May has come and gone without Microsoft releasing a promised second release-candidate beta version of Windows XP service pack 2 (SP2).

Microsoft said earlier this year to expect Release Candidate 2 (RC2) of XP SP2 in May. Repeatedly, during the past two weeks, Microsoft officials have said RC2 would ship "sometime in the next few weeks."

But as June 15 closes in, Microsoft still isn't offering any new word on XP SP2's whereabouts.

Although Microsoft has deemed Windows XP SP2 a service pack, the product is a new version of Windows that will contain a number of features and fixes. With SP2, Microsoft is turning on its built-in Windows Firewall by default; including new browser and e-mail safeguards and enhancing XP's memory protection features, company officials have said.

On Friday, when asked for an update on SP2 RC2's ship date, a company spokesman said, "We are expecting it (XP SP2 RC2) soon." He said no further details were available.

Microsoft officials have said they are not sure whether they will issue an RC3 beta. And at least so far, Microsoft has held fast to its claim from this past spring that the final XP SP2 release will ship in late July.

The Windows enthusiast site NeoWin.Net reported at the end of May that Microsoft discovered a last-minute bug in the No Execute (NX) support that will be part of SP2, and consequently decided to delay the service pack. Microsoft would not comment on NeoWin's report.

Some testers speculated that Microsoft unearthed new application-compatibility problems that caused them to delay the RC2 release.

Since SP2 entered beta testing last year, Microsoft has been cautioning testers to make sure their current applications run on XP SP2. But the Redmond software maker has not specified publicly which applications it expects to break with SP2.

During the TechEd 2004 conference in San Diego in late May, however, Microsoft executives offered a few more specifics.

Get Ready for App-Compatibility 'Gotchas'

John Gray, lead program manager, and Douglas Hill, program manager — both with the Windows customer experience unit — relayed to TechEd attendees some of Microsoft's compatibility findings.

The presenters said that of all the SP2 changes, "securing IE (Internet Explorer) by far had the most adverse affect on LOB (line-of-business) application capability."

So, will your app break? Read on...

("Where Is Windows XP SP2?" Page 2)

Microsoft is predicting the IE changes are "likely to have the widest ranging impact based upon our deployment experience to date," the presenters said.

SP2 will introduce a number of IE changes, including the addition of a pop-up blocker and more granular MIME (Multipurpose Internet Mail Extensions) handling, to Windows XP.

So what's Microsoft doing to help? Gray and Hill discussed the new SP2 feature called "Custom Zones" that will allow individual IE security features to be turned off on a per Web-site basis.

But IE's not the only possible stumbling block, Gray and Hill admitted. The new SP2 setting that turns on the Microsoft firewall by default could be another.

So far, Microsoft has found that most existing client-server applications don't encounter problems with the firewall setting in SP2 RC1. (Microsoft released the RC1 beta on March 17.) In fact, 94 percent of client-server line-of-business apps worked right out of the box, despite the SP2 changes, the presenters said. But applications that attempt to "listen externally," like instant-messaging apps, may require custom configuration, Gray and Hill warned.

Server-to-client apps have proven "more challenging," the presenters said. (Server-to-client apps are those where communication is solicited from another external machine.) Data "will never be received by the client if the port concerned is closed on the client firewall," Gray and Hill said.

Microsoft has posted to its Web site in recent weeks articles explaining some of the "gotchas" that its customers should expect with its own products with the introduction of SP2. It has posted a frequently asked questions document on how SP2 will affect SQL Server and Microsoft SQL Server Desktop Engine (MSDE) customers. It also has posted a document to help insure that the Internet Explorer and ActiveX changes it is introducing with XP SP2 don't break customers' Web sites.

Despite these caveats, Microsoft is proclaiming XP SP2 ready for the enterprise. The reduction in the attack surface of the Windows XP client is "dramatic," said Gray and Hill at TechEd. The stability of SP 2 product is "excellent," they added. And the tools for successful deployment and management are there now.

But customers do need to plan and test, Gray and Hill said. They warned that some apps will require modification, and locating and addressing the issues can be a time-consuming process. The time to test and implement SP2 is higher than a typical service pack. But, the cost to patch code exploits one-by-one is "likely to be greater" than the cost of implementation of SP2, they concluded.

(This is an updated version of an article which originally appeared in the May 27, 2004, issue of the Microsoft Watch newsletter.)