Microsoft now takes blame for WSUS update error

On the same day it tried to refute reports that enterprise customers' PCs were being force-fed the Windows XP desktop search tool, Microsoft did a turnabout and admitted it had messed up.

Some system administrators, however, were still not convinced that the company is telling a straight story.

Late Thursday night (pacific time), Bobbie Harder, a program manager on the WSUS (Windows Server Update Services) team, said the update for Windows Desktop Search (WDS) had, in fact, been installed on some machines without administrator approval, and offered an apology.

On Tuesday, Harder said in a post to a company blog, Microsoft revised and released a WDS update package aimed at machines running Windows XP or Windows Server 2003 that did not have the desktop search tool installed. The update was supposed to be optional.

"Unfortunately, in revising this update, the decision to reuse the same update package had unintended consequences to our WSUS customers," she said. "Many of you who had approved the initial update package for a limited number of machines, had Tuesdays' WDS revision automatically install on all clients because of the expanded applicability scope and because, by default, WSUS is set to automatically approve update revisions.

"We sincerely regret the inconvenience this has caused and extend a sincere apology to all impacted customers," Harder said.

Early on Thursday, reports from enterprise users running WSUS -- the Microsoft software that manages updates and patches to Windows client machines -- began hitting support forums claiming that WDS was installing without permission.

According to some administrators, the first hint they had of the unexpected installs came from users complaining of slow machines. "I come in today to my entire user [base] complaining the network is slow," said Ron Garrison on the Windows Desktop Search support forum. "After some investigation, I learn it isn't the network; it is all the users' computers running slow because they now have Windows Desktop Search installed on them." Others reported the same symptoms, generated by the disk- and processor-intensive initial indexing of the files on the PC.

At first, Harder defended the update and admitted only that, "it may have appeared as if this update was deployed without approval." Nor did she originally apologize for any problems caused for customers, saying simply, "We appreciate the confusion this behavior caused."

By day's end, however, Microsoft had yanked the WDS update from the WSUS channel, and Harder promised her team would not make the mistake a second time. "We are also working on improving our internal publishing processes to ensure this does not happen again in the future," she said.

Some corporate users, however, weren't buying the mea culpa. Several commenting to Harder's blog posting and an earlier Computerworld story claimed that they had never authorized WDS installs on any systems in their care, which should have prevented any updates.

"In my case, WDS 2.65 for XP and for W2K3 was 'Not Approved,' said a user identified as DalePre in a comment to Harder's posting. "WDS 3.01 for both was specifically declined. There is not a single WDS-related approval on my WSUS, so this is not simply a re-interpretation of the rules. This is breaking the rules."

"I find it rather hard to believe [Microsoft's] party line, since this update synchronized, approved itself and pushed itself out before I was even aware of its existence," said another user, Ian B, in a comment to this story filed earlier on Thursday. "The first indications of a problem were my network dragging itself to a crawl yesterday, and new things showing up on the desktop. Previously approved? I think not."

Other users simply vented, angry at Microsoft for putting them in a spot. "Nice move, guys...now I get to waste time figuring out how to disable this damn thing that I never wanted in the first place," said Ed Handschuh on the same support forum as Garrison's message. "Way to go! The trust level of the WSUS had just taken a serious beating."

Harder also told users that they could uninstall the WDS update by using Windows' Add Or Remove Programs control panel applet, by running System Restore on Windows XP or by using an uninstall script she provided.