WSUS: When is a superceded update not a supercededupdate

I had always assumed that cumalative updates for IE would mean that previous updaees wouldn't bee needed. Look at the reports it shows some of the old IE CU as still being neeeed. The same also seems to apply for the Outlook 2003 Junk Mail Filter. You can download the most recent ones but the old ones are stil needed.

There are some updates which are shown both as being superceded and as superceding other updates. What's that all about? Surely an updateshould be superceding until it is no longer needed.

One of the issues with patch management is that, theoretically, you should only apply patches to things that are relevant ...

Unfortunately it is common now for a 'cumulative update' to include patches that may or may not be needed, but are included to add extra protection just in case. This is definitely the case with M$ patches ... and it means that if you build a new WSUS box then you will have lots on superceding and superceded patches. It even happens from month to month depending on whether you have access to hotfixes.

The general practice of accepting everything and wait for WSUS to say "no need to do this one" actually works ... but don't forget to decline whatever gets left behind.

What you'e saying makes sense Tony but to me cumalative means containing everything that came before.

You can only rely on that being true with Service Packs.

Cumulative may just mean a combined update, some of which may supercede previous updates ... not actually containing previous updates.

The cumulative updates were introduced to allow for the applying of multiple patches at a single time, as well as only including certain files a single time if they were required by multiple patches (ie common files, dlls, etc).

In the depths of M$ Technet there is a very good article on patch mangement that seems to have disappeared wince SUS/WSUS came on the scene ... I can't even get the search engine to bring it up ... but a similar one is on techrepublic somewhere (too lazy to search this late at night).

I did my list this morning of superceded patches, cleared about 40 out, these included a few very old Junk Mail ones, Windows Defender, Exchange IMF and some other definitions, Sasser, Blaster and some other dection tools which are now superceded (after 2 years!) and some other btis, shame it doesnt delete them from the system as well....