Strategies for Updating Office 2003 Installations

After a new release of Microsoft Office, Microsoft makes available a series of software updates designed to help improve the security, performance, and reliability of the applications. Keeping clients in your organization up-to-date with the latest updates for the Microsoft Office System is well worth the effort, and there are strategies you can use to make the patching process more efficient and consistent.

 Note   The Office Resource Kit has published new and improved information for updating client installations. This article contains both strategies and instructions for installing the latest patches on users' computers. For information about using Windows Server Update Services and Microsoft Update to deploy Office updates, see Using Windows Server Update Services and Microsoft Update.

Update strategies

Microsoft releases several types of software updates:

  • Service packs comprise a set of all hot fixes, security updates and critical updates released to date, and may also include additional bug fixes or customer-requested design changes or features. Because a service pack includes a new product version in the MSI file, it represents a new baseline version of the product.
  • Security updates are released between service packs and address product-specific, security-related vulnerabilities. These updates are rated based on their severity. In most cases, security updates require that clients have the most recent baseline version of the product installed on their computers.
  • Critical updates are released between service packs and fix specific problems unrelated to security issues. They also typically require the most recent baseline version.

Software updates are released in two forms:

  • Full-file patches, or administrative patches, completely replace all files modified by an update. In past versions, full-file patches were used exclusively to update an administrative installation point, from which clients then recached and reinstalled Office to get the updated version. With Office 2003, you can apply full-file patches directly to client computers. Because complete files are installed, full-file patches typically do not require access to the original Office installation source.
  • Binary patches, or client patches, replace only portions of the files that have been updated. For this reason, they are smaller and more efficient to distribute than full-file patches; however, they typically require that clients have access to the source. Binary patches cannot be applied to an administrative image.

New deployment features in Office 2003 have simplified the process of choosing a patching strategy to two primary options:

  • Deploy Office to users from a compressed CD image, make sure that all clients maintain a local installation source, and distribute client updates. You can distribute either full-file or binary updates directly to clients; binary updates are usually smaller and easier to distribute. If you have not yet deployed Office 2003, this is the recommended update strategy for most organizations.

- or -

  • Deploy Office from an uncompressed administrative installation point, use full-file patches to keep the administrative image up-to-date, and make sure that all clients recache and reinstall promptly.

Determining which method is best for your organization depends on several factors:

  • Deployment method

If you want the efficiency of distributing binary patches throughout your organization, deploy Office from a compressed CD image and take advantage of the local installation source, which Setup creates by default on users' computers. Once you deploy from an administrative image, the local installation source is no longer an option.

  • Network capacity

Recaching and reinstalling Office from an updated administrative image requires considerably more network bandwidth than distributing client updates to users, and distributing full-file updates usually requires more bandwidth than distributing smaller binary patches. A local installation source allows users to rely on more efficient binary patches.

  • Client computer hard disk drive capacity

Caching installation files on users' computer is not free. For example, Microsoft Office Professional Enterprise Edition 2003 requires approximately 290 megabytes (MB) of hard disk space in addition to the space required by a typical client installation of the product. If you support users who have very limited hard disk space, then the local installation source may not be an option for them.

  • Management practices

If your organization maintains strong centralized control over software deployment — for example, if you use Microsoft Systems Management Server to help control software distribution — you can more reliably keep clients synchronized with an updated administrative installation point.

 Note    If you deploy Office from an administrative installation point and you never update the image, you can distribute client patches directly to users, provided that they have reliable access to the original unpatched source on the network. Once you patch an administrative image, however, you are committed to updating that image and recaching and reinstalling Office on users' computers in the future. To help ensure that the update process works correctly over time, settle on one method of updating Office clients.

Caching installation files locally and distributing binary updates

When users install Office 2003 from the CD or a compressed CD image, Setup copies installation files to a hidden folder on the local computer. Windows Installer uses this local installation source both to install Office initially and to repair and update Office later on. You can confidently distribute binary client patches because users have the necessary access to the source on their own computers.

Microsoft recommends this update strategy in most cases, particularly if you:

  • Have experienced synchronization problems between client computers and administrative installation points in the past.

Because the product version in the MSI file remains the same, clients never become out of sync with the source. Even during such operations as detect and repair or install on demand, computers updated with binary patches — including the binary versions of service packs — work correctly with the original source.

