Microsoft responds to accusations of "stealth updates"

It's been reported that Microsoft is updating portions of Windows Vista and Windows XP, even when automatic updates is turned off. Personally, I always turn off automatic updates - I prefer to see and approve updates to my system - though I ask it and other programs to "inform" me when updates are available. Naturally auto-updating for anti-virus signatures is allowed.

Microsoft has responded to this, saying that the "stealth updates" were only to update portions of Windows related to Windows Update itself. While that may be true, it's also true that most IT departments prefer to test updates before rolling them out to their installed base. They can't be happy about this new information.

Also, why didn't Microsoft simply tell us about this? In a statement (below), they say this has been the way Windows Update has operated for years.

Microsoft certainly doesn't need this publicity. One only has to look back to 2006 when WGA was first launched to see an example of Microsoft not being open with users. After not being open about the behavior of WGA, Microsoft had a lot of explaining to do.

From the official Windows Update Blog, Nate Clinton, the Program Manager for Windows Update said today:

One question we have been asked is why do we update the client code for Windows Update automatically if the customer did not opt into automatically installing updates without further notice? The answer is simple: any user who chooses to use Windows Update either expected updates to be installed or to at least be notified that updates were available. Had we failed to update the service automatically, users would not have been able to successfully check for updates and, in turn, users would not have had updates installed automatically or received expected notifications. That result would not only fail to meet customer expectations but even worse, that result would lead users to believe that they were secure even though there was no installation and/or notification of upgrades. To avoid creating such a false impression, the Windows Update client is configured to automatically check for updates anytime a system uses the WU service, independent of the selected settings for handling updates (for example, “check for updates but let me choose whether to download or install them”). This has been the case since we introduced the automatic update feature in Windows XP. In fact, WU has auto-updated itself many times in the past.

The point of this explanation is not to suggest that we were as transparent as we could have been; to the contrary, people have told us that we should have been clearer on how Windows Update behaves when it updates itself. This is helpful and important feedback, and we are now looking at the best way to clarify WU’s behavior to customers so that they can more clearly understand how WU works. At the same time, however, we wanted to explain the rationale for the product’s behavior so our customers know what the service is doing: WU updates itself to make sure it continues to work properly. We are also confident that the choice to use Automatic Updating continues to be the right choice.

Well, OK, sure, you think Automatic Updating is the right choice. I don't, and many others don't either. Also, I've always assumed that when I go to Windows Update and run a manual check (which is what I do since I have Automatic Updating off) that any necessary Windows Updates components will be updated then. So why not do it that way?

I'm sure we have not heard the last of this.