Patching - Finally!

Forums › IT Pro and developers › Patching - Finally!

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#201406 17-Aug-2016 11:17

https://blogs.technet.microsoft.com/windowsitpro/2016/08/15/further-simplifying-servicing-model-for-windows-7-and-windows-8-1/

"Monthly Rollup
From October 2016 onwards, Windows will release a single Monthly Rollup
that addresses both security issues and reliability issues in a single
update. The Monthly Rollup will be published to Windows Update (WU), WSUS,
SCCM, and the Microsoft Update Catalog. Each month’s rollup will supersede
the previous month’s rollup, so there will always be only one update
required for your Windows PCs to get current. i.e. a Monthly Rollup in
October 2016 will include all updates for October, while November 2016 will
include October and November updates, and so on. Devices that have this
rollup installed from Windows Update or WSUS will utilize express packages,
keeping the monthly download size small.

Security-only updates
Also from October 2016 onwards, Windows will release a single Security-only
update. This update collects all of the security patches for that month
into a single update. Unlike the Monthly Rollup, the Security-only update
will only include new security patches that are released for that month.
Individual patches will no longer be available. The Security-only update
will be available to download and deploy from WSUS, SCCM, and the Microsoft
Update Catalog. Windows Update will publish only the Monthly Rollup – the
Security-only update will not be published to Windows Update. The
security-only update will allow enterprises to download as small of an
update as possible while still maintaining more secure devices."

amanzi

Amanzi
1299 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613129 17-Aug-2016 11:32

This is interesting, but I have some reservations... If you need to prevent installation of a single security patch because of a compatibility (or whatever) reason, then with this new system you'd need to block the whole update and miss out on the other security patches too. Also, how will it work on servers where patches address a particular role on a server that's not even installed? Also, I assume Office updates (and other MS components) will still be posted individually?

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613130 17-Aug-2016 11:32

amanzi:

This is interesting, but I have some reservations... If you need to prevent installation of a single security patch because of a compatibility (or whatever) reason, then with this new system you'd need to block the whole update and miss out on the other security patches too. Also, how will it work on servers where patches address a particular role on a server that's not even installed? Also, I assume Office updates (and other MS components) will still be posted individually?

Good points! Maybe @Nathan can clarify.

gjm

808 posts

Ultimate Geek

#1613143 17-Aug-2016 11:58

so now we will be unable to block any "security" updates that try to force Windows 10 on us again....great. On the plus side Ive had a lot of requests for Candy crush to be installed lately so at least that will be fixed :/

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613145 17-Aug-2016 11:59

gjm:

so now we will be unable to block any "security" updates that try to force Windows 10 on us again....great. On the plus side Ive had a lot of requests for Candy crush to be installed lately so at least that will be fixed :/

Given MS is no longer giving it away free, I can't see them installing it without credit card information.

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613152 17-Aug-2016 12:11

amanzi:

If you need to prevent installation of a single security patch because of a compatibility (or whatever) reason, then with this new system you'd need to block the whole update and miss out on the other security patches too.

Hopefully you don't. It's high time MS just started blocking poorly written/legacy apps that don't conform to current standards. Having previously worked in deployment/app packaging there are things I want to do to some software authors that would make a 3rd world dictatorship torture team go pale. *grumble*

I'm a geek, a gamer, a dad, a Quic user, and an IT Professional. I have a full rack home lab, size 15 feet, an epic beard and Asperger's. I'm a bit of a Cypherpunk, who believes information wants to be free and the Net interprets censorship as damage and routes around it. If you use my Quic signup you can also use the code R570394EKGIZ8 for free setup.

networkn

Networkn
32351 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613153 17-Aug-2016 12:12

Lias:

amanzi:

If you need to prevent installation of a single security patch because of a compatibility (or whatever) reason, then with this new system you'd need to block the whole update and miss out on the other security patches too.

Hopefully you don't. It's high time MS just started blocking poorly written/legacy apps that don't conform to current standards. Having previously worked in deployment/app packaging there are things I want to do to some software authors that would make a 3rd world dictatorship torture team go pale. *grumble*

Heh, in general, I despair when I see new apps now, or new versions of old apps, that are so awful it defies belief.

I believe, in general, that software QA is the worst it's ever been in applications and operating systems.

gjm

808 posts

Ultimate Geek

#1613154 17-Aug-2016 12:12

networkn:

gjm:

so now we will be unable to block any "security" updates that try to force Windows 10 on us again....great. On the plus side Ive had a lot of requests for Candy crush to be installed lately so at least that will be fixed :/

Given MS is no longer giving it away free, I can't see them installing it without credit card information.

I don't know, I mean MS have been pushing Win 10 so hard, it makes me think that a subscription for your OS type of model is surely coming. I wouldnt be surprised to see the free upgrade offer be extended or repackaged in some other way.

Having been a Windows user since 3.11 I am now working on a macbook as I got so annoyed at Microsoft for all the hours I had to spend on family members computers, fixing the "upgrade" that was made much to simple to install for non technical minded folk. When it comes time for them to purchase new machines I will be sending them to the Apple isle.

Do surveys for Beer money (referral link) - Octopus Group

Link for buying beer (not affiliated, just like beer) - Good George

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

Behodar

10508 posts

Uber Geek

Trusted

Lifetime subscriber

#1613193 17-Aug-2016 12:46

Lias: Hopefully you don't. It's high time MS just started blocking poorly written/legacy apps that don't conform to current standards. Having previously worked in deployment/app packaging there are things I want to do to some software authors that would make a 3rd world dictatorship torture team go pale. *grumble*

Sometimes it's more complicated than that. We have an app, "App A". We have version 4 installed, which is not compatible with one of the recent Windows security updates. Version 5 is compatible, but we can't install it because of "App B" (from a different vendor). B integrates with A, but hasn't yet been updated to support version 5.

From what I can tell, App A hasn't done anything wrong; the funcationality that version 4 relied on was documented and supported. When Microsoft announced that it would be going away, the vendor supplied an update. So there's nothing wrong with App A itself, yet updates still break it.

App B on the other hand... let's not turn this into a rant :)

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613248 17-Aug-2016 14:20

Behodar:

App B on the other hand... let's not turn this into a rant :)

I think we're back to doing bad things to certain software authors right? :-P

1101

3122 posts

Uber Geek

#1613668 18-Aug-2016 11:10

Just what are they saying ?
are they saying, for serious security issues, they wont bother releasing patches it till the end of month ?
Surely they arnt saying that..... that would be insane.

or is this new scheme is only for manual downloads of updates & patches ? .

Cant be any worse than it is at the moment for Win7. Its a badly broken mangled system it desperate need of a fixup.
Win7 re-installs can sit for days(yes days) "searching for updates" , the fixes for that often dont work, with MS pages giving a broken link to a no longer existing fix .

At least MS are trying , and still fully supporting an old OS .

I think the rollout of this has started allready for 7 : just very poorly explained in the months rollup download page (with the full commutative update download links broken when & tried to get that earlier this week)
Since the big Convenience update links didnt work (on a fresh install) , I assumed that was superseded by the more recent rollup

theres this
https://support.microsoft.com/en-us/kb/3125574

and then this
https://support.microsoft.com/en-nz/kb/3161608

and this
https://support.microsoft.com/en-nz/kb/3172605

Lias

5589 posts

Uber Geek

ID Verified

Trusted

Lifetime subscriber

#1613873 18-Aug-2016 17:23

1101:

Just what are they saying ?
are they saying, for serious security issues, they wont bother releasing patches it till the end of month ?
Surely they arnt saying that..... that would be insane.

Microsoft already only release patches once a month except in extreme circumstances.

Taking Microsoft Security Bulletin Summary for August 2016 as an example, 9 Separate security patches were released, MS16-095 through MS16-103, in the new model you'd just get a single "August 2016 Security Rollup" or similar instead.