Windows Service Pack refuseniks offered temporary respite

Microsoft has released a tool that allows enterprises to side-step a wave of upcoming Windows service packs. SPBlockerTools toolkit will temporarily defer the installation of Windows XP SP3 and Vista SP1 to allow testing for up to a year following the release of the updates. Windows XP SP3 is due sometime in the first half of …

[Jason Harvey]

Yes...

MS is good at delaying...

[4a$$Monkey]

Thanks Microsoft

...for giving us the choices not to install an untested service pack. How jolly decent of you!

[Lloyd]

All very well

but the reason I refuse to install the damn things is because they try to install on the drive that has the largest amount of disk space which is one that I don't want it to install from, if MS could sort their s**t out and just install on the Windows drive then I'd do it.

[Hedley Phillips]

WSUS

Will I be able to just not approve it in my WSUS console or do I have to block it as well?

Surely WSUS is designed for this very issue.

[Anonymous Coward]

There is a way round it...

The desktop people here have permanently blocked updating via the windows update through group policy. This means that the last six months or so we could only rely on users having XP SP1, and we still don't have IE7 (the developers of our TimeSheet system have managed to make a right old mess of it, it only works in IE6... :).

Which is all well and good for normal users, but makes life hell if you're a developer...

[Mike Lovell]

Lloyd???

"but the reason I refuse to install the damn things is because they try to install on the drive that has the largest amount of disk space which is one that I don't want it to install from, if MS could sort their s**t out and just install on the Windows drive then I'd do it."

Err, why??? I'd rather it didn't unpack anything onto the Windows drive if another drive is available. Multiple paritions, modest sized C:\ drive, very common! :op

[James Carter]

There IS another way around it...

Have the firewall block all access to microsoft.com and any domains owned or registered by Microsoft. Further, have the AV system place any code signed by Microsoft in the bit bucket. That's what a proper AV system and firewall should do anyway.

[Rob]

Microsoft allowing you to do what you like with your own computer??

I didn't realise it was april 1st already

[Aremmes]

@WSUS

Theoretically, yes; anyone using WSUS should simply be able to not approve the service pack for any given computer groups for any amount of time. At our shop, we have yet to approve IE7 for desktop computers, and we have yet to see a rogue installation. I say "theoretically" only because I cannot vouch for WSUS continuing to work in a predictable manner, being MS software and all.

[Anonymous Coward]

@Hedley Phillips

Yes, provided you haven't set WSUS to automatically approve and deploy service packs unattended (which would be stupidity). WSUS gives you this type of control already, for ordinary patches and driver updates as well as service packs - presumably this blocker tool is designed with smaller organisations who just use automatic updates direct from the Windows Update site in mind.

[Anonymous Coward]

i already have a windoze <whatever> blocker...

its called Linux - i recommend you check it out

[Brian Milner]

@ the Linux fan

Linux is great, but you must realise that although it's easy to swap one PC from Windows to Linux, it's hugely difficult for businesses with lots and lots of PCs.

[Anonymous Coward]

Can we not turn off updates ??

Cant I just turn off automatic updates in my Security Center of Windows XP Pro ??. or am i missing something ?.

[F Seiler]

@decompress drive

"but the reason I refuse to install the damn things is because they try to install on the drive that has the largest amount of disk space which is one that I don't want it to install from, if MS could sort their s**t out and just install on the Windows drive then I'd do it."

Oh, *that's* what it looks for - i just had .NET unpack to a (slow) network drive a few days ago ><

[Gordon Fecyk]

I guess XP has some life left after all... an XP SP3?

Doesn't this increase the mainstream support period for Windows XP? I would have expected a "Windows XP SP2 Rollup Package" or something, but not an honest-to-goodness Service Pack.

[Anonymous Coward]

it only works in IE6

Not surprised you want to be anonymous.

Only works in IE-*anything* is a dreadful admission.

But this has been a useful reminder to me to review once again whether or not I want to install SP1.

[Anonymous Coward]

Surely if you write to .....

Microsoft and tell them "my licence number is xyz and I do not wish you to update my computer" then any alteration that they make will be a violation of the Computer Misuse Act ?. Is that correct ?.

[Anonymous Coward]

Give Micosoft some credit for this

Personally I use Ubuntu and Kubuntu so this doesn't affect me personally, though I do use XP at work (and LOL in the face of "Vista"), but lets give micros~1 some credit for this. Remember what happened when XP Service Pack 2 came out? All hell broke loose on the corporate LAN (mainly due to the firewall enabling - WTF), so MegaShaft released a delay util (not needed with WSUS). I have a fleet of bandwagons out the back ready to get on to but surely give Micro$oft credit this. They are releasing the delay util before the crap hits the fan (YA RLY) so good for them! j0k

[Adam White]

RE: Can we not turn off updates ??

Yes you can. And yes, presumably you will need to approve these updates in WSUS as well.

I reckon when XP SP2 was released there was a moderate-sized kerfuffle because it turned out some places don't actually use WSUS (or equivalent) and set all their PCs to individually download (and automatically install) all updates from windowsupdate.microsoft.com. This is Microsoft's way of pandering to those freaks.

