Keeping Computers Up-To-Date: Automatic Updates Isn't Enough

Early Monday morning, while I was making my weekly check for product updates on Microsoft's Windows Update Web site (http://v4.windowsupdate.microsoft.com/en/default.asp), I came across a new update for Outlook 2002 (http://office.microsoft.com/downloads/2002/olk1005.aspx). One sentence from the update description caught my eye: "This update fixes an instability problem introduced in Office XP Service Pack 2 (SP2) that affects Outlook POP3/SMTP clients." My only thought was, "ain't that the truth"—not regarding the specific problem being fixed, but rather regarding the fact that the new update fixes a problem that an earlier update introduced.

I'm conscientious about keeping my personal and professional systems updated with all the current patches and bug fixes, but the complex nature of updating and patching procedures was really driven home to me last week when I stopped by a friend's small office to try and solve a few problems in his 10-user network. All the computers in this network are less than a year old and run either Windows XP or Windows Me. All are Pentium 4 machines with at least 256MB of RAM and only a few applications installed. Even so, these computers were experiencing random blue screen crashes and system hang-ups while users browsed the Internet, and I hoped to find the cause.

I started with the oldest computer in the office, a 10-month-old Dell running Windows Me. My first step was to go to the Windows Update site and scan the local system for missing updates. I discovered that, despite the fact that my friend regularly ran the Automatic Updates feature on the computer (and swore that he had run the feature recently and had accepted the updates), I found when I manually scanned the computer that 6 necessary Critical Updates, 44 Windows updates, and 2 driver updates were available for installation. I figured that my next step would be to install the updates and see whether doing so mitigated the system's overall problems. My plan was easier stated than accomplished. Two hours later, the computer was completely updated and has been running rock solid ever since. But I never expected the update process to take 2 hours.

Even with a fast Internet connection, downloading large updates, installing them, then rebooting between updates can eat up your time. A large part of the problem I faced with my friend's computer was that after I installed some of the recommended updates and rescanned the system, I discovered that I was going backward. I had a larger number of Critical Updates to install than before I had begun the update process. This situation was due to my having upgraded the computer to Microsoft Internet Explorer (IE) 6.1, which introduced several required updates to secure that application. Further complicating the situation is that certain updates, such as for IE and DirectX, can only be processed by themselves; you can't process them in batches with other updates, as most other updates allow.

To be fair, I spent the first hour of my updating adventure upgrading the OS. I spent the second hour on the Office Product Updates site (http://office.microsoft.com/productupdates/default.aspx), where I discovered multiple updates that had to be installed independently and came upon problems that one update caused that required another update to fix. But after 2 hours I was able to scan the computer from both update sites and receive no reports of required or even recommended updates for Windows that were of use to my friend's company. The Windows Update site offers updates that are available for the OS but unnecessary for many users (e.g., the update for the Microsoft .NET Framework).

The importance of staying updated is underscored by the fact that the computer I've described was the least stable of all the computers in my friend's office, yet after I applied the appropriate updates, that computer has now been running for more than a week with no problems.

The moral of my story is this: Don't rely on the Windows OS Automatic Updates feature exclusively. Proactively check for new updates and, if you support users in small or remote offices, make sure they do the same.