"> automatic Archives - Engr Kabir Saleh

Posts Tagged

automatic

With Patch Tuesday arriving tomorrow, get Windows Automatic Update under control

December was a remarkable patching month. For those of you who use Windows Update, there were few surprises. (Manual updaters had it rough, though.) If you’ve been following along, you’ve already installed the December updates. Great. It’s time to get ready for January by temporarily turning off Windows Automatic Update.

If you’re a member of the “Get patched as soon as they roll out” team (a shrinking cohort, from my observation, anyway), my hat’s off to you. We need all the cannon fodder we can get. Be sure to keep us updated on AskWoody.

But if you figure there’s more danger from Pavlovian patching practices than from malware immediately following a Patch Tuesday, there are reasonably easy alternatives. Wait while we all watch the unpaid beta-testers take one for the Gipper.

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Yes, this month’s Patch Tuesday brings the last free security patches for Win7. No, you shouldn’t let them install by themselves. We’ll have a lot of coverage of Win7 weaning worries in the coming weeks.

Blocking automatic update on Win10 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1903. Microsoft released it (to some consternation) in May of last year. It had a shaky start before plunging into a four-patch debacle in September/October, but now appears to be relatively stable. There are detailed step-by-step instructions for moving to Win10 1903 in “Why — and how — I’m moving Win10 production machines to version 1903.”

If you insist on sticking with Win10 1809 (thrice bitten, thrice shy, eh?), you can block updates by following the steps in last month’s Patch Tuesday warning.

There’s a better way with Win10 versions 1903 or 1909

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause 7 days 4 Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. Once set, you can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems, although the aforementioned Keystone Kops IE 0day patch bugs persisted for more than three weeks. 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.



Source link

As Patch Tuesday approaches, turn off Automatic Update temporarily and — especially — disengage IE

It’s hard to overstate the problems caused by Microsoft’s second, third and fourth September  cumulative updates for all Windows 10 versions. For example, Win10 version 1903, the latest and greatest, saw cumulative updates on Sept. 10 (KB 4515384), Sept. 23 (KB 4522016), Sept. 26 (KB 4517211) and Oct. 3 (KB 4524147, which some characterize as a super-early October cumulative update).

As Microsoft kept flinging buggy fixes at the zero-day problem known as CVE-2019-1367, customers kept complaining about problems with:

  • Print spooler crashes No, they weren’t fixed with the fourth cumulative update, KB 4524147, in spite of Microsoft’s assertions. In fact, Mayank Parmar at Windows Latest documents complaints about KB 4524147 breaking PCs that were working after the third cumulative update, KB 4517211. So we have separate printer bug reports for the second, third and fourth cumulative updates. A royal printer flush.
  • Start Menu bugs — Click Start on a patched system and you get the message “Critical Error/ Your Start menu isn’t working,” which is my latest candidate for a D’oh! illuminating error message award.
  • Older JScript-based program bugs
  • Can’t type into the Cortana Search box
  • VMWare won’t start, with the warning “VMware Workstation Pro can’t run on Windows”
  • Machines won’t boot after installing the fourth cumulative update (see Lawrence Abrams’ report on BleepingComputer), or can’t install the update at all.

Microsoft hasn’t acknowledged any of those bugs, except for the printer spooler bug in the second September cumulative update. Yes, that’s the bug that is known to persist (reappear?) in the fourth cumulative update.

There were bugs in the first September cumulative update — audio problems, and the inability to install .Net 3.5 — that appear to be fixed in one of the later updates.

The main source of those lingering problems? Microsoft’s pursuit of the IE frumious bandersnatch, the zero-day security hole known as CVE-2019-1367. Snicker-snack.

Security info locked behind a Microsoft paywall

I was shocked to discover that Microsoft has published details about the CVE-2019-1367 security hole — but they’re hidden behind a pricey paywall. Late Friday night, Susan Bradley posted an excerpt from the Windows Defender Security Portal, which says, in part:

For attacks to be successful, targets will need to use Internet Explorer or another application that utilizes the Internet Explorer scripting engine to open a link containing the exploit. Initial reports of attacks indicate the use of Microsoft Word documents (.docx) with lure content that entice recipients to click on malicious links. …

Customers have encountered Microsoft Word documents (.docx) containing a link to web pages with exploit code for CVE-2019-1367. … On many machines that run older platforms such as Windows 7, the link opens on Internet Explorer by default. … 

Apply these mitigations to reduce the impact of this threat. … Customers are encouraged to use Microsoft Edge or other modern web browsers where possible. For tasks that require Internet Explorer, customers should limit its use to these tasks and set a different application as the default browser.

