By Dennis O’Reilly

The response to Scott Spanbauer’s June 25 Top Story on forced updates makes it clear that a bug in Microsoft’s Automatic Updates service is causing serious problems for Windows users.

Many readers have reported seeing updates being installed at shutdown or reboot time without any notification, much less an opportunity to select which updates will or will not be applied.



Several dozen WS subscribers have confirmed the Automatic Updates (AU) behavior that Scott described. In today’s Top Story, many of his sources report that their shutdown options gave no indication that updates were about to be installed. Also, some WS readers who had configured Automatic Updates to “download only” or “notify only” indicate that AU mysteriously changed to “install updates automatically” against their wishes.

While we await Microsoft’s explanation for this aberrant AU behavior, many tech news sources have picked up Scott’s original story and corroborated the forced updates. The day the story appeared in Windows Secrets, news aggregator Techmeme featured it, in addition to coverage in ITWorld, PCMag.com’s Security Watch, and ZDNet’s Hardware 2.0 blog, among others.

ZDNet writer Adrian Kingsley-Hughes was one observer who’d previously encountered the problem, although he didn’t feel at the time that he had enough evidence to go public:

• “So far, I’ve not been able to replicate this issue. However, I have been receiving reports of these stealth updates for a while now.”
  

For the many readers we heard from who’ve had first-hand experience with this bug, the last thing they want to do is replicate the behavior.

Storm brewing over unexpected update behavior

The most-common example of the AU bug — patches being installed without warning at Windows shutdown — can cause serious problems, as Tom King found out earlier this month:

• “On the evening of June 10, the Dallas/Fort Worth area was hammered by severe storms, with high winds and intense lightning that knocked out power to over 500,000 homes in the area. Unfortunately, our home was among those to lose power, where I have a Windows XP PC and a Mac mini computer in a home office….
  
  “The computers were now running on a limited-time battery backup unit, which normally allows adequate time for normal shutdown of the Mac and Windows PC computers. I proceeded to shut down the Mac and the XP PC, where I had been watching the weather radar and news reports. On the Mac, I selected a forced shutdown, and within seconds the Mac was ready to be unplugged. But the Windows PC turned out to be a much different experience!
  
  “I next moved on to the PC and selected the Turn Off Computer option on the menu bar. Much to my horror, the Turn Off Computer window showed the Install Updates icon over the red Turn off button. I thought, ‘How could this be happening?’ since I had previously set Automatic Updates to download updates for me but let me choose when to install them.
  
  “With the power to the house out and the computer running on a battery backup, it’s not the time for Windows to spend the next several minutes casually installing updates without asking! After nervously waiting about a minute — and with no end in sight for the uninvited Windows update — I reached around to the PC’s power switch, turned it off (update still in progress), and unplugged the machine….
  
  “Microsoft won no points with me the night the severe storms rolled in, and they chose to usurp my control of my computer at the worst possible time! I feel fortunate that the Registry didn’t crash….
  
  “Perhaps it’s well past time Redmond respects who owns the computers they commandeer and who is in the best position to know when updates can safely be applied!”
  

Even in calm weather, the consequences of unanticipated updates can wreak havoc with a single PC or an entire network, as Conrad Knabenschuh found out one recent morning:

• “My customers run the D3 database by Tiger Logic. It runs as a system service, with access to it via ODBC or Telnet.
  
  “I have been forced to set all of their machines to ‘Download updates but let me choose when to install them’ because Windows does not do a clean shutdown if a reboot is required when updates are automatically installed. On a normal shutdown, the database will wrap up its processes and ports and shut down cleanly; then Windows shuts down….
  
  “Probably half a dozen times a year (I support about 60 servers coast-to-coast in both the U.S. and Canada), a customer will have a problem on Wednesday morning where the machine has installed updates and then automatically rebooted. When I check the settings, yup, that machine now reads ‘Install updates automatically.’
  
  “I can guarantee that none of my customers has the technical skill or know-how to reset the setting, and neither I nor my staff ever would. It was not forgotten at machine install, for the simple reason that we always do it; more importantly, it may be a machine that is several years old. I have had a couple of instances where the same machine has reset itself two or three times over the course of a couple of years.
  
