I think you misunderstand how Automatic Updates work. The "3 AM" default setting simply defines when Windows will install updates. The actual detection and download of updates (including the file that the scan engine uses) are not done at 3 AM. Using default settings, Windows will run an update check every 22-17.6 hours. The 20% variance is to help prevent floods from computers booted up at the same (for example, a computer lab). This process will: check to see if there is a new update detection file, download an updated list, run a scan to see if the computer needs updates, and download needed updates. Microsoft releases updates on Tuesday at 10:00 AM PST (though some months they have been a few hours late). So to monitor the impact of the updates, look at the traffic between Tuesday 10:00 AM PST through Wednesday 8:00 AM PST. Note, not all computers will get their updates at this time. The most simplest example are computers that are off. But also, many people disable/modify their Automatic Updates settings, while others will use the Windows Update site. Hope that helps, Adam Stasiniewicz -----Original Message----- From: owner-nanog@merit.edu [mailto:owner-nanog@merit.edu] On Behalf Of Frank Bulk Sent: Wednesday, January 09, 2008 2:48 PM To: nanog@nanog.org Subject: Microsoft's Black Tuesday bandwidth impact? Every month I look at my upstream bandwidth graphs and I see no blip in the hours before 3 am on Microsoft's Black Tuesday. I would think that with the thousands of PCs out on our network downloading updates around that time that I would see *something*. I know every Black Tuesday I see my three PC's blinking a logon screen. Are MSFT's monthly updates really a non-event in regards to internet bandwidth? Frank