Performing Routine Maintenance - Keeping Your System Secure with Windows Update

Note:

Keeping Windows up to date is an absolutely essential step in maintaining a secure computer and avoiding malware. In recent years, the most widely exploited vulnerabilities in Windows have been patched quickly—usually before these issues became widespread problems. Windows users who installed the updates promptly were able to avoid infection, whereas legions of others (who failed to keep their systems updated) fell victim.

Depending on how you have Windows Update configured, you might not need to visit the Windows Update window at all because it does its work quietly in the background, keeping your computer up to date with the latest fixes and improvements. (It's still a good idea to check the list of available updates at least once a month, to find optional updates such as hardware drivers and nonessential fixes to Windows features you use regularly.) You can view its current settings, see what it has been up to, and find out what else it has in store for you by starting at its main window, shown in Figure 1. The top part of the window displays the current status and alerts you to any actions you should take.

Windows Update classifies updates into three categories: important (which includes security and critical performance updates), recommended (among other things, updates to signed drivers that affect performance or reliability, and fixes to noncritical bugs), and optional (updated drivers that don't affect reliability or performance, interesting but unnecessary enhancements, and so on). Security updates—the most important items of the important category—are routinely released on the second Tuesday of each month (informally known as "patch Tuesday"). Other updates are not distributed on a regular basis; instead, they're published when the need arises, such as when a fix is developed for a newly discovered problem. You can make a habit of regularly visiting Windows Update to see what's new, but there's an easier way: install updates automatically. To review in greater detail (and modify, if you wish) your current Windows Update settings, click Change Settings. The page that appears (shown in Figure 2), lets you specify the degree of automation you desire.

The drop-down controls under Important Updates let you specify how and when you want those vital updates downloaded and installed. Under the recommended setting, Windows Update downloads and installs important updates for you, at the time you specify (for example, every day at 3 A.M.). With this option selected, Windows Update will also reboot your system if an update requires it. If you don't want this level of automation, you can choose to have updates downloaded but not installed until you give the go-ahead. Or you can opt simply to be notified when updates are available, allowing you to both download and install them on demand. The Important Updates drop-down list also gives you the not-recommended option of calling the whole thing off.

If you select the check box below Recommended Updates, Windows Update applies the same level of automation to recommended updates that it applies to important updates. Regardless of your setting for important updates, Windows Update refrains from downloading optional updates.

If you use the Install Updates Automatically (Recommended) option and your computer is in a low-power "sleep" state at the specified update time and if your computer is connected to AC power, Windows Update wakes the computer to perform the installation. If your computer is off or asleep but not plugged in, Windows Update waits until the next scheduled installation time.

If you have either the Download Updates But Let Me Choose Whether To Install Them or Check For Updates But Let Me Choose Whether To Download And Install Them option selected, Windows Update notifies you with a pop-up message when new updates are available for your review. You can click the message to open Windows Update. If you miss the pop-up message, the information awaits you the next time you open Windows Update. When you arrive there, click Install Updates to finish installing all updates or, if you want to review them first, click View Available Updates. Windows Updates presents a list of the updates that are ready to install. You can read about each update in the panel to the right of the list.

1. Updating Device Drivers

Windows Update can deliver updated drivers for many commonly used devices, either as recommended updates (if the drivers are considered to affect system stability) or optional updates (if they are not). If your devices meet the standards imposed by Microsoft's Windows Logo certification program, you can generally rely on Windows Update to keep their drivers current. Some device drivers are not ordinarily supplied by Windows Update, however; to get updates for such devices, you will need to visit either the device vendor's website or, in some cases, your computer vendor's website. In certain cases, when hardware vendors make particularly large update downloads available, Windows Update might choose to alert you with a message and a link to the vendor's website, rather than offer the download directly.

2. Using Windows Update Manually

Whether you choose one of the automatic update options or choose the Never Check For Updates (Not Recommended) option, you can always manually check for updates to Microsoft products. To check for updates to Windows 7, open Windows Update and click Check For Updates (in the left pane).

3. Removing an Update

If you find that a particular update creates a problem, you can try removing it. Not all updates can be removed, however. (In particular, security-related updates usually cannot be removed. In addition, updates upon which other updates or other Windows features are dependent cannot be removed.) To find out if an update can be removed—and to go ahead and do the deed, if you choose—in Windows Update, click Installed Updates (in the left pane). Doing so takes you to a page within the Programs section of Control Panel that lists all uninstallable updates.

Note:

The installed updates page might lead you to believe that no updates have been installed. (For some reason, the "No updates are installed on this computer" message gives people that impression.) In fact, this page lists only the updates that can be uninstalled. To see a list of all updates that have been installed, return to Windows Update and click View Update History.

4. Updating More Than One Computer

The simplest way to keep all the computers on your network up to date is to enable automatic updating on each computer. If you have a small network in a home environment, go to each computer, open Windows Update, click Change Settings, and be sure it's set to download and install automatically.

But that's not always practical or efficient. If you have a dial-up connection to the internet, for example, you'll spend a lot of time connected as each computer independently downloads large updates. And in larger networks, even those with lightning-fast internet connections, administrators might want to control which updates get installed (and when) rather than leaving it up to individual users.

Microsoft provides the following ways to manage updates in situations where setting Windows Update to automatic on all computers is impractical:

• Microsoft Update Catalog (w7io.com/2101) is a website that offers standalone installable versions of each update for Windows. Microsoft Update Catalog offers updates for all currently supported versions of Windows, which means you can also use this service to find updates for computers on your network that are not running Windows 7. You can search for updates based on keywords and then sort by the product, date of most recent update, classification, and size. After you \find the updates of interest, download them once and store them in a shared network folder, where they can be installed from any computer.

• Administrators of large networks can use Windows Server Update Services (WSUS) to manage and deploy updates throughout an organization. The WSUS server, which runs on a computer running Windows Server 2003 or Windows Server 2008, manages downloading updates from Microsoft. Computers on the network then obtain updates from the WSUS server instead of directly from Microsoft's update servers. For details about WSUS, visit w7io.com/2102.