"> patch Archives - Engr Kabir Saleh

Posts Tagged

patch

Get the January 2020 Patch Tuesday patches installed

This month has seen a whole lotta hand waving and sky-is-falling-caliber rhetoric, but the reality is much more prosaic. If you aren’t running a major network (and thus aren’t susceptible to the imminent problems with Remote Desktop Gateway, the Citrix network bugs or the whopping 334 patches in Oracle), there’s been little reason to install this month’s updates. 

Still, work on cracking the CurveBall CVE-2020-0601 security hole continues at a furious pace. Some security companies are using CurveBall to sell more product, but the free Microsoft Defender catches at least some afflicted programs; Firefox, Chrome and Edge won’t fall for it; and pre-Win10 versions of Windows (Seven Semper Fi!) have never been exposed.

With several working proof-of-concept routines readily available — but no attacks, and indeed no sign that a general attack is imminent — patching for CurveBall falls in the “abundance of caution” bucket. Since we’ve seen few weird problems with the January patches, now seems like a good time to get patched up.

As usual, Patch Lady Susan Bradley has a detailed analysis in her Patch Watch column with a full patch-by-patch reckoning in her Master Patch List (paywall; donation requested).

Here’s how to get your system updated the (relatively) safe way.

Make a full backup

Make a full system image backup before you install the latest patches.

There’s a non-zero chance that the patches — even the latest, greatest patches of patches of patches — will hose your machine. Best to have a backup that you can reinstall even if your machine refuses to boot. This, in addition to the usual need for System Restore points.

There are plenty of full-image backup products, including at least two good free ones: Macrium Reflect Free and EaseUS Todo Backup

Patch Win7, Win8.1 or associated servers

This is the last month we’ll see free Win7 patches — or so we’ve been promised. (I find it hard to believe that Microsoft won’t patch the Win7 Internet Explorer JScript security hole CVE-2020-0674, but Microsoft, eh?)

As for those of you Win7 holdouts worried about sprouting a black wallpaper due to the Win7 January “Stretch” bug, Microsoft now advises:

We are working on a resolution and will provide an update in an upcoming release for organizations who have purchased Windows 7 Extended Security Updates (ESU).

Nice guys. 

Bottom line, for you Win7 folks: Do yourself a favor and change your wallpaper so it isn’t Stretched, before installing the buggy January patch. Follow Lawrence Abrams’s instructions on BleepingComputer.

Microsoft is blocking updates to Windows 7 and 8.1 on recent computers. If you are running Windows 7 or 8.1 on a PC that’s 24 months old or newer, follow the instructions in AKB 2000006 or @MrBrian’s summary of @radosuaf’s method to make sure you can use Windows Update to get updates applied.

For most Windows 7 and 8.1 users, I recommend following AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups. You should have one Windows patch, dated Jan. 14 (the Patch Tuesday patch). If you see a Monthly Rollup Preview, ignore it.

If you insist on manually installing Security-only patches for Win7 and Server 2008 (I call that the “Group B” approach on AskWoody), get the full list from @PKCano on the AskWoody site. If in doubt, ask questions on the site! It’s easy and free.

Realize that some or all of the expected patches for January may not show up or, if they do show up, may not be checked. DON’T CHECK any unchecked patches. Unless you’re very sure of yourself, DON’T GO LOOKING for additional patches. In particular, if you install the January Monthly Rollup, you won’t need (and probably won’t see) the concomitant patches for December. Don’t mess with Mother Microsoft.

If you see KB 4493132, the “Get Windows 10” nag patch, make sure it’s unchecked.

Watch out for driver updates — you’re far better off getting them from a manufacturer’s website.

After you’ve installed the latest Monthly Rollup, if you’re intent on minimizing Microsoft’s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping. If you want to thoroughly cut out the telemetry, see @abbodi86’s detailed instructions in AKB 2000012: How To Neutralize Telemetry and Sustain Windows 7 and 8.1 Monthly Rollup Model.

If you’re worried about Windows 7 hitting end-of-support, don’t be alarmed. The first missed security patch isn’t until next month. Besides, you have lots of alternatives, and not all of them involve Windows. We watch your options intently in the Seven Semper Fi series on AskWoody.

Patch Win10 and associated servers

If you’re running Win10 version 1803, 1809, Server 1809, Server 2019, or any earlier version of Windows 10, I urge you to upgrade to Win10 version 1903. (You can find your version by typing winver in the Search box in the lower left corner and pressing Enter.) There are detailed instructions in the article Why — and how — I’m moving Win10 production machines to version 1903.

Win10 1903 is far from perfect, but it seems to be relatively stable at this point. The one huge advantage to version 1903: It lets everybody pause updates with a few simple clicks. That feature has my vote for the most important (perhaps the only important) upgrade to Win10 in the past four years.

If you insist on using Win10 version 1809, go through the steps in All’s clear to install Microsoft’s November patches to get 1809 updated. If you’re on Win10 1909, I figure you’ve jumped the gun, but the following instructions will work.

If you’ve been following my usual advice — to click “Pause updates for 7 days” three times — your machine is probably waiting further instructions, displaying an “Updates paused” notice in the Windows Update pane (Start > Settings (the gear icon) > Update & Security > Windows Update). If you see that updates have been paused, click “Resume updates.” Windows will go out and install the January cumulative update, plus any other ancillary patches (for example, for .Net) that you require.

I’m very happy to say that clicking “Resume updates” will not automatically move you to Win10 version 1909. In order to move to the next version — which continues to suffer from bugs, most notably the File Explorer Search bug — you need to click a link that says, “Download and install now.” Don’t click it.

