Carrying the unwieldy name of Update Rollup for Windows 2000 Service Pack 4, the collection of 51 security-related fixes contains all patches produced for Windows 2000 between the November 2003, release of Windows 2000 SP4 and April 30 of this year, when the rollup's features were locked in place.
Earlier, Microsoft had promised to provide the rollup before June 30, when Windows 2000 slips out of mainstream technical support and heads into what the Redmond, Wash.-based developer calls extended support.
In late 2004, Microsoft announced that it would not offer up an expected Service Pack 5 (SP5) for the venerable operating system, but would instead assemble all existing fixes, including some not related to security, in a so-called "rollup." At that time, it defended the move, saying the number of not-seen-before updates were few.
Tuesday, the company again deflected criticism of its decision to forgo SP5 in favor of the rollup.
"Microsoft believes the Update Rollup will meet customer needs more appropriately than a new service pack," a spokesman said. "The Update Rollup should require less pre-deployment testing because the number of updates is significantly lower than a Service Pack, and Microsoft [has] already released most of the contents of the Update Rollup as individual updates and hotfixes."
Yet Microsoft urged all Windows 2000 users to apply the rollup, and said that the update package would be listed as a "critical" update in Windows Update. "Update Rollup 1 contains additional important fixes in files that have not previously been part of individual security updates," it reasoned in the Web document detailing the new package.
Initially, the rollup won't be pushed to users' machines via Automatic Update, because Microsoft's migrating Windows 2000 users to version 6 of that service over the next few weeks. By "early July," Microsoft said, the rollup with be part of Auto Update.
Although Microsoft has offered blocking tools for major security updates in the past -- for 2004's Windows XP SP2 and this year's Windows Server 2003 SP1, it's not going to give companies a chance to block Auto Update of the Windows 2000 rollup once it's listed on Automatic Update.
"There will not be blocking tool [for Update Rollup 1], because it's not a service pack, and doesn't require the same level of deployment as a service pack," said the spokesman.
More than a few analysts have taken Microsoft to task for snubbing Windows 2000, which by one metrics firm's count retains a 10 percentage point lead over Windows XP in enterprise operating system usage share.
"I could see doing a rollup in the middle of a product lifecycle," said Michael Cherry, an analyst with Directions on Microsoft, an independent research firm based in Redmond, Wash. "But then at the five-year milestone, when support moves from mainstream to support, I think Microsoft should have a final service pack instead, to reset the baseline as to what users have to have installed."
What Cherry doesn't think is appropriate is exactly what Microsoft is doing: crossing an important support landmark with a rollup rather than a service pack.
"Let's talk about the policy versus the reality," said Cherry. "The official [Microsoft] policy is that when you call for support [for Windows 2000] all you need is SP4. But the reality is different. How interested will that support rep on the phone be if you haven't put that rollup in place? If they find any hint that your system's different, or not up to date, they rapidly lose interest in helping you."
This isn't the first time that Microsoft substituted a rollup for a service pack; it did the same for Windows XP in October 2003, when it released a rollup between SP1 of September 2002 and SP2 of August, 2004.
The 32MB Windows 2000 rollup file can be downloaded directly from Microsoft's Web site or through the Windows Update service.