Q: How can I update "WSUS Offline Update" itself? A: As long as release notes or installation hints don't recommend other, you may unpack a new version's archive (.zip) over/into an existing structure, if you let existing files be overwritten. Of course you may use the automatic self update functionality instead. -------------------------------------------------------------------------------- Q: Can I exclude patches from download and/or installation? A: Yes, that's possible through customizing the download- and update scripts according to your requirements. You may add new patches or exclude existing ones. Please follow this guide: 1. Exclude patches from download You have to differentiate between statically defined updates (like the latest Service Packs, for example) and updates that are determined dynamically at runtime of the script. a) Statically defined updates Should you desire to exclude all static updates from download, simply check the "Exclude statically defined updates" checkbox inside the Update Generator before downloading. Please be aware that updates you downloaded earlier, which are now excluded, will be deleted on the run. b) Dynamically determined updates To exclude dynamically determined updates from download, insert their knowledge base ID (KBxxxxxx or simply xxxxxx) into the matching exclude file named "ExcludeList-<platform>[-<architecture>].txt". 2. Excluding updates from installation Once again you have to make a difference between statically defined and dynamically determined updates. a) Statically defined updates The statically defined updates (latest version each) are: - Service Pack (SP) - Windows Update Agent (WUA) - Microsoft Installer (MSI) - Windows Script Host (WSH) - Internet Explorer (IE) These updates will be installed only if the version installed on the target system is lower than the versions defined in the file "SetTargetEnvVars.cmd" (directory .\client\cmd). If you generally want to prevent installation of one of those updates, you have to modify the expected values in the "SetTargetEnvVars.cmd" or insert jump marks into the "DoUpdate.cmd" (which controls the installation process). You should do this in very special cases only, as with SP, WUA, MSI and WSH, certain versions are required as preconditions. b) Dynamically determined updates To exclude dynamically determined updates from installation, insert their knowledge base ID (KBxxxxxx or simply xxxxxx) into the file "ExcludeList.txt" (directory .\client\exclude). These updates will now be ignored; and you'll receive a warning in the log. The following updates are already excluded: - kb816093 (Security update for Microsoft VM) - kb951847 (.NET Framework 3.5 SP1 Family Update (will be explicitly installed if selected)) - kb890830 (Windows Malicious Software Removal Tool (MSRT)) - kb926874 (Internet Explorer 7 (will be explicitly installed if selected)) - kb940767 (Internet Explorer 7 (will be explicitly installed if selected)) - kb944036 (Internet Explorer 8 (will be explicitly installed if selected)) - kb982861 (Internet Explorer 9 (will be explicitly installed if selected)) - kb2718695 (Internet Explorer 10 (will be explicitly installed if selected)) - kb2841134 (Internet Explorer 11 (will be explicitly installed if selected)) - kb976002 (Browser Choice) - kb923618 (Office 2003 Service Pack 3 (will be implicitly installed if required)) - kb2526086 (Office 2007 Service Pack 3 (will be implicitly installed if required)) - kb2687455 (Office 2010 Service Pack 2 (will be implicitly installed if required)) - kb2817430 (Office 2013 Service Pack 1 (will be implicitly installed if required)) - kb936929 (Windows XP Service Pack 3 (will be implicitly installed if required)) - kb914961 (Windows Server 2003 Service Pack 2 (will be implicitly installed if required)) - kb936330 (Windows Vista Service Pack 1 (will be implicitly installed if required)) - kb948465 (Windows Vista Service Pack 2 (will be implicitly installed if required)) - kb976932 (Windows 7 Service Pack 1 (will be implicitly installed if required)) Please be aware that excluding updates may have an impact on the security of your PC. -------------------------------------------------------------------------------- Q: Can I download/install additional patches? A: Yes, you can adjust how the download and update scripts behave by excluding or adding patches from download or installation. For adding updates proceed as follows: 1. Adding updates to download routines For adding an update to be downloaded, insert its download URL into the matching "StaticDownloadLinks-<platform>[-architecture>]-<language>.txt file, found in the "...\static\custom" directory. Please don't forget a trailing <CR><LF>. 2. Adding updates to installation routines Add an update to installation by inserting its knowledge base ID (KBxxxxxx or simply xxxxxx) into the matching "StaticUpdateIds-<platform>[-<architecture>].txt file (directory "...