Jump to content

What are GDR, LDR and QFE Updates?


Recommended Posts


Basic Description

General Distribution Release

GDR packages contain only security and critical stability issue fixes. These are usually released via Windows Update.

Limited Distribution Release

LDR packages contain "other" fixes that have not undergone as extensive testing, and resolve issues that only a fraction of the millions of Windows users might ever encounter. You usually request these from the Microsoft website but they're mostly found in SoLoR Updates.

Quick Fix Engineering

QFE is the old name for LDR (above).

How are they installed differently?

  • At the end of the day, if you have LDR/QFE Mode enabled it will install LDR Mode if the update has that option regardless if its cab or an msu file.

MSU Files

*.msu files will get installed normally using the command below.

pkgmgr.exe/norestart /ip /o:"C:\W7T\Mount;C:\W7T\Mount\Windows" /m:"UpdateLocation\update.msu" /quiet

If you have LDR/QFE Mode enabled then the *.cab file is extracted and the below (CAB Files) method is then applied to the newly extract cab file.

CAB Files

Normally *.cab updates have a file called 'update.mum' but LDR updates also have a file called 'update-bf.mum', if the 'update-bf.mum' is not detected W7T will install cab files normally. Cab files are usually extract from the msu file or when a user has used 'MSU to CAB Converter'

pkgmgr.exe/norestart /ip /o:"C:\W7T\Mount;C:\W7T\Mount\Windows" /m:"CABLocation" /quiet

If, however the update-bf.mum has been located it will extract the cab to a temp folder and install both *.mum files like so:

pkgmgr.exe/norestart /ip /o:"C:\W7T\Mount;C:\W7T\Mount\Windows" /m:"ExtractCABTemp\\Update.mum" /quiet
pkgmgr.exe/norestart /ip /o:"C:\W7T\Mount;C:\W7T\Mount\Windows" /m:"ExtractCABTemp\\Update-bf.mum" /quiet

That's it.

Full Description

Out of the box, all of the files in Windows are on what we refer to as the "General Distribution Release" (GDR) branch.

If updates are only delivered from Windows (or Microsoft) Update (including via WSUS), then all the files remain on the GDR branch.

Some KB articles have packages to address specific issues that are not delivered by Windows Update - "Limited Distribution Release" (LDR) branch packages.

Previously we used the term "Quick Fix Engineering" (QFE), but LDR has taken over – expect to see these terms used synonymously.

GDR packages contain only security and critical stability issue fixes.

LDR packages contain "other" fixes that have not undergone as extensive testing, and resolve issues that only a fraction of the millions of Windows users might ever encounter.

It is not the entire OS that is considered GDR or LDR - it is down to the individual file level.

A package delivered by Windows Update contains both GDR and LDR versions of the files it updates, so that it is able to replace the files on the system regardless of which branch they are currently on.

A package acquired outside of Windows Update contains only LDR versions of the files it updates, and this will "move" the files onto the LDR branch where they will remain until the next Service Pack.

A Service Pack (SP) contains only GDR branch versions of the files which have been updated by ANY package since the previous Service Pack (or RTM).

So installing the latest Service Pack at, or shortly after release will likely put all of your files (back) onto the GDR branch.

One other thing that Service Packs imply is that hotfix packages need to have versions of the files to replace for the most current SP level and the previous one (dubbed "N and N-1 support").

So for every single file updated by a Windows Update hotfix package after the first SP, there are 4 versions of the file present:

"N-1" GDR

"N-1" LDR



Taking a ficticious example, where we have the following files straight out of the box:




1) Hotfix package KB000001 is installed through windows Update, and contains an update to B.DLL - this pacakge contains:



> The SP1GDR version is installed by default, and there are only 2 (identical) versions of this file in the package as we're not yet at SP1.

The machine now has:




2) Hotfix package KB000002 is installed, NOT through Windows Update, and contains an update for A.EXE - this package contains:


> No options here, the version that ends up on disk is now the LDR version

The machine now has:




3) Hotfix package KB000003 is installed through Windows Update and contains an update to A.EXE and C.SYS - this package contains:





> A.EXE is on the LDR branch because of KB000002, while C.SYS is still on the GDR branch

The machine now has:




4) Hotfix package KB000100 is installed through Windows Update, and contains an update for C.SYS for the RTM and SP1 versions of the OS - this package contains:





> OS level is still RTM, the current file is on the GDR branch, so we remain on the GDR branch

The machine now has:




5) SP1 is now installed on the system, which contains only GDR version 2.0 of every file:




> OS level is now raised to SP1 and we push all files on the GDR branch... but look what happens to C.SYS...

