WSUS Installs Stealth Updates

A recent error by Microsoft caused Windows Server Update Services (WSUS) to install Windows Desktop Search on desktops that had not previously installed the feature. This and other “stealth” update incidents show that Microsoft is still struggling to distribute the large number of updates for its products in a uniform and consistent fashion. Organizations that rely on the free WSUS software distribution product to distribute software updates from Microsoft and expect only approved updates to be installed may need to adjust their expectations and policies.

WSUS Error

The problem appeared around Oct. 23, 2007, when many WSUS customers noticed performance problems with their PCs due to the increased processing load generated by the newly installed Windows Desktop Search. According to Microsoft, it made a mistake in revising a previous Windows Desktop Search update, Knowledge Base 917013, which it had first released in Feb. 2007. The original update only updated computers on which Desktop Search was already installed. However, an Oct. 2007 revision (105) of the package was sent out that installed Windows Desktop Search on computers where it was not already installed. Furthermore, by default, WSUS automatically installs revisions to previously approved updates, so in many organizations revision 105 went out to all computers without first getting administrator approval.