Sidebar: Security Play: Windows Installer 3.0

Computerworld - Version 3 of Windows Installer ships with the next Windows XP service pack, which should launch in the summer of next year, says Steve Anderson, a director who oversees .MSI product management at Microsoft. New features are mostly targeted at easing security update headaches. They include the following:

• Smaller patches: Rather than replacing entire files, Windows Installer will execute binary scans to determine only what bits need to change before deploying an update. This will allow for smaller patch files. Microsoft claims MSI 3.0, combined with a new hot-patching technology to be released next year in Windows Server 2003 Service Pack 1, will reduce forced reboots by 30%. And because patches will be issued as .MSI package files, administrators or users will be able to uninstall them.


• Conveying prerequisites: The creator of an .MSI patch package can include information on the proper sequence for an installation, prerequisites and potential conflicts. The administrator can review this information before running the update.


• Smart sourcing: Files to be patched are not always installed on a given machine. Windows Installer will keep a "baseline version" of files on disk so users aren't prompted to get a product CD or find the network share containing the target files.

• Software Update Service 2.0: SUS is a version of the Windows Update service that runs inside the corporate firewall and operates as an intermediary between Windows Update and end users, allowing for more control over the release of patches and service packs to Windows machines. A new version, released concurrently with Windows Installer 3.0, will support all updates in .MSI format. SUS will fade into the background for end users, who will see only a Windows Installer interface that interacts with SUS in the background.


• Microsoft Baseline Security Analyzer: MBSA scans a target Windows machine's system configuration and security update status and can compare the results to the SUS server to determine which operating system updates are installed and which are missing. It will be folded into SUS 2.0, and its capabilities will be expanded to allow similar checks of Microsoft applications.