  • Distribute software updates to different groups of users or at different times.

Because the original installation image remains at the same level, it can support clients with a variety of patches applied. You do not need to maintain different installation images for clients at different update levels.

  • Have network bandwidth limitations.

Typically, binary patches are smaller than full-file patches, and when compared to updating from an administrative image, both types of client patches are easier to distribute to users.

  • Support users who have limited or unreliable network access — for example, traveling users.

With a local installation source always available, offline users can perform any operation that requires the source, including applying binary updates.

This update strategy has the following requirements:

  • You must have an edition of Office 2003 that is compatible with the Custom Installation Wizard and other administrative tools. (Retail editions of Office 2003 do not support these tools.)
  • You must deploy Office from a compressed installation source and take advantage of the local installation source functionality.
  • Users must be administrators of their computers or you must be able to grant elevated privileges for both the initial Office installation and the client updates.
  • The binary versions of software updates released between service packs require that client computers be updated to the most recent baseline — that is, the most recent service pack.
  • New installations from the compressed installation image do not automatically include any updates. For these users, you must modify the Setup.ini file to chain all necessary patches to the core Office installation.

Installing from a CD image

To create a compressed CD image, you copy the contents of the Office 2003 CD (including all hidden folders) to a network share; you do not run Setup to create the installation image. After that, the process of customizing a compressed CD image is similar to the process of customizing an administrative installation point. Creation of the local installation source is enabled by default, and you do not need to set any additional local installation source options.

 Note    When you create the CD image, the Office 2003 cabinet (CAB) files remain in their compressed state. By contrast, when you create an administrative installation point, Setup extracts compressed CAB files from the Office 2003 CD. Once the files are extracted, Setup can no longer create a local installation source on users' computers; they must rely on the uncompressed administrative image as a source.

Unlike deploying from an administrative installation point — where the end-user license agreement (EULA) and Volume License Key are handled as part of the administrative Setup — you must accept the EULA and enter a valid Volume License Key before users can install Office from the compressed CD image. New functionality has been added to the Custom Installation Wizard to handle these settings by means of a transform (MST file) applied during the client installation. For more information, click Help on the Configure Local Installation Source page of the Custom Installation Wizard.

For more information about deploying from a compressed CD image, see Taking Advantage of a Local Installation Source.

Updating existing installations

The compressed CD image on the network represents the Office 2003 baseline for your organization, and it remains at the original release (RTM) level. Once you have established this baseline, you can deploy binary updates to individual computers as needed.

You can use a variety of methods to distribute the patches to users, such as the following:

  • Use a tool such as Microsoft Systems Management Server (SMS) or Tivoli to deploy the update.
  • Post the EXE file that contains the patch on a network share and direct all users to run it.
  • Use the stand-alone version of the OHotFix utility to extract the patch (MSP file) from the EXE file and apply it to users' computers.

Toolbox     The OHotFix utility is packaged in a self-extracting executable file and is available on the Office Resource Kit Web site. You can find this downloadable file on the Office 2003 Resource Kit Downloads page.

Creating new installations

When a new client computer installs Office from the compressed image, you must include all current patches to ensure that the user has all the latest updates. Although you can chain as many client patches as necessary to the core Office installation, Office 2003 patches are cumulative, so you only need to install the latest patches related to a particular application to get all the fixes included in earlier patches. The most recent Office 2003 service pack, for example, includes all previously released updates.

You chain client updates to the core Office 2003 installation by adding the appropriate files to the [ChainedInstall_n] sections of the Setup settings file (Setup.ini). You can either chain the EXE file for each individual patch, or you can chain the OHotFix utility to the Office installation and customize OHotFix to include as many patches as you need.

To use the OHotFix utility to chain client patches

  1. Extract each binary patch (MSP file) from the corresponding client update (EXE file).
  2. Modify the OHotFix INI file to run in quiet mode and to apply the patches.
  3. In the Setup.ini file, chain OHotFix.exe to the core Office installation.

For example:


For more information about OHotFix, see Installing Client Update Files with OHotFix on the Office XP Resource Kit Web site.

