Legacy Update News

Legacy Update 1.14.1

2026-10-21T17:00:00+00:00

Legacy Update 1.14.1 handles the recent disclosure of compromised eMudhra certificates, which were found to be protected by very weak private keys. Any server you connect to on the internet can be impersonated by these certificates, putting your data at risk. Installing Legacy Update 1.14.1 triggers an update to the trusted certificate store, ensuring your system receives Microsoft’s revocation of these certificates.

Mozilla Firefox, Mozilla Thunderbird, Java, and various other software uses its own trusted certificate store, rather than using Windows’s built-in store. To ensure you are fully protected against the compromised certificates, check for updates to all apps you use.

See the full changelog at the release page for Legacy Update 1.14.1.

Windows Server 2012 and 2012 R2 reach end of extended support

2026-10-14T03:40:00+00:00

Today, Windows Server 2012 and 2012 R2 (based on Windows 8 and 8.1, respectively) reached the end of their extended paid support (ESU) programs.

While Windows 8 is a release many users skipped due to its widely criticised redesign in favor of tablet-style apps, the underlying operating system provides major benefits as compared to Windows 7. New features such as ReFS, more responsive Remote Desktop Services, and generally improved performance make Server 2012 and 2012 R2 a worthy upgrade from Server 2008 and 2008 R2.

The Windows Server 2012 and 2012 R2 ESU program ran for 3 years, leaving Server 2012 with a total of 14 years of support, and Server 2012 R2 with 13 years. It is not expected to be extended any further, as was the case for Windows 7 and Windows Server 2008 and 2008 R2.

Aligned with this is two other products that reached end of support today: Windows 11 Home and Pro, version 24H2, and Windows 10 Enterprise LTSB 2016 (based on Windows 10, version 1607). Users of 24H2 should upgrade to 25H2, while users of LTSB 2016 have the option to purchase an ESU license under a program that will run for 3 years.

This month’s Patch Tuesday fixes 1,411 security flaws, including one actively exploited in the wild, continuing Microsoft’s record-breaking streak of flaws fixed in a Patch Tuesday release.

Here are the final updates released for Extended Security Updates (ESU) customers:

Windows Server 2012:
Windows Server 2012 R2:

A valid Extended Security Updates Year 3 license is required to install these updates.

Legacy Update 1.14

2026-10-11T13:30:00+00:00

Legacy Update 1.14 extends the Legacy Update proxy server to be used on Windows 7 and later. Certificates critical to Windows Update on these versions will expire in June 2027, with no official workaround being given. Refer to our news article for more information on the Windows releases this affects.

See the full changelog at the release page for Legacy Update 1.14.

Windows Update to be discontinued on legacy Windows in June 2027

2026-10-11T13:00:00+00:00

Microsoft has announced that critical certificates used by Windows Update will expire in June 2027. This will affect all devices running Windows 7 through to Windows 11, version 24H2. Updates have been issued with new certificates for recent releases of Windows 10 and 11, while remaining versions will no longer be able to connect to the Windows Update service to check for and automatically install updates.

Windows 2000, Windows XP, and Windows Vista are already in this position due to evolving industry regulations that have moved beyond what these versions of Windows are capable of. Legacy Update ensures they remain connected to the Windows Update service by routing this traffic via our proxy server. This same workaround will soon be necessary for a wider range of Windows releases.

Our new release, Legacy Update 1.14, begins the transition to using our proxy server on these affected releases of Windows. As the proxy server won’t be necessary for another 8 months, it will be possible to opt out of using it. After certificates expire on 19 June 2027, the setting will become mandatory. At that time, PCs that opted out of the proxy server will need to reinstall Legacy Update.

This is not related to the expiry of Secure Boot certificates. (As a reminder, the final Secure Boot certificate expires one week from now, on 19 October 2026.)

