Once a month on “Patch Tuesday“, Microsoft releases patches and updates for their operating systems. However, due to potential problems introduced by updating system files, there are many different opinions on when you should actually install these updates. Ask 5 people and you might get 5 different answers.
The benefit to installing the updates is obvious as security holes in the OS are plugged. On the other hand, the general concern is by updating system files, you could potentially break an application (or some of its features). While this is a valid concern I believe it to be only applicable to legacy applications. If an organization depends on legacy applications, I can certainly appreciate the need to hand test each update but for the vast majority of users, this is overkill.
In my 7 years as a full time developer/IT professional I have come across 2 issues (both on desktop machines) caused by Windows Updates. One was due to an application using incredibly outdated ActiveX components (which a “kill bits” update broke) and the other was a .NET update breaking QuickBooks. Both were easily resolved with a phone call. I have never encountered any issues with Windows Updates breaking functionality on servers… knock on wood. Granted, most of the stuff we run is Microsoft (Exchange, SQL, etc.), we still have several non-Microsoft products which run on these machines as well.
So based on my experience, I do the following:
- Have updates download and install automatically on desktop machines. Whenever the user reboots their machine (most likely they will get tired of the reminder screen quickly), the update is applied.
- Install updates on server machines every Saturday night.
My thought process is I would rather deal with an application issue (which will likely be addressed quickly by the vendor) than a compromised machine which could have disastrous effects and a huge amount of time lost, especially if the compromised machine is a server.
So what are your thoughts? Are you cautious when it comes to Windows Updates or do you install them shortly after they are released?
Like what you read?
If so, please join over 28,000 people who receive our exclusive weekly newsletter and computer tips, and get FREE COPIES of 5 eBooks we created, as our gift to you for subscribing. Just enter your name and email below:
I'm cautious. You're right, it rarely breaks things, but it does happen. On occasion MS closes some door that some application was using.
At home, I do it manually, as I think of it. But at the office, I'm similar…desktops automatically, the server I will do myself at least once a month. For the server, I've found it's better to just do it in a regular way, so that you can have a good idea – when things break the next day, it was probably one of the updates.
Ever since there was scare, long, long ago, about a vulnerability in WU that would allow an attacker to infect a machine VIA WU, I've never gotten over my WU paranoia enough to allow automatic updates on my machines. I always have WU set to notify before downloading and installing. But anymore, this is mostly because I don't want to deal with surprise restart nags and stolen bandwidth at possibly inconvenient times.
Maybe some day I'll get around to determining a good download/install schedule for automatic installs (i don't have a very predictable schedule), and figuring out and implementing in my home domain's AD the elusive registry settings that turn off nags (I've already spent far too many hours testing different reg hacks on different machines, which are different per OS). But until then, I continue to let my ever-more-obsolete paranoia and inconvenience excuses dictate my WU settings.
It's just not that hard (especially in 7 and Server 2008… and presumably Vista) to click the mouse a couple of times per week. Besides, on rare occasions I am actually interested in what is going to be installed/updated, and automatic updates would probably be too transparent to trigger my interest in reading the update notes.
I have my PC set to auto download updates but let me choose when to install. I keep it like this so I can know what updates are being installed. I've never had a problem with an update breaking anything, but I have read about it in the distant past. I figure that I can't know that Win Update broke something if I don't know what it was updating. Another reason that I didn't auto install was that a couple of PC ago I needed to avoid the Windows Grenuine Advantage. Every couple of months MS would try to slip that one in. Now I don't have to worry about that, but od habits die hard.
I usually wait about a week. By that point, the blogosphere is usually fully of “update KBxxxxx broke feature/application Y” if there's a serious problem.