0

It comes to my attention that not all installers are aware of each other (Windows Update, vs some hotfix and service pack installers) and block concurrent execution.

For example, I'm able to run Windows Update Security fixes and Exchange Server Rollup updates at the same time.

Given that example and that it's entirely possible for a poorly written patch to overwrite a runonce registry key (instead of append a multi-value string), I wonder if it's possible for an administrator to unknowingly render a security patch useless due to concurrent patching.

My question is when it known to be safe (or explicitly unsafe) to run patches in parallel, or to not reboot after each patch (running the necessary cleanup actions)?

2

The phrasing your question is very confusing. "Is it ever safe to install patches in parallel on a Windows OS?". Yes, sometimes it's safe. Is it always safe and is it easy to know those 'sometimes'? No.

In the Windows Registry, there's a sub-key called PendingFileRenameOperations. It handles situations where certain operations are performed on files while being locked and performs them when the files are released, and, more specifically, after a reboot. Windows Update installations (including security fixes independently installed security bulletins) make extensive use of this feature in order to apply those patches/fixes. "What could go wrong?", you ask. Well, let's see this example:

  1. You installed Security Fix #1 which contains (amongst other things) File_A version 0.3 which should replace your locked File_A version 0.1, the operation is added to the Pending File Rename queue (mentioned earlier).

  2. Without a reboot, you installed Security Fix #2 which contains (amongst other things) File_A version 0.2 (vulnerable), because your file is locked, the operation is added to the queue (remember, at this point, before the reboot, you still have version 0.1 of that file).

  3. After you reboot, the queued operations are executed on your file in their respective order. File_A is first replaced with version 0.3 and then replaced with version 0.2 (vulnerable).

Had you rebooted between those two fixes, installer would have been able to check the version of the actual file on disk and prevent version 0.3 from being replaced by version 0.2. Since the file on disk is actually 0.1, the installer had no concerns.

Microsoft has a neat little tool called Qfecheck which goes through the installed security fixes and updates and makes sure that they're properly installed and no such situation has occurred. When used in a big environment in batch, it's very useful for generating automatic reports on the patch status of all computers in a corporation.

But wait, there's more! Microsoft also has another very neat tool called QChain. It makes sure that you always have the latest version of the file in the pending operations queue. Here's how to use it:

  1. Run your updates with the -z switch to prevent reboot.

  2. Run QChain.exe

  3. Reboot.

That's it!

2
  • I can't find a Qfecheck source for the newer Windows versions. Additionally, they seem to have retired the download link for XP and prior. Oct 17 '13 at 8:39
  • @RohanDurve Apparently, Windows 7 has it's own mechanism to check for proper update installation, that's why the Qfecheck isn't needed there anymore. Honestly, I've never used Qfecheck, I've always just ran QChain.exe after installing the fixes on the isolated Windows Servers I used to maintain.
    – Adi
    Oct 17 '13 at 8:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.