* Microsoft releases tools to block auto download of Windows Server 2003 SP 1
You’re an experienced network manager. You’re also an experienced desktop manager (even if it’s only your own desktop). When it comes to administering Microsoft’s patches and fixes for your desktop operating system (either at home or in the office), do you let it happen automatically, without your knowledge as a background task? Neither do I.
When Windows XP service pack 2 was released last year, it was quickly discovered that: a) it was being automatically downloaded and installed by corporate machines behind the enterprise firewall; and b) it broke a number of applications. This resulted in: a) enterprise network bandwidth being sucked up by simultaneous service pack downloads; b) help desks being deluged with phone calls because strange things (either the update, the broken apps, or both) were happening on users’ desktops; and c) a large number of calls to important people at Microsoft from some of its biggest customers screaming for relief. Some organizations went as far as completely closing down Internet access to prevent the service pack from being downloaded.
Microsoft responded with some workarounds to prevent the automatic download and update that seemed to, for the moment, satisfy corporate clients. Redmond evidently learned from this fiasco.
Last week, Microsoft director of product management for the Windows Server division, Samm DiStasio announced the availability of not one, but three different tools to block the automatic download and installation of Windows Server 2003 Support Pack 1. (While Win 2K3 SP1 was released some months ago, it’s being held back from automatic update until July 1.)
According to the Network World story by John Fontana (http://www.networkworld.com/news/2005/062105-microsoft-blocking.html), the tools are a Microsoft signed executable, a script and an ADM template.
The story reports that: “The executable creates a registry key with a switch that will block or unblock the download of the service pack while allowing all other patches and fixes to be downloaded. The script will do the same thing as the registry key, but Microsoft says it allows users to specify a block or unblock on a specific machine name. The third option is the ADM template, which works in conjunction with Active Directory’s group policy technology. The template includes new group policy settings to block or unblock delivery of the service pack.”
Microsoft did warn that the executable and the script were only tested as stand-alone command-line tools, not with any systems management tools or remote execution mechanisms. The tools are designed to keep Windows Server 2003 SP1 off the automatic update cycle until March 30, 2006.
Why anyone would have automatic update turned on for servers is beyond me, but fortunately Microsoft foresaw that at least some folks might and is providing the tools to overcome that oversight. Thanks Microsoft.
