Vladimir, those are good concerns you are raising, likely shared by others. I will break down my answer into a few separate points, and hopefully address them all:
1. Registry key update management: The Endpoint agent does not rely on registration with the Microsoft Windows Security Center in order to get updates. As such, it is not affected by the registry key. Instead of relying on the WSC, it will self-update through the Kernel Adaptation Module (KAM) mechanism, a service offered through RSA Live, as soon as the underlying OS was updated. As of today, all but two kernels have been updated, with the remaining two coming online tomorrow. (The MS KB article on this issue details how the registry key works. You will read that only agents registered with WSC respond to that key.)
2. The KAM updates support all the agents since 4.1.0.2. If anyone happens to be on an older agent, we strongly suggest an upgrade to our latest versions, both for features and stability reasons, and because support is not provided on older versions. However, older agents will still be compatible with the updates provided through KAM, as long as they are based on version 4.1.0.2 or later. Your 4.1.1.1 agents will be included.
3. Testing follows the usual procedure we've always had in place for updating the agents in sync with the underlying OS since the feature was introduced, in 4.1. We do have confidence that the patches are functionally compatible with all of our supported agents at this time. TDI should be included, as it always is.
4. We are running some supplemental server-side performance testing, (which Mike Gotham was referring to). We will share our findings, should we find any worrysome slow-downs. Note that the testing concerns the server, rather than the agents, as the MS patch will affect intense I/O operations, which the agents don't do. As of today, we have not found any issue, but testing continues.
Please let me know if this answers your concerns. I will be happy to answer any follow-up question.
