Update to Supersedence Behaviour for Security Only and Security Monthly Quality Rollup Updates

Further to my recent post about Changes to Software Updates on Down Level Operating Systems for ConfigMgr Admins there has been some changes to how the updates are superseded based on feedback for Windows 7, Windows 8.1, Windows Server 2008 R2, Windows Server 2012, and Windows Server 2012 R2. The official update is explained here More on Windows 7 and Windows 8.1 servicing changes.

UPDATE - there has been some misunderstanding about this post. Note that the way updates are bundled has not changed - simply the way they are superseded which affects the way they can be applied using WSUS or Configuration Manager. See More on Windows 7 and Windows 8.1 servicing changes for details of those changes.

Last month when updates were released, contrary to expectation of organisations using WSUS or Configuration Manager;

  • The Security Only Quality Update for October was superseded by the November Security Monthly Quality Rollup for November
  • The Security Only Quality Update for November was also superseded by the November Security Monthly Quality Rollup for November

Visually, this was the supersedence relationship for updates last month (red are superseded):
[caption id="attachment_4395" align="alignnone" width="750"]November Update Supersedence November Update Supersedence Relationships[/caption]

This resulted in customers using WSUS or Configuration Manager 2007 being unable to deploy Security Only Quality Updates using the built in software update mechanisms without additional workarounds.

Based on feedback, the team has updated the supersedence relationship of updates so that Security Only Quality Updates are not superseded. In addition, the logic of the updates has been modified so that if the Monthly Quality update is installed (which contains the security updates), the security update will not be applicable. This allows organisations managing updates via WSUS or Configuration Manager to:

  • Selectively install Security Only Quality Updates (bundled by Month) at any time
  • Periodically deploy the Security Monthly Quality Rollup and only deploy the Security Only Quality Updates since then, and;
  • More easily monitor software update compliance using Configuration Manager or WSUS.

An update to previous Security Only Quality Updates will be released as meta data only for the changes to take effect which will require a Software Update (or WSUS) synchronisation.

Visually, this is the new supersedence relationship as of December (red are superseded):
[caption id="attachment_4405" align="alignnone" width="749"]December Update Supersedence December Update Supersedence Relationships[/caption]