If you turn on the Update Services, regardless of which “turned on” setting you have chosen, required updates to some components of the service will be downloaded and installed automatically without further notice to you. If you would prefer not to receive required updates, turn off the Update Services.”

Source: http://update.microsoft.com/windowsupdate/v6/vistaprivacy.aspx?ln=en-us (See paragraph labeled: Required Updates)

If memory serves me correctly, sometime in 2007 or 2008 Microsoft began using what many have called “stealth updates”. Even if a user selected “Download updates but let me choose whether to install them” or “Check for updates but let me choose whether to download and install them”, updates would still be installed without any other user input. Microsoft did this to facilitate updating Windows Update itself. Users found out that this practice interfered with automatic backups, etc because computers would re-boot in the middle of a task without any warnings. If this is still the case, and I believe it is, then the only safe option for Updates is to select “Never check for updates (not recommended)”. The user would then have to remember to manually check for updates on a regular basis.

Reply | Quote

Mr. Leonhard states, “I recommend that you set Windows to Notify but don’t download, using these steps:…”

I would respectfully have to disagree with Mr. Leonhard’s recommendation. According to Microsoft’s own information:

“If you turn on the Update Services, in order for them to properly function some software components on your system that make up or are directly related to the Update Services will need to be updated from time to time. These updates must be performed before the service can check for, download, or install other updates. These required updates fix errors, provide ongoing improvements, and maintain compatibility with the Microsoft servers that support the service. If the Update Services are turned off, you will not receive these updates.

“Update Services are “turned on” if you choose one of the following settings: (i) install updates automatically, (ii) download updates automatically and choose whether to install them, or (iii) receive notifications about updates and choose whether to download and install them. Windows Update service is “turned on” and set to “install updates automatically” when you choose the recommended option during Windows Out Of Box Experience (OOBE) setup.

“If you turn on the Update Services, regardless of which “turned on” setting you have chosen, required updates to some components of the service will be downloaded and installed automatically without further notice to you. If you would prefer not to receive required updates, turn off the Update Services.”

Source: http://update.microsoft.com/windowsupdate/v6/vistaprivacy.aspx?ln=en-us (See paragraph labeled: Required Updates)

If memory serves me correctly, sometime in 2007 or 2008 Microsoft began using what many have called “stealth updates”. Even if a user selected “Download updates but let me choose whether to install them” or “Check for updates but let me choose whether to download and install them”, updates would still be installed without any other user input. Microsoft did this to facilitate updating Windows Update itself. Users found out that this practice interfered with automatic backups, etc because computers would re-boot in the middle of a task without any warnings. If this is still the case, and I believe it is, then the only safe option for Updates is to select “Never check for updates (not recommended)”. The user would then have to remember to manually check for updates on a regular basis.

I think you are getting confused as to what he’s saying.. it’s not saying to go into services and turn off the update services there, merely to tweak it so that on Patch Tuesday the updates don’t automatically download and you can decide when to install them.

Reply | Quote

Personally, I’ve never had a problem where I had to uninstall an MS patch. I use the download and notify option but that is just so that I can install the patches when it is convenient for me since they often require a reboot.

But here’s a tip that I have never seen anyone here or elsewhere write about:

Even IF you use the automatic update functionality, you STILL SHOULD CHECK the Windows update site yourself on an occasional basis. It appears that auto update ONLY presents updates categorized as high priority. Other updates in the Software & Hardware sections do not get presented through auto updates!

Here is the output from a manual Windows Update scan that I just ran. You can see that there are 6 optional software patches that I could choose to install that were not presented to me by auto update. One or more of these patches might be important to you.

Reply | Quote

Even IF you use the automatic update functionality, you STILL SHOULD CHECK the Windows update site yourself on an occasional basis. It appears that auto update ONLY presents updates categorized as high priority. Other updates in the Software & Hardware sections do not get presented through auto updates!

@Ibe –

That’s actually a good reason to use “notify but don’t download”. It forces you to look on the Automatic Update site to see what’s available.

That said, as noted above, you should never apply hardware driver updates from Microsoft. Always go to the manufacturer’s site. Ain’t broke, don’t fix.

Reply | Quote

One point that seems to be neglected in all of these opinions . . . leave your system on over night and the auto update can run when you are not on nor using your system. Any automatic reboot that is required can be done over night. You will be made aware of the updates by the requirement of you to login again. This has occurred for me since I have been leaving mine on over night. I am using the AutoUpdate and install as recommended, my system is W7 64.

