In March 2019 two updates were released which add
support for SHA-2 code signatures to Windows 7
, comprised of a new Servicing Stack (KB4490628) and the actual update adding support for
SHA-2 code signatures (KB4474419). See updated table below.
The combination of both updates prepare Windows 7 to handle updates that contain only a SHA-2 code signature, which are to be expected
in the upcoming months. Starting in July 2019 the support for SHA-2 code signatures is required to receive future updates!
In October 2018 the Servicing Stack for Windows 7 (KB3177467) was rereleased. See updated table below.
Starting in May 2017 the complete list of monthly update can be found on this separate page
This should make maintenance a bit easier and give visitors a better overview without too much hassle.
Information on Windows Vista can be found on this separate page
for the last three remaining Vista users ;).
Valid as of
Oct 2016 (2016-10-11)
Until MS breaks something again
Note: The above dates only refer to the "speedup" update, the "magic" patch, not the whole page!
This HowTo is valid for Win7 SP1 and 8.1, which have been newly installed or haven't been updated for
some time. It should also help on systems that were up-to-date last month.
These instructions were only tested on Win7 SP1.
Solution to the issue
The term "solution" might be a little bit exaggerated, since the following HowTo only tries to make sure that the
Update Agent doesn't need to check all updates, so the check for new updates is done faster.
Install the following updates BEFORE
letting Windows search for updates, to avoid this very search taking "forever".
It's sufficient to install one of
the Servicing Stack Updates. The current version is highlighted in bold.
One of the Servicing Stack Updates is required
before July 2016 Rollup can be installed!
Maybe you wonder why July 2016 Rollup. The answer is simple: This particular update contains a more recent
(as far as I know the latest) version of the Update Agent. With this update the time needed to search for new updates is
reasonable, almost regardless of the updates installed on the system; the search times vary, of course, but not
as ridiculously much as without July 2016 Rollup.
If you're a user of Intel Bluetooth Hardware and have trouble with BT due to KB3172605, you can take a look at the page
; it contains some links that might be helpful in resolving
Steps to take after Windows installation
- Disable Automatic Updates:
Start > Control Panel > System and Security > Windows Update > Change settings > "Never check for updates"
- Reboot the system (in case the "Windows Update" services is currently checking for updates).
- Download the updates mentioned above and install them via WUSA on a CMD shell (as Administrator):
Tip: Use the TAB key to let the system complete the directory and file names, to avoid typing errors.
start /wait "" "%SystemRoot%\system32\wusa.exe" "C:\full\path\to\Update.msu" /quiet /norestart
- Important: Since WUSA won't output any errors when using above command, even if an update can't be installed at all
(e.g. because of wrong architecture), it's recommended to check whether the updates have been installed correctly:
Start > Control Panel > System and Security > Windows Update > Installed Updates
If there's missing at least one of the updates that were just installed, try to install it again by double-clicking
it to find out why it wasn't installed.
- Reboot the system.
- Now let Windows search for updates, which should be finished in less than 15 minutes.
- Re-enable automatic updates as needed (see step to disable them, but select one of the options to check for updates automatically now),
and install the remaining updates as usual.
To ease the pain of installing multiple systems you can use e.g. this script
is updated regularly. Put the script and all updates in the same directory - a USB flash drive or network share may be a good place.
The script determines the Windows version (Vista, Win7 or Win8.1), its architecture (32 or 64 bit) and so on. It makes use of the
command given above. Just double-click the script - after you've disabled automatic updates (see above) - and it installs all required
updates automatically, including the latest Windows Update Agent (if present). Reboot the system after the script is finished, and
you're done. Re-enable automatic updates as needed.
If you intend to install Windows Updates on a whole network of systems, it's probably better to use some dedicated solution for this, e.g.
WSUS Offline Update
, which already installs the prerequisites in
If you are curious why the search for updates takes such a long time, check out the background information
Thanks to T. Wittrock, author of WSUS Offline Update
Canadian Tech, Woody Leonhard
, Cliff Hogan, lmacri and the community.
You can reach me via the following forums: