2

It's always been my belief that SQL Server needs to be updated to the latest service pack in a timely (and tested) manner to continue receiving security/bug patches.

I'm now partially responsible for a 2008 R2 DB that has not had any service packs installed. The external IT company mainly responsible for maintaining it has told me that they don't install service packs unless there is a specific business need, and that it would automatically recieve security patches any way. Is this the case, or do you need to keep up-to-date (once tested) with the latest service pack?

Improve this question

2 Answers 2

Reset to default
2

It's always been my belief that SQL Server needs to be updated to the latest service pack in a timely (and tested) manner to continue receiving security/bug patches.

You are correct. Some service packs will continue to have new CUs until their lifetime runs out.

... and that it would automatically recieve security patches any way.

They either didn't understand how this worked or flat out lied to you.

Is this the case, or do you need to keep up-to-date (once tested) with the latest service pack?

You'll need the latest SP + Patches. For example, since you're on RTM... you're missing quite a few different security patches because they weren't made for the RTM branch after it went out of support*.

*Note that the links above show the same security updates released for supported service packs at the time. However, RTM was not one of them.

Improve this answer
1
  • Hi, thanks for all the responses. I think this has confirmed what i believed to be the case. Essentially that each release/version(?) has a support lead out time. And that being on a service pack will lengthen that lead out time in most cases. Although not forever. So best to check which support windows have closed and decide on case by case basis whether the installation can/should be updated.
    – ConfusedDBAdmin
    Commented May 15, 2017 at 8:17
0

It depends on the position of the service pack in the product life-cycle. MS support service pack levels for a while after the release of later packs, but the timelines vary by product.

In the specific case of SQL Server 2008R2 you do currently need to have the latest pack (SP3) to be properly supported as the last one left its support window in 2015. See https://support.microsoft.com/en-gb/lifecycle/search?alpha=Microsoft%20SQL%20Server%202008%20R2 for a list of the relevant dates.

That doesn't mean that won't release updates for 2008r2 RTM/sp1/sp2, but don't expect them to without paying for special support fees for hot-fixes via their "premium assurance" scheme or similar arrangement. This is only for new issues: patches released before the end of extended support will still be available in Windows Update, so if you create a fresh install of 2008r2 without SP2 it will get the updates that already exist for it when you next check.

Improve this answer
3
  • It doesn't depend. If the service pack isn't supported then there will be no fixes released for it.
    – Sean Gallardy
    Commented May 5, 2017 at 12:21
  • It depends upon whether or not you have a "premium assurance" agreement or not. Also IIRC there was at least one instance of them releasing updates for Windows XP SPs after their EOL date and at least once instance of them not releasing an update for a product (NT4) still in extended support, so while the state dates are usually adhered to is it not always the case.
    – David Spillett
    Commented May 5, 2017 at 15:15
  • You're specifically speaking about a CSA, which does NOT encompass everything - for example we require you be on the latest patches, also each item is not necessarily covered because you have a CSA, so no, having a CSA does not mean you get security patches backported to you automagically.
    – Sean Gallardy
    Commented May 5, 2017 at 18:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.