关于简化操作系统安全更新后的说明

  • Article

从2016年10月开始，操作系统安全更新发布模式有所变化（请参考之前博文）。原来针对每个受影响的操作系统组件，往往会有单独的安全更新修复。从10月开始，这些针对操作系统不同组件的修复，均集中在一个安装包中完成。

对于企业用户，更新管理系统中会出现Security Only Quality Update 和Security Monthly Quality Rollup这两大类安全更新。由于Security Monthly Quality Rollup 本身就涵盖了当月发布的Security Only Quality Update，细心的用户会发现从11月份开始，Security Only Quality Update被当月的Security Monthly Quality Rollup 所取代。这个取代关系是产品组综合评定下来确定的。

<更新> 2018年9月，Windows Server 2008 SP2也将采取这一模式，请参考博文。

<更新> 2016年12月5日（太平洋时间），产品组听取多方反馈后发布了最新确认信息。从12月开始，当月的Security Only Quality Update将不再被当月的Security Monthly Quality Rollup 所取代。届时对于11月份的安全更新，也会相应修改元数据（Metadata）。使用Configuration Manager 2007的用户将无需各种复杂变通方法来部署Security Only Quality Update。详细信息您可以参考产品组博文https://blogs.technet.microsoft.com/windowsitpro/2016/10/07/more-on-windows-7-and-windows-8-1-servicing-changes/

引文如下：

“UPDATE: 12/5/2016: In November 2016, the Security Monthly Quality Rollups were released as superseding the Security Only Quality updates. This resulted in an impact to customers deploying the Security Only Quality updates, using tools that cannot easily deploy superseded updates, such as System Center Configuration Manager 2007. Based on customer feedback, this supersedence has been changed in December 2016. Please review the updates below if this impacts your deployment scenarios. ”……

“UPDATED 12/5/2016: Starting in December 2016, monthly rollups will not supersede security only updates. The November 2016 monthly rollup will also be updated to not supersede security only updates. Installing the latest monthly rollup will ensure the PC is compliant for all security updates released in the new servicing model.

Note that installing just the security only updates may show the monthly rollup as Missing in compliance tools or reports, as the monthly rollup is also a “Security update”. If the security only updates are installed each month, the PC will have all the necessary security fixes released in the new servicing model.

As long as you install one or the other (security only update or monthly rollup), the PCs will have the needed security fixes released that month. ”

<更新> 2017年3月开始，每月仅安全质量更新不再包含Internet Explorer的累积安全更新。详细可以参考英文博客中的图表。这里摘录图表如下。

最后需要提请注意的是，推荐您尽早安排针对Security Monthly Quality Rollup 的测试。 因为它除了修复安全问题，还提供了系统稳定性的重要修复。有了它，您的系统才能既稳定又安全地运行，您今后的合规检查校验也将更为容易。