The Win 7 “SP2” convenience rollup KB 3125574 might actually be worthwhile

Topic

New Reply

This just in from Noel Carboni: I now have a test Win 7 virtual machine on which I’ve installed the “convenience rollup update”, KB3125574. Rather tha
[See the full post at: The Win 7 “SP2” convenience rollup KB 3125574 might actually be worthwhile]

Reply | Quote

Replies

Noel, interesting observations and a more concise list of updates to keep an eye on with full explanations, while comparing to other much larger lists which are probably excessively long. I think your list is the one which should be used as reference for those concerned with the telemetry issues.
To understand better the context of your latest test, please provide further information in relation to:
– “Win 7 system that was up to date as of January 14” include Recommended and Optional, or only Important or only Security etc
– In relation to KB971033, what version on Windows 7 do you use for testing? I noticed that on Volume licence Pro and Enterprise, KB971033 comes as Important, but not ticked and has been like this for few years. In WSUS, KB971033 is not offered at all. I am interested to know if the Retail licence versions behave differently for this update, i.e if it is ticked by default.
– I noticed that in your second list post-installing the Convenience Rollup, KB2952664 is missing. According to what I know, this update is not part of the Rollup, but your testing may prove something else. Was it just missed for being listed, was it installed behind the scenes or is just no longer offered?

Now there is a very good reason why your previous settings have not been modified by the rollup and why no new telemetry was introduced. Those features have a lot to do with Microsoft understanding better the end-users systems to improve compatibility with the Windows 10 Upgrade via Windows Update.
The Convenience Rollup instead has a different intended audience and is targeted to those IT Pros who have already decided to stay with Windows 7 for those systems where the Convenience Rollup is installed. I am convinced that the Microsoft developers fully understand the impact of their releases and there are no accidents when certain updates behave one way or the other. Those “accidents” are rather management decisions in one way or the other than anything else.

Reply | Quote

Noel,
Many thanks for this very useful work – much appreciated!
What “uncommon software” do you use to monitor telemetry?
It will be really interesting to see how long your system
stays “quiet” (I’ll look here once a day for new posts!).
Bob.

Reply | Quote

As I see it the pertinence of this Convenience Rollup for Windows 7 (KB3125574) is to know how it performs on an original Windows 7SP1 install:

1- Let’s not forget the update requires 7SP1 (it won’t include 7 to 7SP1 update) ;

2a- I have a formatted disk, clean. I install Windows 7SP1;

2b- Once 7SP1 installed I run the onvenience Rollup for Windows 7 (KB3125574) : OK

From there on, does KB3125574 include or not the Windows10 upgrade intruders or not? That is my concern.

Reply | Quote

There’s at least one prerequisite, mentioned in the docs. Mary Jo has an update:

http://www.zdnet.com/article/how-to-make-installing-the-windows-7-convenience-rollup-a-little-less-painful/#ftag=RSSbaffb68

Short answer to your question: the rollup does NOT include 3035583 – the GWX installer – but it does include many other patches that are considered to be Win10 upgrade support. Several of those patches also install additional snooping routines – but exactly what they do is anybody’s guess.

Reply | Quote

Thanks, woody,

1- for the short answer : ok, no 3035583 but nevertheless several Win10 upgrade patches, of which I do hope not the infamous KB3068708 = Diagnostics Tracking Service;

2- The zdnet article you mention states the free Microsoft Assesment and Deployment Kit (ADK), an iso file which needs to be written on dvd and from there on installed on Windows 7. I have here the ADK iso file and though the process of building with it an operational so-called Win7 SP2 ready OS install seems a bit heavy/complicated (but feasible) I might opt for that.

But be it 7SP1 then Convenience Rollup for Windows 7 (KB3125574) OR “7SP2” in both cases the some of the Win10 “pushups” will be included…

As I see it now I’d rather opt for a clean Win7Sp1 install, then install the anti-GWX application (forgot the name since I’m using here Never10 application because I had by chance refused/hidden those Win10 upgrade patches)… the only install the Convenience Rollup for Windows 7 (KB3125574) …

Complicated

Reply | Quote

Noel, The reason you had a problem using Windows Update after installing the “SP2” rollup update is that it doesn’t include the updated “Windows Update Client” – which is a major element of the “Win7 Slow WU Fix”.

Once “SP2” is installed and before you run Windows Update you just need to install
KB3138612 – March 2016 – Windows Update Client
KB3145739 – April 2016 – Updates Gdiplus.dll and Win32k.sys
KB3153199 – May 2016 – Latest Kernel-Mode Driver fix for Win32k.sys

I recently did this install on a clean Win7x64-SP1 install
– the “SP2” update installed in 7 minutes
– and the Windows Update scan took 6 minutes
– a BIG improvement over not using the “SP2” route

This website has a good summary of the latest info http://wu.krelay.de/en/

Doug Collins – Computer Support Engineer – London UK

Reply | Quote

I think Mary Jo has the right balance in naming the Convenience Rollup.
“Microsoft’s Windows 7 SP1 convenience rollup isn’t Service Pack 2 for Windows 7, but it might be the next best thing.”

Reply | Quote

The system made no overnight online contact attempts, as verified by Sphinx firewall. So far so good.

Some context:

>– “Win 7 system that was up to date as of January
>14” include Recommended and Optional, or only >Important or only Security etc

I chose a VM snapshot that I had made a few months ago, which at the time I had used to reproduce the “CPU hard loop” problem with Windows Update.

That system had ALL available updates, including optional, save for the ones I listed as hidden.

>– In relation to KB971033, what version on
>Windows 7 do you use for testing?

Windows 7 x64 Ultimate, installed from a retail package in 2009, and maintained fairly carefully ever since. This system is tweaked and lean, settling to a process count in the 30s when left alone.

>– I noticed that in your second list post-
>installing the Convenience Rollup, KB2952664
>is missing

Good catch. I need to re-check my lists carefully. I didn’t actually wait for a long update startup but dredged that list up out of a screen grab I’d made back when doing my prior Windows Update testing, and I was pretty sure it was from that system. However, I need to restore the snapshot, waiting the 30 minutes for Windows Update to finish a check, look at the hidden updates, and be sure. It’s worth getting this exactly right.

-Noel

Reply | Quote

Sure, easing the pain of setting up a new Win 7 system is important to folks who want to do new setups with an old OS – even if Microsoft can’t yet understand why you’d want to do so.

But I also see it as pertinent if it might be able to bring people’s existing systems out of the “update hell” that many have been experiencing lately.

If – as we hope – it’s not a “trick” to get more Windows 10 prep/nagware into peoples’ Windows 7 systems, it could be (as Woody has suggested) the equivalent of an “SP2” installation that helps folks maintain their systems moving forward more efficiently.

We have entered a time, unfortunately, when parts of Microsoft have proven that we need to be VERY wary about anything they do. Remember when having an update like this show up would have been all positive?

-Noel

Reply | Quote

1. I use the commercial Sphinx Windows 10 Firewall (Network/Cloud edition) on all my systems. It provides a very nice monitoring readout. At present I have a beta version as I have been working with the author on making it even more usable and robust. I have set up a deny-outgoing-connection-by-default configuration across the board, which is more work to manage than the default permissive setup in Windows, but is also more secure.

2. I run a local DNS server from which I can watch the logs in real time to see what name resolutions are done. That’s always VERY interesting to watch.

So far, this Win 7 test setup has not attempted any unsanctioned online contacts in most of a day. Of course it still does do the normal, expected comms, such as contacting online certificate information servers, NCSI requests, anything ad hoc (like browsing), etc.

Keep in mind I had already gone through the process of reconfiguration to avoid telemetry in all the ways I know, which included disabling a number of jobs in the Task Scheduler. My intent here is to see if anything gets undone or is added by this update, or if Microsoft stops following its own rules and attempts comms anyway.

This needs to be clear: If you have not previously allowed the telemetry updates to be installed in your system and had not taken steps to thwart telemetry (basic opting out in the several places provided, disabling jobs), the convenience roll-up will add telemetry communications that you didn’t have before.

-Noel

Reply | Quote

This is quite interesting. Robert Smith PFE has useful recommendations which I am still assessing and I actually have reservations about some of those recommendations, in particular in relation to KB2775511.
https://blogs.technet.microsoft.com/windowsitpro/2016/05/17/simplifying-updates-for-windows-7-and-8-1/
Otherwise it is very good information, based on the assumption that it is just an opinion and not absolute truth.

Reply | Quote

Oh, and I agree with you totally, ch100 – Microsoft knows EXACTLY what they’re releasing in updates, and how the updates work. It’s just not something that could work by accident.

-Noel

Reply | Quote

OK, I restored the snapshot I had to install the “convenience update”, ran Windows Update, and waited. It *finally* got through the long delay (well over an hour) to see what updates were hidden…

I can confirm that ALL the hidden updates were just as listed in the original post.

