Automatically download all security updates for WinXP?

[MichaelD]

Is there a way to automatically download all security updates for WinXP? Say, some Microsoft page where you put in a date range and then you can download them all automagically?

I'm slipstreaming my next OS install and would like to have to download as few updates as possible after the fact.

Thanks.

 

[Arkainium]

I'm not 100% certain but I think you need to download each update manually. Some people have already done the work for you though; see xable.net and RyanVM.

 

[MichaelD]

Thanks, Arkainium. For some reason, I can't get the download link to work on the RyanVM page. I get a "No permission" error.

I downloaded the Xable one, but not sure how to use it. I see the folder w/all the updates in it, but it's a lot smaller than the list on Ryan's site and the Xable one has all kinds of weird programs and .dlls in the main folder.



*edit*
I found another download source for the RyanVM pack. Softpedia

 

[MustISO]

There's a program I use called Windows Update Downloader

wud.jcarle.com

 

[Arkainium]

I slipstream the Xable pack by using nLite and I'm not sure about RyanVM as I haven't used it myself but I think it includes its own integrator. As for why Xable is smaller, it's because it only includes the critical updates whereas RyanVM includes a lot of extras.

 

[MichaelD]

Thanks guys. I wound up just adding the whole RyanVM zipped file to the "updates and hotfixes" seciton of nLite, added a few basic drivers (RAID card) and that was it. It burned and verified fine.

I wish it was easier to integrate video card drivers. I mean, after you unzip the NVidia driver, which files do you put in for the driver?

But still, this speeds up the process of having a more updated/secure OS tremendously.

 

[zig3695]

http://windowsupdate.62nds.com/

 

[Schadenfroh]

Made this list (with download links) for you

 

[MichaelD]

@zig36995 :laugh: Everyone's a comedian these days.

@Schadenfroh :shocked: Wow, thanks a lot! That's some list! I'll compare it to the RyanVM update package (Revised Nov 07) and see what's different.

That was very nice of you. :gift: Have a great day.

 

[hclarkjr]

Originally posted by: MichaelD
Thanks guys. I wound up just adding the whole RyanVM zipped file to the "updates and hotfixes" seciton of nLite, added a few basic drivers (RAID card) and that was it. It burned and verified fine.

I wish it was easier to integrate video card drivers. I mean, after you unzip the NVidia driver, which files do you put in for the driver?

But still, this speeds up the process of having a more updated/secure OS tremendously.

video card drivers are hard to integrate with nlite, i tried a few time to no avail, ended up giving up and just install the latest after i have windows installed

 

[Bluefront]

Autopatcher did this exact thing for years. The last version contained every security patch and update after SP2 to August '07. After that, MS threatened to sue or something. You could install the whole thing (about 330mb) with a single reboot.

You still might be able to find a link somewhere.....it never had a problem the many times I used it. :brokenheart:

 

[dclive]

Originally posted by: hclarkjr

Originally posted by: MichaelD
Thanks guys. I wound up just adding the whole RyanVM zipped file to the "updates and hotfixes" seciton of nLite, added a few basic drivers (RAID card) and that was it. It burned and verified fine.

I wish it was easier to integrate video card drivers. I mean, after you unzip the NVidia driver, which files do you put in for the driver?

But still, this speeds up the process of having a more updated/secure OS tremendously.

video card drivers are hard to integrate with nlite, i tried a few time to no avail, ended up giving up and just install the latest after i have windows installed

I've routinely done video card integration - ati, nvidia, and intel. What problem are you having? Just make sure the appropriate inf is fully exposed, and it works fine.

 

[MichaelD]

Originally posted by: dclive

Originally posted by: hclarkjr

Originally posted by: MichaelD
Thanks guys. I wound up just adding the whole RyanVM zipped file to the "updates and hotfixes" seciton of nLite, added a few basic drivers (RAID card) and that was it. It burned and verified fine.

I wish it was easier to integrate video card drivers. I mean, after you unzip the NVidia driver, which files do you put in for the driver?

But still, this speeds up the process of having a more updated/secure OS tremendously.

video card drivers are hard to integrate with nlite, i tried a few time to no avail, ended up giving up and just install the latest after i have windows installed

I've routinely done video card integration - ati, nvidia, and intel. What problem are you having? Just make sure the appropriate inf is fully exposed, and it works fine.

I've actually never tried it yet; I'm just fearful that b/c there are so many files that make up "the driver" that it wont' work from just one .inf file being in there.

I want the NVidia Control Panel and all that jazz in there too...not just the driver. Did the whole thing work for you just by putting in that one .inf?

 

[gsellis]

I have not looked at this in years, but have you considered implementing WSUS? The systems update server would DL all the patches automagically. You then set them up for distribution. IIRC, I could get the patches out of the SUS library (I was experimenting with 1.0). Or instead, you can just have WSUS distribute them. I cannot remember if it is still free though.

Not SMS and not for distributed enterprises, but SUS did allow IT control of patch rollout from a known point. So it might help.

WSUS at MS

PS - I never found the old downloader to support ranges. I did make a request through my TAM that MS look at doing a functional view of patches. Example, enter "Exchange Server" and version, and it would list all relevant patches for that specific task and config.

 

[dclive]

michaeld - it works.

 

[gsellis]

Originally posted by: MichaelD

Originally posted by: dclive

Originally posted by: hclarkjr

Originally posted by: MichaelD
Thanks guys. I wound up just adding the whole RyanVM zipped file to the "updates and hotfixes" seciton of nLite, added a few basic drivers (RAID card) and that was it. It burned and verified fine.

