Distribution of Microsoft Security Updates

[landsharkbark]

I was wondering if anybody has any guidence on if I should or shouldn't try distributing Microsoft Security Patches in my install. The specific install is for MS08-040.

It doesn't seem to be as "smooth" as a normal service pack install and have had some bumps just getting it on regularly.

Just looking for advice on if this is or is not recommended.
Thanks

[KathyMorey]

Personally, I would think the answer would be a resounding "no". I believe our customers would be a bit upset if we installed something that wasn't ours, especially something from Microsoft that they might want to test before deployment throughout their organization. If your software requires a particular update from Microsoft to function properly, I think a better practice would be to document that as a prerequisite and possibly detect and abort if the required update is not present.

[Christopher_Pai]

I've been on the other end of that spectrum. The question to ask is your installer a Product or a System?

The subtle distinction is important. In many industries ( Government and Military to name couple ) there is an expectation from clients for a very comprehensive/integrated deployment story. I've worked on 'systems' where a CD/DVD is going to be shipped somewhere in the world where there isn't exactly going to be many external resources available. Everything they could possibly need to deploy the system needs to be on that media; whether the ISV EULA allows it or not and whether best practice suggests it or not.

But otherwise I agree with Kathy. If you are just the typical ISV shipping a product, steer clear of these little landmines.

[landsharkbark]

Thanks for the input.

Just to kind of answer "is it a Product or System" question you possed...

We distribute our CD to a larger field force, some under our control and some not. Our corporate network group is pushing us to distribute this update, because they do it to all the corporate environment.

So it is a like your statement about is it a Product or System. To the control group it is like a System, to the non-controlled group it is a Product.

[HennoKeers]

landsharkbark wrote:
Thanks for the input.

Just to kind of answer "is it a Product or System" question you possed...

We distribute our CD to a larger field force, some under our control and some not. Our corporate network group is pushing us to distribute this update, because they do it to all the corporate environment.

So it is a like your statement about is it a Product or System. To the control group it is like a System, to the non-controlled group it is a Product.

I would point out that patches from MS also get new revisions, to get rid of introduced bugs.
If you decide to distribute such a patch, then you also could be distributing a bug from MS.
Your corporate network group should know that there are much better ways to deal with patches, for example with WSUS or SCCM2007.

Reg, Henno

[Christopher_Pai]

I agree, in the context of an enterprise, they should push the patches and your install could have a SystemSearch\LaunchCondition to require it have been done before you install.

[Install_guy]

@HennoKeers

What about a scenario where you have users who need those hotfixes and are not on the domain, but are still employees?

This is the scenario that we are currently facing, we periodically send out Hotfix CDs to some of our users, and this needs a setup.