Affected versions

This change affects Windows 7 and Windows Server 2008 R2 up to Windows 11, version 24H2 and Windows Server 2025. As announced by Microsoft, only versions of Windows currently in support will receive an update to resolve this issue. That somewhat messy picture is:

Windows 11, version 25H2 and later: Not affected. Issue is already resolved in this version.
Windows 11, version 24H2 and Windows Server 2025: Resolved as of the 2025-09 Cumulative Update (KB5065426).
Windows 11, version 22H2 and 23H2: Resolved as of the 2026-07 Cumulative Update (KB5101650).
Windows Server 2022: Resolved as of the 2026-07 Cumulative Update (KB5099540).
Windows 10 LTSC 2021 (version 21H2) and 22H2 ESU: Resolved as of the 2026-07 Cumulative Update (KB5099539).
Windows 10 LTSC 2019 (version 1809) and Windows Server 2019: Resolved as of the 2026-07 Cumulative Update (KB5099538).
Windows 10 LTSC 2016 (version 1607) and Windows Server 2016: Resolved as of the 2026-07 Cumulative Update (KB5099535).

If your version of Windows has an update listed above, and Windows Update displays that no updates are available, you should not have any issues.

These versions of Windows are also affected, but based on Microsoft’s announcement, will not receive an update to resolve the issue:

Windows 11, version 21H2
Windows 10, version 1507 through 21H2, excluding LTSC releases listed above
Windows 8.1 and Windows Server 2012 R2
Windows 8 and Windows Server 2012
Windows 7 and Windows Server 2008 R2

Extended Security Updates customers of Windows Server 2008 R2 through 2012 R2 have not received any update for this issue. This is in line with what we observed with Windows Server 2008, where the public Windows Update service became unusable for such devices, forcing these customers to use an internal Windows Server Update Services server. The July 2027 expiry date is 8 months after the end of ESU for 2012 and 2012 R2, and 18 months after ESU ended for 2008 R2.

Why this is happening

In May 2012, the sophisticated Flame malware was discovered. It hijacked Windows’s integration with online services, including Windows Update, by abusing an outdated built-in Windows certificate the attacker managed to crack.

In June 2012, Microsoft released critical security updates for all supported versions of Windows at the time (Windows XP SP3 through Windows 7 SP1), adding defensive measures against the type of attack Flame was able to pull off. One such measure added was certificate pinning, which confirms the device is connecting to the expected server infrastructure. This protects the connection from being hijacked by any other trusted certificate on the device - only a very small, hardcoded list of certificates is considered trusted.

The certificates expiring are intermediates that were created 15 years ago, in June 2012. The Windows Update Agent checks all TLS connections and downloaded configuration files match one of the following intermediates:

Update Secure Server CA 2.1 and 2.2: Used to confirm a secure connection to Windows Update. Expires 21 June 2027.
Update Signing CA 2.1, 2.2, and 2.3: Used to confirm validity of updates and Windows Update configuration files. Expires 19 June 2027.

The new certificates further harden the Windows Update service by splitting the Update Signing CA into separate certificates for each purpose:

Update Secure Server CA 3.1 and 3.2: Direct replacement for the Update Secure Server CA 2.x certificates.
Update SLS Signing CA 3.1, 3.2, and 3.3: Used for Windows Update configuration files (Service Locator Service).
Update SIH Signing CA 3.1 and 3.2: Used for repairing the Windows Update service on Windows 10 and later (Server-Initiated Healing).
Update Metadata Signing CA 3.1 and 3.2: Used to prevent tampering with update configuration data on Windows 10, version 1809 and later.

All of the new 3.x certificates expire on either 13 or 14 December 2035.

Update metadata signing was introduced in Windows 10, version 1703, and became fully enforced in version 1809. It is not yet clear why Microsoft is indicating that these versions will encounter a certificate expiry one month sooner, on 17 May 2027, but this date does line up with the expiry of the Microsoft Time-Stamp Service certificate.

What will change

Based on the 2021 end of Windows Update support for Windows XP and Windows Vista, we expect that the only issue will be in validating the connection to the Windows Update service. By proxying this traffic via Legacy Update, the remainder of Windows Update will fully work. Existing updates and configuration files will remain valid indefinitely, as they were signed prior to the expiry of their respective certificates.

We currently don’t anticipate updates being fully removed from the server, but we are still continuously archiving as much as we can for the day it becomes necessary for us to fully replace the Windows Update service. (That will be expensive. Donate?)

As the list of trusted certificates is hardcoded into the core Windows Update engine (wuaueng.dll), it is not straightforward to extend this list with newer certificates. Legacy Update does not patch system files, as this can prevent successful installation of updates.

What to do now

If you are running an affected version of Windows, install the applicable update listed above, or any later version.

If no update is available for your system, install Legacy Update.