I wish it was easier to integrate video card drivers. I mean, after you unzip the NVidia driver, which files do you put in for the driver?

But still, this speeds up the process of having a more updated/secure OS tremendously.

video card drivers are hard to integrate with nlite, i tried a few time to no avail, ended up giving up and just install the latest after i have windows installed

I've routinely done video card integration - ati, nvidia, and intel. What problem are you having? Just make sure the appropriate inf is fully exposed, and it works fine.

I've actually never tried it yet; I'm just fearful that b/c there are so many files that make up "the driver" that it wont' work from just one .inf file being in there.

I want the NVidia Control Panel and all that jazz in there too...not just the driver. Did the whole thing work for you just by putting in that one .inf?

As dclive confirms, it works. Make sure in pnpupdate path is set to the inf "store" (hklm\software\microsoft\windows\currentversion\devicepath). I used %systemdrive%\PNP as a directory and created some subdirs where required.

The only time this does not work is if it is a strong "software first" install and when the mfgr screwed up the driver or the inf (example - Synaptics touchpad uses the same PnPID as a generic IBM PS/2 mouse. The touchpad app will install on a set if this driver is in the path... without a touchpad. inf's get screwed up by hardcoded paths.)

If you do have a software first install, you can use a VB script to query the PnP ID and install if present. I attached a sample that I created to detect a Globtech/Moxa card. On 0 return, I execute the software install.

 

[gsellis]

hmmm... attach code did not work well

dim strfilename, t, strTempLine
const c1680 = "PCI\VEN_1393&DEV_1680"
const cMoxa = "PCI\VEN_1393"
On Error Resume Next
Set WshShell=WScript.CreateObject("WScript.Shell")
Set WshNetwork=WScript.CreateObject("WScript.Network")
Set fs = CreateObject("Scripting.FileSystemObject")

bWin2000 = False

strUser = WshNetwork.UserName

Set tempSet = GetObject("winmgmts:{impersonationLevel=impersonate}").ExecQuery("select DeviceID from Win32_PnPEntity")

if err then
err.clear
Wscript.Quit 0
End If

if tempset.count=0 then
Wscript.Quit 0
End If

For each Device in tempset
strTempLine = Device.DeviceID
sComp = Left(strTempLine,12)
nRtn = StrComp(cMoxa, sComp)
if nRtn = 0 Then
sComp = Left(strTempLine,21)
nRtn = StrComp(c1680, sComp)
if nRtn = 0 Then
Wscript.Quit 1
End if
End if
Next

Set tempSet = Nothing
Wscript.Quit 0

 

[Mattster]

Anyone tried this before? I've been using for quite a while and it makes life a lot easier when I build a new XP system for someone.

http://www.heise-security.co.uk/articles/80682

 

[MichaelD]

DClive - Thanks, I'll give it a shot.

Gsellis = Thanks for sharing the code with me. WSUS is a very good idea! Kind of embarassing that I didn't think of it as I use it/administer it at work. Heh, my bad.

When you say "set the pnp path to the store" do you mean "make sure that the inf file you choose comes from the same folder with the rest of the files, .dlls and such?

What I've done is use Winrar on the NVidia driver and just extracted it to a folder. I would get the .inf file from there, and Nlite would automatically add all the files for the control panel and such?

Thanks much!

 

[dclive]

You're doing it right - nLite will handle that for you.

 

[gsellis]

Originally posted by: MichaelD
When you say "set the pnp path to the store" do you mean "make sure that the inf file you choose comes from the same folder with the rest of the files, .dlls and such?

What I mean is that in the unattend/sysprep install, PnPUpdatePath (I think that is the sysprep key) is set include the path to where the inf is.

[Unattended]
OemPnPDriversPath = "pnp\Video;pnp;"

That information gets appended to the DevicePath registry location listed above as %systemdrive%\pnp\Video;%systemdrive%\pnp. Or basically c:\pnp and c:\pnp\Video. Your INF goes in there and usually all of the files with it. The CAT file is very important, but you usually can drop stuff like Readme unless you have a interactive install that calls it. Some inf's may specify other directories and you may have the inf in \pnp, but there will be a pnp\X86 directory.

Old drivers can have inf's that were STUPID. I have had to fix some that had hardcoded paths (ex A:\x86). Almost all of the drivers that have been around since SP2 are correct and don't hardcode carp.

 

[gsellis]

Originally posted by: MichaelD
What I've done is use Winrar on the NVidia driver and just extracted it to a folder. I would get the .inf file from there, and Nlite would automatically add all the files for the control panel and such?

Thanks much!

Forgot... what you have works. Just be careful to not zip drivers for things such as disk controllers, processor architecture, and network controllers that you would need before you could actually start adding to the install. Those need to be extracted or at least packed as Windows can handle them (Expand). Some of those are detected and installed before you would get a chance to uncompress them.

Me, my install, which is dated but it has been working since NT4 SP3, uses a cmdlines.txt file to set some reg settings and prep a auto login that runs a VB script on first interactive boot. The VB script does about everything you can do and manages the installation from that point. Basically, the same thing nLite does and sets up. nLite makes it real easy without having to read hundreds of pages of MS documentation.

The new SMS and Windows install kit setups are way cooler, but I moved over to security. No chance to play with them.

 

[MichaelD]

@Gsellis: You've got some serious Windows knowledge, my friend. It's great that you choose to share them and I appreciate it.

I'm going to redo my OS install disk as I left the vast majority of drivers out of it due to my ignorant fears. The MB I'm doing this disk for should be here soon; we'll see what happens.

Thanks to ALL that helped. :beer: