Dave Aiello wrote, "If you have been following this site recently, you know that I jumped at the opportunity to upgrade my copy of VMware Workstation for Linux to Version 3.0 in order to take advantage of greater virtual disk capacity and USB support. I subsequently discovered that in order to practically use these new features, I had to recreate the virtual machines that I use everyday."
"Last night, I began the process by backing up my Windows 2000 virtual machine's user files, reinstalling the Windows 2000 Professional operating system, and reinstalling Office 2000 Standard Edition. In the course of doing this, I had the opportunity to frequently visit the Microsoft Windows Update web site. This site is a repository for patches to the Windows operating systems. A related site called Microsoft Office Product Updates contains the patches for that product line."
"As you may guess from the title of this article, the process of securing the operating system and application suite took longer than I expected. Read on for a summary of my experience."
Dave Aiello continued:
It's difficult for me to understand the design choices that Microsoft has made in the Windows 2000 update process, and why it differs from the Windows NT update process in this respect: as far as I know, most updates to Windows NT are cumulative, while updates to Windows 2000 are done in stages.
If I wanted to update Windows NT to a reasonably secure state, I believe I can just apply Windows NT Service Pack 6a and be done with it. (Feel free to comment on this story if you think I am wrong in this assessment.) Admittedly, NT Service Pack 6a is a huge file, and it may be more practical for some people to get it on CD than to attempt to download it.
In the case of Windows 2000 Professional, in order to get to a reasonably secure configuration, I had to:
- apply Windows 2000 Service Pack 1a
- apply Windows 2000 Service Pack 2
- apply several "Critical Updates"
- apply additional patches to Internet Explorer to get to a reasonably safe version of IE 5.5
Most of these updates had to be done one-at-a-time, followed by a reboot. Windows 2000 Service Pack 1a was particularly large, and the second stage download took a long time, apparently due to the load on Microsoft's server.
The Office 2000 Standard Edition installation and update process was similarly complicated and time consuming.
The biggest advantage to the Windows 2000/Office 2000 update processes, in my opinion, is the fact that you can download some executable code to your machine that cooperates with the Windows Update web site to determine which patches need to be applied to the software that is presently installed on your system. This is a definite improvement over Windows NT.
The big disadvantage is the number of cycles necessary to complete the process. I must have done five or six large downloads, taking 10 minutes to one hour over a broadband connection, waited anywhere from 5 minutes to half an hour while each set of patches was applied, and then waited for a reboot to take place. All in all, the process took several hours, and I decided to go to bed once I started the Internet Explorer 5.5 update process.
I have been trying to find the time to do these reinstallations since Thanksgiving, so I am glad to have the bulk of it behind me. The only significant efforts left are to reinstall Visio 2000 and QuickBooks 2001, and to restore the data files that I created with Office and these applications. But, trying to bring a single workstation up-to-date from the base installations reiterated to me the fact that the greatest component of the total cost of ownership of Windows operating systems is keeping up with the patches they require in order to avoid exploitable security holes.
At this stage of the evolution of end-user computing, it is not practical for most people to choose an operating system that is not based on Microsoft Windows technology. But eventually, something has to give because the update process is on the verge of mind-numbing.