Legacy Update 1.13.2: Security advisory

2026-07-21T10:00:00+00:00

Legacy Update 1.13.2 addresses a security issue in the Legacy Update ActiveX control. Please update as soon as possible.

See the full changelog at the release page for Legacy Update 1.13.2.

Details of the vulnerability

An advisory has been published as GHSA-f4g7-4gmx-jfgf.

As an ActiveX control, Legacy Update exposes some access to the operating system through Internet Explorer. To limit the potential for damage, ever since version 1.0, we have implemented logic that checks the website domain used to access the control. The domain must exactly match either legacyupdate.net or test.legacyupdate.net. Should the domain not match, any attempt for the web page to execute Legacy Update functions will be denied. Much of Legacy Update’s architecture mirrors the original Windows Update website control (wuweb.dll), which uses the same domain-based security model.

Since the major rewrite undertaken in Legacy Update 1.12, a flaw was introduced in the CLegacyUpdateCtrl::IsPermitted() function which caused the check to succeed even if the host isn’t in the allowed domain list. The function was refactored to use the standard COM error handling paradigm, in which the return value is a success or error result code (HRESULT), rather than its former design which used a simple boolean TRUE/FALSE return value. This paradigm reuses a variable named hr throughout the function, containing the last error returned by each function call. In this refactor, the function is now expected to return either S_OK (“success - ok”) or E_ACCESSDENIED (“error - access denied”). A line of code was missing that would have initialised the default return value to E_ACCESSDENIED. The result is that the function always returns S_OK.

Impact

The nature of a remote attacker receiving higher privileges through a web page causes the vulnerability to be assessed at a CVSS v3 score of 9.9 out of 10.0. Despite the high score, we are confident the scope of the attack is limited to creating annoyances (denial of service) and leakage of your system patch level.

An attacker can:

Cause unexpected dialogs to appear, such as User Account Control dialogs, Windows Update installation and settings dialogs, proxy logon dialogs, and log files (by default, in Notepad).
Determine installed software; installed, pending, and hidden updates; and the kernel build string of your operating system, which may assist in deciding whether your system is vulnerable to other exploits.
Quietly install updates on your computer.

In the default configuration, Windows Update only accepts updates signed by Microsoft. There is a possibility that this can be defeated by using SHA-1 collision attacks. However, this would be a preimage attack, which is currently not proven to be feasible for SHA-1. Further compounding the infeasibility, collisions must occur at several points in the update process for successful exploitation.

While updates can be installed through Legacy Update, it does not support uninstalling updates.

How it has been fixed

In Legacy Update 1.13.2, we made the following changes:

The logic error has been corrected - IsPermitted() now returns E_ACCESSDENIED if the accessing domain is not in the trusted list. The logic also now confirms that the protocol is http or https. (In our opinion, an attack from an alternative protocol is infeasible, but there’s no harm in having the more specific check.)
The control now uses the ActiveX object safety feature, signalling to Internet Explorer whether the control is “safe” in the current context. This moves responsibility for enforcing the check from Legacy Update into Internet Explorer itself. Should an unauthorised website attempt to use Legacy Update, you will receive an Information Bar alert: “Internet Explorer has blocked this site from using an ActiveX control in an unsafe manner. As a result, this page may not display correctly.” (Prior to Internet Explorer 6 SP1, a warning dialog is shown.)
The control now also confirms that the website is in the Trusted Sites zone. Legacy Update setup adds legacyupdate.net to the Trusted Sites zone automatically. If you install Legacy Update by directly registering LegacyUpdate.dll, you must now also ensure Legacy Update is added to Trusted Sites.
On installation or upgrade to 1.13.2 or later, the system is configured to block ActiveX control versions prior to 1.13.2 from being used. This is known as a “killbit”. To ensure the vulnerability remains mitigated, this block is not removed from the registry if you uninstall Legacy Update. Downgrading to an earlier version of Legacy Update will result in the website being non-functional.

Mitigation

Install Legacy Update 1.13.2 as soon as possible. This fixes the bug, and your system will be configured to block vulnerable versions of the Legacy Update ActiveX control.

If you have a reason to not update, limit your use of Internet Explorer to only websites you trust. Using a limited, non-administrator user account will ensure website access to Windows Update is limited. On Windows Vista and later, do not run Internet Explorer as administrator, and do not accept User Account Control dialogs you weren’t expecting.