To use Windows Installer to chain client patches

  1. Extract each binary patch (MSP file) from the corresponding client update (EXE file).
  2. In the Setup.ini file, chain Msiexec.exe to the core Office installation.

You must create a separate [ChainedInstall_n] section for each patch.

For example:

file]  /p /qb /lpiwaeo [path\name of log file]

Note that Microsoft Windows® correctly finds and starts Msiexec.exe even if the Windows folder is not in the same location on all computers in your organization.

For more information about chaining, see Deploying Office and Other Products Together.

 Note    If a user double-clicks a client update that is already installed on the computer, Windows Installer 2.0 reapplies the patch, even though no files are changed. If a user applies a client update by means of an Msiexec command line, however, the patch is not reapplied.

What about full-file client updates?

Full-file updates, like binary updates, can be applied directly to client computers. Because full-file updates completely replace all the files affected by the update, they may be the better choice in some scenarios. For example, if a user's local installation source is corrupted or deleted, and the user does not have access to a source on the network, you can send the full-file update. In most cases, users can apply the patch even if they do not have access to the source, and without putting themselves out of sync with the source.

For example, you might be deploying a patch released after Office 2003 Service Pack 2 (SP2) to users who have never updated to Service Pack 1. Because binary patches require the most recent baseline, these users cannot apply the binary version of the update. They can, however, apply the full-file version. Full-file patches support the two most recent baselines.

The methods you use to deploy the full-file and binary forms of client patches to users are the same: an e-mail message, logon script, Microsoft Systems Management Server, or other methods used by your organization. Users double-click the EXE file to apply the patch to their local computer. Note that applying a full-file patch to a client computer does not change the product version in the MSI file, as it does when applied to an administrative image. Users can apply full-file patches and binary patches interchangeably.

Updating clients from a patched administrative image

For organizations that deploy Office 2003 from an administrative installation point, patching the administrative image and reaching and reinstalling Office on clients is usually the most efficient patching strategy. Recaching and reinstalling replaces the previously cached MSI file on users' computers and overwrites any old files with the newer versions. New clients that install from the patched administrative image automatically get the updated version — you do not need to chain patches to the core installation.

When there is a delay between updating the administrative image and reinstalling Office on clients, however, client computers can become out of sync with the administrative image. Operations that rely on the source — such as install on demand or detect and repair — fail because the client does not recognize the updated administrative image, which has a new product version in the Office MSI file. Relying on this method of updating clients may require you to set up two administrative images: the patched image for updated clients and an unpatched baseline image for everyone else.

Microsoft recommends this updating strategy only if you:

  • Maintain strong, centralized control over software deployment, and support users who have consistent and reliable network access.
  • Support users who are not administrators of their computers and to whom you cannot easily grant elevated privileges for the patching process.
  • Use Group Policy to handle software deployment.
  • Prefer to handle the PIDKEY and EULA during administrative Setup, rather than in a transform (MST file).
  • Run any Office applications from the source.

You cannot use the Run from Network feature installation setting from a compressed source.

This update strategy has the following requirements:

  • You must have an edition of Office 2003 that is compatible with the Custom Installation Wizard and other administrative tools. (Retail editions of Office 2003 do not support these tools.)
  • Your network must have sufficient capacity to handle recaching and reinstalling Office throughout an organization.

For more information about deploying Office from an administrative image, see Running Setup from an Installation Image.

Patching an administrative installation point

You must install administrative updates (MSP files) from the command line. On the command line, you run Windows Installer with options to specify the path to the MSI file and the name and path of the MSP file.

The MSI file is the Windows Installer package file from your original administrative image. The MSP file is the Office administrative update file that contains information about the changes in the upgrade. The update instructs Windows Installer to add, update, or remove files in the administrative image.

 Note    Before you update an administrative installation point, make sure that no client computers are using the share. If a file on the share is in use during the upgrade process, a newer version of that file is not copied to the administrative installation point.

To apply an update to an Office administrative installation point

  1. Download the self-extracting executable file for the update and run the following command line to extract the MSP file:
[path\name of EXE file] /c /t:[location for extracted MSP file]

 Note   Double-clicking the EXE file does not extract the MSP file; it applies the patch to the local computer. In order to patch an administrative image, you must first extract the MSP file.

