Installing some of those updates here at the office has caused us more than considerable heartache. Some of those updates change configuration settings for IIS and other applications that have disabled networks, access to the internet, etc.
Worse, MS doesn’t warn you that its doing it, or tell you that it’s done it.
They aren’t debugging their fixes well enough. I believe their philosophy is that in point of fact, you can’t debug it enough to satisfy everyone.
We stopped the automatic fixes, and even still some of our apps are updating themselves without telling us, and we don’t know how.
Well, if it's Word or something that has no godly reason to be talking to or serving to the internet, set your firewall not to allow them access.
Obviously this means you need to be running a firewall other than the Windows one. I like Zone Alarm. I can't believe the guys at Microsoft are such a bunch of yutzes that they think a firewall from Microsoft would even be a desirable thing. If Microsoft's garden variety incompetence wrt security issues isn't enough disincentive, Microsoft products are probably 60% of the reason I run a firewall in the first place. Why oh why would I ever run a firewall FROM Microsoft??? I'd probably be safer with no firewall at all.