If you can’t click through to the Windows Defender Security Portal, you’re not alone. As Bradley explains:

I get to the site courtesy of a Microsoft Defender Advanced Threat Protection license which you can only get with a Windows 10 E5 license or a Microsoft 365 E5 license. Mere mortals can’t get this info, it’s an E5 license only. I purposely pay for one E5 license just to get this info.

The E5 license currently costs $690 per seat. I’m not easily shocked, but that faux pas is one for the record books.

The buggy bottom line

If you’ve been following along as Microsoft pushed September patches, you’ve been exposed to a lot of potential headache. Not everyone got bit by a bug in the second, third, or fourth cumulative updates last month (or for Win7 and 8.1, the Monthly Rollup Preview, followed by the second Monthly Rollup). But those who did get bit have reason to howl.

Microsoft has tried over and over to fix a security hole that almost everyone can counter by simply blocking Internet Explorer. At some point, you’ll have to install whatever fix Microsoft finally delivers. But for now, all roads lead through IE. If you don’t use IE, and you have a different default browser, the methods for invoking this particular vulnerability become much, much more difficult — and much less likely. According to that $690 paywalled report.

How to set a browser such as Firefox or Chrome as the default? It’s easy.

Obviously, it starts with installing the browser of your choice. I use Google Chrome most of the time, but if snooping makes your skin crawl, try Firefox or one of many alternatives. Typically, setting your new browser as the default is part of the setup process. Just follow the instructions.

What if the browser you want as the default is already installed? Here’s how to make the change in Windows:

Windows 10: Click Start/Settings/Apps. (On older versions of Win10, you need to choose System.) In the left column of options, click Default Apps. Next, under the “Default apps” heading, find Web browser and click on whatever browsers Microsoft has chosen for you (usually Edge). In the “Choose an app” list, pick anything except Internet Explorer.

You don’t need to click Save, just close Settings.

Windows 8.1: Click Start/Settings, then pick Search and Apps. Click Default Programs, then select Set your default programs. Choose your preferred browser from the list and click Set this program as default.

Windows 7: Click Start/Control Panel. Under Programs, click the Default Programs link. On the left, select the browser you want to use and, on the right, choose Set this program as default.

There are many variations on the theme — most browsers have handy shortcuts in their settings that let you make them the default. But at its most rudimentary, the aforementioned paths should get you there.

Yes, I know some of you need Internet Explorer some of the time. Even if you’re backed into that corner, disable IE as your default browser and only use it when absolutely necessary. That will certainly protect you from all disclosed attack vectors.

Blocking Automatic Update, October 2019 version

If you followed my instructions about installing last month’s updates as soon as they appeared, you got the first set of September patches installed, and you defended your machine against Microsoft’s second, third and fourth volleys. That, and ensuring IE isn’t your default browser (see preceding section), is the best of all possible worlds.

If you somehow missed the September patches, I say don’t worry about it. We’ll have new — and hopefully better — versions shortly. There’s nothing in the September patches that comes even close to outweighing the mayhem brought down by the re-releases and re-re-releases.

Yes, you have to patch sooner or later. In some rare cases you need to install specific patches shortly after they’re released. We’ll warn you about the stinkers. But in almost all cases, you can afford to wait a couple of weeks to get patches installed — and that’s usually enough time for the bad bugs to show themselves.

Blocking automatic update on Win7 and 8.1

It’s true. Windows 7 originally shipped with an automatic update feature that was turned off by default. How times change, eh?

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro version 1803 or 1809

If you’re using Win10 Pro version 1803 or 1809 I recommend an update blocking  technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates — which is intended for admins, but applies to you, too. (Thx, @zero2dash)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. You see the settings in the screenshot.

