My RSS reader was on fire this weekend after word of the Office Genuine Advantage (OGA) mix-up made the rounds. To prevent this issue from getting (further) blown out of proportion I've listed a few key details below.
Point #1:
The OGA hotfix requires admins to accept an End User License Agreement (EULA) before deploying anything to WSUS clients. I captured a screen shot of the OGA EULA using my lab WSUS server.
Point #2:
Even if your WSUS server(s) use automatic approvals, an EULA-enabled update still requires manual approval. This is an important point that every WSUS admin who uses automatic approvals should understand. I prefer to manually approve all but Definition Updates; however, your environment may allow less stringent controls.
Point #3:
Immediately after recognizing the mistake (yes, mistake... not conspiracy) Microsoft marked the update as Expired by issuing an update revision. This action essentially disabled OGA and prevented unsuspecting WSUS admins from approving it. Unfortunately most WSUS servers only sync once or twice per day, which means OGA was hanging around unexpired for 12-24 hours. However, this doesn't change the fact that OGA still required an EULA before being deployed (see first bullet). Here is a screen shot of both revisions, with the second one highlighted.
Bottom Line:
OGA shouldn't have been published in the first place. Microsoft needs to implement tighter controls on the publishing channel. However, in this instance OGA could not be deployed without admin intervention. I hope this post answers any questions you had after reading other accounts of the incident. Feel free to post a comment if you have any questions. Note: Due to comment SPAM your question will not appear right away (I need to moderate first). Depending on my schedule this could be anywhere from 2-24 hours. Thanks for your patience.
Blog Post Changelog:
4/21/08 (v.1) - Initial post
4/21/08 (v.2) - Added info to clarify EULA-enabled updates still require manual approval. Also misc. typesetting changes.