Microsoft explains new crop of automatic downloads

Microsoft is attempting to clear the air with users after a fresh rash of reports of unauthorised downloads.

The company issued two postings regarding incidents of applications installing updates without notifying users.

Most Windows PCs are set by default to check for and install any Microsoft updates automatically. For stability reasons, some users choose to disable this option and manually install updates after extensive testing.

Members of Microsoft's OneCare development team issued a statement regarding reports of the security application altering Windows Automatic Updates settings.

The Windows Secrets newsletter had reported that OneCare forces Vista to install all updates automatically, and warns the user of a security risk if the update setting is changed back.

Microsoft confirmed the report, but said that it was done only to protect users from attack.

"OneCare is built for people who do not want to worry about protecting and maintaining their PC," said the team. "This behaviour is by design and is not unique to the latest version of OneCare."

The team said that it would listen to feedback, but did not give any indication that the practice of changing automatic updates settings would be abandoned any time soon.

In what the company told vnunet.com was an unrel ated case, Microsoft also acknowledged reports of Windows Desktop Search performing updates on networked machines without administrator approval.

Bobbie Harder, programme manager for Windows Server Update Services (WSUS), said in a blog posting that the issue arose from an optional update first posted in February 2007.

The update had originally been intended only for machines that had Desktop Search already installed. Last week, an updated version of Desktop Search was released as well.

However, the update had been packaged for download as a revision of the February release.

Harder said that WSUS has a feature that will automatically download revised versions of any update.

Because of this, the desktop search update was automatically downloaded and installed by WSUS on Windows Server 2003 and XP systems.

As a result, machines which had not been previously authorised to use Desktop Search received the update anyway.

Harder apologised to users and said that WSUS would not be distributing the Desktop Search update until the issue could be resolved.