Legacy Update 1.13.1

2026-05-16T15:00:00+00:00

Legacy Update 1.13.1 fixes a few bugs introduced in 1.13, and adds workarounds for issues with some Lenovo devices and Intel Macs. It also addresses a potential security issue.

See the full changelog at the release page for Legacy Update 1.13.1.

Legacy Update 1.13

2026-03-16T15:08:00+00:00

Legacy Update 1.13 improves handling of some edge cases you might run into while using Legacy Update. It includes 23 fixes and improvements (and plenty more small changes).

Some highlights:

Windows 7 can now get up-to-date faster, thanks to a new feature that can install the Windows 7 Convenience Update Rollup.
Multiple bugs in the Windows Vista Service Pack 1 and 2 installers have been worked around.
We no longer install the Windows Server 2008 servicing stack from 2019 on Windows Vista, unless you specifically opt into it. This addresses compatibility issues some users were facing.
When enabling Windows Embedded 2009 updates on Windows XP, Legacy Update now hides the notoriously broken KB2686509 update.
Support for Windows audit mode has been added. This allows you to preinstall Legacy Update on a computer in advance of it being given to an end-user.
“Access is denied” errors are fixed on Windows 2000 (sorry!), and a crash when installing updates from the website on Windows Vista has also been fixed.

See the full, extensive changelog at the release page for Legacy Update 1.13.

Introducing our improved website

2026-02-11T01:00:00+00:00

The Legacy Update website has been completely rebuilt.

When I started Legacy Update in 2022, I didn’t plan for the website to be much more than a homepage and a copy of the Windows Update web app. Over the years (it’s been a few), we added our Microsoft Download Center Archive, and the Help pages.

At a certain point, handling all this content became a bit too much for the basic website I threw together all those years ago. We want to continue to expand the useful content we provide for users, particularly in our growing Help center. To resolve this, over the past 6 months, I rebuilt the website on top of a proper application framework and content management system (CMS).

If it seems like nothing has changed, that’s a good thing! I worked hard to make sure everything is just as it was before. I did, however, add some new themes:

Watercolor, from betas of Windows XP
Microsoft.com, styled like the website in the 2000s
GeoCities and Space Jam, as a homage to Web 1.0

We also now have a dark mode in modern browsers that support this feature.

You’re also looking at our new News section. If you’re into RSS, add it to your feed reader!

If you find anything broken, let us know. Next up: Legacy Update 1.13!

An additional update: Thanks to some sleuthing by @AntonFromSweden, our Windows Live Essentials Archive now features downloads for the original 2007 Windows Live suite, also known as the Windows Live Installer.

Windows Server 2008 and 2008 R2 reach end of extended support

2026-01-13T19:05:00+00:00

Today, Windows Server 2008 and 2008 R2 (based on Windows Vista and 7) finally, truly reach end of support.

Windows Vista and Windows Server 2008 is the longest supported version of Windows, at 19 years. Behind it is Windows XP and Windows Embedded 2009 at 17 years, and Windows for Workgroups 3.11 at 16 years. Ironically, Windows Vista and Windows Server 2008 are known for having the most issues with servicing, as compared to Windows XP and Windows 7.

Here are the final monthly rollups released for Premium Assurance (PA) customers:

Windows Server 2008:
- 2026-01 Security Monthly Quality Rollup (KB5073697): x86, x64
- 2026-01 Security Only Quality Update (KB5073700): x86, x64
Windows Server 2008 R2:
- 2026-01 Security Monthly Quality Rollup (KB5073695): x64
- 2026-01 Security Only Quality Update (KB5073699): x64

A valid Premium Assurance Year 3 license is required to install these updates.

Windows Live Essentials Archive

2026-01-07T23:54:00+00:00

You’ve been asking me for years, and I finally did it.

Windows Live Essentials was a suite of free add-on software from Microsoft. It’s a perfect fit into the Windows 7 experience, but it’s been hard to find official download links. Now, we have them easily accessible on a dedicated page:

Windows Live Essentials on our Microsoft Download Center Archive

The Download Center Archive is getting some attention

2025-12-15T15:42:00+00:00

It’s been great to see the positive response to the new Download Center archive. It was shared on Hacker News earlier this week, and was just covered by The Register. (They’ve also positively covered Legacy Update a few times in the past, most recently after we released Legacy Update 1.12.)