1809 sac 365 15 1 Woody Leonhard/IDG

Step 3. To pull yourself out of beta testing (or, as Microsoft would say, to delay new versions until they’re ready for broad deployment), in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, set the “feature update” deferral setting to 120 days or more. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 120 days after a new version is declared ready for broad deployment before upgrading and re-installing Windows on your machine.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or re-issued.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers — months where the cumulative updates were irretrievably bad, and never got any better, as they were in July of last year — we’ll let you know, loud and clear. 

Tired old approach for Windows 10 Home version 1803 or 1809

Here’s the thing about Windows 10 Home. Microsoft considers Home customers fair game. They really should call it Win10 Guinea Pig edition. Microsoft has no qualms whatsoever in pushing its new, untested (perhaps I should say “less-than-thoroughly-tested”) updates and upgrades onto Windows 10 Home machines.

If upgrading to Win10 version 1903 isn’t an option — 1903 lets you defer updates (see the next section), but I still run 1809 on my production machines — your only other reasonable option is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

Defer updates on Win10 version 1903

We finally have enough experience with Win10 version 1903 to recommend bug-busting settings. Unfortunately, we don’t have any experience at all with the upgrade to 1909 — due to happen any day now — so you may have to modify these instructions when the 1909 baby hits the water.

If you’ve already paused updates for 21 or more days by following the instructions in my September patch go-ahead post, you don’t need to do a thing. You already have Windows set to block automatic updates until October 23 or so, which should be more than enough to protect you.

If you don’t have updates paused, here’s how to proceed with caution:

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. 

Step 2A. If you see the settings in the preceding screenshot, you have a relatively untouched system. (If you don’t see those settings, go on to Step 3.) If they’re there, set Semi-Annual Channel (the term doesn’t mean anything any more, but nevermind), and put feature update deferrals at 365 days, quality update deferrals at 15 days or more. And realize that after you make those changes, you’ll never see this part of the Advanced options pane again. That’s OK. Take a screenshot if you’re feeling nostalgic.

Step 3. Back on the Windows Update pane (see screenshot; you may have to click the back arrow in the upper left corner), click Pause updates for 7 days. Then click on the newly revealed link, which says “Pause updates for 7 more days.”

1903 pause 7 days 1 Woody Leonhard/IDG

If you do that today, you’ll keep Microsoft’s mitts off your machine until Oct. 21, which (fingers crossed) should keep you out of harm’s way.

Step 4. You don’t need to click Save. Just “X” out of the Settings app.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 1 — a rare red flag setting — on the AskWoody Lounge.

Copyright © 2019 IDG Communications, Inc.



Source link

Browsers Are Bringing Automatic Dark Mode to Websites

Chrome logo over a dark background with dry ice smoke clouds.
nalyvme/Shutterstock.com

Dark mode is now everywhere, including in iOS 13 and Android 10. Web browsers like Chrome, Firefox, Safari, and Edge have embraced dark mode, too. Now, browsers are bringing automatic dark mode to websites thanks to a feature called prefers-color-scheme.

Websites Can Now Detect Dark Mode Like Apps Can

YouTube's webside with the dark theme enabled

Some sites offer dark modes today. For example, you can enable dark mode on YouTube, Twitter, or Slack in a few clicks. That’s pretty cool, but who wants to enable this option separately each time they visit a new website?

When you enable dark mode on Windows 10, macOS, iOS, or Android, the applications you use all know you’ve enabled dark mode and can automatically enable it. Google Chrome doesn’t even have an easy-to-access dark mode option. Chrome just automatically adjusts itself based on your overall operating system choice.

In the past, there wasn’t a way for websites to automatically implement dark mode. Even if your browser’s interface goes dark, websites will continue using their bright backgrounds. You have to manually enable dark mode or use a browser extension that forces dark mode.

It wasn’t web developers’ faults—they had no way of detecting whether dark mode was enabled on your device. That’s changed with a new cascading style sheets (CSS) feature websites can take advantage of.

It’s Already In a Browser Near You

Enabling dark mode in Windows 10's Settings app

The answer to this problem is prefers-color-scheme, a CSS feature that websites can use to ask your web browser whether you have dark mode enabled. A web page can use a different theme depending on whether you have dark mode enabled or disabled.

