Legacy Update: Get back online, activate, and install updates on your legacy Windows PC

This release addresses a security issue in the Legacy Update ActiveX control. Please update as soon as possible.

• Security:
  • Fixes a logic error that allowed any website to access the Legacy Update ActiveX control, rather than only legacyupdate.net. This may allow an attacker to cause disruption to your system, such as by installing updates without consent, causing unwanted dialog boxes to appear, or revealing your exact operating system build number. For more information, see our security advisory. (GHSA-f4g7-4gmx-jfgf)
  • On installation of Legacy Update 1.13.2, your system will be configured to block earlier versions of the Legacy Update ActiveX control. This is also known as a “killbit”. To ensure the vulnerability remains mitigated, this block is not removed from the registry if you uninstall Legacy Update.
  • Adds support for Internet Explorer’s “object safety” feature, which displays an Information Bar if an unauthorised website tries to access the Legacy Update ActiveX control.
  • Adds a requirement that websites using the Legacy Update ActiveX control must be on the http:// or https:// protocol, and in Internet Explorer’s Trusted Sites zone.
• Bug fixes:
  • Allows the Legacy Update ActiveX control to be installed on Windows Server Core, in cases where Internet Explorer has been manually installed.
  • Fixes Legacy Update offering to install Internet Explorer 9 on Windows Server 2008 for Itanium-based Systems, which is not supported.
  • Fixes an unintended RegSvr32 dialog appearing during uninstallation.
  • Various minor improvements to harden security of the Legacy Update codebase.

Thanks to @renodr and @nononymousse for helping with reviewing/testing security and bug fixes in this release.

This release fixes a few bugs introduced in 1.13, and adds workarounds for issues with specific hardware.

• Windows 2000:
  • Fixes “error (error)” when installing Internet Explorer 6.
• Windows XP:
  • Works around a bug in Boot Camp on early Intel Macs that causes “Fatal error during installation. (1603)” when installing Windows XP Service Pack 3.
• Windows Vista:
  • Fixes occasional “The RPC server is unavailable” when continuing in setup mode.
• Windows 7:
  • Fixes “Access is denied” when checking for updates from a non-elevated Internet Explorer window.
  • Works around a bug in the official Windows 7 system image used on 2008 – 2010 Lenovo PCs that causes “The system cannot find the path specified. (3)” when installing updates.
• General fixes:
  • Fixes occasional “The server threw an exception” while using the website.
  • Fixes Internet Explorer occasionally taking a long time to close while using the website.
  • Fixes “Installing Updates” dialog appearing behind Internet Explorer.
  • Fixes reinstalling or updating Legacy Update causing backed-up Windows Update registry keys to be lost.
  • Updates NSIS to version 3.12, which addresses a privilege escalation vulnerability (CVE-2026-42171).

This release improves handling of numerous edge cases you might run into while using Legacy Update.

• Adds integrity verification of files downloaded by Legacy Update setup. This ensures downloaded files are not corrupt, blocked by a firewall, or tampered with.
• Adds detection for a currently running Windows update, to ensure Legacy Update setup doesn’t try to start a conflicting update installation.
• Legacy Update now detects when Windows has been upgraded (such as from Windows XP to Windows Vista), so it can display a message that it needs to be reinstalled to function correctly.
• Installation of root certificates is now skipped if it has already been done in the past 30 days. Updates to the root certificate store are infrequent, typically only occurring a few times per year.
• Adds logging that can help to diagnose issues in Legacy Update.
• Windows 2000:
  • Fixes “Access is denied” errors when installing Legacy Update on Windows 2000.
• Windows XP:
  • When upgrading Windows XP Media Center Edition or Tablet PC Edition from RTM or SP1, Legacy Update now installs Service Pack 2 in between, rather than Service Pack 1a. This upgrades Media Center Edition to 2004, and Tablet PC Edition to 2005.
  • When enabling Windows Embedded 2009 updates on Windows XP, Legacy Update now hides the notoriously broken KB2686509 update.
  • When Windows Embedded 2009 updates have already been enabled on hardware that will run into compatibility issues, Legacy Update setup will show a warning.
• Windows Vista and Server 2008:
  • Installing the Windows Server 2008 servicing stack is now split out into a separate “Prepare for Extended Security Updates” checkbox.
    We’re reverting to using the latest general public servicing stack for Windows Vista, released in 2012. While there are some security and performance benefits to using the Windows Server 2008 servicing stack from 2019, it also brings some compatibility issues, so we now let you decide if you want this. This only applies to new installations of Legacy Update, and won’t change existing ones.
  • Adds a prerequisite update to Hyper-V, KB950050, required for Windows Server 2008 SP1 with Hyper-V to be correctly upgraded to SP2. (Contributed by @Goldfish64 - thanks!)
  • Fixes installation of Windows Vista Service Pack 1 getting stuck at “Configuring updates…”.
  • Works around bugs in the Windows Vista Service Pack 1 and 2 installers causing it to not check if the system has sufficient disk space available, and to fail for languages other than English, French, Spanish, German, and Japanese.
  • Fixes a Windows bug causing the wallpaper from setup mode to persist into the user’s desktop on some editions of Windows Server 2008.
  • Fixes a crash when clicking “Install Updates” on the website.
• Windows 7 and Server 2008 R2:
  • Adds an option to install the Windows 7 Convenience Update Rollup on new installations of Windows 7. This is a bundle of 66 updates released prior to April 2016.
    While this rollup helps you to get up-to-date faster, it contains updates that introduce telemetry features that some users find undesirable. As such, this option is not selected by default.
  • Adds support for installing Windows Server 2008 R2 Service Pack 1 on Itanium systems.
• Windows 10 and 11:
  • Fixes some updates not being staged for installation when restarting the system via the Legacy Update website.
• General fixes:
  • Fixes crashing on 486 processors. (Contributed by @renodr - thanks!)
  • Fixes /norestart flag not working.
  • When running on Windows Server Core, Legacy Update setup now skips features that are not applicable - particularly, Windows Server Core lacks Internet Explorer, so the ActiveX control is skipped. (Contributed by @Goldfish64 - thanks!)
  • Adds support for running Legacy Update setup in Windows audit mode, which is used to prepare an installation of Windows in advance of it being given to an end user.
  • Adds detection for Terminal Services Execute mode on Windows Server. Legacy Update setup must be run in Install mode. We now provide an option to switch to Install mode automatically.

A huge thank you to everyone who contributed towards our fundraiser for a renewed code signing certificate, which we’re now using for this release, and another thanks to those who helped make our new Microsoft Download Center Archive a big success!

This release fixes some issues from Legacy Update 1.12. Refer to that release for the list of major changes in 1.12.

• Fixes SSL connection errors on Windows 2000, Windows XP, and Windows Server 2003.
• Fixes the website not detecting when a restart is required on Windows 2000.
• Fixes setup not correctly resuming after restarting the system.
• Fixes “Permission to access the Windows Update service was denied.” errors after clicking Yes on the User Account Control prompt.
• Fixes a Windows bug causing the wallpaper from setup mode to persist into the user’s desktop.

Our code signing certificate expires less than a week from now. We are looking at free options, but may need to purchase the same certificate again for $369 USD. Your support is appreciated to help us reach this goal and continue working on Legacy Update for another 2 years.