Network News

X My Profile
View More Activity

Microsoft's Auto-Update Too Slow?

Yesterday I woke up to find my computer presenting me with the Windows login screen.

I know that Microsoft's auto-update feature -- which is enabled on my main home machine -- after a period of time automatically restarts your PC after downloading and installing security patches. But it still spooks me out whenever I see a login prompt without having shut down the computer on my own. Plus, I'm always worried that Windows will shut down some task, e-mail or document that I've left half-completed.

Anyway, it dawned on me that Microsoft installed the latest round of security patches on my PC nearly a full week after releasing them to the general public. Microsoft released nine patches Oct. 11, but the Windows auto-update didn't install any of them until the wee hours of the morning on Oct. 17. Another computer of mine that uses auto-updates didn't reboot until earlier this morning. (It, too, is always on.)

I know Microsoft has had some trouble with one of its patches recently and has had to reissue the update to correct problems that some people reporting having after installing it. But is that any reason to delay deploying the rest of the fixes?

Seems to me that in an era where worms are exploiting Windows security holes just hours after Microsoft releases a patch -- in hopes of catching vulnerable users before they can install it -- Redmond should not delay in pushing patches out to customers who have opted for automatic updates precisely so they don't have to worry about it.

What do you think, Security Fix readers? Do you use auto-update? If so, how long did it take for your patches to be pushed to your PC? (In Windows XP, you can tell by clicking on "Start," "Control Panel," "Add/Remove Programs," and making sure that the box at the top next to the words "Show Updates" is checked. Scroll down to the bottom of the program list to "Security Updates" and note the dates of the patches at the bottom of the list, which should be the most recent.)

By Brian Krebs  |  October 18, 2005; 2:15 PM ET
Categories:  From the Bunker  
Save & Share:  Send E-mail   Facebook   Twitter   Digg   Yahoo Buzz   Del.icio.us   StumbleUpon   Technorati   Google Buzz   Previous: Attack of the Splogs
Next: Longer Logins at Online Banks?

Comments

Following your instructions I verified that my last sec. updade from MS for Windows XP installed on 10/15, which I would consider timely. As my update installation is set to download but to ask me for permission/control to install, it installed fine, no problems, and then it asked me to restart the computer, which I did. No fuss, no muss. All very timely and clean up to this point with Windows XP in my opinion.

Posted by: Yuval Warshai | October 18, 2005 2:39 PM | Report abuse

Same thing happened to me. I just got the downloads today and had to go to a website to know they came out for another computer.

Posted by: Moses | October 18, 2005 2:39 PM | Report abuse

I got the update last night

Posted by: Terence Hollis | October 18, 2005 2:42 PM | Report abuse

I got the update last night but it seems that some of these updates are affecting my computer in other ways. Seems I get alot more application crashes. I have stopped using Outlook Express cause it would hang my system

Posted by: Terence Hollis | October 18, 2005 2:44 PM | Report abuse

Last Thursday (10/13/05) I decided to check up on updates manually on a computer that's configured to get them automatically, and noticed that the recent patches weren't installed. So updated manually and checked my other machine......which had updated automatically.

The question may be "When do the MS patches actually hit the system?" Since my computer checks in the wee hours of Wednesday morning (Tuesday night), maybe the automated checks don't see the update until the next check the following Tuesday night.

Posted by: Reston | October 18, 2005 2:54 PM | Report abuse

I have been using Micro Soft and Norton Updates for some time. However common sense seem to dictate that should log on these websites every few days anyway to make sure that the software is uptodate. More than once, I have discovered some update, particularly a new or updated module that did not automatically down load to my computer.

Peter Roach

Posted by: Peter Roach | October 18, 2005 2:56 PM | Report abuse

After reading your column on 10/15/05 re: tardy updates, I went directly to Microsoft updates to download them since I had not been auto informed about them.
I encountered your problem of an over three-hour download (dial-up) to get current with updates. I'm assuming that since I was still "signed up" for auto updates/install from "Windows Updates" rather than "Microsoft Updates," I was "out of the loop" on several previously released patches. So not only did I have to install the MIcrosft Updates that became available in October 2005, but had to install others dating back to June 2005.

