HP 4320t Using Microsoft® Baseline Security Analyzer 2.2 and Windows& - Page 20

Good News about WES 7 Quick Fix Engineering (QFE) Releases Fortunately, most WES 7 QFEs download and install from the C:\Windows\SoftwareDistribution\Download folder. This means that it may not be necessary to modify the environment variables for monthly QFE updates. No data is available from Microsoft about the requirements for available TEMP space for any given QFE, so individual QFEs may behave differently, depending on how the feature team at Microsoft developed and delivered the package to the Windows Update team. The rule of thumb is that most monthly QFEs do not require modification of environment variables in HP thin clients, but watch out for large packages and feature upgrades such as IE, WMP, or .Net Framework. Disk Space Concerns A flaw in the Microsoft QFE strategy for WES 7 is the lack of a nobackup switch for QFEs. In XP Embedded, Microsoft QFEs could be passed a /nobackup argument that would prevent the QFE from creating a backup folder on the disk (typically in the C:\Windows folder). This was helpful in preventing the limited disk space on thin clients from filling up over time. It is unclear if Microsoft will implement the /nobackup switch option for individual WES 7 QFEs, or if QFEs downloaded and installed via Windows Update will automatically have the /nobackup option enabled. HP will continue to engage Microsoft to improve this scenario in WES 7. Because the nobackup switch is not available, QFEs can also be uninstalled. This is also a major change in behavior in Windows Embedded QFEs. HP will not test and qualify all of the permutations of the install/uninstall scenarios around MS QFEs. It is recommended that QFEs only be uninstalled if there is cause to believe a regression or issue is a direct result of a QFE installation. HP Windows Update Perspective HP officially discourages customers from using Windows Update because of the known limitations with the Microsoft implementation. The client pull servicing schema that Windows Update offers is not consistent with the way thin clients are typically serviced industry wide. A server push schema is the more deterministic and successful way to manage thin clients in the enterprise environment. For all the virtues of the client pull servicing scenario, risks are still involved with user managed devices. Best examples are: • Users can opt to not install QFEs for vulnerabilities, if they don't want to (disable WU or change settings to ignore availability notices). • Microsoft does not guarantee that QFEs and updates will not harm or conflict with your system or configuration. • Administrator rights and privileges are required. 20