Follow Slashdot blog updates by subscribing to our blog RSS feed

 


Forgot your password?
Close
typodupeerror
×
Windows Operating Systems Software Security IT

DIY Service Pack For Windows 2000/XP/2003 197

Posted by kdawson from the patch-it-yourself dept.
Karsten Violka writes "Looking for manageable Windows updates even without an internet connection? Heise's script collection Offline Update 3.0 downloads the entire body of fresh updates for Windows 2000, XP, or Server 2003 from Microsoft's servers in one fell swoop and then uses them to create ISO-Images for CD or DVD. Included is an intelligent installer script that allows you to update as many PCs as desired." Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.
This discussion has been archived. No new comments can be posted.

DIY Service Pack For Windows 2000/XP/2003 More

DIY Service Pack For Windows 2000/XP/2003

Comments Filter:

  • yeah, that's real safe (Score:3, Insightful)

    by ILuvRamen ( 1026668 ) on Tuesday December 12, 2006 @04:42PM (#17213308)
    Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.
    yeah, that's just so terribly safe compared to not having it...except that now there will be like a million fake isos floating around the internet saying they're the latest batch of windows updates and people who are too lazy to make the iso themselves will install the fake, spyware and trojan infested ones.

    • Already been done in a better form (Score:5, Informative)

      by cHiphead ( 17854 ) on Tuesday December 12, 2006 @05:25PM (#17213976)
      Its called Autopatcher and its WAYYYY sexier. Lots of installable extras and sexy registry patches to make windows life easier.

      http://www.autopatcher.com/ [autopatcher.com]

      • Re:Already been done in a better form (Score:5, Informative)

        by MCraigW ( 110179 ) <craig AT mcraigweaver DOT com> on Tuesday December 12, 2006 @06:49PM (#17215458) Homepage
        I've been using Autopatcher for quite some time now, and I'm quite happy with it. It also has some extra utilities that it will install if you select them, and the ability to make various UI tweaks. I find it is a nice way to install everything on a new PC. I download the latest version, write it to a CD and take it to the new PC. The new PC never has to be connected to the internet to get the latest MS updates.

      • Re: (Score:2, Interesting)

        by sbben ( 983577 )
        Same with Nlite, located here http://www.nliteos.com/nlite.html/ [nliteos.com].

        I believe a vista version was release as well known as vlite. I have not used either but they look very promising, I have been meaning to try out nlite for the next time I reformat but maybe I will try one of these alternatives instead. Any one out there used them all?

      • Re: (Score:2, Insightful)

        by NorQue ( 1000887 )
        If I understood the information on the website correctly autopatcher is just a collection of the latest MS updates from a third party. With the offline update scripts from Heise you're able to create your *own* autopatcher collection from scratch. No middleman involved.

  • Well Einstein (Score:2, Informative)

    by El Lobo ( 994537 )
    1) Who says that you must download it from an unpatched PC?

    2) The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?

    3) What else will we whine about now... the versatility of Macintosh hardware?

    • Re:Well Einstein (Score:4, Funny)

      by joe 155 ( 937621 ) on Tuesday December 12, 2006 @04:46PM (#17213382) Journal
      "The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?"

      I would say your second guess of 2 is closer than your first of 0... shall we split the difference and agree at 1?

      • would say your second guess of 2 is closer than your first of 0... shall we split the difference and agree at 1?
        bool hack_probability=1;

        I guess there is good reason to be careful.

    • Re: (Score:3, Interesting)

      by truthsearch ( 249536 )
      Home desktops aren't usually behind firewalls. A new PC gets connection attempts from evil scripts and viruses within seconds of plugging it into the internet. Even with a high speed connection it takes quite a long time to download and install all of the Windows updates on a new PC. So the chances of getting infected are quite high.
      • Comment removed based on user account deletion

      • Re:Well Einstein (Score:4, Insightful)

        by Vellmont ( 569020 ) on Tuesday December 12, 2006 @05:19PM (#17213886) Homepage

        Home desktops aren't usually behind firewalls.

