Posts Tagged

automatic

Patch Tuesday’s tomorrow. We’re in uncharted territory. Get Automatic Updates paused.

It’s always a good idea to pause Windows updates just before they hit the rollout chute. This month, we’re facing two extraordinary issues that you need to take into account. Wouldn’t hurt if you told your friends and family, too.

Take last month’s Windows patches. Please. We had one patch, KB 4524244, that slid out on Patch Tuesday, clobbered an unknown number of machines (HP PCs with Ryzen processors got hit hard), then remained in “automatic download” status until it was finally pulled on Friday. We had another patch, KB 4532693, that gobbled desktop icons and moved files while performing a nifty trick with temporary user profiles. Microsoft never did fix that one.

Those aren’t isolated incidents. We see the same pattern, over and over again. Microsoft releases patches that aren’t adequately tested. Screams of pain ensue. Microsoft fixes some of the patches, doesn’t fix others. Wash. Rinse. Repeat. 

Getting out of the automatic update-induced karmic crapwheel is a mighty pain — and one that’s entirely avoidable. Just avoid the automatic updating, wait and see while crowdsourced beta-testing runs its course.

As if you needed more incentive, this month two additional problems loom.

First, the “optional, non-security, C/D Week” patch that rolled two weeks ago, KB 4535996, has had all sorts of problems. Mayank Parmar at Windows Latest and Lawrence Abrams at BleepingComputer document an impressive list of freezes, crashes, broken drivers, lousy performance, and black and blue screens. Microsoft hasn’t officially acknowledged any of the bugs.

The only bug that has been acknowledged, one that breaks the signtool.exe app in Visual Studio used to sign projects, drew a reference in one blog post from one Microsoft engineer. “We are working on a resolution and estimate a solution will be available in mid-March.”

In normal times, we’d expect the bugs in the “optional” patch to get ironed out by the time the regular cumulative update appears. The past couple of weeks, though, have been anything but normal times.

Almost all of Microsoft’s staff in the Northwest has been working from home for the past week. Microsoft announced late last week that two of its employees in the Seattle area have tested positive for COVID-19, the new coronavirus. You would think that the transition to telecommuting would be easy — after all, Microsoft’s been selling telecommuting-friendly software for decades — but word from the trenches is that there are plenty of bumps in the road.

That brings me to my second concern about this month’s patches. Even if Microsoft gets its act together and fixes the known (and unknown!) bugs in this month’s Patch Tuesday patch, we have exactly zero experience with Microsoft handling new bugs in this coronavirus-influenced work-from-home environment. 

Microsoft has a hard enough time fixing bugs when the whole crew’s in one building, in shouting distance. Heaven only knows what’s going to happen this month.

You have to patch sooner or later. But there’s even more reason this month to not be in the “sooner” cohort.

Blocking automatic update on Win7 and 8.1

Those who paid for Win7 Extended Security Updates should be plenty cautious about installing patches immediately. Those who didn’t will either ignore the patches (large majority there), or wait to see if free alternatives appear. We’ll be covering both intently on AskWoody.com.

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Windows 10

By now, almost all of you are on Win10 version 1903 or 1909. Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1909. If you insist on sticking with Win10 1809 (hard to blame ya!), you can block updates by following the steps in December’s Patch Tuesday warning. Be acutely aware of the fact that Microsoft won’t be handing out any more security patches for 1809 Home or Pro after the May Patch Tuesday. Two months to go.

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. If your Updates paused timer is set before March 30 (see screenshot), I urge you to click Resume Updates and let the automatic updater kick in — and do it now, before noon in Redmond on Tuesday, when the Patch Tuesday patches get released.

1909 pause updates to 3 30 2020 Woody Leonhard/IDG

If Pause is set to expire before the end of March, or if you don’t have a Pause in effect, you should set up a patching defense perimeter that keep patches off your machine for the rest of this month. Using that administrators account, click the “Pause updates for 7 days” button, then click it again and again, if necessary, until you’re paused out into late March or early April.

If you see an Optional update available (you can see one in the screenshot), DON’T click “Download and install.” You’ll be bit by those bugs soon enough.

Don’t be spooked. Don’t be stampeded. And don’t install any patches that require you to click “Download and install.” 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order. Otherwise, sit back secure in the knowledge that you aren’t in the first round of cannon fodder. Let’s see what problems arise.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.



Source link

With Patch Tuesday arriving tomorrow, get Windows Automatic Update under control

December was a remarkable patching month. For those of you who use Windows Update, there were few surprises. (Manual updaters had it rough, though.) If you’ve been following along, you’ve already installed the December updates. Great. It’s time to get ready for January by temporarily turning off Windows Automatic Update.

If you’re a member of the “Get patched as soon as they roll out” team (a shrinking cohort, from my observation, anyway), my hat’s off to you. We need all the cannon fodder we can get. Be sure to keep us updated on AskWoody.

But if you figure there’s more danger from Pavlovian patching practices than from malware immediately following a Patch Tuesday, there are reasonably easy alternatives. Wait while we all watch the unpaid beta-testers take one for the Gipper.

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Yes, this month’s Patch Tuesday brings the last free security patches for Win7. No, you shouldn’t let them install by themselves. We’ll have a lot of coverage of Win7 weaning worries in the coming weeks.

Blocking automatic update on Win10 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1903. Microsoft released it (to some consternation) in May of last year. It had a shaky start before plunging into a four-patch debacle in September/October, but now appears to be relatively stable. There are detailed step-by-step instructions for moving to Win10 1903 in “Why — and how — I’m moving Win10 production machines to version 1903.”

If you insist on sticking with Win10 1809 (thrice bitten, thrice shy, eh?), you can block updates by following the steps in last month’s Patch Tuesday warning.

There’s a better way with Win10 versions 1903 or 1909

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause 7 days 4 Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. Once set, you can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems, although the aforementioned Keystone Kops IE 0day patch bugs persisted for more than three weeks. 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.



Source link

As Patch Tuesday approaches, turn off Automatic Update temporarily and — especially — disengage IE

It’s hard to overstate the problems caused by Microsoft’s second, third and fourth September  cumulative updates for all Windows 10 versions. For example, Win10 version 1903, the latest and greatest, saw cumulative updates on Sept. 10 (KB 4515384), Sept. 23 (KB 4522016), Sept. 26 (KB 4517211) and Oct. 3 (KB 4524147, which some characterize as a super-early October cumulative update).

As Microsoft kept flinging buggy fixes at the zero-day problem known as CVE-2019-1367, customers kept complaining about problems with:

  • Print spooler crashes No, they weren’t fixed with the fourth cumulative update, KB 4524147, in spite of Microsoft’s assertions. In fact, Mayank Parmar at Windows Latest documents complaints about KB 4524147 breaking PCs that were working after the third cumulative update, KB 4517211. So we have separate printer bug reports for the second, third and fourth cumulative updates. A royal printer flush.
  • Start Menu bugs — Click Start on a patched system and you get the message “Critical Error/ Your Start menu isn’t working,” which is my latest candidate for a D’oh! illuminating error message award.
  • Older JScript-based program bugs
  • Can’t type into the Cortana Search box
  • VMWare won’t start, with the warning “VMware Workstation Pro can’t run on Windows”
  • Machines won’t boot after installing the fourth cumulative update (see Lawrence Abrams’ report on BleepingComputer), or can’t install the update at all.

Microsoft hasn’t acknowledged any of those bugs, except for the printer spooler bug in the second September cumulative update. Yes, that’s the bug that is known to persist (reappear?) in the fourth cumulative update.

There were bugs in the first September cumulative update — audio problems, and the inability to install .Net 3.5 — that appear to be fixed in one of the later updates.

The main source of those lingering problems? Microsoft’s pursuit of the IE frumious bandersnatch, the zero-day security hole known as CVE-2019-1367. Snicker-snack.

Security info locked behind a Microsoft paywall

I was shocked to discover that Microsoft has published details about the CVE-2019-1367 security hole — but they’re hidden behind a pricey paywall. Late Friday night, Susan Bradley posted an excerpt from the Windows Defender Security Portal, which says, in part:

For attacks to be successful, targets will need to use Internet Explorer or another application that utilizes the Internet Explorer scripting engine to open a link containing the exploit. Initial reports of attacks indicate the use of Microsoft Word documents (.docx) with lure content that entice recipients to click on malicious links. …

Customers have encountered Microsoft Word documents (.docx) containing a link to web pages with exploit code for CVE-2019-1367. … On many machines that run older platforms such as Windows 7, the link opens on Internet Explorer by default. … 

Apply these mitigations to reduce the impact of this threat. … Customers are encouraged to use Microsoft Edge or other modern web browsers where possible. For tasks that require Internet Explorer, customers should limit its use to these tasks and set a different application as the default browser.

