Since Microsoft started promoting the free upgrade to Windows 10, changes have occurred in Windows Update. I'm a true believer in not installing anything that I don't know that my system needs. This means that I have installed very few optional updates, only the "Platform Update for Windows 7" and other optional updates required to install Internet Explorer 11. This means that no updates pertaining to the "free Windows 10 upgrade" or the Windows Update Cient itself have been installed.

As a side note, the updates to the Windows Update Cient are among the "critical/important" updates but they remove the Windows Update Icon from the Notification Area. Don't ask me why the Icon is removed but I like the Icon to be there so, I omit those updates too.

I download the updates manually to the computer and install them off-line. Before installing the new batch of updates, I restore the Ghost Image from previous month and afterwards, I create a fresh Ghost Image. This means that the Windows Update Client is the same as when installed in 2011. There's no problem installing a batch of updates with a single reboot when done.

However, during the month, when Windows Update checks for updates, strange things happen.

My system has an AMD Phenom II, quadcore 3 GHz and 4 GB RAM.

When the computer is started and Windows Update checks for updates, there's a process "TrustedInstaller" and an instance of svchost.exe that combined use 25% of the CPU and several GB of RAM. Total RAM usage is up to 75%. It goes on for some 25 minutes and when done, CPU usage drops to "idling" and RAM usage to 17-18%.

If I try to manually install updates when this "process" is running in the background (not initiated by yours truly), I get to the first one but the second hangs until the "process" has been terminated. Well, I can terminate the "wsus process" and restart the computer between each update but what the heck ... ... ?

Prior to "Windows 10 promotion", a run of Windows Update took approximately a minute or a few at most.

On a second startup, when Windows Update doesn't check for updates, the computer settles at 25% RAM usage with no excessive CPU usage.

Is there anyone out there with the same experience?

Any thoughts?

NightOwl

Quote:

I don't recall ever visiting Woody but I may have forgotten about it. I'll follow the link later. For now, I'll respond to your quotes.

Quote:


Those two updates pertain to the "free Windows 10 promotion" and are optional which means that I don't have them installed. I have tested them and with the latter, a new Icon in the Notification Area appears - a blue/white Windows Flag nagging about Windows 10. The updates were removed by restoring an Image.

Quote:


That's my conclusion too. It started in August with KB3075851 which in September was replaced by KB3083324 and in October by KB3083710. They seem to be monthly revisions of the same disaster, sorry ... ... update, which means that we have not seen the last one. I have tried them all with the same result (loss of the WU-icon in the Notification Area). They were all uninstalled by restoring an Image.

NightOwl wrote on Oct 17^th, 2015 at 12:52am:


No, if referring to "Microsoft Compatibility Appraiser under Application Experience", I don't have it. I believe that task is linked to KB2952664 (which checks the system for Windows 10 compatibility) and possibly KB3035583.

On my system, after restoring an Image, without any of the mentioned updates installed, the process "TrustedInstaller" and an instance of svchost.exe appear as soon as the computer has been connected to the internet and WU has been run. The problem problem seems to be dumped on me in the background.

Quote:


Since I don't uninstall but restore an Image, the update history is unaffected.

Quote:


Those pre-August updates were "optional". I didn't notice the "WU Client updates" until KB3075851 was made "important" from August. As I mentioned, I never install or even look at all the "optional" updates.

Quote:


I ask the same question and my own answer is ... ... MS-spyware.

Quote:


That's interesting! It was on the same day that the October batch of updates was released. I wonder if it was while KB3083324 was still the most recent (prior to installing the new batch) or if the October version, KB3083710, had been installed?

I should always have the Icon showing because in Control Panel > Notification Area Icons, the check box to "Always show all icons and notifications on the taskbar" has been checked since "day one".

Quote:


I don't have the Diagnostic Tracking Service.

I think that GWX is the "Get Windows 10" task/service which is installed by KB3035583. It can be disabled by a regedit.

NightOwl wrote on Oct 17^th, 2015 at 12:52am:


I believe I have covered it all above but if I have missed something, please ask again.

NightOwl wrote on Oct 17^th, 2015 at 12:52am:


They are not in my update history. They have, from August been installed, one after the other when released but always "removed" by restoring an Image.

NightOwl wrote on Oct 17^th, 2015 at 12:52am:


Nope, never heard of it. I only have "TrustedInstaller + an instance of svchost.exe that I have identified as
culprits. When the RAM-usage drops to normal, TrustedInstaller goes away from the Taskmanager but I haven't counted the number of instances of svchost.exe.

NightOwl

Christer wrote on Oct 16^th, 2015 at 6:04am:

Well, on a second or third thought, it probably isn't. Since the computer is a Virgin, Windows Update is of the version that searches for updates to Windows only. After the cumbersome procedure described above, the first step I take is to install Microsoft Security Essentials and with that, Windows Update is upgraded to search for updates to "Windows and other products" (or whatever it says in English).

The plot thickens ... ... and when I find the time, I'll restore an Image and let the computer connect to the internet to run Windows Update without MSE.

NightOwl

I've been at Woody's and read the entry on the October updates (MS-DEFCON 2: Time to get Windows Update locked down again). A comment made by Ed indicates that installing one of these udates to the Windows Update Client, cures the resource hogging and lenghty search for updates but at the expence of the Icon in the Notification Area. I'll check it out!

EDITED:

I initiated a run of Windows Update. It took ~8 minutes, used 25% CPU and total RAM-usage was 72%.

I installed KB3083710 and restarted the computer.

After the usual few minutes of waiting, the WU-Icon appeared in the Notification Area.

I initiated a run of Windows Update. It took ~17 minutes, used 25% CPU and total RAM-usage was 46%. This was the first run with the updated Client. I restarted the computer.

After the usual few minutes of waiting, as expected, the WU-Icon did NOT appear in the Notification Area.

I initiated a run of Windows Update. It took ~8 minutes, used 25% CPU and total RAM-usage was 44%.

On my system, it seems like a choice of "plague or cholera". Less RAM-usage but loss of the Icon in the Notification Area.

The jury is still out. It will be 24 hours after the latest run of WU until it runs automatically upon starting the computer. Prior to installing KB3083710, this has taken ~25 minutes. I'll find out tomorrow if there's an improvement.

"Other than disabling the Diagnostic Tracking service and running the GWX control panel ..."

"I think that GWX is the "Get Windows 10" task/service which is installed by KB3035583"

For the benefit of lurkers, let's clarify that GWX and GWX Control Panel are two different things. GWX is Microsoft's "Get Windows 10" update, which MS tries to sneak in with other Windows updates into your 7 or 8.1 system. GWX Control Panel is a no-install, third-party utility to check and prevent MS from sneaking GWX into your system. GWX Control Panel is a vital tool to make sure your system is not being upgraded to Win 10 behind your back.

I agree with NightOwl that Windows Update has become a disaster. For me it reached that point a few years ago, before the current GWX debacle. For about 3 years now, I've been turning Windows Update completely OFF on all the systems I support. I gave up on the "Let me choose" option when MS started sneaking certain updates by and auto-installing despite the "Let me choose" setting. Turning updates completely off seems to have prevented that kind of problem, though I'm not entirely confident MS can't still slip something through if it wants.

In lieu of online updating, I've been instead using WSUS Offline Update. (I'll describe this utility in a separate post for those who wish to know more.) One key feature of WSUS Offline is the ability to blacklist updates you don't ever want installed. So rather than playing cat-and-mouse games with Windows Update, I just blacklist them in WSUS Offline and they never get installed.

Some may argue that my delayed-install strategy doesn't get legitimate updates installed in a timely manner, but for me that's an acceptable tradeoff. Historically, my pristine system has proven to be at greater risk from Microsoft than from random hackers on the internet. Given the number of bad updates MS has pushed out in recent years, I prefer to let others be the guinea pigs before I install an update on my system.

(Okay, full disclosure time: I even quit using AV on my own system over a year ago. After hearing that experts like Steve Gibson and Bruce Schneier don't use AV on their personal systems, I gave it some thought and realized that my system has never been infected and it's been years since I've even heard a peep from any of my AV programs. I don't recommend this for everyone, but for those of us who are overly cautious the risk of malware infection seems so low that we can get away relying only on backup images if anything bad happens. It took me a year before having the guts to finally pull the plug, but I did a little over a year ago, and have had absolutely no problems.)



I like Christer's Reply #3. That's the same strategy I've been using since before the release of XP-SP3 8 years ago, although I reimage annually instead of monthly. My philosophy is that because Microsoft constantly issues patches and then patches to those patches, I prefer to wait more than one month for MS to get it right before I install anything and in the long run I should end up with a cleaner system.

Like Christer, my strategy is to make a clean install, include programs I know I'll always want to keep, then store away an image. Throughout the subsequent year I may add updates and additional programs, but may decide some of those new programs aren't worth embedding in my pristine image.

At the end of the year I make a note of which programs are keepers, then restore the year-old image, update Windows, add back in the new programs I decided to keep, and reimage. Similar to Christer, my pristine image never actually touches the internet. Windows updates are applied via WSUS Offline.

