An automatic updater of untrusted certificates is available for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2

Users who have disconnected systems can install this update. But those users do not receive a benefit from the update. In fact, installing this update may cause service startup failures immediately after the server is restarted. Services that perform certificate validation tasks during service startup may experience an increased delay while network retrieval of the trusted and untrusted CTLs from Windows Update is tried.

For systems that are running Windows Vista, Windows 7, Windows Server 2008, or Windows Server 2008 R2 and that are using the automatic updater of untrusted certificates (that is, if either KB 2677070 or KB 2813430 is already installed), see the rest of this section and also Microsoft Knowledge Base article 2813430 for more information. Customers do not have to take any action because these systems will be automatically protected.

If the system does not have access to Windows Update, either because the system is not connected to the Internet or because Windows Update is blocked by firewall rules, the network retrieval will time-out before the service can continue its startup procedure. In some cases, this network retrieval time-out may exceed the service startup time-out of 30 seconds. If a service cannot report that startup has completed after 30 seconds, the service control manager (SCM) stops the service.

If you cannot avoid installing this update on disconnected systems, you can disable the network retrieval of the trusted and untrusted CTLs. To do this, you disable automatic root updates by using Group Policy settings. To disable automatic root updates by using policy settings, follow these steps:

1. Create a Group Policy or change an existing Group Policy in the Local Group Policy Editor.
2. In the Local Group Policy Editor, double-click Policies under the Computer Configuration node.
3. Double-click Windows Settings, double-click Security Settings, and then double-click Public Key Policies.
4. In the details pane, double-click Certificate Path Validation Settings.
5. Click the Network Retrieval tab, select Define these policy settings, and then clear the Automatically update certificates in the Microsoft Root Certificate Program (recommended) check box.
6. Click OK, and then close the Local Group Policy Editor.

After you make this change, automatic root updates are disabled on those systems to which the policy is applied. We recommend that the policy be applied only to those systems that do not have Internet access or that are prevented from accessing Windows Update because of firewall rules.

If automatic root updates are disabled, Administrators must manually manage root certificates that are trusted by Windows. Trusted root certificates can be distributed to computers that are running Windows by using Group Policy. For more information about how to manage the root certificates that are trusted by Windows, visit the following Microsoft website:

For more information about Windows certificate trust verification, go to the following Microsoft webpages:
For more information about the Windows root certificate program, click the following article number to view the article in the Microsoft Knowledge Base:

Update replacement information

This update replaces the following update:

For a list of the files that are provided in this update, download the file information for this update 2677070.