News

Microsoft Explains 'Update Rollups' for Windows 8, Windows Server 2012

Microsoft this week detailed the difference between "cumulative updates " and the monthly "update rollup" system it uses for Windows 8 and Windows Server 2012.

According to Microsoft's explanation, a May update rollup for Windows Server, for example, will not contain the prior April update. Instead, users have to install those earlier update rollups first. Moreover, each update rollup may be "chained" to other updates in a parent-and-child-dependency scheme.

The update sequence and dependencies get addressed automatically for organizations or individuals that have turned on Windows Update, or for those who use Microsoft's Windows Server Update Services or System Center Configuration Manager management solutions. Otherwise, those who manually install these updates have to figure out all of those complexities, Microsoft explained.

Microsoft claims that it only will create an update rollup to address a "significant event," such as software flaws or data losses. The company also claims that "update rollups are not security related and are intended to improve the overall performance and reliability of Windows." Update rollups are different from the security fixes that Microsoft releases on the second Tuesday of every month. However, Microsoft is still expecting IT pros to test update rollups every month -- just the same as the monthly security bulletins it issues.

"It is expected that these updates [update rollups] can be distributed and tested using the same procedures that are used for the monthly Security updates so as to not significantly increase the burden on IT staff," Microsoft explained.

Microsoft seems to be having an ongoing debate with itself about whether to include security patches within an update rollup, but the definition of update rollups in Microsoft's standard terminology does include the phrase "security updates." Moreover, Microsoft's definition of an update rollup sounds a lot like a service pack, as other observers have noticed. Cumulative updates are different still, as they essentially are a collection of past update rollups.

The debate looks to get even foggier as Microsoft has been talking about quarterly release cadences for some of its newer server software in the coming year.

Microsoft now refers to an "upgrade" as a complete product replacement, whereas an "update" refers to "collections of new features," according to reporting by veteran Microsoft watcher Mary Jo Foley in reference to coming "Windows Blue" updates. Windows Blue is expected to appear as a public preview near Microsoft's Build developer event next month, but descriptions are ill defined at this point. However, Microsoft explained this week that it won't charge extra for the Windows Blue updates for its Windows 8 customers.

Foley cites a Microsoft Technical Fellow as explaining that these updates to come aren't technically service packs in chunks.

"One of the fundamental mindset changes with the move from 'Service Packs' to 'Updates' has been that the primary value of Updates is new value -- and sure we'll fix a lot of bugs too, but that's not the focus," explained Brian Harry, Microsoft Technical Fellow and product unit manager for Team Foundation Server, as cited by Foley.

In any case, it looks like IT pros may face a quarterly pace, at minimum, for testing for the various Windows updates to come, regardless of name, in addition to monthly security patch testing.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • Microsoft Dismantles RedVDS Cybercrime Marketplace Linked to $40M in Phishing Fraud

    In a coordinated action spanning the United States and the United Kingdom, Microsoft’s Digital Crimes Unit (DCU) and international law enforcement collaborators have taken down RedVDS, a subscription based cybercrime platform tied to an estimated $40 million in fraud losses in the U.S. since March 2025.

  • Sound Wave Illustration

    CrowdStrike's Acquisition of SGNL Aims to Strengthen Identity Security

    CrowdStrike signs definitive agreement to purchase SGNL, an identity security specialist, in a deal valued at about $740 million.

  • Microsoft Acquires Osmos, Automating Data Engineering inside Fabric

    In a strategic move to reduce time-consuming manual data preparation, Microsoft has acquired Seattle-based startup Osmos, specializing in agentic AI for data engineering.

  • Linux Foundation Unites Major Tech Firms to Launch Agentic AI Foundation

    The Linux Foundation today announced the creation of a new collaborative initiative — the Agentic AI Foundation (AAIF) — bringing together major AI and cloud players such as Microsoft, OpenAI, Anthropic and other major tech companies.