"Infinite CREATOR" cast "Loving Light" upon thee
TIA, CU L8R, 'd' "LoneWanderer"
"Only you can control your future." Dr. Seuss
NOT a leader,
NOT a BLIND follower,
Join US and LIVE this LIFE as ONE!
Original author Unknown

Reply | Quote

I have owned a computer store in Houston since 1983. I strongly disagree with turning off Automatic Updates for Windows. We build a lot of systems for customers. It is an extremely rare that a Microsoft Update has ever caused any of my customers any problems. Believe me, if they have a problem they come back to us as the ones who built their system.

In my experience, more problems are caused by the customer who takes home his system and never updates his Windows, his anti-spy programs or virtually any program. They come in with IE6 still on their system and infected something terrible. I deal with hundreds of my customers personally every month/year. I really get on them when I find they haven’t been doing their updates and I tell them all updates, optional and recommended with the only exception being hardware updates. I tell them to never do the hardware updates…”if it ain’t broke, don’t fix it”. Video drivers need updating frequently, especially for game players, but the place to get them is from the manufacturer, not Microsoft.

Reply | Quote

In my experience, more problems are caused by the customer who takes home his system and never updates his Windows, his anti-spy programs or virtually any program. They come in with IE6 still on their system and infected something terrible. I deal with hundreds of my customers personally every month/year. I really get on them when I find they haven’t been doing their updates and I tell them all updates, optional and recommended with the only exception being hardware updates. I tell them to never do the hardware updates…”if it ain’t broke, don’t fix it”. Video drivers need updating frequently, especially for game players, but the place to get them is from the manufacturer, not Microsoft.

@Gary –

Agree on all points. If the user isn’t savvy or concerned enough to watch after updates, they need to have Automatic Update turned on. But if they’re smart enough to change their oil, they should be able to figure out that they need to keep their PC protected, too.

I’m VERY glad that Microsoft Security Essentials updates itself.

Reply | Quote

Woody is “not overly concerned about automatic updates to Microsoft Security Essentials”. Until about a month ago I was not either, but since then I have been plagued first by long download times during which everthing else was locked up, and in the last week when the lock ups became hard freezes which required power-off/reset and reboot to recover from, only to occur soon again. Yesterday I could not get rid of the lock ups so I uninstalled MSE and have been problem free since then. I would be interested in any comments Woody has about experience with the release of version “2.0.657.0 Final” of MSE on December 16, 2000. There is some indication on the Internet of lock ups, freezes and “not responding”s associated with this release.

On the more general topic of whether one agrees with Woody, it’s unfortunate that his article’s title is “Banish Automatic Updates”, whereas the content of the article indicates that the title should have been “Banish Automatically Installed Updates”. I certainly suffered from not knowing about the dangers of automatic installation of updates when, for example, I let Microsoft automatically install updates to the various .NET Framework programs.

Reply | Quote

I would be interested in any comments Woody has about experience with the release of version “2.0.657.0 Final” of MSE on December 16, 2000. There is some indication on the Internet of lock ups, freezes and “not responding”s associated with this release.

@Donald –

I hadn’t heard about it. OUCH. Lemme see if I can find somebody who can shed some light….

Reply | Quote

Last month I spent a couple of days troubleshooting a notebook that was “slow”. In fact it was so slow that it took 7 hours to download AVG. After spelunking around a bit, I found that windows update was hogging the system. So I disabled automatic updates, and enable notify only, and re-booted.
The machine ran great – 10mb download speeds.
Then allowed windows update to run. There was an update it thought it needed for Windows live essentials – so it would download the update, then attempt to apply. The update was not applciable to the version of windows live on the system, so it would undo the update, remove the downloaded software – and then start the cycle all over again!

Reply | Quote

It would be great if Microsoft would revisit updating. Currently, it is far too inflexible.

MSE and Outlook definitions should be separated from WU so that they could be left to update automatically at least daily.

I am undecided about what the best procedure is for other updates. I too have notifications only selected. But I am a computer professional: most of my friends and colleagues are PC-luddites and I strongly believe that they should have WU set to automatically update.

That said, there should be a better warning system telling those type of users that updates are about to be installed and to save any work and close all applications with a dialog containing the options, ’Wait for X-minutes or Wait until X-Time or Proceed Now’ displayed. The update should never proceed until the users has pressed Proceed Now – even after x minutes, except when the user has entered the X-Time.

It should not be possible for updates to be applied if the user is absent from their PC except when they have entered an X-Time in the dialog.
[/font][/size][/color]

Reply | Quote

MSE and Outlook definitions should be separated from WU so that they could be left to update automatically at least daily.

Fortunately, both MSE and the Outlook spam filter updates will happen, even if you choose “Notify” or “Download”.

IMHO, that’s exactly as it should be.

Reply | Quote

Fortunately, both MSE and the Outlook spam filter updates will happen, even if you choose “Notify” or “Download”.

IMHO, that’s exactly as it should be.

I’ve been testing MSE updates over the last couple of days and it seems automatic updating has changed. I agree that prior to V2, MSE would update itself. But I have tested this with v2 on a newly installed Win 7 x64 desktop and it looks to me that WU has taken full control of updating. If I have WU set to notify of updates only, then MSE does not update itself and WU pops up the updates available dialog in the notification area.

I haven’t got Outlook installed to test at the moment.

Would someone else test MSE updating to see if they have the same result using a fresh install of v2 (an update v1 to v2 may not be the same).

Reply | Quote

I’ve been testing MSE updates over the last couple of days and it seems automatic updating has changed. I agree that prior to V2, MSE would update itself. But I have tested this with v2 on a newly installed Win 7 x64 desktop and it looks to me that WU has taken full control of updating. If I have WU set to notify of updates only, then MSE does not update itself and WU pops up the updates available dialog in the notification area.

I haven’t got Outlook installed to test at the moment.

Would someone else test MSE updating to see if they have the same result using a fresh install of v2 (an update v1 to v2 may not be the same).

Terry –

As I understand it, if you have WU set to notify, and there’s an MSE update available, the WU notification appears for a short period of time – hours, I think. If you don’t respond, the update is downloaded and installed automatically, regardless of your WU setting.

Reply | Quote

Hi, Woody and community,

How are you?

Thank you for all the recent Windows 7 tips.

We have w7 64 on all three machines now, and I found out the hard way that when we shut down the pc, it installs updates – EVEN if we have Windows Updates set to “download but don’t install”.

I found a web page that explained how to set a group policy to disable the automatic update ( http://tipsfor.us/2009/06/22/disable-the-install-updates-and-shut-down-option-in-windows/ ). But then I found out that it only works on W7 Professional or higher.

Should we really be expected to pay an extra $120 for a version of Windows just so it will do what it says it is going to do? Or did they already fix this and I am missing something?

May the Lord bless you,
Philip

Reply | Quote

We have w7 64 on all three machines now, and I found out the hard way that when we shut down the pc, it installs updates – EVEN if we have Windows Updates set to “download but don’t install”.

That’s precisely why I recommend “Notify but don’t download.” In the normal course of events, if you aren’t careful, Windows will take it upon itself to install any downloaded updates whenever you re-boot the machine. There are ways around it, but why put yourself through the stress? “Notify but don’t download” is the easiest choice.

Reply | Quote

That’s precisely why I recommend “Notify but don’t download.” In the normal course of events, if you aren’t careful, Windows will take it upon itself to install any downloaded updates whenever you re-boot the machine. There are ways around it, but why put yourself through the stress? “Notify but don’t download” is the easiest choice.

Thank you, Woody!

Reply | Quote

Hi, Woody and community,

How are you?

Thank you for all the recent Windows 7 tips.

We have w7 64 on all three machines now, and I found out the hard way that when we shut down the pc, it installs updates – EVEN if we have Windows Updates set to “download but don’t install”.

I found a web page that explained how to set a group policy to disable the automatic update ( http://tipsfor.us/2009/06/22/disable-the-install-updates-and-shut-down-option-in-windows/ ). But then I found out that it only works on W7 Professional or higher.

Should we really be expected to pay an extra $120 for a version of Windows just so it will do what it says it is going to do? Or did they already fix this and I am missing something?

May the Lord bless you,
Philip

No, what’s going on is that with the setting of download but do not install on a heavy patch day the patches dribble down and are there in the process of getting ready to install. Then when you go to shut down, you are missing the teeny tiny icon indicating that there are updates that will install.
Change it to notify, rather than download, or just be a bit more watchful on Patch Tuesday week.