Posted by: Don | October 18, 2005 2:58 PM | Report abuse

You do know you can choose just to download the updates automatically, but not install them until you say so, right? I recently made that switch when i had a big download aborted by the update process, much to my major disappointment, since i am on dialup and have to do such things overnight.

My last security updates were on 10/17. There are six indicated for that date, and two from two days before.

Everything from Microsoft has always been too slow.

Posted by: terry in florida | October 18, 2005 2:59 PM | Report abuse

The updates were auto-installed on my home computer on 10/13 and I haven't noticed any problems. They didn't show up on my computer at work until today.

Posted by: David in Baltimore | October 18, 2005 3:28 PM | Report abuse

i guess i was a bit luckier. my updates were installed on the 14th. i actually have 8 security updates on that date.

Posted by: lynne | October 18, 2005 3:38 PM | Report abuse

you actually get paid to write this crap?

Posted by: ad | October 18, 2005 3:52 PM | Report abuse

I've opted to get the Microsoft Security Updates Newsletter via email. When I get one telling me that new updates are out I download them manually. (even though I have the auto update enabled.) I, too, found that it sometimes takes too long before the auto update takes effect.

Posted by: Falls Church | October 18, 2005 4:05 PM | Report abuse

I have the auto-update feature turned on (auto download + manual installation), but I find that by reading your column I am aware of updates before the auto-update feature alerts me to them. It is somewhat disconcerting that the auto-update is not triggered more promptly. Also, by using the manual installation feature, I control when the installation occurs, and, more importantly, when the reboot occurs.

Posted by: David Mitchell | October 18, 2005 4:06 PM | Report abuse

I received my updates on 10/12 and have had no operating problems.

Posted by: Eugene | October 18, 2005 4:07 PM | Report abuse

I use it, and I also use Windows Server Update Service/Software Update Service at client sites, and am generally satisfied. Remember, if you are hyperconscious of your security with regard to MS operating systems, you can manually update at your own discretion.

Posted by: Steve Carlson | October 18, 2005 4:08 PM | Report abuse

I turned-off the auto-update feature on three mission-critical computers because of the delayed patch delivery problem. Now I watch www.news.com for stories about pending updates and download patches manually on their release date.

Posted by: Jon Taber | October 18, 2005 4:10 PM | Report abuse

Why are you expecting MS to be neat and tidy when you aren't? Leaving half-done, unsaved documents open on your computer overnight? That's just asking for trouble.

As for the delay, it's pretty simple. MS is trying to work around users' sloppiness and desire not to be bothered by doing things in the middle night days after the mad rush of people who are diligent about their updates, so that their servers are not overwhelmed.

Take charge of your life. Don't let things slide and then whine when they aren't done lickety-split. It's not just rude - it's stupid.

Posted by: Rod in DC | October 18, 2005 4:18 PM | Report abuse

Why do you leave your computer(s) on all the time? Bit of a waste of energy, don't you think? Also, as far as security is concerned, this leaves you open to more attacks, as your computer can't be hacked when it's off.

I agree that the auto-updates are too slow. I am glad to read this column to see when there are updates and I run windows update then, usually before autoupdate gets them.

The autoupdate/windowsUpdate in general also scares me a bit in that IT could be possibly hacked and then someone could install a worm via the update process. But if you don't update, then you are vulnerable too. Maybe it's time to get a Mac or switch to Linux...

Posted by: Michael | October 18, 2005 4:26 PM | Report abuse

Mine updated sometime last week. I had clicked no to restart several times, but alas it decided it knew better than me.

Unfortuneatley, I had a lot of stuff running. A couple of the processes had been churning data for the past 3 days. Kinda sucked having to restart those..

As well, I made the poor decision of using Windows as my host OS for vmware. So, all of my vmware instances running a Un*x, sat and fsck'd for a while. Fortuneately, *BSD and Linux handles this alright and I had no data loss.

Seems like clicking NO would mean NO.

Posted by: Curious George | October 18, 2005 4:27 PM | Report abuse

I know that MS usually applies their monthly updates the second Tuesday of each month, and even with auto update on, I still make it a habit to check windows update manually on a regular basis anyways (at least once a week). It only takes a few moments.

Posted by: TC in DC | October 18, 2005 4:30 PM | Report abuse

How many Windows users in the world -- a couple huundred million? Don't complain about bandwidth problems when they try to push it out to all the folks who can't/won't take responsibility for their own machines. I run all my backups, updates, etc., automatically, at least every other night, at 3AM.