This feature was only recently added to modern web browsers in 2019.

  • Google Chrome for all platforms (including Android) has supported it since Chrome 76, released on July 30.
  • Safari for iPhone and iPad gets it with Safari 13 as part of iOS 13 on September 19.
  • Mozilla Firefox has supported it since Firefox 67, released on May 21.
  • Safari for Mac has supported it since Safari 12.1, released on April 5.
  • Microsoft Edge doesn’t support it, but the new Chromium-based Edge browser will.

This isn’t an option you select in your browser itself. Just choose between light and dark modes in your operating system, your browser will obey the change, and websites can follow along and automatically enable dark mode if they like.

So Where Are the Dark Mode Websites?

While this feature is live today and working in all the popular browsers, it’s very new. Dark mode comes to iPhone and iPad with the new iOS 13. On the Android side, only Android phones with the new Android 10 have dark mode support. Even Google Chrome on desktop has only supported prefers-color-scheme for a few weeks.

It’s just so new. You likely won’t encounter many websites that use prefers-color-scheme to automatically enable dark mode yet.

That will hopefully change in the future. Websites can now respect your dark mode preference and automatically follow it. Web developers have a new option they can take advantage of.

We love dark mode. Now that it’s an option on all the latest operating systems, we’ll be excited to see it spread across the web.

RELATED: Dark Mode Isn’t Better For You, But We Love It Anyway





Source link

Tomorrow’s Patch Tuesday — time to block Windows automatic update

If you haven’t patched your Windows machine since May, you’re in harm’s way and need to get your BlueKeep inoculation right away. That goes for PCs running Windows XP (!), Vista, Win7, Server 2003, Server 2008 or Server 2008 R2. There’s a working-but-not-yet-fully-armed exploit for the BlueKeep hole making the rounds right now, and it’s only a matter of time before it’s fully weaponized. With 700,000+ machines unpatched and immediately accessible, BlueKeep is a disaster waiting to happen. Tell your friends.

With that very notable exception, now would be an excellent time to make sure Windows automatic update is reined in. I call it crowdsourced bug hunting, and describe it in “The case against knee-jerk installation of Windows patches.”

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type “About,” then click “About your PC.” The version number appears on the right under Windows specifications.

If you’re on Win10 Pro version 1803, you have three options: Stick with version 1803 a while longer (the last scheduled patch for 1803 arrives on Nov. 12); upgrade to version 1809; or go for 1903, which has had teething problems lately. I have details on the options, what they entail, and how to pursue them in last month’s column, “Is Windows pushing you to upgrade? Don’t be bullied. There’s a middle path.”

If you’re using Win10 Pro version 1809, or if you’re on 1803 and want to stay there a bit longer, I recommend an update blocking technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates — which is intended for admins, but applies to you, too. (Thx, @zero2dash.)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. If you’re using Win10 version 1803 or 1809, you see the settings in the screenshot. 

1809 sac 365 15 large Microsoft

Step 3. The first box — “Semi-Annual Channel” — is no longer recognized by Microsoft. It has changed the terminology over and over again. In our newly redefined update world, choosing “Semi-Annual Channel” adds 60 days to the “feature update” setting discussed in the next step. I recommend that you nod, wink and, in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, roll the “feature update” deferral setting all the way up to 365 days. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 425 days after a new version is released (60 days for Semi-Annual Channel + 365 days deferral) before upgrading and reinstalling Windows on your machine.

Of course, nobody expects Microsoft to keep its mitts off your 1803 machine until Jan. 12, 2020 ( = the version 1809 release date + 425 days) or refrain from upgrading your 1809 machine until July 19, 2020 ( = version 1903 release date + 425 days): Even though those settings appear here, Microsoft is sure to ignore them and blast you onto the next version, somehow, at some point. We just don’t know how or when quite yet.

If you’d like to block a forced upgrade to 1903 for the foreseeable future, follow the instructions in “How to block the Windows 10 May 2019 Update, version 1903, from installing.”

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or reissued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers — months where the cumulative updates were irretrievably bad, and never got any better, as they were in July of last year — we’ll let you know, loud and clear. 

