Update on the .Net security updates

OK, we’ve had one of our best people (namely Aaron Stebner) working on getting this working.  He’s got a set of steps that workaround the previously mentioned problems with applying the .Net security updates to XPE runtimes.  Look for the updates to be back on the OEM Secure Site within a week – in the meantime, you can DL the bits from the Download Center to test these steps out (Aaron shold repeat them on his blog as well).

1. Figure out the exact version of the .Net Framework you have (major and minor version plus service pack).
• If you are using the .Net 1.0 component we shipped in XPE SP1, it will be 1.0 SP2.
• If you are using the .Net 1.1 component we shipped in XPE SP2 or as a QFE to XPE SP1, it will be 1.1.
• If you are using the .Net 1.1 component in the value-add folder of XPE SP2, it will be 1.1 SP1.
2. Go to the Download Center and locate the hotfix that matches the version of the .NET Framework you have.
• If you are using .Net 1.0, get the test package from http://www.microsoft.com/downloads/details.aspx?FamilyID=33d4d33e-473f-4842-a3a8-c8266aee8fab&DisplayLang=en.
• If you are using .Net 1.1, get the test package from http://www.microsoft.com/downloads/details.aspx?FamilyID=e54be8be-22af-4390-86e1-25d76794d5c7&DisplayLang=en.
• If you are using .Net 1.1 SP1, get the test package from http://www.microsoft.com/downloads/details.aspx?FamilyID=9bbd5617-49ae-40bf-b0fa-f9049349c6f5&DisplayLang=en

You will need to choose the version that is specifically marked for "Tablet PC / Media Center" (for 1.0 hotfixes) or "Windows Server 2003" (for 1.1 hotfixes).  Note that you can’t use the regular Windows XP Pro update – we use a different install method for .Net on XPE that confuses the update installer.
3. Download the exe for the hotfix from the Download Center.
4. Extract the exe to a local folder by running
   
   <name of exe> /x:<folder>.
   
5. If you have .Net 1.0 SP2 or .Net 1.1 SP1 installed (not .Net 1.1 in XPE SP2), you will need to add an additional registry value – the update package is checking this registry key as a prerequisite.  You need to add
   
   HKLM\Software\Microsoft\Updates\.NETFramework\1.1\SP1,(DWORD)Installed=1.
   
   Note that this key name should be changed as needed to 1.0 or to a different service pack level if there is a higher .Net Framework SP installed.  This key is unnecessary for .Net 1.1 installs.
6. Go to the folder that you extracted the .Net Framework hotfix to in step 4 above and open each of the update*.inf files in the update folder.  There is a [Version] section at the top that you will need to update the following values for:
   
   NtBuildToUpdate=2600
NtMinorVersionToUpdate=1
MinNtServicePackVersion=###
MaxNtServicePackVersion=###
ThisServicePackVersion=###
   
   The values of Min, Max and This for service pack should match the CSDVersion value in your registry at HKLM\System\CurrentControlSet\Control\Windows.  For example, for XP Embedded SP2 this value should be 512, for XPE SP1 this value is 256.
7. Now you can run update.exe from the update folder on your embedded device (assuming your embedded device has the Desktop QFE Installer support component, or includes the dependencies update.exe needs to run correctly).

We have verified these steps via PSS and Test, and they work as advertised.

Pain in the butt?  You’re right – we’re working on a quicker, simpler way of doing this with DUA.  If you’re not using DUA, you’ll have to either do these steps manually or script them yourself – the easiest way I can see would be to prep the install in steps 1–4 and step 6 once, then write a script that makes the registry changes and runs the installer for steps 5 and 7.