Posted by: At Kosatka | October 18, 2005 4:56 PM | Report abuse

I just use manual update.

Posted by: Sonu27 | October 18, 2005 5:31 PM | Report abuse

Get a pause button on your cable modem to disconnect overnight, or shut down to save energy. Manually update the second Tuesday night of every month.

Posted by: Carl Marx | October 18, 2005 5:48 PM | Report abuse

my puter is downloading updates as i am writing this. the last round of updates seemed to make puter cranky for a few days. at least i don't get the "fatal error" message anymore.

Posted by: doug porter | October 18, 2005 5:50 PM | Report abuse

Seven were installed silently on the 15th with auto update.

Posted by: Tait Milliken | October 18, 2005 6:15 PM | Report abuse

well i havent had an update since aug 10 and when i go to win update it keeps telling me validation failure...called support and guess what,its india and two hours on with him and still no updates....so much for micro soft support.........al

Posted by: al | October 18, 2005 6:53 PM | Report abuse

Brian, I check in with your website twice, sometimes three times a day, so I download the updates on my own as soon as you tell us about it. But, as true as you say, a week later I wake to find my computer has restarted. Confusing and confounding to say the least. I use Thunderbird, so that's always closed.

Annoying as all hell.

Posted by: Trevor | October 18, 2005 6:55 PM | Report abuse

A very good point: I manually updated when I returned from work with Microsoft Update after reading your security blog earlier in the day. One would think that Microsoft would want to have the critical updates installed as soon as they were released.

Posted by: Ron | October 18, 2005 7:30 PM | Report abuse

iGive me a break! Skyrocketing fuel prices, Hurricanes Katrina and Rita rpping the South into shreds, war in Iraq, and you get an automatic update six days after MS releases it? Who died and put you at the front of the queue?

Posted by: Joseph | October 18, 2005 7:32 PM | Report abuse

Auto-update is ON, using a DSL connection. I got seven (7) security patches 17 Oct; the previous ones were five (5) in August. Was September a vacation month in Redmond? hahaha

hjorg
Ever vigilant when awake.

Posted by: Harry | October 18, 2005 7:48 PM | Report abuse

BK, you most likely ran into the throttling mechanism of AU. If you look at the windowsupdate.log file in c:\windows, you will probably see lines that say "Update is not allowed to download due to regulation."

This is telling you that the update site has prevented your machine from downloading that day. If you look closer at the log, you will see something like this:

Odf parameters...
Refresh Interval: 5
Accept rate high: 1000
Accept rate normal: 166
Accept rate low: 0

These values from from a file that is downloaded by the AU client from the update site. Your computer compares an internal number to the three numbers. If the internal number is less than any of the downloaded numbers, the client is allowed to download updates of that priority. The update site will change the numbers as the load on the site changes.

Posted by: Matt | October 18, 2005 9:52 PM | Report abuse

Harry, no security updates were released in the month of September:

http://www.microsoft.com/technet/security/bulletin/summary.mspx#ELAA

Posted by: Matt | October 18, 2005 9:55 PM | Report abuse

素人.きっと素人ライブチャットが一番萌えて,ライブチャット,萌えるライブチャットがアダルト動画,素人すぎるからきっといい, Hav a nice day.

Posted by: 素人 | October 19, 2005 3:18 AM | Report abuse

I two have to echo someone elses comments:

You actually get paid to write this crap?
Gosh, please send me an application.

1207 systems at my office got all the updates just fine by the evening of the 15th after I approved them all on the 13th. So yours was a little slow...for any number of reasons, SO WHAT!

Posted by: kevin | October 19, 2005 3:58 AM | Report abuse

I'm dusgusted with auto updates in general. Not just the fact that MS is slow about it but also the rate of failure on installation.
These 'updates' are nothing more than bug fixes because the product was released before it was thoroughly tested before release. Bill Gates has made the world of Windoze his beta lab since Win 3.0 and the consumer his beta testers...at our expense.
Point abd click is wonderful for the companies that have hundreds of inexperienced users that know no more than to point and click and it saves those companies a bunch of money on training their employees on computer usage. I'm sick of being a lab rat for Microsoft. I'm tired of finding their errors and after complaining waiting till they can come up with a 'work around'.
Gates is worth $50 billion plus cuz he's got the American public to test his product when it's only half finished and then he has the nerve to charge for customer support. He and his cohorts are a scandal looking for a place to rest.