Also if you have a single WSUS realm I guess you could use this tool to selectively deploy the Service Packs after they have been approved.

[Anonymous Coward]

@ the M$ Defender

Moving from Windoze to Linux is easy next to the downgrade to Vista, for a single computer or an organization with thousands. How many times do you have to suffer upgrade abuse before you get off the treadmill? The sooner, the better because M$ is only making things harder. Your users will thank you.

[Anonymous Coward]

@Thad

Luckily, we're not responsible for our own Time Sheet system (thank god...) it's outsourced to an Indian outfit, has been for a few years... ;)

[Colin Wilson]

About switching updates off...

Since several people seem to have asked why you can't just switch off updates - might I humbly suggest you do some reading on the subject.

Microsoft don't follow user settings, nor do they abide by the rules of the Trusted Computing Group (http://www.trustedcomputinggroup.org), of which they are members, by ignoring the basic principles, such as "The owner controls the trust relationship."

You could do worse than starting here:

http://www.theregister.co.uk/2007/09/14/microsoft_dispels_stealth_update_rumors/

My next machine *will* run linux. No way in hell will I ever touch Fister !

[Gordon Fecyk]

A lot of you (especially Linux religious fanatics) missed the point.

That point is:

"The idea in all cases is to create a means for firms to test the application of the software within their environment and roll out changes gradually, rather than dealing with a Big Bang upgrade. As with similar software packages the latest tools only DELAY (Emphasis mine) the application of service packs."

The delay in question is not a programmatic one. It's not like M$ can shove a Service Pack down your throat unwillingly, as much as some of you would like to believe that. It's actually a support-related delay. Microsoft will eventually only support Windows XP that has Service Pack 3 installed. Likewise Vista, with Service Pack 1. This means no more bugfixes, no more new software (such as IE 8 or WMP 12 when they show up) and no more free or refunded support requests without the latest Service Pack.

So the point is to give "refuseniks" an excuse to delay, but not postpone indefinitely, the deployment of a Service Pack.

And don't even get me started on XP SP2 breaking software or Vista breaking software. Developers had enough warning in both cases, and it seems the majority decided to stick their heads in the sand about it. And we are paying the price for their ignorance.

[Stan]

@A lot of you (especially Linux religious fanatics) missed the point.

The point is MS are covering there ass for the next 'but I had updates turned off' episode, this way they can say "we have a utility for that" when XP SP3 forces it's way in with the DRM and "for your security" hellware forcing everyone onto the vista downgrade.

cheers

[Antoinette Lacroix]

Blah

I'm a Unix person and never had a piece of MS on my box . . . but

I Installed the latest beta SP3 on my dad's box, and it works like a charm. Nothing broke, nothing went wrong. A restore point gets set, old data is preserved. A patched uxtheme.dll for running unsigned themes is also availible.

Start the bashing when something is wrong, not out of habit.

And spare me those linuxish comments, especially you, with your crappy pieces of patchwork, called Ubuntu.

[Anonymous Coward]

Makes you wonder doesn't it?

> Moving from Windoze to Linux is easy

Yeah, easy, until you come across 3 things:

1. Your delegates are Window$ fanatics and refuse to move on (I've seen people who scream bloody murder when I suggest them to move to Linux just because they want Window$ and refuse to switch because they don't want/like changes to the way they get things done).

2. Exotic software that are Window$ only and won't run under WINE due to anti-piracy/copy protection/anti-cheat (for games)/undocumented Window$ calls/forced direct hardware access. I've seen a fair share of them, mostly entertainment titles like games.

3. Exotic hardware with zero Linux support. I just bought a network-enabled LED-technology color printer (Okidata C3300N if you must know- a real steal at RM700/US$175/100 quid), and it plays nice with my old Macintosh (a REAL Mac, with a PowePC CPU! although the OS is the toyish OS 9) and the Window$ boxes in the network (sadly I have 3- a gaming rig, a Media Center, and one that's used for serious programming/web development work), but not with the Linux boxes I have (one running Debian Sid, the other RedHat 7, although I'm tempted to change RH7 to FreeBSD). Linuxprinting.org calls it a "paperweight" and there have been arguments about it in the Linux printing forums (some successfully getting it to work under SuSE, but I'd rather not switch distro again as I just jumped from Slackware to Debian).

> Err, why??? I'd rather it didn't unpack anything onto the Windows drive if another

> drive is available. Multiple paritions, modest sized C:\ drive, very common! :op

I'd rather slipstream the stuff into a CD, then use it as an excuse to reformat the machine (what ever happened to the recommendation of reformatting your PC every 6 months?)

[JC]

@ Gordon

It is not the developer's burden to rewrite their code to make it work again after MS breaks something with a SP.

It is not the system owner's burden to "test" anything to be sure it doesn't break because MS wants to shove a SP down your throat.