Tired old approach for Win10 Home 1803 and 1809

If you have Win10 Home, version 1803 or 1809, your only reasonable option (other than installing a third-party patch blocker) is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic. Worryingly, there are some reports that Microsoft is pushing for upgrades even if they go over metered connections.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

There’s a better way with Win10 version 1903

I still don’t run 1903 on my production machines — it’s still causing undue anguish — but if you’ve taken the plunge, your patching life is considerably simpler. Although Microsoft hasn’t officially documented the changes anywhere I can see, it now appears as if the Win10 version 1903 patch blocking mechanism works.

In version 1903 (either Home or Pro), using an administrator account, click Start > Settings > Update & Security. At the top, click the “Pause updates for 7 days” button. 

1903 pause 7 days Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. You can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems.

It looks like Win10 version 1909 will be distributed just like a cumulative update, later this month or early next month. We’ll have more details as the update/upgrade/version/service pack unfolds.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link

How to Disable Automatic Gym Equipment Detection on Apple Watch

Apple Watch Workout App
Justin Duino

Some newer pieces of gym equipment include the ability to connect to your Apple Watch to sync data automatically. If you don’t want this pairing process to happen automatically, you can disable the gym equipment detection on your iPhone. Here’s how.

Open the “Watch” app on your iPhone.

Apple iPhone Apple Watch App New

In the main menu, tap on the “Workout” option, located halfway down the list.

Apple iPhone Apple My Watch Menu

Scroll down to the bottom of the list and toggle off “Detect Gym Equipment.”

Apple iPhone Apple Watch App Workout Menu

If you ever want to revert the setting, you can jump back into the “Workout” menu and toggle “Detect Gym Equipment” back on.


And that’s it. Your Apple Watch will no longer automatically detect and connect to GymKit-compatible gym equipment.

If you still want to sync data from smart gym equipment to your Apple Watch, you can even with the automatic detection feature turned off. All you have to do is open the Workout app on your watch and then hold the watch near the device.






Source link

Save yourself a headache: Make sure Windows automatic update is off

Much has changed in the past month. We’ve seen an emergency cry for all Windows XP, Vista, Win7, Server 2003, 2008 and 2008 R2 systems to get patched in order to fend off widely anticipated BlueKeep attacks. We’ve also seen Microsoft officially release Windows 10 version 1903, with unsuspecting “seekers” now the prime targets.

If you want to avoid the mayhem that seems to accompany every month’s dump of partially-tested patches, it would behoove you to turn off Windows automatic update and wait to see what squishy stuff gets stuck in others’ shoes.

You’ll have to install the June 2019 patches at some point. But for now, discretion’s demonstrably the better part of valor.

Blocking automatic update on Win7 and 8.1

If you haven’t recently patched Windows XP, Vista, Win7, Server 2003, 2008, or 2008 R2 systems, drop everything and get patched now. Once you’ve installed the BlueKeep patches, come back here and turn automatic update off. (No need to bother with XP and Vista; they aren’t getting automatically updated anyway.)

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro

If you’re using Win10 Pro version 1709, 1803, or 1809 I suggest an update blocking  technique that Microsoft recommends for “Broad Release” in its obscureBuild deployment rings for Windows 10 updates – which is intended for admins, but applies to you, too. (Thx, @zero2dash)

Step 1. Using an administrative account, click Start > Settings > Update & Security.

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. If you’re using Win10 version 1803 or 1809, you see the settings in the screenshot.

1809 feature update 180 days Microsoft

Step 3. To pull yourself out of beta testing (or, as Microsoft would say, to delay new versions until they’re “for broad deployment”), in the first box, choose Semi-Annual Channel.

Microsoft has declared that its old terminology is no longer in effect, then later declared that Win10 version 1809 is Semi-Annual Channel, using the old terminology, and thus ready for widespread deployment. You don’t have to agree – you get to choose whether to stay with 1803 or move to 1809. Even though I’ve upgraded my production machines to 1809, I can certainly understand if you don’t want to.

Step 4. To further delay new versions until they’ve been minimally tested, set the “feature update” deferral setting to 180 days or more. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 240 days after a new version is released (60 days for Semi-Annual Channel + 180 days deferral) before upgrading and re-installing Windows on your machine.