Posted by: Jack | October 19, 2005 4:19 AM | Report abuse

I'm disgusted with auto updates in general. Not just the fact that MS is slow about it but also the rate of failure on installation.
These 'updates' are nothing more than bug fixes because the product was released before it was thoroughly tested before release. Bill Gates has made the world of Windoze his beta lab since Win 3.0 and the consumer his beta testers...at our expense.
Point and click is wonderful for the companies that have hundreds of inexperienced users that know no more than to point and click and it saves those companies a bunch of money on training their employees on computer usage. I'm sick of being a lab rat for Microsoft. I'm tired of finding their errors and after complaining waiting till they can come up with a 'work around'.
Gates is worth $50 billion plus cuz he's got the American public to test his product when it's only half finished and then he has the nerve to charge for customer support. He and his cohorts are a scandal looking for a place to count their money and wait for their 'beta testers' to report to Windoze central.

Posted by: Jack | October 19, 2005 4:21 AM | Report abuse

Hello,
I find that the auto update feature is not sufficient for my uses. to me, i find its drawbacks are:
1. too slow to acquire the updates from when they are release - like you said in your article the auto updates download the fixes quite a while after they are released
2. quite a few of the patches require the pc to restart, which doesnt seem to happen too much in Linux, in fact i havent ever had to restart my Linux box after updating and ive been running it for 6 months now.
3. the restart feature is annoying due to it sometimes automatically restarting the system. i may have open documents but it will go ahead and restart anyway without saving my data first (luckily i save it manually myself)
4. there is no feature to download and install straight away, there is a feature to set a specific time to download and install... but what if the pc is not started at that time, maybe it is started after that time - does that mean you have to wait a whole day or longer until its connected at that specific time to acquire the downloads?

Posted by: Steve | October 19, 2005 9:33 AM | Report abuse

Your the security guru at the Post? Come on, you should be able to figure this out. First, what are your Auto Update settings? If they are once a week, then you may not get them on the exact day they are released. Second, if everybody tried to update at the same time, it is likely that many (most?) would not be successful in downloading the updates because the servers would be overloaded.

By waiting a few days, you missed getting the patch that had problems. It probably is better advice to most of your readers to wait a few days rather than rush to get patches on the first day of their release.

Posted by: Alex | October 19, 2005 9:57 AM | Report abuse

And yes, I typed your instead of you are. I might as well get ahead of the grammer checkers out there.

Posted by: Anonymous | October 19, 2005 10:00 AM | Report abuse

Wow. Seriously? This is nothing new. Microsoft has been throttling the Auto Update process for a long time so that the servers don't crash from the huge amount of traffic that would result from 200 million users all downloading at the same time.

Do a little research before you post this kind of stuff.

Oh, and for all the people who complain about the restarts - CHANGE YOUR SETTINGS! You can set it up so that the patches are downloaded, but only installed when you give the OK.

AND, most businesses don't turn on Automatic Updates that come directly from Windows Update, but instead have a product from Microsoft called Software Update Services which allows IT to manage the roll out of patches to users, so that problems like losing data in the middle of the night don't happen.

Research much?

Posted by: KU | October 19, 2005 10:21 AM | Report abuse

Actually I use your announcements of these updates, and those in the NYTimes, to hit MS for the fixes EVEN THOUGH I HAVE ALL OF MY COMPUTERS SET FOR INSTANT UPDATES. The caps were necessary for the carp. Thank you for these.

Posted by: Jock Baird | October 19, 2005 10:21 AM | Report abuse

I find it interesting that so many readers were upset at me for even bringing this up. Microsoft ostensibly set up automatic updates to greatly simplify the process for users who are less adept or inclined to download and install updates on their own.

Yet none of the posters who were so vociferously opposed to my entry addressed the issue of the position that this leaves these users in when a worm breaks out a few days after the patches are "released."

Of course I am aware of throttling, I have written about it in the past. The reason I brought this up is because this was a first for me -- I have never had to wait more than 3 days max to get patches pushed to me from Microsoft. And of course I can -- and do -- get patches manually. I have several PCs, but not all are set to auto-update.

