Automatic Updates - good or bad?

Hi! Welcome to the latest edition of our weekly newsletter, bringing you articles on topics that we feel could help you in the day-to-day use of your home or small business PC. The articles are written by myself, Nathan Forrest of Future Systems (Sussex). I've been helping out as a moderator on the free computer support forums at www.d-a-l.com since they first opened and I have 15 years' experience of residential and small business IT.

I love Microsoft. I really do. Yet, I can't help noticing that, over the past year or so, they've become a lot more authoritarian in their approach to dealing with users of their software - choosing to tell us what we need rather than offering suggestions about what we might like. I can think of two recent examples in particular.

The first is Windows Vista's introduction of User Account Protection. This is a security model whereby the user is prompted for confirmation (or a username and password) whenever they try to do something that could potentially damage their system. The idea here is that malicious software, hackers and untrained users without an administrator password cannot change critical system settings and risk ruining their Windows installation or opening up security loopholes. It sounds like a great idea. But Microsoft have gone too far and Vista raises warning dialogs when you try to carry out practically any task to do with making an adjustment or checking a setting.

The result is one of two solutions: either the user becomes so blasé about the constant barrage of warnings that they just don't bother reading them any more and just automatically click 'Continue' or they use an even more thorough method of bypassing the warnings - they switch off the messages completely. What a total waste of time! My real grievance with Vista's new security, however, is that you get the same irritating visual assault of messages even when you are logged on as Administrator. WHAT?! Yes, that's right - Microsoft have decided that the "Administrator" is no longer going to be the administrative regulator of a system - they are.

My second example has probably affected a lot more people and certainly in a very short space of time. When Microsoft released the latest version of their web browser, Internet Explorer 7, it had some new security features in it, including a new anti-phishing tool that is intended to stop you from giving your credit card details or other personal information on a fake web site - one that is pretending to be the official site of your Bank, Paypal or Ebay, etc. This was good.

Unfortunately, however, they also introduced a lot of design changes, such as opening new windows on an additional tab rather than in another instance of Internet Explorer, as well as a very different toolbar and menu layout, all of which I personally dislike. I can understand why some people welcomed it but it is not everyone's preferred way of working. So what? Just because I don't like to use my web browser in that way, it doesn't mean that other users shouldn't have the choice.

And there's the problem. Microsoft, rather unbelievably, decided to class Internet Explorer 7 as a "high-priority update", as apparently inconsequential as one of their many security updates that patch up one specific security bug that you'll probably never notice. In other words, this is an urgent update that you cannot possibly do without and must install at the earliest opportunity. Because they made this crazy "we will decide what's best for you" decision, everyone that had Automatic Updates switched on (and set to automatically download and install) got this new, different version of Internet Explorer. It was downloaded and installed on their PC automatically and without warning. Who do Microsoft think they are - AOL?!

Within just a couple of weeks, Microsoft had thrown thousands (if not millions) of novice users into complete confusion about how to use the Internet. They seemed oblivious (or was it indifferent?) to the fact that many novice users know how to carry out a very limited amount of tasks based on clicking on a button, menu, link, page or other option that will always be where they expect it. Microsoft didn't even tell those users how their Internet Explorer had changed. It's just different - deal with it.

Supporting many users through the carnage that followed this event made me extremely wary of the Windows Update web site (http://windowsupdate.microsoft.com) and the Automatic Updates feature of Windows 2000, XP and Vista. What are they going to decide we need next? Will Microsoft remove my favourite anti-spyware software and replace it with Windows Defender just because they think it is better?!

Since that time, which was quite a few months ago now, I have never allowed the Windows Update web site to carry out the 'Express' installation of Windows Updates on any PC that I've set up. I always choose the 'Custom' option. Conveniently, doing this brings up a list of all available "high-priority updates" and they will all be selected but I have the control to be able to scroll through the list, find out what Microsoft are planning to install for me and then de-select the Internet Explorer 7 option. When you de-select an option from the 'Custom' list of updates, you can also choose to hide it from the list so that, the next time you go to the Windows Update site, that particular update is not listed. I think that this is a much better way of working - Microsoft can suggest what they think that I should have but, if I am knowledgeable enough that I can make my own decisions, then I have the ability to override their choice.

Please don't misunderstand me - patching your system up with the latest security updates IS very important. I am definitely not trying to scare anyone away from keeping their security up-to-date. However, I recommend that you find out what updates are going onto your system before they are installed. Internet Explorer 7 wasn't a "patch" - it was a completely new version. Even if you always select all of Microsoft's recommended updates, at least you will have an idea of what caused a problem when you find that your computer is behaving differently. Knowledge is power - it's a lot easier to remove an undesirable update if you know what it was that you've just installed.

As well as using the 'Custom' option instead of the 'Express' installer at the Windows Update site, I also configure PCs so that Automatic Updates is switched on but I am notified when updates are available, rather than having them automatically downloaded and installed.

To check your Automatic Updates setting, open Control Panel from the Start Menu (Windows 2000 users will need to click 'Settings' on the Start Menu first). If you are viewing Control Panel in 'category view', you'll need to click the 'Security Center' option. Select 'Automatic Updates' and a dialog will open showing four options (see figure 4).

The default option is Automatic. This means that, when new "high-priority" updates are available, Windows will automatically download and install them. Note that the default frequency is for Windows to check for updates every day at 3.00am. Microsoft assumes that you won't be using your PC at 3.00am (they are very nice people really - they don't want to slow you down during the day). Of course, if your PC is always switched off at 3.00am, then it will never check for available updates so you might want to change that setting.

Personally, I prefer the second and third options. Depending on the control that you need over how much is downloaded through your Internet connection, you can either have Windows download all of the updates and then let you choose when to install them or Windows can just tell you that there are some updates that you might want, leaving you to review the list and choose what you want to have downloaded.

I only leave Automatic Updates switched off (the fourth option) when I am setting up a new PC and am busy installing service packs and other patches myself. If you check the Windows Update web site on an un-patched PC running Windows XP Service Pack 1a, you'll have around 90 updates to download. However, installing Windows XP Service Pack 2 first will reduce the number of downloads required as many will already be included in the service pack. A similar principle applies to Microsoft DirectX and Media Player - install the latest version on a new PC and it will then be less likely that you will need to download security fixes.

After I've installed all of the new versions, service packs and updates that I have on CD, on a USB memory stick or on my network, I'll configure the Internet connection on the new PC and go straight to the Windows Update web site (http://windowsupdate.microsoft.com). After choosing the 'Custom' option, I'll normally still have a pretty large number of patches to download. That will often require one or more reboots and, after each, I'll need to run the Windows Update process again to check if there are then any remaining or additional patches in the list. Once the list is empty, I'll reboot again and then switch on Automatic Updates. Microsoft can take over from here ..... but only with as much authority as I've allowed them.