Although Microsoft’s latest major upgrade for the XP operating system is supposed to help harden computers against Web-based attacks, less than 25 per cent of XP users have installed Service Pack 2 (SP2), according to a Canadian research firm.
AssetMetrix, an Ottawa-based IT trend watcher, says it surveyed 251 corporations in North America about their SP2 situation. Less than a quarter of respondents had installed the program, which is designed to automatically turn on the Windows firewall, better protect computers against security risks from hackers and viruses, and reduce the amount of Web-page pop-ups.
Microsoft users might be behind the times because they’re worried the service pack, a major upgrade for the XP operating system, could disrupt applications on their computers. As well, the sheer size of the service pack might scare some people from downloading it, said Steve O’Halloran, AssetMetrix’s managing director. SP2 is 256MB and can take up to an hour to download, he said.
O’Halloran said SP2 blocks access to certain Web sites and it disrupts automatic antivirus updates with its already-on firewall, although he added that it takes just a few clicks of the mouse to clear those barriers. As well, he found it alarming that “a very large subset of the population” surveyed indicated that their companies hadn’t yet decided whether to download SP2. O’Halloran said it tells him that at these companies, there is no corporate policy on whether or not to implement SP2. In a sense, companies are pushing the decision off to users.
Elliot Katz, product manager for Windows clients at Microsoft Canada wouldn’t confirm or deny AssetMetix’s findings, but he did say Microsoft is pleased with the progress and deployment of SP2.
Katz added that about 185 million copies of SP2 have been distributed worldwide since its release last August.
Around that time, Microsoft also provided a tool that prevented XP’s automatic update feature from downloading the latest service pack, should users prefer to operate their PCs without the upgrade. The tool gave computer operators time to test the service pack to see if it works with the applications they were already using.
But as of April 12, that tool became essentially useless. If users have their automatic update feature turned on, they will get SP2 whether they want to or not. Still, Katz said, “fewer than one per cent of our enterprise customers in North America used the tool.”
Windows XP users do not have to get SP2 if they do not wish, said Katz, but he hopes to get 100 per cent of users running SP2 as it would protect their PCs from malicious attacks.
If users choose not to get the latest service pack installed, they will have to disable the automatic update feature or redirect the automatic updates so they come to a central server, where a company’s IT department can dictate which of the desktop machines should get the service pack, and which shouldn’t.
However, O’Halloran does not recommend companies take such measures. “If you don’t upgrade to SP2 you are more prone to attacks,” he said.
One analyst said she believes many IT departments had trepidations about deploying SP2 and took “a wait and see” approach. “Some were skeptical that it would provide a viable solution to some of the challenges they were facing, such as [virus attacks],” said Michelle Warren, IT industry analyst at Toronto-based Evans Research Group. She added that over time, the upgrade has proven its worth but there still hasn’t been widespread adoption.
According to O’Halloran, SP2 is an almost-new operating system designed to resolve a lot of the loopholes that viruses have exploited in XP. “You’re getting more of a bullet-proof operating system with respect to Internet-facing activity,” he said.
