By Michael Cherry [bio]
Posted: Sep. 22, 2003

• Chart: Windows Service Pack Roadmap Summary

The following is the full text of an article published by Directions on Microsoft, an independent research firm focused exclusively on Microsoft strategy & technology. Each month we make one or more key articles available to non-subscribers.

A new Windows Service Pack Roadmap posted by Microsoft provides information on the approximate availability date and contents of the next Windows service packs. The roadmap could prove valuable to corporate customers, who rely on service packs to deliver tested fixes for bugs and security vulnerabilities, and give them a standard support baseline for their computers. However, the roadmap implies the next Windows XP service is not due for some time, and releases beyond that have not been set. As a result, customers need maintenance plans for Windows that don't rely solely on service packs.

The latest version of the Windows Service Pack Roadmap was posted to Microsoft’s Web site in Aug. 2003 and will continue to be updated quarterly. In addition to providing information on the current service pack and approximate availability and contents of the next service pack, the roadmap also gives customers information about the preceding service pack. It does so because as part of the Windows Product Life Cycle, older service packs are supported for one year after the delivery of the current service pack. (For a summary, see the chart "Windows Service Pack Roadmap Summary".)

Service Pack Release Dates Impact Customers

Customers use service packs to ensure that any fixes they apply to deployed versions of Windows have been thoroughly tested, and to reset the support baseline for their computers to a standard level. Service packs also provide an efficient way to apply many fixes to a computer all at once.

Delivering tested fixes. Customers often do not install every security patch or critical update that Microsoft releases because these fixes are typically not tested to the same degree as a service pack. But service packs generally have the same degree of testing as a product release. According to Microsoft, this means that they should not have a negative effect on existing functionality or performance, compared with either the previous service pack or the full product release. They should also include no changes to applications or device compatibility unless the change is necessary to fix security vulnerabilities.

Consequently, when a vulnerability or problem is discovered, customers frequently choose to deploy a workaround, such as turning off a service or network communications port, until the next service pack ships.

Resetting the support baseline. Corporate customers tend to use service packs to establish support baselines for their organizations; they do this by rolling service packs out to all computers in an organization, ensuring that all PCs will have the same version of the OS and other software.

Efficient deployment of fixes. Service packs provide the simplest way to apply a large number of fixes to a computer at one time, which is important to OEMs, small business customers, and home users. While OEMs have the right to preinstall security patches and critical updates, the pace at which such updates are released along with the complexity of updating preinstalled OS images means that few exercise this right. As a consequence, a large number of individual security patches and critical updates must be downloaded and installed on new computers from Windows Update.

Corporate customers may have the expertise and tools to manage this problem with a high degree of automation, but small businesses and consumers who purchase a new computer from an OEM with Windows XP Service Pack 1 preinstalled must download more than 20 updates totaling more than 30MB in size. Getting their new computers secure can take hours over dial-up connections.

Deploying a service pack can take considerable planning and resources for OEMs and for corporate customers as well, as it must be evaluated and coordinated with other tasks and projects. Service pack deployments may also have to be scheduled through a change-control process with long lead times. Many customers treat service packs as they would any new release, evaluating and testing them, then planning their deployment. The Windows Service Pack Roadmap could be valuable for this planning.

Service Packs Stretched Out

Unfortunately for customers, the current Windows Service Pack Roadmap indicates that service packs will be coming less frequently, and it is vague beyond the next release.

Specifically, the roadmap indicates that Microsoft will not deliver the second service pack for Windows XP until mid-2004. If this service pack is released on June 30, 2004, it will come 22 months after the first service pack. In contrast, the second service pack for Windows 2000 was 10 months after the first (and 15 months after general availability). With more than 20 security patches and critical updates already released for Windows XP since the first service pack, this is a long time to wait for the next service pack.

The next service pack for Windows 2000 is even vaguer, listed only as "to be determined." Although it is true that most bugs tend to be found early in a product’s life cycle, mainstream support for this product ends on Mar. 31, 2005, and many customers expect that the fifth, and likely last, service pack for Windows 2000 will be released before that date.

Microsoft says the roadmap is vague because customers have firm expectations and requirements for service packs, and therefore, as with full product releases, Microsoft will not release a service pack until it has been completely and thoroughly tested (including betas and release candidates).

However, the long delay to the next Windows XP service pack, and the vague roadmap beyond it, may reflect some pressures on the Windows sustained engineering team which produces service packs. That team, which has its own program managers, developers, and testers, and the Windows product team may be facing competing priorities, including the following:

• Testing multiple products (Windows 2000, Windows XP, and Windows Server 2003), multiple editions (such as Windows XP Home, Professional, Media, Tablet, and Embedded editions), and multiple languages simultaneously
• Keeping Windows secure by developing, testing, and releasing security patches
• Keeping Windows current by adding features and functionality, such as support for hardware such as Universal Serial Bus 2.0, the Intel Centrino processor, and new wireless security features such as WiFi Protected Access
• Working on the first preview version of Windows Longhorn, currently scheduled for release at the Oct. 2003 Professional Developers Conference.

In the Meantime…

The vague Service Pack Roadmap gives customers little data that could help in managing Windows deployments, and until the next service packs, customers will have to keep patching Windows with an ever-increasing mountain of updates.

For large corporate customers, a variety of tools could make this more tenable, including the following:

• Software Update Service (SUS), which provides an automated means to distribute and install critical Windows updates and security patches
• Systems Management Server (SMS) with the Software Update Services Feature Pack, which makes it substantially easier for organizations to use SMS to deploy Windows and patches
• Automatic Update, which allows users to automatically download (in the background) updates from either the Microsoft Windows Update site or a corporate (in-house) SUS server.

However, OEMs and small business and home users could benefit from a security rollup that contains all security patches in a single package—a mechanism which Microsoft does not currently offer. OEMs do not like to change their manufacturing processes each time a new fix is released, and they could either preinstall a rollup or bundle it separately with new computers. In addition, the majority of small businesses and consumers still connect to services like Windows Update via dial-up connections, and many do not have the expertise to decide which fixes they need to install. Security rollups—available either online or at computer stores (like the Windows Experience marketing CDs that are distributed from a wide variety of sources) for free or a small fee—could spare customers hours of downloading every time they bought a new computer or reinstalled Windows.

Availability and Resources

For the Windows Service Pack Roadmap, see www.microsoft.com/windows/lifecycle/servicepacks.mspx.

For the Windows Product Life Cycle, see support.microsoft.com/default.aspx?pr=lifecycle.

Roadmaps for Windows and other key Microsoft enterprise products can be found in the Directions on Microsoft "Enterprise Product Roadmap".