Updates displayed in red, what does it mean?


I'm trying to create the definitive win7 installation media (since there are no more updates), but some updates are displayed in red color. Does it mean they will not be integrated? why?
Especifically, I'm talking about KB3125574 (I'd rather use that one instead of 100+ small updates). Also the IE11 language pack is displayed in red.

Any ideas?


Active Member
There's a missing pre-requisite for one of your updates, or a conflict that needs to be resolved. On the Updates page, check the Analyze button on the menu for more explanation.

In recent weeks, most of the 5574 warnings are from the highest selected Servicing Stack (SSU) update is not high enough (or too high).
Last edited:


I checked the prereqs, and they were only SP1 and the SSU. I included both KB4490628 (it replaces all previous SSUs) and the latest SSU (which, stupidly, does not replace 4490628), KB4537829.
I'll try the "analyze" option, thanks for the tip!


Active Member
Servicing Stacks are a goofy mess. They're not cumulative, but stacked on top of each other (pun intended).

The oldest one 3552 has manifest info needed to satisfy WU checks, 0628 is the "baseline" that MS requires before all modern rollup patches, and you apply the most recent one (6952 or later) last in order.

SSU changes past Jan 2020 are intended for folks on the ESU maintenance path, and its shenanigans. There's no harm, but also no benefit from a later SSU if you're building a W7 "end of service" release.


maybe I need to include an older SSU to allow the integration of 3125574, although 4490628 superseeds all previous SSUs...


Active Member
3552 & 0628 are both required, they're the bottom of your stack. Then top off with SSU update no older than the last monthly update you apply.
3552 + 0628 + 6952 (or a later one).

What is confusing is most folks don't understand what superceding means in the Windows update sense. Superceding is a stacking a new patch over an older patch, but the way pre-reqs or underlying manifests (file versioning) works you need one or more layers of previous updates. Monthly rollups, normally do completely replace the previous version -- but it still needs a the same pre-reqs as the very first rollup in that sequence.

ie. 5574 "SP2 rollup" -> monthly rollup -> later monthly -> even later -> latest monthly
ie. 5574 "SP2" -> latest monthly

Other updates are similarly layered. IE11 requires a 5319 (an older cumulative rollup), before you stack the last IE11 rollup (4251).


Well-Known Member
i bow to nuhi's technical knowledge, i have just reported my findings and KB3177467 is what i have used for a few years with 3125574.
install net 4.8, gather IE11 and prerequisites, install then scan for EOL updates, installed those in build date order.
I am certain my updates list was discussed many moons ago on this new forum, pmikep was a participant.
Last edited:


NTLite developer
Staff member
Btw just to add to this topic, the tool will indeed mark red something to point you to the Analyze button in the toolbar, it will tell exactly what is missing.
However, since updates are changing more often that the tool itself, make sure to refresh the tool's update data by going to Tools - Download Updates, or Updates - Add - Latest Online updates.
Then close that window to readd your manual updates (or add them from the latter option as usual) and it will use the latest KBs to mark any requirements.
Will make it cache that data in one of the future updates so this step is not needed on each restart when the tool is not newer than the data.

Let me know if I missed something.


Active Member
The only info that I can add is that I have simply let NTLite do its thing with updates and, so far, it's always worked. I have gotten into the habit of Trimming the update folder since updates are superseded/go obsolete so often. IIRC, when I upgraded Win10 from 1903 to 1909, there was a SS update where NTLite removed a previous SS in favor of a newer one. The 1909 build worked fine.


Thanks, I got it sorted out and it's working perfectly. I just have another question: How do I completely disable UAC in the settings? There are just too many options, tried several of them an none worked, I still get UAC enabled. In Wintoolkit, the option to disable UAC was absolutely straightforward: just "disable UAC". Period.