IE11 patches blocked until Windows 7 users install KB 2929437

Following the Windows 8.1 Update 1 model, Microsoft will no longer fix Internet Explorer 11 until earlier patches are installed

The situation isn't as dire as it was (and is) with the forced march of users to Windows 8.1 Update 1, but as Computerworld's Gregg Keizer first revealed on Sunday, Microsoft won't offer any patches for IE11 until users get specific, older patches installed first.

Last week's monster Black Tuesday IE patch, MS 14-035, doesn't even appear using Windows Update on Windows 8.1 machines unless users have successfully installed Windows 8.1 Update 1, the infamous KB 2919355. On Windows 7 SP1 machines with IE11, this month's patches won't appear until users have successfully installed April's Windows 7 IE11 patch MS 14-018/KB 2929437.

(Note that Internet Explorer 11 does not run on Windows 8. If you want IE11 and/or its patches, you have to upgrade to Windows 8.1 Update 1. Also note that the IE11 patches are available for organizations that use Windows Server Update Services/WSUS, Intune, or System Center Configuration Manager -- see KB 2963950. Only those of us who rely on Windows Update or Microsoft Update get snubbed.)

Microsoft has had patch dependencies before: You won't get Patch B until you install Patch A. In many cases, attempting to install Patch B will automatically install Patch A first -- no such luck in this case. If you are running Windows 7 SP 1 (or Windows Server 2008 R2) and haven't installed MS 14-018/KB 2929437, Windows Update won't show you this month's MS 14-035/KB 2957689 patch rollup; ditto for folks running Windows 8.1 without Update 1. It's a big rollup, too -- designed to fix 59 separately identified security holes.

Here's what KB 2957689 says:

This update applies only to computers that are running Internet Explorer 11 and that do have update 2919355 (for Windows 8.1 or Windows Server 2012 R2) or update 2929437 (for Windows 7 SP1 or Windows Server 2008 R2 SP1) installed. All future security and nonsecurity updates for Internet Explorer 11 require you to have update 2919355 or update 2929437 nstalled in order to receive updates. We recommend that you install update 2919355 or update 2929437 in order to continue to receive updates.

But wait. It gets more convoluted:

For Internet Explorer 11, security update 2957689 update is for systems that have the 2929437 update or the 2919355 update installed. Internet Explorer 11 customers have to make sure that the 2929437 update or the 2919355 update is installed before security update 2957689 can be offered to them or installed.

Note For Internet Explorer 11 customers who do not have the 2929437 update or the 2919355 update installed, security update 2963950 can be installed instead of security update 2957689. However, security update 2963950 is available only for customers who manage updates by using Windows Server Update Services (WSUS), Windows Intune, or Microsoft System Center Configuration Manager.

Got your scorecard handy?

This time around, I don't expect to hear the same hue and cry that accompanied the Windows 8.1 Update 1 straitjacket restrictions, for three reasons:

  1. Very few people have reported problems installing MS14-018/KB 2929437. Looking around the Internet, I don't see many intractable problems with the patch. (If you have a counterexample, please post it in the comments!) By contrast, the Microsoft Answers forum erupted with problems installing Windows 8.1 Update 1/KB 2919355 -- and they haven't all been solved yet.
  2. If you have problems with KB 2929437, Internet Explorer 11 is relatively easy to uninstall on Windows 7 systems. For months, I've been waffling about recommending IE11 for Windows 7 users. Now I have a good reason to recommend that Microsoft customers not switch from IE10.
  3. Don't fight, switch. There are lots of good alternatives to IE.

While the forced Windows 8.1 Update 1 restriction hit lots of Windows customers in the solar plexus, this restriction smacks of hubris. Why isn't Windows Update smart enough to line up the installation of prerequisites? Good question.

This story, "IE11 patches blocked until Windows 7 users install KB 2929437," was originally published at Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest developments in business technology news, follow on Twitter.