  “I have been totally unable to find a pattern. In general, I patch all machines regularly. It doesn’t seem to matter whether it’s XP or 2003 — the database runs under either, and if the network has fewer than 10 users, XP is more than adequate. The only guess I’ve had in a couple of cases is that the updates hadn’t been done for several months, but that doesn’t hold true for every instance, either.”
  

Mysteries abound in relation to this AU bug, which clearly dates back much farther than Microsoft’s extra-heavy June 9 patch extravaganza.

More evidence of behind-the-scenes AU changes

The people who have the most experience with unexpected AU behavior are those who fix PCs for a living. Ed West of Ed’s ComputerWorks is one such person:

• “I run a computer shop in Oregon, and I choose the option ‘Notify me but don’t automatically download or install them’ for my personal and shop computers and most clients. I’ve seen Microsoft updates being installed at shutdown on several computers the last two weeks. I’ve double-checked those computers to make sure the appropriate option had been chosen for updates, and indeed it had been set to my standard mentioned above. Ticks me off royally.”
  

At least Ed’s PCs retained their AU settings. Such is not the case for Tom Amann:

• “After reading your article about forced updates, I checked my settings, because I noticed an auto-install the other day at shutdown. I always keep the setting at ‘download but don’t install.’ When I checked just now, it was set to ‘download and install automatically.’ I use XP. Can a malware program change the setting and mimic a true MS update? I changed the setting back to my preference.”
  

Scott reports in today’s Top Story that some well-known security programs silently reconfigure AU to “automatically install.” It’s also possible that a malware infection caused the change to Tom’s AU settings. Some malware programs turn on AU as a defense against other intruders, whose routines often try to kill off any competing infections.

Melodie Larsen used information she’d read in previous WS newsletters to sleuth the source of her recent hardware woes:

• “I also had a problem with a ‘stealth update’ from Microsoft. I had my update settings to notify me of updates but to let me decide what and when to download. On June 17, my computer suddenly wasn’t able to see my Maxtor One Touch backup drive, either in Windows Explorer, Device Manager, Drive Management Console, or Maxtor Manager. A request for help from Seagate/Maxtor merely suggested that I try the drive on another computer.
  
  “I suspected some kind of update interference, checked in Add/Remove Programs, and found that a number of updates had occurred during the night without my knowledge. First, I tried uninstalling, rebooting, and then reinstalling the Maxtor installation programs, to no avail.
  
  “I studied each of the updates listed in Add/Remove Programs on the Internet, then removed update 970238, which is supposed to fix a vulnerability in Remote Procedure Call. After removing that particular Windows patch, I followed the steps that I had received previously from Maxtor to fix a similar problem with the drive not being recognized by Windows…. Now my drive is again visible within Windows, Device Manager, Disk Management Utility, and Maxtor Manager….
  
  “If I hadn’t been reading Windows Secrets and following Susan Bradley’s columns — in which she suggested rolling back an update to see whether it was the cause of problems — I would probably still be playing message tag with Seagate/Maxtor support.”
  

We’ve known for some time that forced updates can seriously disable Windows’ functionality. For example, WS contributing editor Susan Bradley reported in her July 10, 2008, column (paid content) that Microsoft patch MS08-037 completely disabled the Internet connection of machines using the ZoneAlarm firewall.

Here’s hoping Microsoft permanently corrects AU’s forced-install bug soon.

Readers Tom, Conrad, Ed, Tom, and Melodie will each receive a gift certificate for a book, CD, or DVD of their choice for sending tips we printed. Send us your tips via the Windows Secrets contact page.

The Known Issues column brings you readers’ comments on our recent articles. Dennis O’Reilly is technical editor of WindowsSecrets.com.

Related posts:

1. Microsoft updates Windows without users’ consent
2. Windows may install updates without asking
3. Help For MS Office Users
4. Windows Update finds no updates, but it’s only a matter of time
5. Bugs and lack of apps plague 64-bit users