OK, this is mainly targeted at the population of this board who are employed as security pros in a large enterprise environment, however, I'd welcome input from anyone who would like to contribute.

Question: With the release of Windows XP SP2 looming closer, what are other large enterprise security folks doing to plan for, test, and otherwise deal with deployment of this service pack?

Issues: Although I have seen on this and other message boards some rash responses such as "No way we are going to deploy this" and "this SP is mainly for home users" etc..., I feel that a more careful look is warranted at this issue.

XPSP2 represents a significant release for MS. Why? Well first, it is really the first time that a Service Pack has been released which contains truly "new" functionality and features. Second, the focus of this SP is largely on improving the security of the OS at the fundamental level, not simply patching dlls. Finally, many enterprises have now settled into deployment of XP on the desktop (ours has) as standard.

I have read through most of what MS has published regarding the SP, as well as other 3rd party info. However, I have yet to see anyone publish a definitive implementation "roadmap" for deployment of this SP. Considering that this SP is such a drastic change in the OS, I cannot imagine simply blasting it out through SUS/SMS/etc on release day and expecting to have everything operate as normal. This would likely result in a disaster for IT departments.

Our company has not yet made a committment to either testing or planning for the deployment of this SP. I am completely aware of the folly of this, so please, allow me to critisize us, and lets focus on a possible answer.

My concern is that post release of XPSP2, it is very likely that future security updates and fixes released for the XP platform will depend on having SP2 installed. I don't think that MS will release security fixes in multiple versions forever (SP2 and non-SP2 versions). Initially they probalby won't have the choice, but with so many changes and recompiled binaries included with SP2, it is going to get expensive for MS to have parallel development efforts for security fixes for the same platform. So, to delay or avoid its deployment in the long term would not appear to be a smart option.

So here is my cry for help:

Has anyone out there developed or been involved in the development of a testing/deployment strategy for XPSP2 that they would be willing to share? We are (like many other companies) an understaffed IT Security department, and although we have the skill and talent to develop such a strategy, we simply are running out of time. If there is anyone out there who has some work done in this area, I personally, as well I'm sure as others like me, would be most appreciative of any input you could contribute to this issue.

Thanks!

i'm not in charge of any large scale network, but here's my opinion....
just testing it, you're not going to find too much. there are many many people out there already creating vulnerabilities for this stupid update. i say wait a few weeks or months before a mass deploy... it's going to be hit hard... if you didn't need it before, you deffinitly don't need to get it as soon as it gets released!

Thanks for the good advice/input. Fortunately for us we already have a semi-standard desktop image (we call it SOE - "Standard Office Environment"), and we will likely test against that initially.

Although I agree that there will be significant problems along the way. I can't help feeling that eventually we, and other enterprises are going to have to roll this thing out. BTW, for reference we are talking about roughly 22,000 desktops, spread out across 137 locations nationwide.

Thanks again...

I have working with for Windows XP sp2 for a some time.I do not know if my opinion help you or not but I will tell you that after i have installed sp2 over a xp sp1 corporate edition i hava a big nasty surprises because the OS do not working any more the same....very much delays in using some programs, the big special firewall work very strange...etc...


From my point of view until Microsoft do not release the Windows XP SP2 build in it has no point to installed it over an windows xp.

In my opinion the only good thing i've seen so far in sp2 is the automatic updates system. (way better than that crappy SUS)

(the firewall got better too if u use any of that crap)

But i dont really recommend a mass implementation of it, not in the first few weeks/month or two atleast
As far as i know there's still a shitload of bugs in the rc that has been released