Office App layer installing Defender Updates when patching

[Richard Olah1709161669]

I have a Windows 2016 base OS layer with Defender running in the OS layer. I am trying to create a fully patched Office application layer and am following the below process;

 

1) In the OS layer i enable the Windows update service and check for all security updates, this downloads the latest updates for both Microsoft OS and Defender and i then disable the Windows update service and finalize the layer.

2) I then create a new application layer for MS Office and use the OS layer in step 1 as the source OS version

3) In the Office layer after the installation i enable the the Windows update service and and check for all security updates.

 

The problem i am having is that although it is bringing down all the Office updates i need, by the time i have got to this stage there is a new Windows Defender security intelligence update available which it pulls down and installs into the app layer. I had a look on the Microsoft site and they now seem to be releasing these update every few hours. Does anyone know of a way to prevent Defender installing updates into the app layer without it overwriting the OS layer when it compiles the image?

[Rob Zylowski]

Is it causing issues on your images. I would think it fine as long as you have only newer updates in the office layer. 

[Darryl Sakach]

I have noted the same behavior in our implementation. We have not had any know issues, but Rob's comment draws a bit of concern. "I would think it fine as long as you have only newer updates in the office layer." This may not be the case at all times. We typically update our OS Layer then immediately update our Office Layer. However, if we take a hypothetical scenario:

1A. Update OS Layer and get Defender version 1

1B. Updagte Office layer and get Defender version 2

1C. Publish and image is running Defender version 2

2A. Update OS layer and get Defender version 3

2B. Update Office layer and get no Defender update

2C. Publish and image is running Defender version 2, not 3.

 

I am not stating that this will cause issues, but it certainly is not optimal.

[Rob Zylowski]

Yes it means you need to always update office after updating the os layer.