        That may have been true 10 years ago, but these days most home PCs are at least behind a NAT. Unless you've gone out of your way and configured your NAT to forward all ports to your PC (i.e. a DMZ), outside attacks will be quite useless. The only threat in this case is the user downloading a virus from email, or visiting a compromised website. If you run windows update (well, several times) before you do either of those things, there's no danger.

        • Re:Well Einstein (Score:4, Interesting)

          by Shakrai ( 717556 ) on Tuesday December 12, 2006 @05:24PM (#17213966) Journal

          That may have been true 10 years ago, but these days most home PCs are at least behind a NAT.

          Umm, I'd have to disagree with that statement. Around here the biggest provider of internet connectivity for home users is Roadrunner. They provide you with a cable "modem" that acts as a bridge between their network and your PC. The PC gets a globally valid address.

          In fact the only Roadrunner home users I know (not counting geeks/techies) that have NAT routers are those that have more then one computer. Otherwise it's right into the PC and come and get it boys cuz I'm wide open!

          • but they're in the minority now.
            They provide you with a cable "modem" that acts as a bridge between their network and your PC. The PC gets a globally valid address.
            That's true, but there's a large percentage of people with more than one computer/game console/etc in their household, and roadrunner only provides one IP address unless you want to pay big money for business class service. Those people will buy a cheap NAT router at best-buy and plug it in so they can get more than one computer connected to th

            • Re: (Score:2)

              by Shakrai ( 717556 )

              That's true, but there's a large percentage of people with more than one computer/game console/etc in their household, and roadrunner only provides one IP address unless you want to pay big money for business class service. Those people will buy a cheap NAT router at best-buy and plug it in so they can get more than one computer connected to the internet.

              I don't disagree with you on that. I just disagree with your original statement of "most" home PCs being behind a NAT. Being the only techie at my com

        • Most home PCs are behind NATs? Personal ones? I find it impossible to imagine that most non-technical people are asking for routers/gateways when they purchase their PCs. Especially when they're only purchasing one PC and therefore don't require a NAT. Do you have any evidence?

          • I find it impossible to imagine that most non-technical people are asking for routers/gateways when they purchase their PCs.
            Most of them don't know what the hell it is, they just want something that'll allow them to connect multiple computers on the same internet connection.

            Do you have any evidence?
            Just my own experience. It really doesn't take much of any technical experience to setup a NAT. Your average interface-jockey can certainly plug the thing into the cable modem, and plug his computers into the l

            • Re:Well Einstein (Score:4, Funny)

              by IdolizingStewie ( 878683 ) on Tuesday December 12, 2006 @06:50PM (#17215472)
              Your average interface-jockey can certainly plug the thing into the cable modem, and plug his computers into the lan side.

              I want your users. I lost internet access three times last year because some dumbass down the hall plugged his router in backwards and was trying to NAT the whole damn building.


              • I want your users. I lost internet access three times last year because some dumbass down the hall plugged his router in backwards and was trying to NAT the whole damn building.
                Heh. Well I didn't say they understood what's going on at all. In their own home they can only screw up their own crap (and when it doesn't work, they plug it in the other way). In a public LAN they're dangerous as hell.

                I had a similar problem a few years ago when some damn fool miss-configured his router with the same IP address

          • Re: (Score:2)

            by shmlco ( 594907 )
            Jumping in, the Qwest DSL modem (Cisco) we received for home use was preconfigured to automatically put us on an internal NAT w/DHCP running.

            So yes, evidence exists.

      • Re: (Score:3, Informative)

        by Shakrai ( 717556 )

        Home desktops aren't usually behind firewalls

        Depends on your service provider. In my experiences most DSL providers use NAT routers -- even for single PC connections. Most cable providers seem to use bridges and your PC gets a globally valid address, which tends to be a problem for a Windows PC.

        Then there's dialup users. But if you have to use dialup to do a complete set of Windows updates on a brand new PC it's an even money bet that you'll die from old age before they finish and in this scenario wh

        • Re: (Score:2)

          by Firehed ( 942385 )
          Depends on your OS too. If it's a new PC, it has XP SP2 installed. Which has a firewall that's enabled by default.