Win10 version 1809 was nominally released on Nov. 11, 2018. Add 240 days and you get July 11, 2019. So if you’re running 1803 update on Semi-Annual Channel, and you set the “feature update” deferral to 180 days, you won’t be forcibly upgraded to 1809 until July 11, at the earliest.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or re-issued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers – months where the cumulative updates were irretrievably bad, and never got any better, as they were in July 2018 – we’ll let you know, loud and clear.

Tired old approach for Windows 10 Home

If you have Win10 Home, version 1803 or 1809, your only reasonable option is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

Special note for Windows 10 version 1903

Couldn’t resist the temptation, eh?

If you’ve already jumped ahead to Win10 version 1903, you’re entering uncharted territory. We’ve heard lots of promises about the new updating regimen, but haven’t been through enough update cycles to know exactly what’s going to happen.

If you’re running Win10 1903 Pro, my advice is that you NOT click Pause updates on the main Windows Update page. Instead, click on Advanced Options and (as shown in the screenshot) choose to defer feature updates by 365 days and defer quality updates for 15 days.

1903 pro update advanced settings Microsoft

If you’re using Win10 1903 Home, we still don’t have enough experience – or reliable documentation – to say for sure what’ll happen. But it seems to be a good idea to both set your connection to metered, as discussed in the preceding section, and to click Pause updates twice – for a total of 14 paused days. Historically, that’s been sufficient to avoid the worst problems.

We’re at MS-DEFCON 2 on AskWoody



Source link

Patch Tuesday’s coming, so lock down automatic updates

In theory, when Windows 10 version 1903 rolls out in late May, we’ll suddenly have tools at hand that’ll make it easy to temporarily turn off automatic updating. I’m not yet convinced that all will be milk and honey, but for now there’s every reason to take control of your machine and turn off automatic updating. Wait for the dust to clear before you apply the next round of patches.

By introducing new patch-blocking capabilities in Win10 version 1903, Microsoft’s implicitly acknowledging what you and I have known for a long time: Windows (and sometimes Office and .NET) patches have a nasty habit of clobbering machines. It makes no sense to join the first line of cannon fodder. Far better to wait and, if the coast is clear, patch when millions of our compatriots have participated in the grand unpaid beta test.

That’s what cannon fodder’s for, right?

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro

If you’re using Win10 Pro version 1709, 1803, or 1809I recommend an update blocking technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates – which is intended for admins, but applies to you, too. (Thx, @zero2dash)

Step 1. Using an administrative account, click Start > Settings > Update & Security.

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. If you’re using Win10 version 1803 or 1809, you see the settings in the screenshot.

1809 feature update 180 days Microsoft

Blocking Windows 10 updates can head off the introduction of nasty bugs.

Step 3. To pull yourself out of beta testing (or, as Microsoft would say, to delay new versions until they’re ready for broad deployment), in the first box, choose Semi-Annual Channel.

Microsoft declared that its old terminology is no longer in effect, then later declared that Win10 version 1809 is Semi-Annual Channel – using the old terminology – and thus ready for widespread deployment. Who knows? Even though I’ve upgraded my production machines to 1809, I can certainly understand if you don’t want to.

Step 4. To further delay new versions until they’ve been minimally tested, set the “feature update” deferral setting to 180 days or more. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 240 days after a new version is released (60 days nominally waiting for Semi-Annual Channel + 180 days deferral) before upgrading and re-installing Windows on your machine.

I have a feeling the terminology will change again in the next month or two. Don’t sweat it.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or re-issued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

Step 7. Don’t click Check for updates. Ever.

If there are any real howlers – months where the cumulative updates were irretrievably bad, and never got any better, as they were in July 2018 – we’ll let you know, loud and clear.

Tired old approach for Windows 10 Home

We’re hearing a lot of promises about the ability to delay cumulative updates in Win10 Home version 1903. I’ll believe it when I see it. The promises so far don’t match what we’re seeing in the latest beta builds, so I don’t know where we’re headed.

If you have Win10 Home, your only reasonable option is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic.

To set your Ethernet connection as metered: Click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

While you’re thinking about patching Windows, now’s a good time to download and squirrel away an official, free copy of Win10 version 1809.

We’re at MS-DEFCON 2 on AskWoody.



Source link