Support? Gordon, you're saying they won't support it later, but not supporting is exactly what they're doing now to the extent we have to test and ultimately, the SP delay is only temporary, thanks to MS it will still happen. That is the opposite of "support".

Gordon seems to think support means supporting MS' agenda, not supporting the customers' needs.

[Anonymous Coward]

Will this stop MS...

...stealth updates as well??

[Stuart Castle]

@Lloyd

"but the reason I refuse to install the damn things is because they try to install on the drive that has the largest amount of disk space which is one that I don't want it to install from, if MS could sort their s**t out and just install on the Windows drive then I'd do it."

Why? The SP will only unpack itself to the drive with the most space, then installs to the Windows drive anyway. Also, if it bothers you that much, look up the commandline for extracting it manually (something like "SP.EXE /X"), run that, specify where you want it extracted, then run "update.exe" from the update folder in the folder where you extracted it.

[Paul Weston]

Tips for stopping unwanted windows updates

When Windows Update tries to install, goto the custom install option and untick the box next to IE7 and SP3, then it wont try and install it again.

Wait 6 months till they have released enough hotfixes to make it stable, then goto download.microsoft.com and download the network deloyment version and install from there, this will always unpack to the $systemroot$\windows\ folder (when you get WSUS download) but with the manual sp downloads you can set the drive and folder it can be unpacked too.

After the sp has been installed windows update will grab the hotfixes after the reboot and update.

If there are any problems boot into safe mode (F8 on startup) and uninstall from the administrator account.

[Colin Millar]

??an excuse to reformat

Every six months??

You really need to get out more

[Anonymous Coward]

Looking forward to SP3

I just applied the GPO to stop our 2000+ desktops updating to SP3. Microsoft usually supply tools to control updates like this (for example we will not be using dog slow IE7 - ever), and it's a good thing as here we will need to test our apps and systems to ensure they work with SP3 before we roll it out when we are ready and in a controlled fashion using SMS.

As for being 'freaks' and not using WSUS, we have a lot of laptops and I'd rather they just update themselves wherever they may be rather than having to wait until they connect back at base. And no, I don't want to present a MS WSUS server to the internet thankyouverymuch. Only a lunatic connects Windows directly to the Internet.

[Lloyd]

Because

"Why? The SP will only unpack itself to the drive with the most space, then installs to the Windows drive anyway. Also, if it bothers you that much, look up the commandline for extracting it manually (something like "SP.EXE /X"), run that, specify where you want it extracted, then run "update.exe" from the update folder in the folder where you extracted it."

I found a load of "Defender" crap on my D drive which refused to uninstall or delete, in the end I had to re-format the drive which isn't how I want my OS to work (or not work as the case may be), so now I just don't bother with the updates any more for fear of having to spend ages copying all of my data off onto different drives so I can remove a load of MS junk.

[Robert Pogson]

Get off M$'s treadmill

Even if you have many PCs, if they are networked PCs, they usually can boot PXE. Install LTSP from LTSP.org, K12LTSP, Debian, etc. on a powerful server on the LAN and you can convert a lot of machines to GNU/Linux very quickly. It may take only a couple of minutes per PC to make the PXE option available. Some distros, like K12LTSP or EdUbuntu have an installation option to set up an LTSP server. A new 8-way server choked with RAM and storage can serve a lot of PCs. Then your desktop management problems are cut way down. If you like the thin client solution, you can buy small fanless boxes that bolt onto the back of an LCD monitor (Vesa) for about $100. It is not impossible to convert a large organization of desktop users over a weekend. Give them a training session Monday AM and you are good to go. I did that last year. I handed out password lists to managers, gave the managers a one hour intro and it worked.

If you are already using thin clients, just back up the data for users and install it on a new server and you are done. Shut down all the clients and when they boot they are running Linux.

The fewer than 20% of situations that need some special app can be left on that other OS or migrated to a FLOSS substitute. All the generic stuff is already in the Debian distro. See http://packages.debian.org

[Joe Blogs]

Hmmm...

<quote> Moving from Windoze to Linux is easy next to the downgrade to Vista, for a single computer or an organization with thousands. How many times do you have to suffer upgrade abuse before you get off the treadmill? The sooner, the better because M$ is only making things harder. Your users will thank you. </quote>

Until the factory stops working because of a piece of software that will only run under real windows 2000 fails. Yeah, great idea!!!

@Gordon Fecyk

<quote>Doesn't this increase the mainstream support period for Windows XP? I would have expected a "Windows XP SP2 Rollup Package" or something, but not an honest-to-goodness Service Pack.</quote>

Yeah, or maybe SP3 has some code in it that makes XP run so bad that it will make Vista look good!!!

[wulff heiss]

@Looking forward to SP3

erm.. your users are allowed internet access while roaming?!?

that's why VPNs were created... not the checkpoint type that allows LAN, internet and VPN, but the cisco type that locks off your computer to anything except VPN...

[Anonymous Coward]

@ Colin Millar

> You really need to get out more

Hmmm... I guess tips for Windows 95 doesn't apply anymore, doesn't it?