Update Consolidation

Cumulative

The complexity and uncertainty of trying to figure out which updates you may have installed or missed is gone with Windows Server 2016.  The monthly packages are cumulative, meaning they will include all previous updates.  When you install a new server, no more having to install a long list of updates.  If you have the latest monthly update installed, you have all the updates you need... it's just that simple!

Predictable Cadence

Proactive Patch Discovery

Key Takeaways

• Predicable monthly update cadence you can plan for
• Fewer updates to manage
• Cumulative updates that have everything you need
• Proactive notification of updates before they cause downtime
• Simplified test matrix and streamlined verification process

Written by: Elden Christensen, Microsoft

• Server with Desktop Experience
• Server Core

Using PowerShell:

1. Open a PowerShell prompt with Admin permissions.
2. Type Get-Hotfix and press Enter.
   

Using a command line:

1. Open a command prompt with Admin permissions.
2. Type systeminfo.exe and press Enter.
   NOTE: There may be a short pause as the tool inspects your system.

   

3. Under the Hotfix(s) section, you will see a list of hotfixes / updates that you have applied to your machine.

Using the Windows Update Settings User Interface:

1. Open the Windows Settings UI.
2. Click on Update & security.
3. Click on the "Update history" link located under the Windows Update tab.
   

Applies to:

• Server with Desktop Experience
• Server Core

Validate your current WU settings using SCONFIG

To determine what updates your machine has already installed, follow these steps:

• Open a command prompt with Admin permissions.
• Type sconfig and press Enter.
  • NOTE: There may be a short pause as the tool inspects your system.

     

• Option #5 shows the current configuration of your Windows Update settings.

   

  

Change your Windows Update Settings

To change your Windows Update Settings with SCONFIG, follow these steps:

• Open a command prompt with Admin permissions.
• Type sconfig and press Enter.
  • NOTE: There may be a short pause as the tool inspects your system.

     

• Press 5 and then Enter. This will bring up the following options for you to choose from:

   

  

   

  • (A)utomatic – This will configure your machine to automatically scan, download, install and reboot after applying any updates.
  • (D)ownloadOnly – This will automatically scan, download and notify the admin if updates need to be installed. This is the default setting on Windows Server 2016.
  • (M)anual -- This turns Automatic Updates off. Your system will never check for updates.

     

• Press the letter specified in the "( )" and press Enter to apply.
• When the tool applies the configuration you have selected, you will see a message pop-up similar to the one below. Click the OK button to dismiss the message. The tool will refresh the menu and option 5 will now show the new configuration.

   

  

   

That's it, you are all set.

Your thoughts, questions and feedback are very valuable to us and we encourage you to share them in the comments section below.

Along with sharing the same modern settings UI, you may have noticed that we also use the same notification system. For example, when updates are found and ready to be installed, depending on policies, we notify you with either a small toast notification at the bottom right corner of the desktop, in the Action Center, or a large modal notification like the one shown below.

Not to worry, you can dismiss this notification by clicking the Get updates button – this will not install updates. If you are not ready to install the updates, simply:

     1. Click the “Get updates” button and which launches the Windows Update Settings page in the Settings UI.

     2. Close the Settings UI.

NOTE: This notification will reappear daily until the updates have been installed.

We realize this is a change in behavior and are interested in your feedback in the comments section below.

In an effort to provide additional protection for customers, we are releasing an update that further enhances the security of Windows Update / Microsoft Update (WU/MU) Client.

Improvements include further hardening of infrastructure used by WU/MU client and a more secure communication channel between WU/MU Client and Service.

The update is applicable to Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, Windows 8, Windows RT, Windows Server 2012 and the rollout will begin today. Similar to past updates, this update will be automatically installed if Automatic Updates is turned ON, either set to automatically install updates or notify to download/install updates.

Details on the changes to the WU/MU client can be found at KB 2887535.

As with past updates, this update will not change your current Windows Update or Automatic Updates settings. Anytime Windows Update (or Automatic Updates) is turned ON, either set to automatically install updates or notify to download/install updates, Windows Update will take care of updating itself.

It's important to keep your PC up to date with the latest updates to keep your PC running smoothly and safely.

WU/MU Team

As part of the phased mitigation strategy we outlined on the MSRC blog, an update was released with Security Advisory 2718704 that prevents unauthorized certificates from being used to attack Windows systems.  In an effort to provide additional protection for customers, the next action in our mitigation strategy is to further harden Windows Update as a defense-in-depth precaution. Now that we have seen broad adoption of Security Advisory 2718704, our deployment of the security hardening update to Windows Update and Windows Server Update Services (WSUS) infrastructures will begin to roll out over the next few days.