I had neglected to mention I had also hidden all the various language packs that were offered as updates at some point or another. I use only English.

On another subject, something I noticed was that after the convenience update an SFC check was failing. I just re-verified that an SFC check passes before it’s installed. I’m going to do the install again and check SFC again after.

-Noel

Reply | Quote

Woody,

Please keep us updated if we SHOULD install this update or NOT.

Thanks, in advance.

Dave

Reply | Quote

The bad news is:

SFC /SCANNOW passes before the convenience update and fails after. I’ve just verified it.

Next step, look in CBS.log and try to discern why…

-Noel

Reply | Quote

If you are not applying this update to a fresh installation, make sure you can live without your PC for 40-70 minutes.

If the update is unsuccessful, it will take the same amout of time to revert back the settings.

Do a FULL SYSTEM PARTITION BACKUP before installing this. Interrupting the update may easily render your system into a non-bootable state.

Reply | Quote

Arrrrrrgh.

Reply | Quote

There’s no reason to install the “SP2” convenience rollup, unless you have a brand new Win7 installation.

Reply | Quote

Noel,
Many thanks for your prompt and thorough response to my post.
I can well imagine how interesting your local DNS server logs are – but have
you seen any evidence (from Sphinx or wherever) of Windows using hard-coded IP
addresses instead of hostnames to communicate with Microsoft servers?
Bob.

Reply | Quote

Thank you for all your replies Noel.
One of them in particular seems to prove my belief that while KB971033 is offered to all Windows 7 editions as Important update, it is ticked by default for the retail versions (Ultimate is technically Enterprise less the licence which is different) and not ticked by default for the volume installations, activated or not (I tested in time with both). It can be installed though on the volume licence versions Pro and Enterprise from Windows Update. It is not offered at all on WSUS. Actually only two Windows 7 updates are offered on Windows Update and not on WSUS. They are KB971033 and KB3035583. Every other update is offered on both systems. In addition KB3035583 is not offered to Enterprise on Windows Update as it is documented in the KB article.

New bug introduced by the Convenience Update in relation to SFC? I think there was an update introducing a similar bug which was corrected later. Might be the same bug which now appears as side-effect of one of the rollup’s components?

Thanks for clarifying what your test system “fully patched” meant. It is indeed fully patched for the purpose of our discussion, as the omitted updates (those previously hidden) appear not to be part of the rollup.

Reply | Quote

Just checked and my clean install with “SP2” and mine does NOT fail the “sfc /scannow” test. I was using a fresh Win7-SP1x64 install plus the “SP2” rollup update with all later MS updates installed via Windows Update.

The CBS log shows the usual reams of Info messages about “Pending renames” and “Ignoring duplicate folder ownership” that you always get – but no Errors, Warnings or failed repairs.

Reply | Quote

Noel, as I understand you say that the new rollup would enhance the already existing telemetry if it was allowed before the installation of the rollup, but would not undo what was disabled/blocked/not installed.
Is this correct?
If so, the typical installation of the rollup is with telemetry enabled as the recommended implementation is to apply it immediately after SP1 and the servicing stack update to create a new baseline, “SP2” like if we want to name it this way. In such a case, the measures to disable CEIP and additional components like Scheduled Tasks would be done AFTER the rollup installation.

Note: I don’t like to designate the Convenience Rollup “SP2” because there is a clear delimitation between a Rollup Update (or Update Rollup) and a Service Pack in my view. The rollup contains previously released updates packaged in a convenient installer, while a Service Pack normally introduces new functionality, never released before (except for betas).

Reply | Quote

It is true, but the Windows 10 Upgrade support patches by themselves do not trigger the upgrade invite without KB3035583 being installed on the system. The support patches introduce only additional monitoring of the local system by Microsoft, officially for the purpose of making the Windows 10 Upgrade more reliable. I don’t know and is hard to prove if there are other hidden intentions related to that monitoring and in theory this would be illegal without being clearly stated in EULA. However there are a lot of grey areas surrounding this subject.

Reply | Quote

@Simpson There is a way to use DISM and slipstream the Convenience Rollup without using ADK.
If you use virtual machines, you would be better off creating a VM template with sysprep for this purpose.
If you use physical machines, a image of a sysprepped installation would also do the job.
It may be a lot easier than to use the Microsoft ADK.