If you can’t click through to the Windows Defender Security Portal, you’re not alone. As Bradley explains:

I get to the site courtesy of a Microsoft Defender Advanced Threat Protection license which you can only get with a Windows 10 E5 license or a Microsoft 365 E5 license. Mere mortals can’t get this info, it’s an E5 license only. I purposely pay for one E5 license just to get this info.

The E5 license currently costs $690 per seat. I’m not easily shocked, but that faux pas is one for the record books.

The buggy bottom line

If you’ve been following along as Microsoft pushed September patches, you’ve been exposed to a lot of potential headache. Not everyone got bit by a bug in the second, third, or fourth cumulative updates last month (or for Win7 and 8.1, the Monthly Rollup Preview, followed by the second Monthly Rollup). But those who did get bit have reason to howl.

Microsoft has tried over and over to fix a security hole that almost everyone can counter by simply blocking Internet Explorer. At some point, you’ll have to install whatever fix Microsoft finally delivers. But for now, all roads lead through IE. If you don’t use IE, and you have a different default browser, the methods for invoking this particular vulnerability become much, much more difficult — and much less likely. According to that $690 paywalled report.

How to set a browser such as Firefox or Chrome as the default? It’s easy.

Obviously, it starts with installing the browser of your choice. I use Google Chrome most of the time, but if snooping makes your skin crawl, try Firefox or one of many alternatives. Typically, setting your new browser as the default is part of the setup process. Just follow the instructions.

What if the browser you want as the default is already installed? Here’s how to make the change in Windows:

Windows 10: Click Start/Settings/Apps. (On older versions of Win10, you need to choose System.) In the left column of options, click Default Apps. Next, under the “Default apps” heading, find Web browser and click on whatever browsers Microsoft has chosen for you (usually Edge). In the “Choose an app” list, pick anything except Internet Explorer.

You don’t need to click Save, just close Settings.

Windows 8.1: Click Start/Settings, then pick Search and Apps. Click Default Programs, then select Set your default programs. Choose your preferred browser from the list and click Set this program as default.

Windows 7: Click Start/Control Panel. Under Programs, click the Default Programs link. On the left, select the browser you want to use and, on the right, choose Set this program as default.

There are many variations on the theme — most browsers have handy shortcuts in their settings that let you make them the default. But at its most rudimentary, the aforementioned paths should get you there.

Yes, I know some of you need Internet Explorer some of the time. Even if you’re backed into that corner, disable IE as your default browser and only use it when absolutely necessary. That will certainly protect you from all disclosed attack vectors.

Blocking Automatic Update, October 2019 version

If you followed my instructions about installing last month’s updates as soon as they appeared, you got the first set of September patches installed, and you defended your machine against Microsoft’s second, third and fourth volleys. That, and ensuring IE isn’t your default browser (see preceding section), is the best of all possible worlds.

If you somehow missed the September patches, I say don’t worry about it. We’ll have new — and hopefully better — versions shortly. There’s nothing in the September patches that comes even close to outweighing the mayhem brought down by the re-releases and re-re-releases.

Yes, you have to patch sooner or later. In some rare cases you need to install specific patches shortly after they’re released. We’ll warn you about the stinkers. But in almost all cases, you can afford to wait a couple of weeks to get patches installed — and that’s usually enough time for the bad bugs to show themselves.

Blocking automatic update on Win7 and 8.1

It’s true. Windows 7 originally shipped with an automatic update feature that was turned off by default. How times change, eh?

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro version 1803 or 1809

If you’re using Win10 Pro version 1803 or 1809 I recommend an update blocking  technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates — which is intended for admins, but applies to you, too. (Thx, @zero2dash)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. You see the settings in the screenshot.

1809 sac 365 15 1 Woody Leonhard/IDG

Step 3. To pull yourself out of beta testing (or, as Microsoft would say, to delay new versions until they’re ready for broad deployment), in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, set the “feature update” deferral setting to 120 days or more. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 120 days after a new version is declared ready for broad deployment before upgrading and re-installing Windows on your machine.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or re-issued.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers — months where the cumulative updates were irretrievably bad, and never got any better, as they were in July of last year — we’ll let you know, loud and clear. 

