After a couple of years of rattling around its release cage, Microsoft settled on a monthly patching pace that’s largely worked.
First Tuesday (“A week”):
Non-security (installed) Office patches
Patch Tuesday (“B week”):
Cumulative Updates for Win10
Monthly Rollups for Win7, 8.1, Server 2008, 2008 R2, 2012, 2012 R2
Security-only versions of those Monthly Rollups
.Net patches (recently removed from the main patches)
Many additional patches
Third Tuesday (“C Week”):
“Optional non-security” Win10 Cumulative Updates
Monthly Rollup Previews for Win7, 8.1, Server 2008, 2008 R2, 2012, 2012 R2
Sometimes the Third Tuesday patches don’t appear until the Fourth Tuesday (“D Week”), but that’s unusual (except for Win10 1809, which is a different kettle of fish).
To be sure, there are loads of bug fixes along the way. We’re starting to see fixes for bugs introduced in the Win7/8.1 patches appear in the next month’s Monthly Rollup Previews. Win10 bug fixes can be handled by one-off “silver bullet” patches (which don’t appear in the official monthly reports) or by CYA patches which can appear at any time.
Things don’t always work out according to plan. Last August, for example, saw a delay in Windows and .Net patches until the Fifth Thursday of the month. We never did hear precisely why the patches were delayed, but they came out in full fury — security, non-security, bug fixes, the lot. I figured it was due to the proclivity of ‘Softies to take August off and the massive lot of self-inflicted bugs that accumulated in July and August.
Now it appears that history is repeating itself. April had the usual round of First Tuesday non-security Office patches, and Patch Tuesday Cumulative Updates, Monthly Rollups, and Security-only patches. There were bugs galore — most notably the conflict between many popular antivirus programs and (at least) six patches.
But there’s been nothing since Patch Tuesday. Third Tuesday (“C Week”) came around with no fixes. Now Fourth Tuesday (“D Week”) passed by with nary a fare-thee-well.
We don’t even have the usual excuse for a delay in the Win10 version 1809 second cumulative update. It’s no longer in the Release Preview Ring, having been bumped by its unwashed sibling, version 1903.
@abbodi caught sight of KB 4499418, which is apparently the second April Cumulative Update for Win10 version 1607 (the ancient LTSC version), but it only appeared fleetingly on the Windows Update server. Gone now.
To be sure, Microsoft’s under no obligation to ship the second round of cumulative updates on a Tuesday. The official Windows 10 update servicing cadence post from ‘Softie John Wilcox promises:
The “C” and “D” releases occur the third and fourth weeks of the month, respectively. These preview releases contain only non-security updates, and are intended to provide visibility and testing of the planned non-security fixes targeted for the next month’s Update Tuesday release. These updates are then shipped as part of the following month’s “B” or Update Tuesday release.
(thx, @warrenrumak)
But the same document says:
IT managers should be able to plan for a simple, regular and consistent patching cadence. You shouldn’t need to stop what you’re doing to test and deploy an update. You should be able to plan a time, well in advance, to work on new updates. You also shouldn’t have to memorize multiple release schedules; the Windows release cadence should align with that of other Microsoft products.
And there’s the rub. “Normal” Windows users may be oblivious to all of this, but I assure you that admins all over the world are wondering what in the blue blazes is going on. As patching ace Susan Bradley puts it:
Second Tuesday has been predictable. We will get updates. We will see side effects. We will wait. The C/D releases are NEVER predictable. Some come on C some on D, some come on Tuesday, some "D" week actually slid into the A week of the following month.
You have to wonder what’s lurking. The problem has to be bad enough to hold off on Win7, 8.1, Server, and all Win10 versions — every version of Windows. But, according to the Marquis of Queensbury rules, it shouldn’t include security patches.
I guess we’ll find out.
We’re waiting with bated breath on the AskWoody Lounge.