Reply | Quote

@Doug Interesting and useful lists, the one you posted and the one at http://wu.krelay.de/en/
Just be aware that KB3138612 is actually another one of those updates which facilitates the Windows 10 Upgrade in addition to the good effect on Windows Update behaviour from the previous versions superseded.
From the KB article: “This update includes Windows Update support for Windows 10 updates (feature updates) that are distributed though WSUS (content released after May 1, 2016). See related update 3159706.”

Reply | Quote

Well put.

Reply | Quote

As usual, things are not simple.

I went ahead and allowed the pending updates to go in, because THIS time after installing the convenience rollup (KB3125574) quite a number of updates showed up.

This is a very interesting difference because it’s the exact same virtual machine I had Installed the convenience rollup on before.

I can only attribute the difference to a difference in availability of Microsoft’s online Windows Update services between the two times. Also, this time the update after the rollup install literally took hours. It finally completed at 2:35 am.

After a reboot, the system now shows having installed all these updates AFTER the rollup:

http://Noel.ProDigitalSoftware.com/ForumPosts/Win7/AfterRollup.png

I wish we could nail this whole Windows Update thing down again so that it didn’t require days of experimentation to try to figure out what’s going on.

-Noel

Reply | Quote

Several of those I had hidden showed up in the various lists, so I hid them again.

Now, interestingly, the GWX update shows up TWICE in my hidden list. And none that were hidden before are installed now.

And just now 5 more .NET Framework 4.6.1 security updates have appeared available for installation. They went in fairly quickly (a few minutes), without incident.

-Noel

Reply | Quote

Bottom line is that since I saw system protection broken on a system on which it would pass before (see the following), I can’t recommend the use of this update rollup.

http://Noel.ProDigitalSoftware.com/ForumPosts/Win7/PreRollup.png

http://Noel.ProDigitalSoftware.com/ForumPosts/Win7/SFCFailureAfter.png

I note that at least one person has reported the rollup didn’t break their system protection. Your mileage may vary – mine often does.

-Noel

Reply | Quote

If the GWX update is KB3035583, then it is likely that you see multiple versions of the update released under the same number, but only loosely related. This was noticed by other posters too. It will likely be resolved next time when Microsoft does the cleanup for the older versions. It happens now and then with KB2952664, although right now I think only the latest version dated April 13 is offered and this one if it is installed removes the previous ones from the current list.

Reply | Quote

I read Noel’s email and then checked my updates. I don’t see any of those numbers. Are they related to Ultimate only? I run Win 7 Home Premium SP1 (64bit). I did accidentally install 30355883 but had no unpleasant surprises from M/S (like the dang Windows 10 icon in the tray). Some months ago, when reading Windows Secrets, one of the writers described a registry entry that keeps that from happening. Apparently, it works! I apologize that I can’t tell you what it was. I would have to go through previous issues to find it. I eventually plan on installing Windows 10 but will wait until July 15 (after the “anniversary” edition) to do so. If I hate it, I can roll it back as others have outlined here and elsewhere. So, do I need to worry about the missing KB numbers? What about the supposed SP2? Thanks in advance for your input.

Reply | Quote

For me an installation of Windows 7 Pro with all updates to date (May 2016) except those mentioned by Noel in the original post takes less than 2 minutes to check on Windows Update. This test machine does not have the Convenience Rollup and does not have other Microsoft products like Office, Silverlight, MSE. I do the check on Microsoft (not Windows) Update and it offers Silverlight and MSE, none of them being hidden. It may be that the additional products installed add to the scanning load, thinking primarily about Office.

Reply | Quote

[Woody again… I had a horrible time starting with a clean Win7 SP1 and running the rollup – hours and hours of delays..]
==
That’s because you probably have WU enabled at auto-check, or a background search session is already running
when you start the .msu installer, it’s actually doing/waiting the initial WU scan with servers until finished, then the stuck-search issue jumps in
afterwards it begin to install the package

Reply | Quote

That’s likely true. I simply took all the defaults – which includes WU auto update checked – when installing the rollup.

Reply | Quote

Try Check for updates, leave over night and install groups of updates, let’s say start with all designated Update and Important. At next scan, continue with all Recommended Updates if you wish to install them, but if you are looking for efficient scans, you have to install the Recommended updates. Their role is to improve Windows functionality (with telemetry or not). The few updates related to Windows 10 in Noel Carboni’s recent list can be skipped without negative side effects. When all those designated Updates (Important + Recommended) are installed, continue with all Security. Only when all the core updates including Security are done (leave Optionals out for now and decide later if you want them or not), you can move on to IE. Leave .NET for the final round.
If you will try the procedure outlined here, please let us know the results and how the scans perform after all is completed.

