Windows Server 2003 SP1 Blocker Toolkit: Frequently Asked Questions

Windows Server 2003 SP1 will be delivered through Automatic Updates starting July 26, 2005.

The blocker toolkit is available as of June 21, 2005.

Microsoft strongly urges customers not to disable AU because AU provides the ongoing delivery of critical and security updates to all AU-enabled systems, and disabling AU can potentially leave these systems more vulnerable. Windows Software Update Services (WSUS) allows IT professionals complete control over deployment of updates to their systems. Microsoft has specifically created these tools to safely disable and re-enable delivery of Windows Server 2003 SP1 to systems in organizations that cannot use SUS, SMS 2003, or another update-management solution.

This is not recommended because it would stop delivery of all critical and security updates to the organization—not only to Windows Server 2003 systems but to all supported versions of the Windows desktop and server operating systems.

Because the delivery-disabling mechanisms being provided by Microsoft rely on a new registry key that is used only for purpose of disabling and re-enabling delivery of Windows Server 2003 SP1, there should be no additional impact or side effect on the system. No additional testing should be necessary to validate the mechanism.

HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate

The key value name is "DoNotAllowSP."

If the value is '1' delivery of Windows Server 2003 SP1 through WU/MU and AU is disabled. If the value is not '1' or if the key doesn't exist, the system will be able to get Windows Server 2003 SP1 if the Windows Update site is accessible or if AU is configured to get updates from Windows Update.

No, this mechanism only blocks delivery of Windows Server 2003 SP1 from WU/MU or directly through AU (if customer is not using SUS). Windows Server 2003 SP1 can still be deployed using SUS, SMS, and other methods while the blocking mechanism is activated.

It is essentially a small program that accepts one of two command line options (disable and enable) and creates or removes the registry key that controls the ability to deliver Windows Server 2003 SP1 to the system via AU or WU/MU. It is signed by Microsoft, so the operating system knows the executable is provided by Microsoft and is therefore trustworthy.

The sample script is a simple wrapper for the signed executable software that allows specification of the name of the system on which the executable should be run. The system name is specified as a command-line option.

The Administrative Template (.adm file) allows administrators to import the new group policy settings to block or unblock delivery of Windows Server 2003 SP1 into their Group Policy environment, and use Group Policy to centrally execute the action across systems in their environment.

The mechanism will work until March 30, 2006, one year after the release of Windows Server 2003 SP1. After March 30, 2006, WU and AU will ignore the presence of the registry setting and will deliver Windows Server 2003 SP1.

After March 30, 2006, AU and WU will ignore the presence of the registry setting, and deliver Windows Server 2003 SP1 automatically to all systems configured to receive updates automatically using AU and WU/MU.

The tool will work without modification on any language edition of Windows Server 2003.