Download MSSE items many times

[DJW]

I just used 8.7.2 to get try the October Windows 8 updates that Win 8 says are available. I'm not sure it's managed that but what I wanted to point out that WSUSUpdate downloaded the 80Mb mpam-fe.exe at least 5 times. It looks like it evaluates the request for MSSE updates for every section/OS version. The log file doesn't show the download size so it's easy to overlook, and I lost count, but I suspect the run I just did caused the download 5 times! (400+MB!!)

Maybe the MSSE evaluation should be done last. Why it did it during the OXP update analysis I can't quite imagine

Thanks for providing the utility. I find it very useful.

Cheers - Dave

[boco]

That's actually MS's fault. MSSE definitions are distributed to multiple mirrors, and these mirrors very often contain different files. Unfortunately the wget tool always re-downloads files if the sizes differ from the local ones and ignores dates in that case.

Other mirror = possibly other file = re-download

Wash, rinse, repeat. Not only does it waste a lot of bandwidth, but you actually can't be sure you'll end up with the latest definitions, either.

[DJW]

Thanks boco. That doesn't surprise me too much.

However, the updater must be requesting the definitions. If there were only one set, would it not be possible to do the WGET on them as the last steps. I've not looked at the script so have no idea how complex that would be. As I said it does surprise me that WSSE updates are done as part of the OXP update but then I have _no_ idea how any of this is done as I'm a VMS/Fortran old fogie

A look at the log does give me an idea though. Each section including (ofc, o2k3, o2k10) evaluates the /includemsse option. If this were limited to the OS updates that might save a bit...

Thanks again.

Cheers - Dave

[TMan]

I have seen the message about skipping due to 'same day rule'. Can this not be extended to a 'past few days' rule?

Another option is to disable the MSSE definition updates and download them manually from http://support.microsoft.com/kb/971606

[boco]

I have seen the message about skipping due to 'same day rule'. Can this not be extended to a 'past few days' rule?

Why? You'd get outdated signature updates, then.

[status]

msse has a mechanism of differential updates for example version 1.1.1 to 1.1.2 weights several Mb
ms antimalaware client forms a special http get that contains his version and in response a minified mpam-d.exe is sent

Code: Select all

GET http://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.10201.0&avdelta=1.165.887.0&asdelta=1.165.887.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

returns empy page (that means - no update needed)
But if for example you send such a request (replaced last 887 to 600)

Code: Select all

https://go.microsoft.com/fwlink/?LinkID=121721&clcid=0x409&arch=x64&eng=1.1.10201.0&avdelta=1.165.887.0&asdelta=1.165.600.0&prod=EDB4FA23-53B8-4AFA-8C5D-99752CCA7094

in return you get a 2,7 Mb file that is much less than 60-80Mb full update.
Most interesting is that if version numbers differ too much - you'll be given a full mpam-fe in response!
I've tried to make a workaround about it in my domain some time ago, if you need - I'll try to make a usable update script.

[boco]

Please note this is an offline update - PC is not expected to have any online access at time of installing. Additionally, the patch level of the target system is unknown beforehand.

[status]

First of all: yep, I know, this is an offline update, but if you have small dl speed (<100kb/s for ex) you can't download all updates starting updateGenerator once. Every time you start it - you need to download msse updatepack twice 90mb.
If you go to the link I've posted, microsoft update server will give you 8mb update-file, not the 90mb one(40 days passed from link posted)
Second: if you place mpam-fe.exe and mpam-d.exe so
c:\update\
\x86\mpam-d.exe
\x86\mpam-fe.exe
\x64\mpam-d.exe
\x64\mpam-fe.exe
and launch c:\Program Files\Microsoft Security Client\Antimalware\MpCmdRun.exe -SignatureUpdate -UNC -Path c:\update\
not the c:\update\x86 or else!
it will correctly update mpam-fe.exe and then to mpam-d.exe, so there is no need to download mpam-fe.exe every time updateGenerator starts
it will correctly update x86 and x64 versions
Update also can be performed by launching mpam-fe.exe and then mpam-d.exe(if present)
sample download script here http://pastebin.com/PWxSSurd
it uses sigcheck.exe and wget.exe from wsusoffline(must be same directory with script or in %path%)
p.s.: can be totally rewritten in js|vbs in single file without using wget and sigcheck