The machine now has:




> The SP1 package does not contain anything other then the GDR 2.0 versions of the files… so where did the GDR 2.5 version come from?

The hidden, compressed folders named $NtUninstallKBxxxxxx$ in the %systemroot% folder contain the backup of the version(s) of the replaced file(s) when the hotfix was applied, plus the executable to uninstall the package (in the spuninst sub-folder).

The hidden $hf_mig$ folder in the %systemroot% folder contains all the files extracted from the hotfix packages in sub-folders KBxxxxxx- these are necessary to ‘migrate’ the hotfix in the event that a switch of branches occurs or an earlier hotfix package is later installed.

In the example above at step 5, the post-SP1 hotfix package was used to migrate the updated version of C.SYS during the installation of SP1.

If this was not done, or if the folder had been deleted, then the file would have been regressed from 1.5 to 2.0.

What? A regression from a lower version to a higher version? Is that a typo?

Think of 1.5 as "RTM with KB000100" and 2.0 as "SP1 without KB000100" and it makes a bit more sense.

The migration of hotfixes to avoid regression is done from hotfix to hotfix as well as with SPs.

Imagine we have module X.DLL which has a dependency on module Y.DLL, and they both start at GDR 1.0.

Now a GDR hotfix KB000123 is applied which updates Y.DLL to 1.3.

Now an LDR hotfix KB000075 is applied which updates X.DLL to 1.1 and Y.DLL to 1.1.

The resultant files on the system would be:



If we took Y.DLL 1.1 from the second hotfix then we regress in the security fixes, and if we left Y.DLL 1.3 from the GDR branch then we might miss a dependency that X.DLL LDR 1.1 may have which could lead to instability.

By switching to the LDR branch for the higher version of the file Y.DLL, we remain at the correct level in terms of security & stability fixes (changes in the GDR branch) but also add the fix for the issue mentioned in KB article KB000075.

Moving to the LDR branch for a specific KB article number will not just give you the security changes up to that point plus the 1 non-security issue mentioned in the KB article - it will also contain every non-security update to the files in the hotfix package.

For this reason you will see the all-too-familiar disclaimer:

"A supported hotfix is available from Microsoft. However, this hotfix is intended to correct only the problem that is described in this article. Apply this hotfix only to systems that are experiencing this specific problem. This hotfix might receive additional testing. Therefore, if you are not severely affected by this problem, we recommend that you wait for the next software update that contains this hotfix."

If you followed the above then you will also understand why you should never manually delete the$NtUninstallKBxxxxxx$ folders – you will be unable to remove these hotfix packages yet they will be listed in Add/Remove Programs (and you will gain very little disk space by doing this as the contents are compressed on disk).

If you were to delete the $hf_mig$ folder then you would break migration and may prevent the installation of future hotfixes or introduce unexpected regressions when installing service packs.

As if that wasn’t enough… you then have separate packages for the same hotfixes (where appropriate) x86 (i386/IA32), x64 (amd64) and IA64.

x86 is “only 32-bit” and IA64 is “only 64-bit”… but x64-based Windows has the concept of WOW (Windows-On-Windows) so these packages can have an even bigger list of files for the native 64-bit versions and the WOW6432 versions to support 32-bit apps.

Now you can see the value in the file lists documented in the KB articles, showing not just the file versionnumber, but the different branches which have fixes, and this has de-mystified the versioning system a little.

The above is correct for Windows versions up to and including 5.2 (Server 2003 & XP x64 Edition) – when we moved to 6.0 (Vista) we changed how it works.

Edited by Legolash2o
Link to comment
Share on other sites

Very good description, although there is one question left : What happens if I use MSU>CAB Convert prior to integrating the converted hotfixes with AIO Tool? Will it still integrate the LDR branches (if the option is checked, of course)?

Edited by ulysse
Link to comment
Share on other sites

OK thanks, but I am still not sure I understand...

Does this mean that people who want the LDR branches to be integrated should not convert to MSU to CAB any longer?

I always used to convert the MSU files to CAB because I read that it would save time when running the integration.

Link to comment
Share on other sites

Well MSU to CAB Converter extracts the cab file from the msu, so the 'CAB Files' part of the first post still applies. And yes, i recommend using cab files if you want faster integration.

At the end of the day, if you have LDR/QFE Mode enabled it will install LDR Mode if the update has that option regardless if its cab or an msu file.

Edited by Legolash2o
Link to comment
Share on other sites

  • 2 weeks later...

