Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If a user sets their Windows 8/7 computer to automatically accept and install updates from Windows Update, what prevents this from being a vector of viruses? Is setting user's computers to automatically accept and install updates a recommended policy for sysadmins?

share|improve this question
up vote 3 down vote accepted

The two primary things are that your host will be connecting to Microsoft to do it and the updates are digitally signed.

While it is true that an attacker could potentially poison your DNS or your upstream DNS to fool you into going somewhere else to obtain updates, unless those updates are signed with a valid Microsoft code signing certificate, they will not be accepted.

Keeping up to date is very important. A few years back it was realized that a few keys that could be used for signing updates such of this could be derived from other certificates (improperly configured certificates) on the systems. These certificates, however, were revoked and changes were made (that are applied in Windows 7/8) to require longer certificate key lengths.

share|improve this answer

The recommended policy for Sysadmins is to test Windows updates in their environment before deploying them to users.

For home users, using well known applications, the best policy is to apply updates automatically.

How can I be sure that updates are safe to install?

Windows uses Secure Socket Layer (SSL) to encrypt the transfer of system information and updates between your computer and the Windows Update Web site. Each file that you download using Automatic Updates has a digital signature from Microsoft. Digital signatures are designed to ensure the authenticity and integrity of signed files. Automatic Updates will not install files that do not contain the correct digital signature.

Source: Automatic Updates: Frequently Asked Questions

share|improve this answer
@Ramhound I've updated my answer to deal with both the original questions. – David Marshall Feb 8 '14 at 13:21

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.