Our hardening introduces two defense-in-depth changes.  First, we have further hardened the Windows Update infrastructure so that the Windows Update client will only trust files signed by a new certificate that is used solely to protect updates to the Windows Update client. Second, we are strengthening the communication channel used by Windows Update in a similar way.  Details on the changes to the Windows Update client can be found at KB 949104. WSUS customers will also receive an update; more details can be found at KB 2720211.

As with past updates, this update will not change your current Windows Update or Automatic Updates settings. Anytime Windows Update (or Automatic Updates) is turned on, either set to automatically install updates or notify to install updates, Windows Update will take care of updating itself.

It’s important to keep your PC up to date with the latest updates to keep your PC running smoothly and safely.

WU/WSUS Team

Service Pack 1 (SP1) for Windows 7 and Windows Server 2008 is now available on the Download Center (DLC) and also through Windows Update and WSUS.  On February 9th, we announced the Release to Manufacturing (RTM) of SP1.  For Windows 7, SP1 will help keep your PCs well supported by delivering ongoing updates, many of which have been made previously available through Windows Update. It also includes client-side support for RemoteFX and Dynamic Memory which are two new virtualization features enabled in Windows Server 2008 R2 SP1. For more information on the changes with SP1, see the notable changes document on TechNet.

Here’s a short list of the tools and guidance that’s available for SP1:

•                    If you’re managing systems that connect directly to WU, you can use the updated Service Pack Blocker Tool Kit to prevent WU from offering SP1 to your client computers.

•                    For more information about SP1, refer to the SP1 Frequently Asked Questions on TechNet.

•                    For help with deployment related questions, you should read this blog post on the Windows team blog.

We hope this information helps you prepare to deploy SP1.

--

The MU Team

As you may have heard, Windows Live Essentials 2011 has been released. It will be available through Windows Update (WU) in the coming weeks, starting October 19th. This software upgrade will only be offered to users who have enabled updating through the Microsoft Update service. For more information about Windows Live Essentials 2011 and why you want it, click here.

Windows Live Essentials 2011 will be offered as a Recommended Update for users who have any one of the Windows Live software products installed, otherwise it will be offered as an Optional Update. If you have configured your computer to automatically download Recommended Updates then it will download automatically. After download is complete, WU will notify you of available updates, and you can start the upgrade. It will not install automatically.

Windows Live Essentials 2011 will be offered through WU for Windows 7 and Windows Vista SP2 computers. If you have not upgraded to Windows Vista Service Pack 2 then this would be a great time to take care of this task. Please note that you may need to install other available updates and Service Packs for Windows Vista before WU will offer Service Pack 2 for installation. Windows Live Essentials 2011 cannot be installed on Windows XP computers.

Thanks,

Microsoft Update Team

Here’s a reminder for people running Windows XP SP2 and Windows Vista RTM or SP1. Service packs are important for many reasons. They are a rollup of previously released Windows updates, and they typically contain software improvements that aren’t released in a stand-alone update. Service Packs are a part of Microsoft’s support policy. When a new Windows Service Pack is released, Microsoft will provide 24 months of support for the previous service pack. When support ends, we typically do not release new updates for the unsupported platforms. This includes Security Updates.

On April 13th 2010, support ended for Windows Vista RTM (no service pack installed). To continue getting updates and support, Windows Vista users need to install Windows Vista SP1, and we strongly recommend installing Windows Vista SP2. On July 13th 2010, support ended for Windows XP SP2. To continue getting updates and support, Windows XP users need to install Windows XP SP3.

What do you need to do? Vista users should install Windows Vista SP1 & SP2 using Windows Update (WU). Windows XP customers should install Windows XP SP3 using Automatic Updates (AU) or the Microsoft Update site. You may need to install other available updates before a Service Pack is offered to you in WU or AU. Service Pack installation is always recommended through Windows Update, due to AU/WU’s ability to reduce the size of the download and manage the download process. Windows XP SP3 requires a 316mb download through the Microsoft Download Center and the typical download through AU/WU is ~70mb.

Thanks!

The MU Team

Just a reminder, we are starting the Windows Update and Microsoft Update service upgrades today. The service upgrade will include updates to the online update services and the Windows Update (or Automatic Updates on XP) client code installed on your computer. As explained in our previous post, the upgrade will take several months to complete, and you don’t need to do anything on your own to complete the service upgrade. The client code will be updated automatically when needed, if your computer is configured to automatically check for updates, download updates, or install updates. If you have disabled updating and do not check for updates then the client code will not be updated automatically.

For more information, please refer to our previous post.

Thanks,

MU Team