  1. Connect to the server share for your administrative installation point.

You must have write access to the administrative installation point on the server and the appropriate privileges to carry out the task, including the Change privilege.

  1. On the Start menu, click Run, and then type the Windows Installer command line with the appropriate options for your installation. Use the following syntax:
msiexec.exe /p [path\name of MSP file] /a [path\name 
of MSI file] /qb /lv* [path\name of log file]

If an update contains multiple MSP files, you must run the command line separately for each MSP file that you apply to the administrative installation point. You cannot reference multiple MSP files on the same command line.

The following table describes the command-line options.

Command-line option Description
[path\name of EXE file] Path and file name of the downloadable update file.
/c Extracts the MSP file or files from the EXE file without installing them.
/t:[location for extracted MSP file] Folder in which to extract the MSP file from the EXE file. If you do not specify a location, you are prompted for a target folder.
Msiexec.exe Executable file name for Windows Installer.
/p Directs Windows Installer to apply an update to an existing installation.
[path\name of MSP file] Path and file name of the MSP file for the update.
/a Directs Windows Installer to perform an administrative installation of a product on a network share.
[path\name of MSI file] Path and file name of the Windows Installer package for your original administrative image.
/qb Sets the user interface to the basic level (simple progress and error handling)
/lpiwaeo Turns on logging and sets a path for the log file. The default setting /lpiwaeo logs a subset of information, such as error messages and warnings. Use /lv* to log all information
[path\name of log file] Path and file name of the Windows Installer log file.

Updating client computers

After you update your administrative installation point, you need to perform a recache and reinstallation on all client computers that use the administrative image as a source. Any new client installations from the administrative installation point automatically include the updated version of Office.

To update an existing client installation from an administrative installation point, users need only rerun Setup.exe on the administrative installation point. If the administrative image has been patched, Setup automatically triggers the recache and reinstallation of all Office 2003 applications and features. Unless Setup is set to run in quiet mode, users are prompted to update.

Alternatively, you can distribute the following command line to the clients:

setup.exe REINSTALL=[list of features 
modified by the update] /qb

In this case, Setup.exe calls Windows Installer to perform the installation and automatically generates log files. You can run this command line by creating a logon script, distributing it as a batch file, deploying it by using SMS, or using other means according to your practice. The options for this command line are described in the following table.

Command-line option Description
Setup.exe Executable file name for Office Setup program.
REINSTALL=[value] Specifies whether to reinstall all applications or only the features affected by the patch. The default REINSTALL=all reinstalls all applications and features in the updated package. See the Knowledge Base article associated with the patch for specific features to reinstall.
/qb Directs Setup to run in quiet mode.

Each update that Microsoft releases includes Knowledge Base documentation listing all the features affected by the update. You can minimize the time and network bandwidth needed to update users' computers by setting the REINSTALL property to reinstall only the features modified by the update. Note that the values for REINSTALL shown in the feature list are case sensitive.

Applying client updates between service packs

As an efficient alternative to recaching and reinstalling Office with every new release of a critical update or security update, you can distribute these interim updates directly to clients, even if they rely on an administrative image as a source. You must first have established all users on the most recent baseline of Office 2003.

For example, you may have updated your administrative image to Office 2003 Service Pack 1 (SP1) and reinstalled Office throughout the organization. Shortly thereafter, Microsoft releases a security update in response to a new virus. You can download the patch and run the EXE file directly on client computers. In this scenario, you would not patch your administrative image — that would put clients out of sync with the patched source. You can continue with this strategy until the next service pack is released.

Note that you cannot use the same tactic to deploy service packs themselves. The client versions of service packs require a source at the original release level — such as an unpatched administrative image or a local installation source.

Related links

In a managed environment, Microsoft recommends that you block users' access to Office updates on Office Online. By setting a single registry subkey or policy, you can prevent users from downloading client patches on their own yet still allow them to take advantage of all the other resources on Office Online. For more information, see Blocking Users' Access to Office Update.

The strategies for applying updates to Microsoft Office Multilingual User Interface Packs are identical to those for updating the core Office installation. For more information, see Distributing Multilingual User Interface Pack Updates.

Transforms can only be applied when Office is initially installed. You cannot apply transforms when you patch Office. For more information about updating users' configurations after Office is installed, Updating Feature Installation States and Application Settings.