Microsoft's OneCare silently changes Automatic Updates

Posted by sumeethevans on October 26 2007, 9:30 AM. Posted in OneCare.

Microsoft Corp.'s consumer security software changes the Automatic Updates (AU) settings in Windows XP and Vista without telling users or getting their approval, a researcher said today -- behavior that may explain recent reports of patches being installed and systems rebooting without permission.

When Microsoft responded to new charges of silent changes last week, however, it denied that AU settings were ever altered without user approval, and it didn't mention OneCare as a possible culprit.

Scott Dunn, an editor at the "Windows Secrets" newsletter, reported this morning that OneCare silently changes AU settings as it installs. No matter what AU setting the user selected previously, OneCare's installer quietly changes it to the fully automatic option.

"Some security products have turned on AU in the past," said Dunn, who also tested several other current consumer suites, including Symantec Corp.'s Norton 360 and Norton Internet Security, McAfee Inc.'s Internet Security Suite, and Check Point Software Technologies Ltd.'s ZoneAlarm Internet Security Suite. "But OneCare was the only guilty party."

OneCare's willful way with AU may be an explanation for the reports two weeks ago of machines downloading and installing the Oct. 9 set of security fixes even though their owners had explicitly instructed Windows to ignore all downloads or notify them before they were installed.

Several days later, after it wrapped up an investigation, Microsoft said AU settings were never changed without user consent, and it blamed absent-minded users for making modifications and then forgetting that they had.

"I find this surprising and very disturbing," said Dunn. "If they're going to change [AU] settings, they should let you know."

Full Story At Source