          I don't know if it's any good or not, but my understanding is that it should keep you covered at least until you get all your patches. Chances are that if you're confident enough with computers to have reformatted the thing for whatever reason, you have more than one in active use and thus a hardware firewall via your router.

          Not to mention anyone with a wireless connection will have a wireles

      • Re:Well Einstein (Score:4, Funny)

        by Klaidas ( 981300 ) on Tuesday December 12, 2006 @05:26PM (#17214004)
        Well, the safest thing to do it to simply turn the computer off, remove the CPU, dig it in the yard and lock the rest of the computer in a safe.
        Although, script kiddies might still be trying to infect it...
      • Even with a high speed connection it takes quite a long time to download and install all of the Windows updates on a new PC. So the chances of getting infected are quite high.

        Would that be a new PC running the current version of Windows, namely XP Service Pack 2 where the firewall is installed by default?

        How is that going to get infected please?
    • The probability that an unpatched PC behind a firewall will get "hacked" in the moment while you are downloading it is what... 0,2?

      I've personally seen a Windows 2000 system get railroaded because it got bad DNS from a malicious DHCP server in the real world. Visit windows update, ends up feeding you a bogus IP, redirects you to someplace that owns you.

    • I thought the idea was somewhat far-fetched, too... that is, until I was infected by Blaster wiithin minutes of my first boot, before I had a chance to download the service packs or a firewall (my router was acting up, so I was directly plugged into the cable modem.) So yeah, it happens, and I don't think I'm the only one it's happened to, either...
  • Does MS offer a cd with patches? Even for download (or would that violate DRM/DMCA/DigitalDarkAges laws/technologies)?

    I know Apple offers their patches as download, complete with SHA1 sig.

    • Re: (Score:2, Interesting)

      by phantomcircuit ( 938963 )
      They used to offer a CD that they would MAIL you for free (around 2002) but stopped doing that. (no reason was given for why they stopped).
      • Er, they have Windows XP SP2 [microsoft.com] available. That came out well after 2002 IIRC.

        I didn't look around more for other newer patches, but they might be doing that as well.

    • Re: (Score:2, Informative)

      by SuneSpeg ( 662034 )
      It seems like people are totally unaware of the lovely thing from M$ called WSUS (Windows Server Update Services). Which is a local server that works as an update proxy. It saves tons of bandwidth and time!
  • This sounds like a useful script. I know people who manage Windows Updates for corporate networks, and they've mentioned these sorts of ISOs before. Effectively, it allows an admin. to read the KB articles on microsoft.com and pick-and-choose which updates to make available to the corporate network. There's a lot of updates! A backup ISO of the updates you've chosen to make available allows you to easily rebuild the update server if anything happens to it, and to build update servers for other networks base

    • Re: (Score:3, Informative)

      by LurkerXXX ( 667952 )
      I don't know any admin who would use these for a corporate network. ISOs are typically a thing you use when you only have one or a handful of individual machines to update. WSUS [microsoft.com] makes things easy to customize for what computer receives what individual patches without messing with DIY patch ISOs. WSUS Server chaining, replicas, or offline updates allows you to copy settings to other WSUS servers without worrying about 'backup ISOs' of what you have selected. It does it all for you.

  • Danger? (Score:5, Insightful)

    by dedazo ( 737510 ) on Tuesday December 12, 2006 @04:49PM (#17213438) Journal
    Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.

    A "danger" that is eliminated with a rinky $25 NAT router.

    • Thankyou. Or you could just slap a decent firewall on there from a USB key before you hook it up to the net. It's what I do when a client gets a new rig they want me to setup.

      • Re: (Score:3, Insightful)

        by AliasTheRoot ( 171859 )
        Or plug in the Ethernet cable after you have turned on the firewall built into XP - assuming you aren't using a SP2 install where it's enabled by default.