Reply | Quote

Greetings readers of this lounge and Windows Secrets,

Most people are either not aware or just do not care if their system is updated regularly or not. I feel all of this is needed for those that do care and even those that are just la!-la! land bound and are unaware. As the saying goes, “everyone has an opinion, like a__ holes, and they all stink,” in this case I feel we need to smell this subject until we have covered all of the ‘stink’ and found the one that smells the least for our own use. No matter how strongly you feel about your specific opinion, everyone’s system is an individual’s own responsibility and should be done by them. We should not attempt to toss stones at anyone for how they do their own system, it is their’s.

Not being in any way an IT specialist or even fully knowledgeable about these systems, self taught on my system, personally I use the “Automatic Update and Install” since acquiring Win7 64 with little difficulty. As a matter of fact there has not been any problem at all, factually it has functioned exactly as it should without any need to uninstall any update or portion there of.

Woody has done a very fine job and should continue same. His title for any article is doing just what they are designed to do, attract attention and get you to read to find out what is in the article. Keep reading and make your own decision and Woody, “keep your information coming and let us, not part of a salad, make up our own minds on how to use and handle any issue for our own system.” If you disagree with this philosophy is fine with me, because; it is your decision and I am not attempting to ‘dictate’ to anyone. Just remember we are passing on information for others to read and use as they see fit.

Arguing will get you no where or becoming upset if someone disagrees with you. Explain and let it go. Hopefully we are all adults and should leave ones ego out of this discussion.

That is how see this is going and would like to see you that are much more knowledgeable than myself and many another that read here keep yourself providing good info and recommendations and allow us to maintain our own systems and be responsible for our own.

Happy New Year and keep the discussions going as a discussion,

"Infinite CREATOR" cast "Loving Light" upon thee
TIA, CU L8R, 'd' "LoneWanderer"
"Only you can control your future." Dr. Seuss
NOT a leader,
NOT a BLIND follower,
Join US and LIVE this LIFE as ONE!
Original author Unknown

Reply | Quote

@ NTxLS–


I hope none of my Replies to this Topic were viewed as argumentative or dictatorial. I have no such intentions. I have simply posted what has happened to me with Microsoft Updates, and why I do not take just any updates which Microsoft offers.


And in all fairness, the worst bad updates offenders seem to be the anti-virus companies. I just got done cleaning up after a bad Avast 5.1 update (Jan. 5, 2011). It made my Windows XP Pro Recycle Bin impossible to Explore or Empty. So that update had to go, and fast! Just one among many recent AV updates which have caused problems.


Compared with that AV situation, Microsoft looks very solid and reliable by comparison. Still, I do not want to be the one in a million who gets the Blue Screen of Death, the Endless Reboots, or gets Wireless Networking messed up. Those experiences were not fun for me, and I do not wish to repeat them.


Agreed, for anyone who tends to “forget” to look for new updates once a month, Automatic Updates is definitely the way to go. Or, if you like to just have most things happen automatically and are prepared to deal with the occasional glitch. To each their own.


I do not see the differing points of view ever really coming together unless MS Updates become as routine and trouble-free as Google Chrome updates are presently. Maybe MS should learn something from Google’s updates testing process. Just a thought.

-- rc primak

Reply | Quote

Google tests one thing, it’s own browser. It’s not testing the entire operating system/interaction with third party software. The comparison is not realistic.

Reply | Quote

While this is not a question in regards to Woodys’ topic it does concern the process of windows updates. I’ve been notified of an update pending it is KB976902. Microsoft states that the update is required for future updates to be installed correctly and that without it future updates may not be able to be downloaded and installed.

I find it a little worriesome that an update that is not considered “critical” and therefore was not automatically downloaded and installed and only got noticed because I checked my updates status could possibly prohibit all future Microsoft updates from being installed properly. I haven’t seen anything regarding this as of yet on Windows Secrets and am concerned about whether or not it really is that crucial to security of my system in the future.

Reply | Quote

I’ve been notified of an update pending it is KB976902. Microsoft states that the update is required for future updates to be installed correctly and that without it future updates may not be able to be downloaded and installed.

That’s the pre-patch needed before you can install Windows 7 Service Pack 1.

Don’t worry about it for now. When you’re ready to install SP1 (which isn’t out yet!), you’ll need to install this patch first. But the installer will install it for you anyway.

Reply | Quote