Reply | Quote

Thanks for that info, Doug.

It turns out I had the first two of those updates in my test VM, and the third one just went in with the latest Windows Update check.

I’ve found that there can be a lot of “false positives” in checking to see whether the “long update time” problem is resolved. It seems to go away after this or that update, then comes back when there is a significant list up updates the next month.

So we shall see whether things speed up in the future.

For now the SFC problem is bothering me most. The cause has been identified, and it’s probably innocuous, but I don’t like it at all that Microsoft breaks their own system integrity check…

http://forums.mydigitallife.info/threads/19461-Windows-7-Hotfix-repository/page1051?p=1231135#post1231135

-Noel

Reply | Quote

I have a question regarding the monthly roll up process. Will MS be replacing the individual updates with the update roll up or will individual updates still be something you can filter out? I’m just hoping that Win Update doesn’t become a process whereby all monthly updates are rolled up into one package and thereby presenting significant risk. Further if you deploy SP2, but want to rip out specific pieces, if memory serves me correctly it’s an all or nothing proposition, unless you dig into the MSI/MSU packages.

Reply | Quote

We don’t yet know. If it’s all non-security patches bundled together (as it is this month), just don’t check mark the bundle.

Reply | Quote

Noel, would the Internet connection speed or latency make a significant difference in the performance of Windows Update? Or maybe using proxy servers or firewalls blocking certain not so obvious communication? I noticed that the scan through enterprise proxy servers tends to take longer than direct Internet communication and I have no way to find out exactly what happens when communicating through that proxy.

Reply | Quote

It’s almost certain that the communications pathways could/would/will affect update speed, but when I watch Windows Update download data it’s actually quite sparse and VERY bursty.

I have a fiber connection myself, with quite low latency to most online servers and whether Windows update has completed quickly seems to have more to do with what the software on the local system decides to check/do.

Lastly, these servers are all involved with completing a Windows Update across the range of the various recent Windows versions (with something less than the whole list being contacted on any one system), so it’s not hard to imagine that some could be burdened while others not and the overall process be affected…

ctldl.windowsupdate.com
sls.update.microsoft.com
fe2.update.microsoft.com
ds.download.windowsupdate.com
fg.ds.download.windowsupdate.com
v4.download.windowsupdate.com
au.v4.download.windowsupdate.com
fg.v4.download.windowsupdate.com
fe2.ws.microsoft.com
download.windowsupdate.com
go.microsoft.com
http://www.microsoft.com
statsfe2.update.microsoft.com

-Noel

Reply | Quote

I did further research about the updates proposed by Noel to be avoided. While the list is complete and accurate, I identified 2 updates in the list which are telemetry related, but not Windows 10 Upgrade related.
• KB3068708 (Update for customer experience and diagnostic telemetry)
• KB3080149 (Update for customer experience and diagnostic telemetry)

Those 2 updates are also offered to Windows 2008 R2 Server which is used by businesses and not usually by individual end-users. They are indeed telemetry related and as such not desirable, but definitely not Windows 10 related.
It is up to everyone to decide if they want those updates or not, knowing what they do. They may have a useful functional role which is difficult to assess and as such may be useful.

Reply | Quote

Stay away from the update, it has a lot of issues, some listed here:

http://windows-update-checker.com/FAQ/ConvenienceRollupKB3125574-Issues.htm

Reply | Quote

Thanks for posting that information. I am struggling to build a new Win7 system. The convenience rollup appeared to work OK with another 66 and 50 odd updates to download. Before letting that happen, I ran sfc /scannow and the file corruption problem appeared. The cbs.log narrowed it down to the usbhub.sys.mui drivers but I had to stop at that point. I could not work out why a clean instllation had corrupted files…

I will wait for MS to sort it out!

Thanks again,

JB

Reply | Quote

Just noticed a fix has been released for the SFC Integrity issue caused by KB3125574….

https://support.microsoft.com/en-au/kb/3181988

Reply | Quote

I was curious to know if anyone actually slipStreamed the rollup into a Win7ServicePack1.iso; I am currently in the process of finishing just that but was wondering if I should just scrap that idea. After reading most of the posts here I have realized that there have been some issues with the rollup.

Please do let me know if anyone has had success with this process and if not what the errors were.

Thank you.

Reply | Quote

Yep. Caught it here:

http://www.infoworld.com/article/3122260/microsoft-windows/gwx-swept-away-as-pattern-emerges-in-windows-updates.html

Reply | Quote