    • Re:Danger? (Score:5, Informative)

      by LodCrappo ( 705968 ) on Tuesday December 12, 2006 @05:07PM (#17213710)
      A NAT in front of your windows box does do a lot to prevent trouble while you're patching up a new install. As long as you immediately get up to date (before using the machine for anything else) then I'd think this is fine. The problem is people who rely on a NAT device for some sort of security *in place of* security patching. Many exploits work just fine through NAT if you're actually using the machine to surf the web or read email, and way too many people seem to not understand this.

      • Torrents (Score:3, Interesting)

        by shmlco ( 594907 )
        "Many exploits work just fine through NAT if you're actually using the machine to surf the web or read email, and way too many people seem to not understand this."

        Or connect to a torrent server. Watch the number of attacks on your PC's FW skyrocket the instant you run BT and connect to a tracker. Lot's of hackers run torrent servers just to mine the connection information and find new, unprotected computers to attack.

  • autopatcher has been doing this for a while now (Score:5, Informative)

    by schnikies79 ( 788746 ) on Tuesday December 12, 2006 @04:49PM (#17213442)
    i keep a up-to-date copy for my dialup friends, which most are.

    Autopatcher! [autopatcher.com]

    • Re: (Score:3, Insightful)

      by Fëanáro ( 130986 )
      autopatcher is a closed source solution which requires you to trust executables from a dubious source. Even if you accept the autopatcher guys as currently trustworthy, they may still sell out or get hacked with much higher probability than microsoft.

  • Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates.

    Or you could just buy the firewall you really should have anyway and be done with it. Seriously, I can't imagine anyone would try to argue that it's acceptable to put a server out on the net without a firewall in front of it, so why should a desktop PC be any different? That way you get to protect your unpatched Linux box too.

    • Re:Or just buy the firewall you should have anyway (Score:5, Insightful)

      by mcrbids ( 148650 ) on Tuesday December 12, 2006 @05:04PM (#17213666) Journal
      Perhaps the key difference is this:

      I can put an unpatched RedHat Linux system on the public Internet and download patches without worrying about it. In fact, I routinely use such systems AS the router/firewall for other systems!

      If you hear people around here saying things like "Windows is insecure and/or isn't really ready for the Internet", that's because it's true, or you wouldn't need that stupid $25 router in the first place!

      The fact that you can't even imagine a server without a dedicated firewall in front of it speaks volumes.
      • Good luck to you and your unpatched Redhat, it doesn't have the volume of attacks a Windows box has - but don't assume it won't get rooted - it will.

        It has always been good practice to have a firewall, or at least a NAT router in front of any server, be it Redhat / Windows / BSD / OSX / Solaris whatever. Thats only one piece of the puzzle of course, but a very important one.

        However, for your average desktop machine there has to be a balance between security and usability, a balance that the builtin firewall

        • Re: (Score:2)

          by mcrbids ( 148650 )
          Good luck to you and your unpatched Redhat, it doesn't have the volume of attacks a Windows box has - but don't assume it won't get rooted - it will.

          As I recall, it takes an average of about 3 months for an unpatched RedHat box to get rooted, if left up in its default config and unpatched. Can't find a link - but there was a honeypot project on this a while back. And somehow, I doubt that even at 28.8 Kbps, it would take 3 months to complete an update.

          However, patch the system, and apply reasonable "best pr

          • Re: (Score:2)

            by shmlco ( 594907 )
            such as NOT having the password of "god" for the root account

            Is it time for the obligatory 1-2-3-4-5 luggage joke?
          • 3 months average doesn't mean that it'll definitely happen in 3 months. It could never happen, it could happen in 5 minutes. You are taking a gamble every time you go online if you aren't behind some kind of firewall.
            • But it's reasonable to expect not to be rooted in the two or three hours it takes to get all the patches you need, if the mean time to failure is three months.

              • Re: (Score:3, Insightful)

                by KillerBob ( 217953 )

                But it's reasonable to expect not to be rooted in the two or three hours it takes to get all the patches you need, if the mean time to failure is three months.

                That's up to you. But please don't take it as an offense if I say that I'd never hire you as a sysadmin.

                Ask yourself this... is the 5 minutes it takes to set up basic firewalling (or even simply shutting down any daemons you're running) worth the extra time you risk if you have to reinstall the computer? Banking on averages is never a good idea, espec

      • Comment removed based on user account deletion
      • >or you wouldn't need that stupid $25 router in the first place!

        Or you know, the windows firewall that came with your xp system. Enable it. Block printer and file sharing ports on the local lan (MS default). Now download your updates.

      • Re: (Score:2)

        by Tim C ( 15259 )
        I can put an unpatched RedHat Linux system on the public Internet and download patches without worrying about it.

        Friend of mine did that until he realised that it'd been rooted a few weeks ago. Fortunately he didn't lose anything important, but it cost him an evening to work out what had happened then reformat and reinstall.

        Don't assume that Linux is impervious to attack, as it most certainly isn't.

        The fact that you can't even imagine a server without a dedicated firewall in front of it speaks volumes.

        Yes -

  • nLite (Score:5, Informative)

    by Nasarius ( 593729 ) on Tuesday December 12, 2006 @04:59PM (#17213574)
    I've been using nLite [nliteos.com] and RyanVM's update pack [ryanvm.net] to do this for a while now. Great stuff, even works with my Dell OEM version of XP.

  • nlite (Score:4, Interesting)

    by Danathar ( 267989 ) on Tuesday December 12, 2006 @05:03PM (#17213656) Journal
    nlite does almost the same thing and is much more flexible and easier to use

    http://www.nliteos.com/ [nliteos.com]

    • Re: (Score:2)

      by OAB_X ( 818333 )
      Well ...... its not the same. nLite requires windows to be re-installed to do that patching (via the RyanVM patch), this is designed to be a patch utility that does not require re-installing windows.

      Assuming it works of course, nLite does indeed work, this box is running via an nLite made windowz disk. (with RyanVM updates and driverpacks drivers slipstreamed)

  • Check out RyanVM too (Score:2, Informative)

    by SteWhite ( 212909 )
    For anyone interested in this sort of thing, you might also want to check out RyanVM:

    http://www.ryanvm.net/msfn/ [ryanvm.net]

    This allows you to produce updated Windows installation CDs, that actually have the service packs and post-service pack hotfixes *already integrated into the installation*. This saves the extra time normally taken to install Windows *then* go apply all the updates.
  • ...a Windows zealot slagged for saying "How are you supposed know how to configure support in *nix if you can't get on the internet to do it?" Seriously...

    "Sounds like a great idea, given the danger of putting an unpatched PC on the Internet to download security updates." - Who the heck said you should connect the unpatched machine to the 'net to grab this stuff? FFS, I bet ol' Karsten would go to town of the Windows zealot for playing stupid. ;)

    • Re: (Score:2)

      by Jerf ( 17166 )
      Who the heck said you should connect the unpatched machine to the 'net to grab this stuff?
      Actually, that is a good question. Who did say that?

      Could it be... you?

      (Clearly the point is that you use a patched machine to make the CD, then feed the CD to an unpatched machine, resulting in 0 unpatched machines on the raw internet.)
  • This is a useful tool for my particular environment where we use RapiDeploy to re-image boxes. The image gets a little stale and we have to go through a quarantine network before our Cisco Clean Access authenticates us--we're essentially in a leper colony while we're trying to catch up on patches. It's a bit of a catch 22.

    Having the patches on hand would really help when we don't have a little router on hand on field calls.

  • Yes but... (Score:2, Informative)

    by kosmosik ( 654958 )
    Yes but no Polish (or any other than few) language version is supported. So it is useless for me.

    It just shows how retarded update management is in Windows. It is like 10 years behind Linux and 5 behind OSX. And Vista is no different either.
  • I wish the big Linux distros would start doing this. Being unable (or unwilling) to patch a linux box without a broadband connections is one of my biggest pet peeves with the current crop of distros.

    • If you use synaptic (for debian and friends) it will create a download script which is just a file with a bunch of "wget url" lines in it, where url is a full URL to a .deb package.

