Microsoft Windows Security Resource Kit

Windows Update

Microsoft Windows Update is a Web-based application that enables you to determine whether new updates are required for your computer. You can use Windows Update by connecting to the Windows Update Web site at http://windowsupdate.microsoft.com.

Windows Update can determine necessary security updates and service packs for the following Windows operating systems:

• Microsoft Windows 98

• Microsoft Windows 98 Second Edition

• Microsoft Windows 2000 Professional

• Microsoft Windows 2000 Server

• Microsoft Windows 2000 Advanced Server

• Microsoft Windows Me

• Microsoft Windows XP

• Microsoft Windows Server 2003 family

To use the Windows Update site, the following requirements must be met:

• Microsoft Internet Explorer must enable cookies.

  The Windows Update site uses cookies to track and record security patch installation data. Windows Update identifies your computer by generating a globally unique identifier (GUID), which is stored in a cookie. The cookie contains the following information to identify your computer:

  • The OS version for determining security patches related to your OS and service pack level

  • The Internet Explorer version for determining Internet Explorer version-specific updates

  • The version number for other software that can be updated by Windows Update, including Windows Media Player and Microsoft SQL Server

  • The Plug and Play identification numbers of hardware devices to identify required hardware device driver updates

  • The region and language settings to determine whether a localized version of a security patch must be installed

• Internet Explorer must allow Microsoft ActiveX controls.

  The Windows Update site downloads an ActiveX control to determine which security patches are required by your computer. To enable the download of the ActiveX control, the security settings for the Internet zone in Internet Explorer must be set to Medium or lower.

• The person running the ActiveX control must be a member of the local Administrators group.

  Only members of the local Administrators group have the necessary permissions to scan the file system and registry to determine whether a security update is installed. In addition, only members of the local Administrators group have the necessary permissions to install security updates.

To use Windows Update to scan for required security updates and other patches for your OS and applications, following these steps:

1. Ensure that you are logged on as a local administrator. As we mentioned, only members of the local Administrators group have permissions to download and install updates from the Windows Update site.

2. Open Microsoft Internet Explorer and connect to http://windowsupdate. microsoft.com. You must use Internet Explorer because the Windows Update site uses an ActiveX control to determine which updates your computer requires. If prompted, click Yes to download the latest version of the Windows Update ActiveX control.

3. In the Welcome To Windows Update page, click Scan For Updates. Based on your OS and current updates, the Windows Update site will determine which updates are required.

4. In the Pick Updates To Install page, click Review And Install Updates. This option will allow you to pick exactly which updates to apply during this connection to the Windows Update site.

5. In the Total Selected Updates page, critical updates are automatically populated in the selected updates list. Some updates might require separate installation, so be sure to scan the list of proposed updates. You can remove individual updates by clicking the Remove button. You can add Windows 2000 or driver updates to the list by clicking Windows 2000 or Driver Updates in the left-hand pane and clicking the Add button for individual updates in the details pane (as shown in Figure 23-1).

6. Once you have selected all updates to apply to your computer, click Review And Install Updates.

7. In the Total Selected Updates page, click Install Now.

8. In the Microsoft Windows Update Web Page Dialog box, read the Windows Update license agreement and click Accept to accept it. The selected updates are installed from the Windows Update site. Once the download is complete, the installation proceeds.

9. When all updates are installed, a listing will appear indicating which updates were successfully installed and which, if any, were not. Once you review the list, you typically must restart the computer by clicking OK in the Microsoft Internet Explorer dialog box.

   Figure 23-1. Choosing which critical updates, Windows 2000 updates, or driver updates are applied to a computer