How is criticality of Windows updates determined?

horstj · 23 Jan 2014

Does anyone know how MS determines the status of an update? I have a patch deployment appliance which uses Lumension to analyze patches, but there is a disconnect between what they see and what MS sees. Windows updates has patches such as KB2533552 or KB2868116 that show up as Important updates, but Lumension says they are just recommended. I assume that it is because there are no bulletins posted for those patches (search for them here Microsoft Security Bulletins ? Updates & News), but I don't know if that is true. Does anyone know about this?

NoelDP · 24 Jan 2014

Note that there is a difference between Security ratings and non-security ratings.

Note the following articles apply to the two patches above..
Updates are available that improve the content in warning messages that you receive when you run local executable files in Windows
An update that prevents a "0xC0000034" error message when you try to install Windows 7 SP1, Windows Server 2008 R2 SP1, or Windows Embedded Standard 7 SP1 is available

Neither are Security patches

I suspect that Lumension may be applying their own system, and perhaps downgrading based on their own evaluation.
The KB2533552 patch is one which really only applies to RTM - any machine produced since SP1 released would have had that installed already. It's really only application in limited circumstances, but MS pushed it out to everyone to reduce further support problems.
The KB286116 is really only a cosmetic thing - but it can make troubleshooting a lot easier.

horstj · 24 Jan 2014

Thank you for the update. That actually makes sense and I think I will just use the Lumension tool and accept that some semi-important updates (as defined by MS) will not get installed.

NoelDP · 24 Jan 2014

My own preference would be to install everything except possibly 'optional' updates - it's served me well over the past 12 years :)
The only things I check out before installing are Drivers - often WU driver updates are older than ones available at the manufacturer's website, and sometimes the offering still appears despite having newer drivers installed (mostly because the newer drivers aren't 'approved').