      Personally I save this file to my USB key which has a windows wget.exe on it, and name the file whatever.cmd. Then I just put the usb key in my windows machine, double-click the file, and bingo! It downloads the packages. If I save the selection file as well, then I can copy the files to the distfiles location, load the selec

    • just how up to date do you feel you need to be?

      debian do a "point release" every so often which includes security updates among other things and when they do so they build both new full CD/DVD images and a set of update CDs (they don't seem to yet do update DVDs but i've just suggested it ;) ).

      If you really wan't the latest updates you can always take a copy of the relavent directories on security.debian.org and burn it to a CD/DVD.

  • What about Microsoft? (Score:3, Interesting)

    by febuiles ( 743020 ) on Tuesday December 12, 2006 @05:21PM (#17213918) Homepage Journal
    I wonder what Microsoft thinks about this, right now I'm downloading updates that I wouldn't be able to get since I don't use a legal version of their software.

    Thank you :D

  • Comment removed (Score:4, Informative)

    by account_deleted ( 4530225 ) on Tuesday December 12, 2006 @05:52PM (#17214482)
    Comment removed based on user account deletion
    • > No, I'm no Microsoft fan but let's stick to facts
      > rather than "science fiction" FUD stories...

      These are not SF FUD stories. There are a lot of people who:
      - don't know shit about security
      - don't know shit about patching
      - own USB xDSL modem or connect to *untrusted* network with wifi or something similar (do you carry a $50 router with your laptop?)
      - use computer to Just Work With it - as a tool - you know

      And Windows is not uber-user-friendly there. In fact I think you need to be relatively skilled t

    • Re: (Score:2)

      by Eskarel ( 565631 )
      Actually I connected a freshly reinstalled XP box up to the internet(my disk is really old so it's pre SP1 and I didn't have a copy of SP2 lying around), without installing the firewall and AV software before I connected to the internet(I was tired and stupid at the time). On 8/1 ADSL my PC was pwned to the point that I couldn't download any files(including spyware scanners) that weren't corrupted before I could finish getting the windows updates. This was through a NAT router with no open ports. Without at

  • Well, it can be, but doesn't have to. Behind a decently-configured firewall, the machine can download patches without any connections from the outside getting through. YOU might ruin things by initiating connections to non-trusted sources, but that's your fault, not the OS. Of course, the security of other machines on the same network is important, but it's easy enough to maintain a seperate, firewalled network for "fresh" machines, or any sort of machine you're not sure of.

    steve
  • I prefer UpdateHF.vbs

    Once you've installed Installer 3.1 and BITS2 , it downloads and installs all the updates from the Windows update site

    http://www.wsus.info/forums/index.php?showtopic=68 31 [wsus.info]

  • Comment removed (Score:4, Insightful)

    by account_deleted ( 4530225 ) on Tuesday December 12, 2006 @07:31PM (#17216146)
    Comment removed based on user account deletion
  • I just tried it, selected Windows 2K english, per selected platform. It instantly pops up a CMD window with a wget error:

    Starting download (v. 3.02)
    Copying Microsoft registry console tool...
    Downloading Microsoft ifmember tool...
    Can't timestamp and not clobber old files at the same time.
    Usage: wget [OPTION]... [URL]...

    ERROR: Download failure.

    Press any key to continue . . .



    Looking at the components it's not clear if there's an erroneous parameter passed to wget or something, as several thing

  • I made a service pack 7 for Windows NT some while ago, but it is still in late alpha. When this installs, it does so as "Revised service pack 6A". Still, i use one further patch file to deliver updates, like the 2k3 NTLOADER / NTDETECT.COM, sol.exe and cmd.exe from Windows 2000, and a few other "fixes".

    There are, none the same, a number of useful projects to slipstream fixes etc into both OS/2 and Windows.

    One might for OS/2, try UPDCD, and compare this with the various Windows versions: NLITE, HFSLIP,

Slashdot Top Deals

For God's sake, stop researching for a while and begin to think!

Close