Posted by: Bk | October 19, 2005 11:03 AM | Report abuse

Glad that I read your column. Checked and I still hadn't gotten the automatic updates. What a Joke!!!

Posted by: Webjockey | October 19, 2005 11:12 AM | Report abuse


Since my home computer is not always on, I have AU set to just notify me when updates are available, which it did on 10/11. I prefer to download and install them manually.

Posted by: Richard | October 19, 2005 11:21 AM | Report abuse

"1. too slow to acquire the updates from when they are release - like you said in your article the auto updates download the fixes quite a while after they are released"

Not necessarily.

"2. quite a few of the patches require the pc to restart, which doesnt seem to happen too much in Linux, in fact i havent ever had to restart my Linux box after updating and ive been running it for 6 months now."

Guess you haven't patched your kernel in six months. There have been several patches released in that time.

"3. the restart feature is annoying due to it sometimes automatically restarting the system. i may have open documents but it will go ahead and restart anyway without saving my data first (luckily i save it manually myself)"

Uh, this is why you can configure a time when the updates are installed. The restart prompt is intentionally annoying. When you install a patch but don't reboot, you aren't protected.

"there is no feature to download and install straight away, there is a feature to set a specific time to download and install... but what if the pc is not started at that time, maybe it is started after that time - does that mean you have to wait a whole day or longer until its connected at that specific time to acquire the downloads?"

Again, the time of the install is configurable. By default it is 3am. This does not mean the patches are downloaded at 3am and then installed. Usually they are installed sometime before that, during the day. Then they wait until whatever time you configure to actually install.

Posted by: Matt | October 19, 2005 12:09 PM | Report abuse

"These 'updates' are nothing more than bug fixes because the product was released before it was thoroughly tested before release. Bill Gates has made the world of Windoze his beta lab since Win 3.0 and the consumer his beta testers...at our expense."

Hi...please show me commercial software that has never had a patch.

Have you ever developed software? Have you ever developed software that hundreds of millions of people use everyday, in different languages and with countless combinations of hardware and software?

I'm going make a wild guess the answer is no.

Posted by: Matt | October 19, 2005 12:14 PM | Report abuse

I seemed that Macintosh System 9.0 and OS X 10 are more powerful and very fine program and internet better than MS and Windows XP. Most time other who always attack on MS as more virse and a lot of problem. It is true.

Posted by: Bernard Prusak I | October 19, 2005 12:21 PM | Report abuse

I noticed the little shield icon in my tray indicating updates were downloading the day the updates were released. Apparently they didn't all download that day (I turn my PC off when I'm not using it), since I didn't get the notification baloon that they were ready to install until three days later. Still, given previous experience, not too bad.

Posted by: Rob | October 19, 2005 12:34 PM | Report abuse

Brian,
As soon as I see an announcement about a fix from Microsoft, I download it about 12 hours after Redmond puts it online. I don't wait for auto-update because I'm running Windows 2K Pro. and I know it's already more vulnerable that Windows XP-SP2. I just bought XP Pro from Buy.com (because MS charges NJ tax and Buy.com doesn't (yet). My son is going to help me install it Thanksgiving weekend. I will still not wait for auto-update. The hackers are just too fast today to wait applying patches. MS should invest in more and faster servers and get the auto-updates out a lot faster than many days later!

Posted by: dbm1rxb | October 19, 2005 2:12 PM | Report abuse

Macintosh.

Posted by: Scout | October 19, 2005 2:58 PM | Report abuse

Are you "mountain-out-of-molehilling" once again? If you were the _only_ user entitled to updates, I might understand youre pique. However there are evidently quite a few users out there vying for this (free) service, so perhaps a little patience on your part is in order.

Posted by: Armond | October 19, 2005 3:24 PM | Report abuse

I believe my updates loaded on 10/13. That's the same day Firefox stopped working. Now, XP updated on my laptop Monday and Firefox continued working. Anybody know about the XP updates affecting Firefox?

Posted by: JT | October 19, 2005 3:34 PM | Report abuse

Don't blame Bill Gates for releasing products before they are ready , he is just following a fine American tradition started by the automobile industry.

Posted by: John. | October 19, 2005 3:47 PM | Report abuse

I am not receiving any updates at all, I have the function on and I go to the qweb site4 to manualy update and the site times out w2ith a error message I have tried to use the help section but that doesn't correct the problem. Wish I knew how to contact them personally and get this problem solved.