So, if I read it correctly, the Solor updates aren't the critical updates, just the "other" types of update? I just assumed that the Solor updates *were* the critical ones, so I downloaded the SP1 iso via WinKit, integrated the Solor updates and found I had 68 or something updates to still install... I really should read through these forums more :)

What resources do people here use to download a complete hotfix pack of all the critical updates? I might be simplifying things far too much, but all I want to do is download the iso, integrate a whole bunch of patches and when I check Windows Update it will say "No updates"! If such a complete pack is indeed out there could Winkit link to it, just as it does the Solor ones?


Link to comment
Share on other sites

  • 1 year later...

i see... the difference between them in integrating to image is the speed... i thought when you convert the msu updates file to cab the image size will shrink to a few percent... i was making an updated AiO image that will be able to fit in a 4.7gb dvd... 

Link to comment
Share on other sites

The "source" file for the update will be different sizes depending on whether it is .cab, .msu, or whatever.  The "source" files are just a distribution container, the files inside that container are the same.  If you were distributing a DVD full of updates, then I think your understanding would be correct.  But if I understand the process correctly, once you have installed/integrated that update into your updated AIO OS build, then those updates are all expanded/stripped out of their containers and either replace existing files or are stored in a "install pending" location.  In either case, I believe that the format used inside the OS to store those files is independent of the format of the "source" file.  I could be wrong, but that is the way I understand it.


Cheers and Regards

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Similar Content

    • By hkroiss
      Hi, since around 1.5 half years i am integrating Updates into our Windows Image at our Company. However i have noticed that even when all the latest Updates are integrated after installing the OS it shows a few ".NET Framework" Updates that couldn't be integrated (see Attachment). A year ago it were only around 10, now around 15. So its getting more and more, it hinders the usfulness of the Slipstreaming process a bit.
      Did anyone of you find a way to integrate this pesky ".NET" Updates into the Image?
      Thanks for the help.

    • By jakson
      I want to integrate last upadates into Windows 7 SP1-U ISO and I have two doubts:
      1. Does KB3172605 (July 2016 update rollup) replace KB3156417 (May 2016 update rollup)?
      2. Integrate KB3170455 (update for Windows Print Spooler)? Supposedly it stops non-admin users from installing a network-printer :/
      What set of updates is the best to integrate (KB in exact order):
      KB3020369 kb3125574-v4 KB3168965 KB3172605
      KB3020369 kb3125574-v4 KB3156417 KB3168965 KB3172605
      KB3020369 kb3125574-v4 KB3156417 KB3168965 KB3170455 KB3172605
      KB short descritpion:
      KB3020369 April 2015 servicing stack update for Windows 7 and Windows Server 2008 R2
      KB3125574 Convenience rollup update for Windows 7 SP1 and Windows Server 2008 R2 SP1
      KB3156417 May 17 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
      KB3168965 July 12 2016 Security Update for Windows Kernel-Mode Drivers
      KB3170455 July 12 2016 Security Update for Windows Print Spooler Components
      KB3172605 July 21 2016 update rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1
    • By PsycH0Ooo
      Hello Everybody
      I have a Problem with the Updates i would like to intergrate some updates in my install.win but the Problem ist, that if i would like to intergrate the updates the mark are yellow and not green. On the state the say me install pending. If i install a Windows machine with the iso the updates are not installed but why ?
      Its a Windows 7 ISO.
      If i would like to intergrate the Updates with the Updates installer, and i add all updates that i would intergrate to my install.wim file it says Not compatible with 10240 : "and the source to my update"
      What did i make not correctly ?
      Best regards PsycH0Ooo

    • By Guppy
      Good evening everyone!
      I've been using WinToolkit since a lot of years to integrate updates in Windows Installations. Recently I redid my Win7 x64 Installation. I removed the ei.cfg and integrated all major "General" "Security" and "Hotfix" Updates. After integrating I created an ISO and started it in a virtual Machine. But upon booting it only says 
      I don't know what the problem is, especially since my x86 Version started without any issues and in the past there was nothing comparable. Can you tell me what might have went wrong and how I can fix this? 
      Thank you for all suggestions in advance and have a nice day!
    • By glowdude
      Host OS: Windows 7 Ultimate x64
      Image OS: Windows 7 x64
      Windows ADK for 8.1 installed: Yes (I used this link http://www.microsoft.com/en-us/download/confirmation.aspx?id=39982)
      In WinToolkit v1.5.3.12, when I add the kb2603229, kb3035126, kb3035132 they show up and the program says they are integrated.
      But when I test the image, Windows updates says they are not integrated.
      They are integrated when I use the dism command in cmd.
  • Create New...