I don’t usually talk about these things because money isn’t the point of this project, but I wanted to add an amusing tidbit that the traffic spike from Hacker News brought 42,810 page views to the Download Center homepage in 24 hours according to Cloudflare, yet, Google AdSense shows only 3,738 page views. So in case you were wondering how much of Hacker News uses an ad blocker (I know you weren’t), the answer is, 91%. Also, I didn’t even realise it was on Hacker News until almost a day later, so, good to know my infrastructure handles that kind of traffic spike!

Overall, we’ve been hitting an average of around 900,000 – 1 million daily requests, most of which is Windows Update traffic, search engine bots, and AI training/search bots. I’m kinda ok with the search/AI bots because it doesn’t seem to be causing any issues, and it is a good thing that people are finding a legitimate download source when asking AI, rather than something sketchy.

Hopefully soon, I’ll start loading more data into the archive. A few people have helped point out data that was incomplete (particularly missing file listings), or downloads that were missing entirely. We won’t be able to get all of it due to the state of the archives being incomplete, but the aim is to still try to get as close as we possibly can.

Thanks to everyone who helped to spread the word!

Microsoft PowerToys and Fun Packs Archive

2025-12-01T13:14:00+00:00

We now have a dedicated page to download Windows XP PowerToys and Fun Packs. PowerToys includes the power user favorite of Tweak UI, plus TaskSwitch (an Alt-Tab replacement with window thumbnails), and the 3D Windows XP logo screen saver. Fun Packs add extra features to Windows Media Player and Windows Movie Maker.

Microsoft PowerToys and Fun Packs on our Microsoft Download Center Archive

Expanding the Download Center Archive

2025-12-01T13:13:00+00:00

Hi everyone! I’ve been working on a major upgrade to our archive of the Microsoft Download Center.

We initially set up our Download Center archive in 2023 to provide an index of data scraped in August 2020 by ArchiveTeam, a community effort that preserves information at risk of being deleted. Microsoft decided to delete thousands of downloads on the flimsy basis that they were signed using the insecure SHA1 algorithm, providing less than a week of notice through an obscure forum post. Thanks to the power of the Wayback Machine, and ArchiveTeam’s efforts, we were able to provide a comprehensive index of all downloads that existed in the days before the purge. This particularly included downloads for Windows XP, Vista, and 7, Office 2003, 2007, and 2010, and so on.

What I didn’t fully realise at that point is that Microsoft quietly deletes downloads all the time. So I pulled down many thousands more downloads from the Wayback Machine (and then took almost 2 years to do anything with them). The United States Library of Congress had some archives too. This data ranges from 2012 to today, giving me an incredible view of what turned out to be 41,011 downloads, up from the 28,310 in the August 2020 archive. At this point, it was very clear that Microsoft is trigger-happy to get rid of downloads as soon as they deem them out of support.

It makes sense in one way, since Microsoft is no longer offering security updates or customer support services for these downloads, and doesn’t want to make any guarantees on the safety of using this software today. In another way, I’m confident that users are able to make their own judgement on the risk of downloading old software, and I’d way rather they find these downloads from a trusted source such as the Wayback Machine. This is why we run our archive - these downloads didn’t stop being useful just because they’re 10, 15, 20, or 25 years old.

The new archive is a huge expansion, adding many previously popular downloads for Windows 98, Me, and NT 4.0, Office 97 and 2000, and so on. We’ve also added a dedicated page for Windows XP PowerToys and Fun Packs, which includes Tweak UI, TaskSwitch (a more XP styled Alt-Tab replacement), and the 3D Windows XP screen saver.

Bringing all of this data into a consistent format for our database was no small task. The main script I wrote for this ended up at 1,600 lines that are an absolute mess, because of how rough HTML scraping is naturally going to be.

There are still a few remaining unsolved problems, but I’m overall very happy with where everything is right now:

In July 2024, Microsoft did a sloppy migration of data in their backend system, which reset the published date on every download to 15 July 2024. In most cases, we’ve corrected these dates, but there are still plenty of downloads that need fixing.
A range of download archives from the mid-2010s are missing a list of files.
Some downloads lead to archives of a 404 page. I think timestamps on file metadata we pulled from the Wayback Machine might have drifted since I started this archiving effort.
There are downloads from even earlier than 2012 that are valuable - I’m planning to add those. They haven’t been forgotten!
I know it’s still English-only - sorry about that. As the Internet Archive is based in the US, other languages are poorly archived. If you know of any archive websites similar to the Wayback Machine in your native language, please get in touch.