Once a system is compromised, you can never be 100% certain you'll get every bit of the malware cleaned out. But by using Christer's and my strategy, we can have a high degree of confidence that--at least once a year (or month, in Christer's case)--our systems are completely free of viruses, malware and backdoors after this kind of "scorched earth" restore.

Dan Goodell

Quote:

It takes a few hours to go through the "cumbersome procedure" and I have considered doing it less often, maybe quarterly or biannually but you do it annually ... ... which indicates that I am overdoing it.

My Ghost-HDD is partitioned in 4, 2 for W7 and 2 for XP (dualboot). When one partition (for each OS) gets full, I reformat the other (holding older Images) and use it as the target for Ghost. This means that I have some 5-10 Images to roll back. Hopefully, any and all issues have been noticed and fixed within that timeframe.

Space is, however, becoming a problem since the W7 installation has grown from 13313 MB (january 2011) to 32404 MB (october 2015). The size is according to Ghost, less the pagefile. I have not installed any programs of significant size and that 143% growth ... ... is, more or less, caused by updates to Windows and Office!

(To compare, the size of the XP installation has grown from 5935 MB to 10138 MB, a 71% growth.)

I'm aware of the Disk Cleanup Wizard addon, I have tested it but didn't install it "permanently". After running it, there was a significant reduction of used space, at the time some 5 GB. Do you have that update installed and if so, do you use it?

Regarding specific updates, I don't examine or vet each one, and don't pretend my blacklist is comprehensive. I follow a few Windows forums, and if there's a lot of chatter about a particular KB then I'll add it to my blacklist. For starters, there's a good list here concerning the ongoing GWX and telemetry fiascos.

I skip the "activation technology" updates (both Windows and Office) on principle. The activation technology built into Windows when it was shipped ought to be enough, and I'm not happy with Microsoft conjuring up new ways to sniff around my computer. If my copies of Windows or Office weren't legitimate, the original activation technology built into them would catch that, so why does the activation technology need an update? Is the update for my benefit or Microsoft's?

Furthermore, there are constant, recurring discussions online from people with legit installations suddenly being flagged as illegitimate. Since most people install every update, I wonder what role the activation updates might play in this. If an update is making the process more aggressive, perhaps it's generating false positives. My installation is legit, Windows says it's activated ... that should be end of story. What benefit for me could there possible be in any "activation technology update"?



Quote:

I'm not an expert on the Windows update process, but I don't think most updates are uninstalled when obsoleted by a subsequent update. And even when a particular .dll is updated the former version isn't deleted, it's archived so it can be reverted to if the superceding update is rolled back.

In contrast, if obsolete updates were never applied in the first place, then they're not going to get installed when you eventually get around to updating--that's whether you do it by WSUS Offline or online Windows Update. Only the latest patch will be installed. (In fact, I've watched the files in my WSUS Offline cache when I refresh WSUS and have noticed KB updaters getting *removed* when they've been obsoleted.)

For example, if throughout the year MS pushes out updates A, B, C and D, each one superceding the former, then my annual method might get only update D embedded in my pristine image. Your method might get B and D embedded. Everyone else (those who never revert to a pristine image) will get all four updates embedded.

That's the kind of bloat I'm trying to avoid by waiting longer before updating my pristine image.



Quote:

The installation on the machine on which I'm writing this is 13GB, and has been updated through Jun 2015. I don't have Office on this particular machine so that would account for some of the difference, but a big portion of the difference between your installation and mine will be orphaned files and other detritus left behind by superceded updates.



Quote:

Yes, I have it installed, but running it makes practically no difference on my system. It has had dramatic results on some of my customers' systems, though, in some cases recovering 8 or 9 GBs.

NightOwl

Christer wrote on Oct 17^th, 2015 at 8:37am:

I restored an Image and let WU run "as it was", checking for updates to Windows only. The first run was in terms of CPU- and RAM-usage, similar to the previous ones. However, on the second run, WU updated the Windows Update Agent to 7.6.7600.320. That's the version I get when installing MSE but still for Windows only. It made no difference concerning performance and CPU-/RAM-usage.

I restored my Image once more. I uninstalled KB2990214 (on Dan's blacklist) since it was the only update, pertaining to the Windows Update Client, that I had installed. Next, I installed MSE and connected to the internet to get the updates. When that's done, it takes a while longer for WU to complete its search. KB2990214 did'nt reappear, only KB3083710 which is the most recent update to the Windows Update Client. Again, no difference in terms of performance.

Weird, right? If there's any logic to all this, the Windows Update Agent is the prime suspect in the meaning that all this happens on the other side of my firewall.