XP SP2 still causing costly IT headaches

Users installing security update by themselves wreak havoc

Robert Jaques, vnunet.com 16 Nov 2004

Four months on from Microsoft's launch of Windows XP Service Pack 2 (SP2), network managers are still experiencing "costly headaches and lost productivity" as end users wreak havoc attempting to install the upgrade.

According to Mani Sridharan, vice president of business solutions at network and system management firm Business Oriented Software Solutions, the most common problems are caused by non-IT staff trying to install the security patch themselves on networked computers.

Other firms reported issues after buying new computers for their corporate networks with SP2 already installed.

"It's a trade off," said Sridharan. "You can have the new security in the Windows XP environment, but the price you pay is having to deal with some of the compatibility issues."

Further problems are caused by the Windows XP feature that allows users to have Microsoft download and install the 'patches' automatically.

Sridharan explained that most of the problems seem to relate to the automatic installation of Windows Firewall, which is part of the SP2 upgrade.

He warned that, although it does a good job of keeping out hackers and malicious code like viruses and spyware, Windows Firewall sometimes restricts legitimate traffic like remote management, peer-to-peer networking, FTP or Microsoft IIS connectivity and general web browsing.

Sridharan added that file and print sharing features are not enabled in the default implementation.

"Windows Firewall blocks activity on most ports by default. This is a good feature, but it breaks many applications because they need some specific ports open for communications," said Sridharan.

"To allow native and third-party software to run, you must identify and then construct and implement a rule in the software to open the port or ports that each application requires.

"The average end user does not know how to do that and even the more tech-savvy users don't know where to get the information they need to do that."

Many users who do not know about the compatibility issues will waste hours trying to fix the problem themselves, Sridharan explained, before they even call their help desks for assistance.

"That puts a big productivity drain on corporations," he said. "The users are supposed to be doing other productive tasks for the overall good of their business instead of wasting a lot of valuable time trying to fix problems they don't really understand."

After Microsoft made SP2 available in August 2004, some of the hardware and software compatibility issues surfaced.

In September, Microsoft extended the time that businesses can block SP2 from downloading automatically until mid-April 2005, to allow companies time to test the update.

"The best solution is to implement SP2 enterprise-wide with the necessary ports/applications open on each for proper communication," said Sridharan.

"This enables enterprises to have complete security on the client side without letting SP2 'break' user applications and cause disruptions in productivity and an unnecessary burden on the already over-extended tech support staff."

See also: