Security Only Updates vs Security Monthly Quality Rollup Updates!

[Paul Black]

Good morning,

On a clean install (other than: KB3020369, KB3125574, KB3172605 and KB3179573), is it best to install ALL the Security Only Updates from October 2016 to February 2018 or just the last Security Monthly Quality Rollup Update?

Ideally, I really only want the critical and security updates and nothing else. I can run Windows update after the clean install and then install the ones that I want to.

I am going to be creating a new install.wim file because this will drastically reduce the number of Windows updates (and the many hours downloading, installing and restarts needed) available when I run Windows updates and just really need to know which scenario is best.

I say this with regard to telemetry and spying updates making their way into the clean install.

There have been many many posts with regard to this but none seem to give a definitive answer!

Thanks in advance.

 

[iko22]

Hi Paul, As far as I am aware, the windows update went through 4 phases: SP1, Convenience rollup update, telemetry updates, and the new rollup scheme (after August 2017). The new rollup scheme meant that a single monthly update would include the months updates rolled into one. The new rollups have a cumulative effect, so one months update cumulatively includes the previous months update.

 

[Brds7t7]

Hi Paul, if you're going from a clean install and want all the Security-only updates and no rollups included, then I would use WSUSOffline to create the ISO before you attempt it all.

Believe me, it's just a big PITA with clean installs now. WSUSOffline makes the whole process much easier. You can select Security-only updates instead of rollups when using the update downloader.

WSUS Offline Update - Update Microsoft Windows and Office without an Internet connection

And if you're going down the Security-only update route, then yes you have to install each months, or you'll have some parts of Windows unpatched.

 

[Paul Black]

Thanks iko22 and Brds7t7 for the replies, it is appreciated.

On a clean install (other than: KB3020369, KB3125574, KB3172605 and KB3179573), is it best to install ALL the Security Only Updates from October 2016 to February 2018 or just the last Security Monthly Quality Rollup Update?

I am really just curious about what people think from their own experience is the best and most stable way to go about creating a new install.wim file for a clean install.

As I said previously, whichever way I choose to go, whether it is the Security-Only option or the Cumulative option the updates KB3020369, KB3125574, KB3172605 & KB3179573 MUST be installed first obviously.

If I was to go down the Cumulative route then I would only have to install the 4 updates above + KB4088875 - Security Monthly Quality Rollup Update (March 2018).

If I was to go down the Security-Only route then I would have to install the 4 updates above + 17 Security-Only updates from KB3192391 - October 2016 > KB4088878 - March 2018.

I do realise that the Cumulative update includes ALL previous updates so is the easier of the two options but does it still include some telemetry? I say this because I did read somewhere that Microsoft have now stopped pushing out the telemetry updates!

Anyway, I was just curious about other peoples opinions and experience and what they had found was the best of the two options, if any!

Thanks in advance.

 

[Brds7t7]

Hi Paul, be warned that the cumulative updates don't include all past updates. MS is slowly rolling the past updates into the Cumulatives, but they're not fully there yet. So either way you go, you'll still have to install more updates from Windows Update.

I can't help you with the install.wim option unfortunately, as I found it less hassle just to install Windows from the disc/USB stick then use WSUSOffline to get me up to date security wise and skip all the rollups easily. This is why it isn't as straightforward as you think since MS changed its servicing model.

Another tool to use which will tell you which Security-only updates are missing is the Microsoft Baseline Security Analyser. After install you can run it and set it to 'Scan the offline catalog only'. This will scan for Security-only updates missing.

Ignore any references to Monthly rollups though.

Download Microsoft Baseline Security Analyzer 2.3 (for IT Professionals) from Official Microsoft Download Center

 

[Paul Black]

Thanks for the reply and link Brds7t7,

...be warned that the cumulative updates don't include all past updates. MS is slowly rolling the past updates into the Cumulatives, but they're not fully there yet. So either way you go, you'll still have to install more updates from Windows Update...

Yes, I appreciate that. The idea is to stop the many many hours needed to download and install them and the numerous restarts that are needed. Hence why I have gone down the route of pre-integrating them and creating a new install.wim file for the initial clean install.

...then use WSUSOffline to get me up to date security wise and skip all the rollups easily.

I will out of interest look at this process over the weekend.
I assume that it is a package that contains ALL the updates that can then be run against the clean install to find those updates that are missing?

Another tool to use which will tell you which Security-only updates are missing is the Microsoft Baseline Security Analyser. After install you can run it and set it to 'Scan the offline catalog only'. This will scan for Security-only updates missing. Ignore any references to Monthly rollups though.

This also sounds interesting, and again, I will look at this process over the weekend.

Thanks in advance.

EDIT:

I am also going to have a go at integrating I.E.11 (I know that this needs at least 4 Prerequisites) into the install.wim file as well to make it a bit more complete. I might also then be able to integrate the KB4089187 - Cumulative Security Update I.E.11 - March 2018.

I know that Microsoft .NET Framework 4.7.1 can't be integrated but this can be done from the downloaded .msu file after the clean install to also reduce the time (as opposed to letting it update through Windows update).

 

[Brds7t7]

WSUSOffline includes all updates either Security-only updates or the rollups whichever you choose when running the downloader. There's a checkbox at the bottom which says "Download Security-only updates instead of Quality Rollups". You can also set it to install all the .NET Framework updates and IE11 plus its updates. Believe me, it's a very handy piece of software to have in the toolkit!

I sound like I work for the team at WSUSOffline, but I'm not affiliated with them in any way.

Give it a try at the weekend, then let me know how you get on.

The install.wim option is probably the quicker option for install, but I got fed up of trying to integrate updates all the time. Must be my age!

 

[Paul Black]

Thanks Brds7t7,

The install.wim option is probably the quicker option for install, but I got fed up of trying to integrate updates all the time.

I can create a new install.wim with the 4 updates + Cumulative update in about 20 minutes.
I can create a new install.wim with the 4 updates + ALL 17 Security-Only updates in just over an hour.
Both Batch driven.

Thanks in advance.

 

[Brds7t7]

I can create a new install.wim with the 4 updates + ALL 17 Security-Only updates in just over an hour.
Both Batch driven.

Thanks in advance.

Don't forget that you have to install all the standalone security updates that came before the 2016 Security-only updates too.

If you can do all that you're a much more patient man than I am! It started driving me nuts keeping up with all the different updates both pre and post August 2016.

 

[Paul Black]

Hi Brds7t7y,

Don't forget that you have to install all the standalone security updates that came before the 2016 Security-only updates too.

Yes, these were the 4 I was talking about that MUST be installed first (regardless of which of the 2 options are used):

KB3020369 - Servicing Stack Update - April 2015.
KB3125574 - Convenience Rollup Package - May 2016.
KB3172605 - Functional Update Rollup (THIS ONE IS IMPORTANT) - July 2016.
KB3179573 - Functional Update Rollup - August 2016.

If you can do all that you're a much more patient man than I am!

Batch driven so it just does it!

Thanks in advance.

 

[Brds7t7]

Ah yes sorry, I missed the convenience update as I've never used it. It included some of the unwanted updates so I always avoided it, but it does save time. I prefer to pick and choose the updates I want though - I'm picky.

 

[Paul Black]

Hi Brds7t7y,

Ah yes sorry, I missed the convenience update as I've never used it. It included some of the unwanted updates so I always avoided it, but it does save time. I prefer to pick and choose the updates I want though.

Don't forget that you have to install all the standalone security updates that came before the 2016 Security-only updates too.

Out of interest then please, what updates do you use instead?

Thanks in advance.

 

[Brds7t7]

All standalone Security updates (Pre 2016 servicing model change).

All Security-only updates (Post 2016 servicing change).

Most recommended updates, skipping the CEIP telemetry updates or the KB2952664 compatTel update (caused ridiculous amounts of Disk thrashing & slowdowns and hasn't been near my system since).

Some optional updates and security updates for Remote Desktop.

 

[Paul Black]

All standalone Security updates (Pre 2016 servicing model change).

I don't suppose you have a list do you? No worries if not.

All Security-only updates (Post 2016 servicing change).

I have these, there are 17 as of this month!

Most recommended updates, skipping the CEIP telemetry updates or the KB2952664 compatTel update (caused ridiculous amounts of Disk thrashing & slowdowns and hasn't been near my system since).
Some optional updates and security updates for Remote Desktop.

I will probably get these updates on a Windows update run after the clean install, so I will be able to pick and choose what I want there and then.

Thanks in advance.

 

[Brds7t7]

I did have a huge list at one point although I'm not sure I still have it. I ditched a lot of stuff relating to the updates after I stated using WSUS. I'll have a search around and post it for you if I find it later.

You can't skip some of the telemetry updates if you install the convenience update though, some are integrated into it. I know the CEIP ones are (KB3080149 for example).

Although I've never believed the hype that these are "spying" updates, I just don't think they're necessary either.

Not sure if you already have it Paul, but here is the list of updates included in the Convenience update.

https://www.askvg.com/install-all-post-sp1-updates-offline-in-windows-7-using-convenience-rollup-package/

 

[MeOnMine]

Hi, this is a bit of a dogs breakfast however it contains all the KB's we all tried to avoid.


