News

W2K SP2 Officially Released

• By Scott Bekker
• 05/16/2001

Redmond has been relatively careful to avoid tying itself down to specific service pack delivery dates. But the company has said that customers wanted regular service packs at about six month intervals, implying that Microsoft would try to meet that schedule.

By those standards, SP2 should have arrived around Feb. 17, a year after the Windows 2000 launch. Instead it checks in 15 months after launch, and more than nine months after Service Pack 1. SP1 shipped July 31, slightly early although behind a rumored June delivery.

Al Gillen, an analyst with IDC, notes that Microsoft did not have nearly the incentive to produce the second service pack.

"SP1 was clearly a very, very important threshold for Microsoft to pass through in order for customers to feel comfortable with Windows 2000. My sense of the market is that SP2 wasn't an impediment for people," Gillen says.

Service Pack 2, which includes all SP1 fixes and can be installed on systems with or without SP1 loaded, includes 366 hotfixes in its fix list, compared with about 250 for SP1.

In addition to rolling together post-SP1 hotfixes on everything from the base operating system to printing to Terminal Services, the service pack automatically and irreversibly changes systems with 56-bit encryption to 128-bit encryption.

There are no apparent blockbuster problems in the latest service pack. One unlisted fix is the recent Internet Information Services 5.0 vulnerability where a buffer overflow exploit could allow malicious users to control a Windows 2000 Server. Published reports had Microsoft including that fix in SP2, despite generally closing the service pack to new problems well before the serious vulnerability with IIS emerged this month.

The service pack applies to Windows 2000 Professional, Server, Advanced Server and Server Appliance Kit. Windows 2000 Datacenter Server customers must obtain SP2 from the OEMs who sold them their complete systems.

SP2 has been available for download for preferred customers since the weekend. The URL for those customers was published by some media outlets and download traffic has been described as heavy.

Microsoft's Service Pack 2 page can be found here.

See also:
W2K SP2 Technical Overview
IIS Vulnerability Could Allow Unauthorized Control of W2K
Service Pack 1 is Here (7/31/2000)
Fixes vs. Features: Microsoft Still Determining How to Handle OS Updates in Short Run