If you find any issues other than these, let us know and we’ll work on it. Also let me know if you find any gems in the archive that should be added to the “Commonly Downloaded” list!

By the way, you will find that Bing and DuckDuckGo (which uses Bing data) already has most of the new download center archive indexed. You might even be able to search our archive through your Start menu search box. Google has never particularly liked me, so the downloads may still be hard to find on Google. (ChatGPT and Claude also do pretty good at finding these downloads - we see users click through from them very frequently in our logs.)

Windows 10 End of Support

2025-10-14T21:54:00+00:00

After 10 years, Windows 10 has reached end of support.

Windows 10 is the most widely adopted version of Windows ever, being installed on around 1.3 billion devices. There are some clear concerns users have with upgrading to Windows 11, and many Windows 10 devices are not officially compatible with Windows 11.

To help you decide what to do next with your Windows 10 PC, we’ve developed a new guide:

How do I continue receiving updates for Windows 10?

So long, Windows Update website

2025-10-02T15:54:00+00:00

This week, Microsoft took down the old Windows Update v6 web app entirely. It was a time capsule locked in the Microsoft.com design from 2005. It’s been broken since 2021.

You can still see it preserved through Windows Update Restored.

Legacy Update 1.12.1

2025-09-29T16:00:00+00:00

Legacy Update 1.12.1 fixes some issues from 1.12. (Surprisingly few issues for a big rewrite!)

More about Legacy Update 1.12

Legacy Update 1.12

2025-09-24T12:35:00+00:00

Legacy Update 1.12 is a huge rewrite release. We switched from compiling with Visual C++ 2008 (and 2010, and 2017, and 2022…), a setup which Microsoft recently broke, to a streamlined open-source MinGW/GCC toolchain. The result: 1.12 is 50% smaller than 1.11, which was already below 1 MB!

I annoyed people a few too many times with the automatic restart, so Legacy Update 1.12 adds a new 3-minute countdown. This also lets you choose to restart later. A bug with it incorrectly thinking a restart is needed on Windows 10/11 (sorry!) is also fixed.

My never-ending quest to make every edition of Windows XP and Server 2003 identify itself correctly continues in this release. With some very specific exceptions, it should now always display the most accurate name for the OS. (Blog post still to come about the craziness behind this sometime)

We also added a partial fix for the slowest of all updates - those for .NET Framework. Each update has to go through an extremely slow, wasteful re-optimizing process. If you use the Legacy Update website to install updates, we now use a workaround to defer the optimization until the end.

Our code signing certificate expires less than 2 weeks from now. We are looking at free/discounted options, but may need to purchase the same certificate again for $369 USD. Your support is appreciated to help us reach this goal and continue working on Legacy Update for another 2 years.

Workaround for ISP issues

2025-08-30T04:35:00+00:00

I set up a workaround on the server that should fix Legacy Update being blocked by some ISPs (specifically, I just set up a new subdomain and redirected all Windows Update download traffic through there).

If you’ve been running into “Windows Update may be blocked by your firewall or proxy server” or error 8024402F, try again now, it should work. If not, you may need to force Windows Update to grab an updated list of download links from our server by deleting the C:\Windows\SoftwareDistribution folder and trying again.

Legacy Update 1.12 – Beta preview

2025-08-24T03:06:00+00:00

Hi everyone! I’m working on Legacy Update 1.12, where I’ve made a pretty major under-the-hood change. Now seems like a good time to release this for beta testing.

I’ve refactored the ActiveX control code to be built with the open-source MinGW compiler, rather than Microsoft’s Visual Studio 2008 (and a bit of 2010, and 2017, and 2022… you can see why I wanted to get rid of this).

Windows is heavily built around the Component Object Model. It’s a neat system where components of the OS can easily talk to each other, and third-party apps can extend the OS with new features. ActiveX is one of systems built on top of COM. With the great power of COM comes great amounts of code to interface with it. Microsoft “simplified” this for developers with Active Template Library, which generates most of the code for you through copious amounts of compiler magic. This relies on non-standard features of the Visual C++ compiler, and at any rate I was feeling paranoid about whether all the code it generates is even necessary.

