Microsoft may have delayed Windows XP Service Pack 2 yet again this week, but IT managers are, in any case, not exactly champing at the bit to roll out the security-oriented update.
The most eager IT departments contacted by eWEEK.com said they would deploy SP2 only after extensive testing. Others said the update was not a priority or they weren't running Windows XP in the first place. Despite the hype around SP2 and the expected benefits, IT managers said the difficulty of the installation process means they are taking a gradual approach.
"Sooner or later Sophos will have to roll out Windows XP SP2—it's just not something we consider a very high priority presently," said a representative of U.K.-based Sophos Antivirus. "We will only do it when we are confident the time is right and we can do it properly."
This caution is exactly what Microsoft says it has been trying to impress upon customers. "Enterprises should approach their deployment of Windows XP Service Pack 2 with the same rigor as they do any normal operating system software rollouts," said Windows client product manager Janet Gibbons. "We advise testing SP2 in a nonproduction environment and working with Microsoft or its partners to plan its deployment around their networks."
She confirmed that SP2 hasn't yet been released to manufacturing, but said Microsoft is still "on track" for an August release. The company had hoped to wrap up work on SP2 this week but decided more work was needed to ensure quality. Most recently the update was delayed from June to July and from July to August.
Following launch, SP2 will be distributed through the Microsoft Download Center, MSDN and Volume Licensing Packs, and companies using Software Update Services will be able to download SP2 through Windows Update, Gibbons said.
Some IT departments said that once they roll out SP2, they won't do so all at once, partly because the file is so large (about 300MB) and complex to install. "The size of the file is not a particular problem. Only if we tried to upgrade everyone at the same time, which we won't, would it cause particular pain," the Sophos representative said.
Sophos hasn't been testing SP2 release candidates, but firms who have say they still expect problems after SP2 goes gold. "There will be some inevitable compatibility issues that are missed in QA [quality assurance]," said the IT manager for one major international IT company. "There will also be issues with SP2 itself and we fully expect Microsoft to follow up with fixes."
The company, which has been involved in the SP2 beta-testing program, said it plans to be an early adopter of the update, but only after "an extensive QA process." It is planning to use Systems Management Server 2003 to deploy the update; home workers and branch offices will either be sent CD-ROMs or receive the patch at their nearest office with an IT staff. "We are treating this as an operating system upgrade," the manager said.
Another IT director said he had upgraded most IT department workstations with SP2 Release Candidate 2 after testing both RC1 and RC2 and finding the latest version stable and unproblematic. "Most of the IT department installed it on their personal workstations so we can begin testing how it interacts with our programs and methodologies," he said. "If we have issues with RC2, it's better it happens to us, the IT department, than anyone else."
Microsoft has not hidden the fact that SP2 will cause some disruption. Some of the changes will break applications, notably some prominent security software. Indeed, earlier this week Microsoft said its latest customer relations management software, Microsoft Business Solutions CRM Sales for Outlook 1.2, won't work with SP2, and posted a fix for the bug.
Security Center Editor Larry Seltzer has no sympathy for developers who complain that applications will break under the new security-focused service pack. They've had plenty of warning, he writes.
Some testers have also reported serious disruption to workstations after installing RC2, although none of the IT managers contacted by eWEEK.com had experienced major problems.
"There is no doubt that installing SP2 should be done more carefully and in a better-planned way than other, smaller updates," said Thomas Kristensen, chief technology officer of Danish security firm Secunia.
A common refrain from several companies was that they wouldn't even be considering SP2 for the moment, because they've standardized on Windows 2000. "To this day at my company we're putting Windows 2000 on all new computers, and we're not about to change to XP anytime soon," said one IT worker.
"Sophos' global headquarters, based in the U.K., does not have that many machines running Windows XP currently," the Sophos representative said. "Desktop computers are typically running Windows 2000, although the situation is different in some of our offices in other countries."
Check out eWEEK.com's Windows Center at http://windows.eweek.com for Microsoft and Windows news, views and analysis.
Be sure to add our eWEEK.com Windows news feed to your RSS newsreader or My Yahoo page
Channel News and Analysis 