\client\static\custom"). Please don't forget a trailing <CR><LF>. -------------------------------------------------------------------------------- Q: Can I skip the dynamic update determination during downloading/installation in order to use my static definitions only? A: Yes. To avoid dynamic update URL determination during download, add "skipdynamic=Enabled" to the [Miscellaneous] section of your UpdateGenerator.ini file. To avoid dynamic update ID determination during installation, set "skipdynamic=Enabled" in the [Installation] section of your UpdateInstaller.ini file. -------------------------------------------------------------------------------- Q: I already have the latest Service Pack for my selected OS and don't want to have it downloaded again. Can I integrate it into the WSUS Offline Updater somehow? A: Yes, if the following preconditions are met: First, you have to put the file into the correct directory; for an XP-SP3 English, this would be ".\client\wxp\enu", for example. Additionally, the filename and the size have to match the properties on Microsoft's servers, in this example "WindowsXP-KB936929-SP3-x86-ENU.exe" with a size of 331,805,736 bytes. As the download uses "wget" with the "-N" option (timestamping), the local copy also must not be older than the copy on the Microsoft server. -------------------------------------------------------------------------------- Q: Can I integrate patches for products made by third parties? A: No, and there are no plans to add this. Patches from third parties commonly have completely different command line parameters which makes an integration problematic, if not impossible. Additionally, the Offline Update is meant for making a PC as secure as possible before going online. Updates from third parties can then be downloaded from their respective websites. Many third party products offer some kind of auto-update mechanism to keep themselves current, e. g. Acrobat Reader, Firefox, Thunderbird, SUN Java Runtime, and others. -------------------------------------------------------------------------------- Q: Is it possible to automate the creation of the update media (CD/DVD images), with a scheduled task maybe? If yes, how do I do that? A: Create a new batch file in the ".\cmd" directory, e. g. "DownloadUpdatesAndCreateISOImage.cmd". Then enter the desired calls to "DownloadUpdates.cmd" and "CreateISOImage.cmd" with the required options into this file. An example of such a file would be: @echo off call DownloadUpdates wxp enu call CreateISOImage wxp enu Next, create a scheduled task for your new custom script "DownloadUpdatesAndCreateISOImage.cmd" and select the desired run time. For example, if you intend to create new update media following each Microsoft Patchday, select "second Wednesday of every month". -------------------------------------------------------------------------------- Q: Can I start update installation from a shared network resource? A: Yes, but you should only use the "Automatic reboot and recall" feature, if the shared resource permits anonymous access. Otherwise the automatic recall will fail, because the share won't be accessible for the temporary administrator account "WOUTempAdmin". If the network share doesn't have a drive letter assigned to, the "UpdateInstaller" script will automatically do a drive mapping, because cmd.exe does not support UNC paths (\\<server>\<share>) as the current directory (see http://support.microsoft.com/kb/156276/). If you like to assign a drive letter yourself using the "map network drive" feature or "net use" command, you'll have to do this in an administrative context/command shell (Windows Vista/7/Server 2008(R2)), because the "UpdateInstaller" script requests administrative privileges for patch installation. Please keep in mind that installing patches over the network is against the philosophy of an Offline update, and the machine may be vulnerable to attacks while the update process is still in progress. -------------------------------------------------------------------------------- Q: A patch is installed over and over again, in spite of being installed already on the target system. What is the reason and how can I resolve this? A: This problem regularly occurs when doing kernel updates on OEM systems; it's a Microsoft issue. To solve the issue, install such updates manually and specify the "/o" (or "/overwriteoem") switch (as shown on http://support.microsoft.com/kb/262841). -------------------------------------------------------------------------------- Q: When installing patches I receive a warning, that kb890830 and kb976002 have been skipped. Why aren't they integrated? A: Patch kb890830 is not really an update, but ...
gabriel-97