So I started removing the ATL magic, and started writing that code by hand. It worked really well, and it reduced the combined size of the 32-bit and 64-bit ActiveX control dlls by 18%. Thanks to the wonders of file compression, the setup exe download is also now 24% smaller. Visual C++ 2008 (for 32-bit) and 2017 (for 64-bit) produce fairly different code, while our new streamlined MinGW toolchain is identical between both 32-bit and 64-bit (aside from the machine instructions of course), so they compress together really well.

This allowed me to better understand how ActiveX works, which made me realise there was a fair amount of dead code - a single line of ATL template magic could end up compiling thousands of lines of code that weren’t even being used. I also got the impression that a lot of what I needed to implement simply hasn’t been done with MinGW before. Perhaps the only project that does so is Wine. Hopefully I’m wrong?

Because we’ve eliminated a crazy amount of complexity needed to compile Legacy Update, the GitHub Actions nightly build now fully works on all versions of Windows we support. Previously, we could only use Visual Studio 2022 and Visual C++ 2017, which painfully took 10 minutes to install, and only supports Windows XP SP2 and up. (We also believe Microsoft recently broke the Visual C++ 2017 toolchain in Visual Studio 2022, and removed the feature rather than fixing it.)

The only bug I’m aware of is that the “Checking for updates” progress bar can draw in the wrong position if you scroll the page, or if the layout of the page changes. Unlikely you’ll run into this issue though.

I also spent way more time than I probably should have figuring out how to display the correct brand name for each edition of Windows XP and Server 2003. A lot of this already happened in Legacy Update 1.11, but of course, it goes deeper. Now, it should be the case that any edition of Windows is identified exactly correctly on the Legacy Update website (save for some later Windows 2000 editions I haven’t looked at yet). It wasn’t harming anything, the OS name is purely cosmetic and doesn’t affect which updates you get, but it bugs my inner perfectionist, ya know? Someday, I’ll finish writing up a long blog post about how Windows’s internal branding system was a mess before Vista.

Huge shoutout to Douglas Reno for putting together both the new build system, and a new continuous integration server we’ll switch GitHub Actions over to soon.

Enough yapping, give me the download

Here is a link you can always use to download the latest nightly build: https://nightly.link/LegacyUpdate/LegacyUpdate/workflows/build/main/artifact.zip

Since it’s https, you’ll likely need to download this on a modern PC or in a modern browser. (Did you know you can download browsers from content.legacyupdate.net?)

Release notes (draft)

Legacy Update’s ActiveX control has been rewritten to be built with the latest open-source MinGW compiler, rather than Microsoft’s Visual Studio 2008. This brings 17 years of compiler improvements, reduces the (already small) installation size of Legacy Update by 18%, and makes it easier for us to work on the project.
Windows XP and Windows Server 2003:
- Fixes setup redownloading the Windows Update Agent after upgrading Windows XP to SP3 or Windows Server 2003 to SP2.
- Fixes incorrect OS names being displayed for some editions.
Windows Server 2008:
- Fixes setup incorrectly downloading Service Pack 1 for Windows Server 2008, which is already Service Pack 1.
General fixes:
- Fixes the ActiveX control not being updated when the Legacy Update website is open in 32-bit Internet Explorer on a 64-bit system.
  This particularly affects Internet Explorer 11, which runs as 32-bit by default.
- Better handles “Unable to write to LegacyUpdate.dll” errors when the Legacy Update website is open in Internet Explorer.
- Better handles detection of Internet Explorer being uninstalled, particularly on Windows XP, 10, and 11.
- Fixes “Open File - Security Warning” dialog at the final stage of setup.
- Fixes multiple Windows Update settings dialogs appearing when clicking “Settings” or “Pick a time to install updates” on the website.
- Fixes the Notepad window being invisible when clicking “View Log File” on the website.
- Updates NSIS to version 3.11, which addresses a privilege escalation vulnerability (CVE-2025-43715).

Issues with antimalware false-positives

2025-08-14T11:17:00+00:00

Hopefully most of you won’t need to worry about this, but if you’re seeing Legacy Update say it’s been blocked by your firewall, there’s some explanation of why here. We’re doing our best to get this fixed, but it’s been ongoing for 2 months now.

Issues with antimalware false-positives