Telemetry etc
-------------------
KB971033 - Windows 7 Activation Update
KB2952664 - Compatibility update for Windows 7 (SP1)
KB2977759 - Compatibility update for Windows 7 (RTM Only)
KB3021917 - Update to Windows 7 SP1 for performance improvements
KB3035583 - "Get Windows 10" App (System Tray Nagware/Telemetry)
KB3075249 - Update that adds telemetry points to UAC in Windows 7
KB3080149 - Update for customer experience and diagnostic telemetry
KB3022345 - Update for customer experience and diagnostic telemetry
KB3068707 - Update for customer experience and diagnostic telemetry
KB3068708 - Update for customer experience diagnostic telemetry (replaces KB3022345)
KB3123862 - Updated capabilities to upgrade Windows 8.1 and Windows 7
KB2990214 - Update that enables you to upgrade from Win7 to Win10
KB2999226 - Update for Universal C Runtime in Windows
KB3150513 - May 2016 Compatibility Update for Windows
KB3173040 - Windows 8.1 and Windows 7 SP1 end of free upgrade offer notification


Windows Update Client
---------------------------------


KB3050265 - ***Windows Update Client for Windows 7: June 2015
KB3065987 - ***Windows Update Client for Windows 7: July 2015
KB3075851 - ***Windows Update Client for Windows 7: August 2015
KB3083324 - ***Windows Update Client for Windows 7: September 2015
KB3083710 - ***Windows Update Client for Windows 7: October 2015
KB3102810 - ***Windows Update Client for Windows 7: November 2015 - High CPU/Long Scan Fix
KB3112343 - ***Windows Update Client for Windows 7: December 2015
KB3135445 - ***Windows Update Client for Windows 7: February 2016
KB3138612 - ***Windows Update Client for Windows 7: March 2016
KB3161647 - ***Windows Update Client for Windows 7: June 2016 is also imbedded in June 2016 Update Rollup for Windows 7 SP1 KB3161608


Internet Explorer Security
------------------------------------

KB3139929 - Security update for Internet Explorer: March 8, 2016, This contains KB3146449.
KB3146449 - lets users learn about Windows 10 or start an upgrade to Windows 10.


Other Optionals
----------------------

KB3038314 IE, Bing default search provider.
KB3046480 Migrate the Microsoft .NET Framework 1.1 to a later version of Windows.
KB2592687 Remote Desktop Protocol
KB2923545 Remote Desktop Protocol.
KB2994023 Remote desktop session constantly disconnects and reconnects.
KB2726535 Adds South Sudan to the list of countries.
KB2660075 Time and date if the time zone is set to Samoa.
KB2999226 Windows 10 Universal CRT
KB3095649 Fixes a crash in Win32k.sys in Windows 7 SP1
KB3077715 August 2015 cumulative time zone update
KB3112148 December 2015, cumulative time zone update
KB 3118401 Update for Universal C Runtime in Windows
KB2876229 SKYPE.
KB2970228 Russian ruble symbol.
KB2977728 Improves the performance of the following graphics and imaging components.
KB2978092 Graphics software or applications crash.
KB3102429 Azerbaijani Manat and Georgian Lari currency symbols
KB3097877 This caused Gadgets to stop running.
KB3148851 Time zone changes for Russia in Windows.
KB3133977 BitLocker can't encrypt crashes in svchost.exe issues with Asus mb and UEFI.
KB2506928 A link in an .html file that you open in Outlook does not work in Windows 7 or in Windows Server 2008 R2


-----------------------------------------


KB3156417 May 2016 update rollup for Windows 7 SP1 [contains Telemetry]

-----------------------------------------


KB3102810 Updates is slow and high CPU usage occurs
KB3020369 April 2015 servicing stack update for Windows 7

 

[Owdrtn]

Quote: Originally Posted by Brds7t7
All standalone Security updates (Pre 2016 servicing model change).

Quote: Originally Posted by Paul Black
I don't suppose you have a list do you? No worries if not.​

Did he ?
Please let me know if you managed to sort out a list for those by now.
With some luck, maybe most of the windows ones can be obtained with the "Enterprise Rollup Update" (KB2775511), released back in March 2013, which contains ~1500 KB (comprising of “Security Updates” and “Hotfixes”) up to April 2016.
.. I wonder if some of those included hotfixes are to be blacklisted tho..

Quote: Originally Posted by Brds7t7
All Security-only updates (Post 2016 servicing change).

Quote: Originally Posted by Paul Black
I have these, there are 17 as of this month!​

yep. 27 by now. but for Windows only. (aren't you installing those for core components and dependencies as well ?) ie. for .NET Frameworks, it started back in October 2016 with KB3188730.Counting a total of 35 by now..
This turns the Security-Only (new model ones) updates to 62 , just for Windows and NetFX.. (speaking W7x64SP1 as always)

.. and again, this is apart from all the standalone security updates released between SP1 and Aug2016 (yea, those mentionned earlier by Brds7t7)