App tests for Win XP SP2 burden users

Most delay installing XP security update

Microsoft Corp.'s Service Pack 2 is an important security-focused update for corporate users running Windows XP. But in the three weeks since its release, it's been a tough pill for many to swallow, as they struggle to test tens, hundreds and, in some cases, at least 1,000 applications against it.

Only two of 32 IT managers who responded last week to a Computerworld survey conducted via e-mail and telephone said their companies had deployed SP2, and in both cases they did so as part of Microsoft early-adopter programs. The majority said they're still testing SP2 to determine its compatibility with the applications their companies run.

"As we get closer to the holidays, we don't make changes of this significance because we don't want to disrupt our environment so close to our peak season," said Mike Jones, CIO at Circuit City Stores Inc. "While I'm happy to see that Microsoft has put out SP2 in response to known issues and weaknesses over time, it just doesn't work out timing-wise for us."

Jones said the Richmond, Va.-based retailer won't deploy SP2 until the first or second quarter of next year. And he was hardly alone in determining that the SP2 deployment will have to wait at least four months.

Fifteen of the 26 respondents who now have at least some XP in their desktop environments indicated either that they would wait until next year or that they had no near-term or set plans for SP2. The remainder said they plan to deploy SP2 when they complete testing, with three of them saying they expect that will be within two months and another within four months.

"We are very concerned about this service pack breaking some of our applications," said Bill Lewkowski, CIO at Metropolitan Health Corp. in Grand Rapids, Mich. "In fact, we had one of our vendors give us notice that their applications would not work."

That vendor was McKesson Corp., a San Francisco-based provider of health care applications, he said. Lewkowski added that he isn't sure when Metropolitan will finish testing SP2, since it will need resources and money that hadn't been budgeted. He said the IT department will work with its more than 400 vendors, but he isn't sure it will ever get to the point where it can deliver SP2 to its users.

But Steve Kleynhans, an analyst at Meta Group Inc., said his firm is advising companies to roll out SP2 as fast as they can. He said he expects it will take most companies four to six months to complete the certification and engineering process to prepare for the rollout. "SP2 is mandatory. You don't have a choice," he said. "Anything in the future is going to be built on SP2."

Yet the application compatibility problems that some companies are encountering can be difficult to work through. John LaBrue, a team leader in distributed computing at OGE Energy Corp. in Oklahoma City, said some applications that the IT department tested broke because of the new Windows Firewall.

"There are methodologies in place to disable the firewall, and we have deployed those in our test environment. We are still having issues," LaBrue said. "So it's not alleviating the problems we are experiencing."

LaBrue said OGE also has several custom applications for mobile data that are in a "broken state." Its Citrix Systems Inc. application also failed, but staffers stumbled upon a fix that worked, even though it wasn't designed for that problem.

In addition to concerns about application incompatibility and firewall issues, DHL Worldwide Network SA/NV is worried about SP2's size making it cumbersome to deploy to users who may be connected via slower network links, according to Meg Plummer, director of front-end services at the international courier.

The full SP2 package checks in at about 265MB, according to Microsoft. The average download is expected to be much smaller because of "smart download" technology that installs only what users need. For XP Professional, the SP2 download is expected to be about 100MB, Microsoft said.

Preemptive Moves

Some companies have had to disable Automatic Update to make sure users don't download SP2 before they've had a chance to test their applications. John Foley, a network planning analyst at Werner Co. in Greenville, Pa., said that even though his company distributes security updates through an internal server, he made a change to the group policy setting in Active Directory to block users from downloading SP2 via Automatic Update or Windows Update.

Companies that rely on instructing users to disable Automatic Update run the risk of experiencing frustrating consequences. According to a source at a manufacturing firm who requested anonymity, two users there downloaded SP2, despite messages instructing them not to install it. Now the machines won't boot and must be fixed.

But SP2's timing will work well for some companies. Allstate Insurance Co. expects to start rolling out Windows XP on April 1 next year, so the company is doing SP2 and XP application compatibility testing at the same time.

Still, that's no small undertaking. Kevin Rutherford, a workstation strategist at the Northbrook, Ill.-based company, said Allstate has about 1,000 applications to test.

So far, Greg Lavigne, an Allstate systems consultant, has already observed that the insurer's WRQ Reflection terminal-emulator software has been flagged by Microsoft on a Web page carrying the headline "Some programs seem to stop working after you install Windows XP Service Pack 2."

Jon Murchinson, a Windows client product manager at Microsoft, said customers should take advantage of SP2's enhancements right away. But the company also recognizes the need for application compatibility testing, he said, and it recommends that customers test SP2 in a closed environment before rolling it out to their entire enterprises.

Copyright © 2004 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon