You may find differing opinions on this, but in my opinion, the ONLY updates to use are those labeled Security. All others are not useful and may be turning your computer into an intelligence gathering machine like Windows 10.
Windows Update - How will it change your system?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Anonymous
You need to make a decision about where you want to be with your system.
My advice is to change the Windows Update (WU) setting to never.
It really depends on where you want to be with your Windows 7 system.
Woody Leonhard has described the situation something like this. Note, I am using my own words here and describing it from my own perspective:
Group A: Roll over and just let MS install what ever they wish on your computer and just don't worry about privacy and the spyware they will install. With this option you leave WU as Delayed start, and set the WU setting at Recommended. This is the easy way and requires no effort or concentration. You just let happen what will. This is essentially what you have with a Windows 10 system.
Group B: Refuse to accept any updates except Security ones. In that case you follow my initial recommendation and leave WU set at Never. You get the Security only updates from the "catalog". There is risk here in B. You are trusting that MS will not put anything in that group that does things you do not want done. A sort of level of trust in MS that I am not sure they deserve. Keep in mind that they have done the same thing with this set of updates they did in the main one. It is all one agglomeration of whatever number of security updates they decide to put in it.
Group C (AKA W): Shut down WU permanently and never again accept a Windows Update. This group feels that the risk of MS changing their machine in unacceptable ways or even bricking it is greater than the risk of a hacker breaking in because some security patch was not installed. I suspect that most people who even think about this topic will opt for this. However since most people think of their computer like a potato peeler, they will not even think about this and things will just happen without them even knowing. They will be Group A and won't even know it.
I am in Group W and would like to be in Group B. It depends on whether I can find a satisfactory way for my 150 or so client machines to be updated. They are average Joes and Janes.
Note that this may not apply to NON-Windows updates such as Office. I am not sure how you can be in group B or W and do this, but I am working on it.
UPDATE November 19, 2016:
It now appears that B is an impractical strategy for 99% of users. And, here is the reason why: When an error is made in a security-only update, if the error turns out not to have a security affect, it may be corrected in a non-security update. In that case if you were following B strategy, you would be left with an un-corrected defective update installed on your computer. If you were extremely diligent and knew about it, you may be able to get the correction in specific cases. This would entail an extreme amount of diligence that few would be willing or able to provide.
The new rollup style of updates that Microsoft is now providing to what we would call Group A, which include all kinds of updates (security and non-security), are cumulative. That means if you miss a month or even more, it will not matter because by installing the latest month's rollup, you would be up to date.
NOTE well, that Security-only updates are NOT cumulative. Which means if you miss a month, you may never get the missed updates.
So one strategy that you may wish to consider is following Group C, but still updating .net and Microsoft Office through Windows Update, but installing no Windows updates at all. It would be advisable in this case that you stop using Internet Explorer because you would not be getting those updates, but instead use an alternative browser.
Then, after following this strategy for some time, if things take a turn for the worse, and you decide you made the wrong choice (Group C with .net an Office updates), you can easily shift to A by simply using the latest offered Rollup offered in Windows Update.
So, as things have evolved, it looks like the vast majority have really only two choices: A as described above or C (modified as described above). The good news is that if you follow the modified C strategy, you have a way back to the Microsoft way, that is easy to implement.
Windows for home | Previous Windows versions | Windows update
Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question.
247 answers
Sort by: Newest
-
Anonymous
2016-10-23T15:41:28+00:00 -
Anonymous
2016-10-23T03:43:58+00:00 I just have a question or 2. How do I know which updates are security updates, and which are truly useful? I always avoid KB3086255 because this "security" update makes my old (version 2) Rosetta Stone programs not work. I now have trouble with old ipods and itunes, but I'm guessing that this is probably not related to MS updates (?). I'm not sure what to believe and MS always just says that each update is solve a problem in windows... Also, does anyone know what MS is actually spying on?
Thanks for the help with the updates though, it was greatly appreciated to not have the computer spin and spin... I'm just not sure which updates I should now eliminate and avoid. Thanks!
-
Anonymous
2016-10-20T10:27:47+00:00 Installing a program and installing a Windows Update are not the same thing.
When you install a WU one of the things the installation does is make a copy of all the files that are going to be replaced with the update. That happens so that if you want to or need to uninstall the update later, the old original files will be put back in place.
In the XP days, a common question was something like "What are all these folders on my system? They are taking up a lot of room. Can I delete all these folders with names like this:
$NtUninstallKB2723135$
The answer is yes you can but that folder contains all the original files that installing KB2723135 replaced so if you ever decide to uninstall KB2723135 later you won't be able to do it. And in my 10 year old XP installation all of those folders only take up about 550MG of space - not very much really.
The installation of KBs works a lot differently in Windows 7 - but still, there must be a mechanism to uninstall a KB and put back the original files. Nowadays all that stuff gets saved in the winsxs folders and it is more complicated.
When you install a program, hopefully the installation includes a way for you to uninstall the program and hopefully that uninstall routine does a good job of cleaning up after itself. That is the stuff you see in the registry in the Uninstall folder.
Hopefully every program you install includes an uninstall routine so that when you uninstall from Control Panel, Windows will look out in the registry Uninstall folder for that program and run what is in the UninstallString value for that program. Hopefully it does a good job.
If you want to uninstall a program and it is not showing up in Control Panel (this is a problem) you might be able to find that programs information in the registry and find the UninstallString that goes with it and just run the command from a Command Prompt. But if you have to do that you have some other problem or the installation routine for the program is written poorly or something else has happened.
So you don't "uninstall a program from the registry".
If you don't see the program in Control Panel to uninstall, something is wrong. You could perhaps still uninstall the program by finding the UninstallString for the program in the registry and execute/run that uninstallation routine another way (from the Command Prompt usually). And if you have to do that something is wrong.
Of course it should no happen that an installed program does not show up in Control Panel but I guess sometimes it does and that would be because of a sloppy installation routine or some other tampering.
That is not what happens when you uninstall a KB.
-
Anonymous
2016-10-20T03:55:20+00:00 Actually, that was one example of what I had in mind, but now I having to figure out a message I received a short time ago that referred me to a very recent article/post by Woody on his site that seems to indicate something very closely related to what we have been discussing -- going into the registry to make something stop working.
Problem I have, though, is I have two other units at this work station that I am busy on and I'm spread thin for what limited brain ability I can muster.
I'm going to have to wait until later, when I have time to go back to Woody's site and study what that is all about. Quick look, though, was quite a surprise, because it seems so closely related to what we have been discussing here.
-
Anonymous
2016-10-20T03:40:51+00:00 Yeah, I'm starting to spread myself out too much here as I try to work on this and do other work at the same time.
I'm actually only interested in disabling a "spy" program put on my system through the Windows Update utility. That's it.
But I somehow thought that programs could be disabled by messing about in the registry, but now I am confused.
The registry contains information, but nothing that can disable a program? Is that what I am supposed to be learning here?
If by 'spy' you are referring to the telemetry gathering and reporting I suggest you look at Spybot Anti-Beacon. It is a simple program that will shut down the telemetry reporting with one click. It will also show the exact registry settings that are being changed so if you like you can do it manually if you so desire. Here is the link: