Delivering a "secure" Internet Explorer

[Quazi11]

Environment:
Medium sized bank, couple hundred branches running NT 4SP6a. Perhaps a hundred back office locations, mixed NT and XP. All software installations completed via login scripts. Multiple versions of IE, 5, 5.5, 6.

Issue:
Upgrading the enterprise to IE6 SP1 with ALL critical security patches. The problem is, if I run the installation, then the latest cumulative update for IE, then the latest cumulative update for Outlook Express, the upgrade will take 3 reboots. Our branch locations can not take this kind of disruption. I've read a number of posts that say you can use Qchain to put IE patches together with one reboot, this is NOT true.

Quote from MS KB doc 296861 (How to Install Multiple Windows Updates or Hotfixes with Only One Reboot)
"The procedure that is described in this article does not work for product updates that do not use Hotfix.exe or Update.exe as the installation program. For example, Internet Explorer updates for Windows NT 4.0, Windows 2000, and Windows XP use an INF-based installation instead of Update.exe. As a result, you cannot use this procedure to install multiple Microsoft Internet Explorer updates with only one restart on Windows NT 4.0, Windows 2000, or Windows XP."

I've also investigated using IEAK to slipstream patches into the service pack install, like the way you can push service packs into an OS installation. The IEAK does not appear to have this functionality though.

Info Sec will not allow us to push out a product with security holes, and our retail department will not allow a three reboot installation. Anyone have any ideas? Sorry for the length of the post. Thanks in advance.

 

[bcastner]

Move all to XP with Service Pack 2 in a month.
I do not mean this unkindly as advice.

At some point you will have to upgrade your NT workstations, and your Win2k workstations.

Start the planning for this upgrade now.

 

[Quazi11]

Thank you for your idea, our Microsoft Rep. is sugesting the same thing. Problem is, there are so many department applications, legacy systems, mainframe apps, etc, that acceptance testing here takes months. We're only now starting to push out SP1. The move to IE6 SP1 is over a year in the making. Thanks for the idea though!

 

[tviman]

Well, as long as you want to upgrade the browser, and your plans are not to upgrade any time soon, then sooner or later you'll have to 3-boot. Can this be done in stages over a period of, say, 3 days? Or on a Saturday night?

There's always a better way. The fun is trying to find it!