Posted by: Pat | October 19, 2005 4:00 PM | Report abuse

Auto Updates scare me:

As a security minded individual, the concept of allowing my computer to download updates to my system without first allowing me to approve or check the contents of them seems insecure. For instance, I might not /want/ to install an update, especially for events similar to the fatal error updates reported. Moreover, This allows Microsoft complete control over my system, allowing them to update anything 'system' oriented.

Update manually. Read the documentation. Know what is being updated.
Use your own firewall. Know what websites you download from. Don't read email from unknown senders.
These are ways to make yourself more secure. Updating automatically is a sure way to garauntee that some day, slow or not, Microsoft, or some other company, will update your software in a way you don't want. It may be DRM. It may be that Microsoft installs a government spyware program to search for 'terrorists'. It may be any number of paranoid things that haven't happened yet. But it will be something you never expected, and should have had control to deny.

I don't use Automatic Update.

Posted by: Raziel | October 19, 2005 4:26 PM | Report abuse

I have 7 separate entries installed on 10/17/2005, which is pretty bad given the release date, but it also raises the further question of why we must wait until the magic Tuesday to release each batch of patches. Is there some techical obstacle or prohibative cost factor to putting each separate patch up as soon as it is ready?

Posted by: Dave H | October 20, 2005 10:48 AM | Report abuse

Are you running a GENUINE copy of WINDOWS?
Timely updates are only available to GENUINE WINDOWS licencees. Failure to comply with anti-piracy regulations will result in a fine of $20000 or 2 years imprisonment. Piracy is a felony. Together we can stamp it out!

Posted by: Bill Gates | October 20, 2005 2:54 PM | Report abuse

I use auto update on a computer that is always om. My updates are timestamped 10/20/05.

Posted by: Mike Russin | October 20, 2005 3:37 PM | Report abuse

gidday, i just downloaded 9 MS updates,
total of 10.7mb it took 14 3/4 hours on dsl and the whole time the computer is un-useable because the page wont minimise. MS SUX

Posted by: kevNZ | October 24, 2005 7:02 AM | Report abuse

gidday, i just downloaded 9 MS updates,
total of 10.7mb it took 14 3/4 hours on dsl and the whole time the computer is un-useable because the page wont minimise. MS SUX

Posted by: kevNZ | October 24, 2005 7:04 AM | Report abuse

gidday, i just downloaded 9 MS updates,
total of 10.7mb it took 14 3/4 hours on dsl and the whole time the computer is un-useable because the page wont minimise. MS SUX

Posted by: kevNZ | October 24, 2005 7:06 AM | Report abuse

I use auto update at home (XP)and backup with e-mail updates from microsoft weekly. I have as many problems with antivirus as with updates (very few).

Posted by: opit | October 25, 2005 12:20 AM | Report abuse

What is wrong with manual updates? Check on the second Tuesday of every month for sure, but for the super paranoid check every week. But I have NEVER seen Microsoft release patches except on the second Tuesday of every month - ergo, check and apply at that time.

Are you still paranoid about the worms? For broadband customers, install a hardware firewall. My longest lived Trojan that NONE of the AV companies accepted despite the fact I reported it to them was over six months. Other Trojans will go for a long time with several AV vendors protecting against it, and others not. Worried yet? Dump MS Windows and install Linux, FreeBSD / OpenBSD, or install SOME form of 'nix or buy a Macintosh. The worm / virus / trojan problem will be gone. Can't do anything about the update problem, but by and large most of your updates can safely be put off unless you are running some sort of mail service (actually, I have never heard of Postfix being hacked, sendmail yes, postfix no) or a web server and you will be amazed at the tranquil and blissful existence you have from that time forward.

Posted by: Henry Hertz Hobbit | October 28, 2005 7:42 PM | Report abuse

You're blaming them for being slow, but would you rather your computer not work? After all if they did update it quickly then you might have had a goldbrick update.

Posted by: Joe | October 31, 2005 10:40 AM | Report abuse

i always get viruses and blockers dont stop them why

Posted by: british male | November 10, 2005 9:13 AM | Report abuse

The comments to this entry are closed.

 
 
RSS Feed
Subscribe to The Post

© 2010 The Washington Post Company