Tired old approach for Windows 10 Home version 1803 or 1809

Here’s the thing about Windows 10 Home. Microsoft considers Home customers fair game. They really should call it Win10 Guinea Pig edition. Microsoft has no qualms whatsoever in pushing its new, untested (perhaps I should say “less-than-thoroughly-tested”) updates and upgrades onto Windows 10 Home machines.

If upgrading to Win10 version 1903 isn’t an option — 1903 lets you defer updates (see the next section), but I still run 1809 on my production machines — your only other reasonable option is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

Defer updates on Win10 version 1903

We finally have enough experience with Win10 version 1903 to recommend bug-busting settings. Unfortunately, we don’t have any experience at all with the upgrade to 1909 — due to happen any day now — so you may have to modify these instructions when the 1909 baby hits the water.

If you’ve already paused updates for 21 or more days by following the instructions in my September patch go-ahead post, you don’t need to do a thing. You already have Windows set to block automatic updates until October 23 or so, which should be more than enough to protect you.

If you don’t have updates paused, here’s how to proceed with caution:

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. 

Step 2A. If you see the settings in the preceding screenshot, you have a relatively untouched system. (If you don’t see those settings, go on to Step 3.) If they’re there, set Semi-Annual Channel (the term doesn’t mean anything any more, but nevermind), and put feature update deferrals at 365 days, quality update deferrals at 15 days or more. And realize that after you make those changes, you’ll never see this part of the Advanced options pane again. That’s OK. Take a screenshot if you’re feeling nostalgic.

Step 3. Back on the Windows Update pane (see screenshot; you may have to click the back arrow in the upper left corner), click Pause updates for 7 days. Then click on the newly revealed link, which says “Pause updates for 7 more days.”

1903 pause 7 days 1 Woody Leonhard/IDG

If you do that today, you’ll keep Microsoft’s mitts off your machine until Oct. 21, which (fingers crossed) should keep you out of harm’s way.

Step 4. You don’t need to click Save. Just “X” out of the Settings app.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 1 — a rare red flag setting — on the AskWoody Lounge.

Copyright © 2019 IDG Communications, Inc.



Source link

Browsers Are Bringing Automatic Dark Mode to Websites

Chrome logo over a dark background with dry ice smoke clouds.
nalyvme/Shutterstock.com

Dark mode is now everywhere, including in iOS 13 and Android 10. Web browsers like Chrome, Firefox, Safari, and Edge have embraced dark mode, too. Now, browsers are bringing automatic dark mode to websites thanks to a feature called prefers-color-scheme.

Websites Can Now Detect Dark Mode Like Apps Can

YouTube's webside with the dark theme enabled

Some sites offer dark modes today. For example, you can enable dark mode on YouTube, Twitter, or Slack in a few clicks. That’s pretty cool, but who wants to enable this option separately each time they visit a new website?

When you enable dark mode on Windows 10, macOS, iOS, or Android, the applications you use all know you’ve enabled dark mode and can automatically enable it. Google Chrome doesn’t even have an easy-to-access dark mode option. Chrome just automatically adjusts itself based on your overall operating system choice.

In the past, there wasn’t a way for websites to automatically implement dark mode. Even if your browser’s interface goes dark, websites will continue using their bright backgrounds. You have to manually enable dark mode or use a browser extension that forces dark mode.

It wasn’t web developers’ faults—they had no way of detecting whether dark mode was enabled on your device. That’s changed with a new cascading style sheets (CSS) feature websites can take advantage of.

It’s Already In a Browser Near You

Enabling dark mode in Windows 10's Settings app

The answer to this problem is prefers-color-scheme, a CSS feature that websites can use to ask your web browser whether you have dark mode enabled. A web page can use a different theme depending on whether you have dark mode enabled or disabled.

This feature was only recently added to modern web browsers in 2019.

  • Google Chrome for all platforms (including Android) has supported it since Chrome 76, released on July 30.
  • Safari for iPhone and iPad gets it with Safari 13 as part of iOS 13 on September 19.
  • Mozilla Firefox has supported it since Firefox 67, released on May 21.
  • Safari for Mac has supported it since Safari 12.1, released on April 5.
  • Microsoft Edge doesn’t support it, but the new Chromium-based Edge browser will.

This isn’t an option you select in your browser itself. Just choose between light and dark modes in your operating system, your browser will obey the change, and websites can follow along and automatically enable dark mode if they like.

So Where Are the Dark Mode Websites?

While this feature is live today and working in all the popular browsers, it’s very new. Dark mode comes to iPhone and iPad with the new iOS 13. On the Android side, only Android phones with the new Android 10 have dark mode support. Even Google Chrome on desktop has only supported prefers-color-scheme for a few weeks.

It’s just so new. You likely won’t encounter many websites that use prefers-color-scheme to automatically enable dark mode yet.

That will hopefully change in the future. Websites can now respect your dark mode preference and automatically follow it. Web developers have a new option they can take advantage of.

We love dark mode. Now that it’s an option on all the latest operating systems, we’ll be excited to see it spread across the web.

RELATED: Dark Mode Isn’t Better For You, But We Love It Anyway





Source link

Tomorrow’s Patch Tuesday — time to block Windows automatic update

If you haven’t patched your Windows machine since May, you’re in harm’s way and need to get your BlueKeep inoculation right away. That goes for PCs running Windows XP (!), Vista, Win7, Server 2003, Server 2008 or Server 2008 R2. There’s a working-but-not-yet-fully-armed exploit for the BlueKeep hole making the rounds right now, and it’s only a matter of time before it’s fully weaponized. With 700,000+ machines unpatched and immediately accessible, BlueKeep is a disaster waiting to happen. Tell your friends.

With that very notable exception, now would be an excellent time to make sure Windows automatic update is reined in. I call it crowdsourced bug hunting, and describe it in “The case against knee-jerk installation of Windows patches.”

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type “About,” then click “About your PC.” The version number appears on the right under Windows specifications.

If you’re on Win10 Pro version 1803, you have three options: Stick with version 1803 a while longer (the last scheduled patch for 1803 arrives on Nov. 12); upgrade to version 1809; or go for 1903, which has had teething problems lately. I have details on the options, what they entail, and how to pursue them in last month’s column, “Is Windows pushing you to upgrade? Don’t be bullied. There’s a middle path.”

If you’re using Win10 Pro version 1809, or if you’re on 1803 and want to stay there a bit longer, I recommend an update blocking technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates — which is intended for admins, but applies to you, too. (Thx, @zero2dash.)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. If you’re using Win10 version 1803 or 1809, you see the settings in the screenshot. 

1809 sac 365 15 large Microsoft

Step 3. The first box — “Semi-Annual Channel” — is no longer recognized by Microsoft. It has changed the terminology over and over again. In our newly redefined update world, choosing “Semi-Annual Channel” adds 60 days to the “feature update” setting discussed in the next step. I recommend that you nod, wink and, in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, roll the “feature update” deferral setting all the way up to 365 days. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 425 days after a new version is released (60 days for Semi-Annual Channel + 365 days deferral) before upgrading and reinstalling Windows on your machine.

Of course, nobody expects Microsoft to keep its mitts off your 1803 machine until Jan. 12, 2020 ( = the version 1809 release date + 425 days) or refrain from upgrading your 1809 machine until July 19, 2020 ( = version 1903 release date + 425 days): Even though those settings appear here, Microsoft is sure to ignore them and blast you onto the next version, somehow, at some point. We just don’t know how or when quite yet.

If you’d like to block a forced upgrade to 1903 for the foreseeable future, follow the instructions in “How to block the Windows 10 May 2019 Update, version 1903, from installing.”

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or reissued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers — months where the cumulative updates were irretrievably bad, and never got any better, as they were in July of last year — we’ll let you know, loud and clear. 

Tired old approach for Win10 Home 1803 and 1809

If you have Win10 Home, version 1803 or 1809, your only reasonable option (other than installing a third-party patch blocker) is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic. Worryingly, there are some reports that Microsoft is pushing for upgrades even if they go over metered connections.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

There’s a better way with Win10 version 1903

I still don’t run 1903 on my production machines — it’s still causing undue anguish — but if you’ve taken the plunge, your patching life is considerably simpler. Although Microsoft hasn’t officially documented the changes anywhere I can see, it now appears as if the Win10 version 1903 patch blocking mechanism works.

In version 1903 (either Home or Pro), using an administrator account, click Start > Settings > Update & Security. At the top, click the “Pause updates for 7 days” button. 

1903 pause 7 days Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. You can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems.

It looks like Win10 version 1909 will be distributed just like a cumulative update, later this month or early next month. We’ll have more details as the update/upgrade/version/service pack unfolds.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link