SQL Server administrators often encounter Microsoft updates labeled as “CU + GDR”, and understandably, this can cause confusion — especially when trying to stay on a consistent CU-based servicing path. This post clarifies what “CU + GDR” really means and why it’s not something to worry about.
What Does “CU + GDR” Actually Mean?
When Microsoft labels an update as CU + GDR, it simply means:
- It is a Cumulative Update (CU) that includes all the latest GDR-level security fixes.
- It is not a GDR-only update.
- It does not switch your SQL Server instance to the GDR servicing branch.
This terminology is used to emphasize that the CU includes all critical security updates — you do not need to install a separate GDR patch.
Common Misunderstanding
Some customers see “GDR” in the label and assume it means the update is part of the GDR-only servicing branch. That’s not the case. If you are on the CU servicing path, applying a CU + GDR update keeps you on that path — and future CUs will continue to install normally.
Example: SQL Server 2022
- CU-based deployment: Install KB5058721 (CU19 + GDR), build 16.0.4200.1
- GDR-based deployment: Install KB5058712, build 16.0.1140.6
KB5058721 is the CU19 update with the latest GDR-level security fixes. It keeps your instance on the CU servicing branch and does not block future CUs.
SQL Server 2016: The Azure Connect Pack Twist
SQL Server 2016 adds another layer of complexity with the Azure Connect Pack, which is a CU-based branch that also enables Azure-specific features (e.g., distributed AGs with Azure SQL MI, enhanced certificate support).
Previously, SQL Server 2016 SP3 offered three servicing paths:
- CU-based
- GDR-based
- Azure Connect Pack (CU + Azure features)
Now, there is no longer a separate “CU-only” branch. To stay current on CU-based updates, you must install the Azure Connect Pack + GDR update.
- CU-based deployment: Install KB5058717, build 13.0.7055.9
- GDR-based deployment: Install KB5058718, build 13.0.6460.7
Final Takeaway
If your environment is CU-based:
- You should install the latest CU + GDR update.
- You are still on the CU servicing path.
- Future CUs will install without issue.
- You cannot install a GDR-only update on a CU-based deployment — it would be a downgrade and is blocked by setup.
A minor observation from inside the mothership: GDRs are not strictly security releases.
Great clarification—thanks for demystifying the ‘CU + GDR’ naming convention! It’s clear that installing one keeps you on the cumulative update path without risk of stepping back into a legacy branch.