Once you’re updated and rebooted, pause updates for 28 days: Click Start > Settings > Update & Security. Click Windows Update on the left side, then click “Pause updates for 7 days.” Next, click on the newly revealed link, which says “Pause updates for 7 more days,” and click it again, and one last time, for a total of four clicks. That pauses all updates for 28 days, until Feb. 21. With a little luck that’ll be long enough for Microsoft to fix any bugs it introduces in February.

If you see an offer of an Optional update (screenshot), don’t click Download and install now. There’s a reason why Microsoft deems such patches “optional.”

1909 download and install now Woody Leonhard/IDG

February’s Patch Tuesday is on the 11th. That’ll be the first day Win7 users will miss a security update (unless they pay for it). Expect much hand wringing and clucking, but not many fireworks.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 3 on the AskWoody Lounge.

Copyright © 2020 IDG Communications, Inc.



Source link

Patch Tuesday aftermath: The NSA Crypt32 threat is real, but not yet imminent

Get ready for your local news station’s weather reporter to start lecturing on the importance of installing Windows patches.

Yesterday we were treated to a remarkable Patch Tuesday. “Remarkable” specifically in the sense that the U.S. National Security Agency was moved to put out a press release (PDF):

NSA recommends installing all January 2020 Patch Tuesday patches as soon as possible to effectively mitigate the vulnerability on all Windows 10 and Windows Server 2016/2019 systems.

That’s a first. Until now, the NSA has never publicly acknowledged its contributions to Microsoft’s patching efforts — nor has it picked up the flogging whip in Microsoft’s patching drive. Security guru Brian Krebs attributes it to a change of heart at the NSA:

Sources say this disclosure from NSA is planned to be the first of many as part of a new initiative at NSA dubbed “Turn a New Leaf,” aimed at making more of the agency’s vulnerability research available to major software vendors and ultimately to the public.

Krebs has an excellent overview of the security hole, loaded with several mind-bending analogies. Get the tech details of the vulnerability in Kenneth White’s Microsoft’s Chain of Fools exposé. If you haven’t yet been inundated with half-fast explanations, rest assured that every news outlet in the world is in the process of trying to digest and regurgitate the complexities of CryptoAPI and Elliptic Curve Cryptography certs.

What does it all mean? If someone can crack the CVE-2020-0601 conundrum, they’ll be able to create programs that appear to come from a trusted source. That’s a scary possibility, but it’s a long way from a third-degree polynomial to working ransomware.

And, no, CVE-2020-0601 can’t be used to break into the Windows Update chain.

As of early Wednesday morning, at least one A-list hacker has put together a working “Proof of Concept” exploit. Casey Smith (@subTee) has a PoC, but it isn’t yet ready for widespread release. As Kevin Beaumont says, “It’s not practical at scale for a variety of reasons.”

So with everybody — the NSA, the ‘Softies, your weather forecaster, your hairdresser’s boyfriend’s precocious but smelly nine-year-old — recommending that you patch NOW, why wait?

Because there are problems with this month’s Win10 patches.

It always takes time for bugs to surface. This month’s no different. As of very early Wednesday morning, I’m seeing plenty of problem reports when installing the patches — the same problems we’ve had for many years. Whether any darker problems lie in lurk is anybody’s guess, and it’s still too early to tell.

For now, I’m recommending that you keep all of the Patch Tuesday patches at bay, until we’ve had a chance to see what other surprises await. That assessment may change quickly, so stay alert.

If you’re in charge of Server 2012, 2012 R2, 2016 and/or 2019 systems, there’s a much larger problem you should confront right now. Two of this month’s patched security holes, CVE-2020-0609 and CVE-2020-0610, reveal a security hole in the Windows Remote Desktop Gateway, RDgateway, that will let anybody into your system if they crawl in through port 443. As Patch Lady Susan Bradley puts it:

If you are a IT consultant or admin with an Essentials 2012 (or later) server, or use the RDgateway role and expose it over port 443 to allow users to gain access to RDweb or their desktops, forget that crypt32.dll bug. This one is one to worry about.

The January patches should be a top priority for this, active security hole. And of course, if you’re using Pulse Connect Secure VPN, or a Citrix Gateway/ADC/NetScaler box you have it locked down (or unplugged) by now, right?

This month we had almost no non-security “quality updates” — which is to say, bug fixes. With a few niggling exceptions (one in Win10 version 1809), none of the Windows patches this month include documented non-security bug fixes. In fact, we’ve seen very few non-security patches since October. 

All of which underlines an ongoing problem with the “as a Service” method of bundling all the month’s patches into one big gob. If we had separate Crypt32 and RDgateway patches, people could choose to fix the big holes while waiting for problem reports on the little ones. 

If wishes were horses then hackers would ride.

Stay up-to-the-minute on Crypt32 cracking with AskWoody.com.

Copyright © 2020 IDG Communications, Inc.





Source link

Today’s Patch Tuesday brings fireworks and — a magic bullet?

Over the past few years we’ve seen a few security holes that have drawn Chicken Little warnings and vast amounts of unthinking press reports. When you turn on a local news program and hear from the hometown weather reporter that you really need to get Windows patched, a bit of skepticism might be in order.

Today’s Patch Tuesday appears to be headed down the same well-worn chute.

Brian Krebs, the security guru with impeccable credentials, fired an opening salvo in his blog post yesterday:

Sources tell KrebsOnSecurity that Microsoft Corp. is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of Windows. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.

On the one side, we have Will Dorman, a highly respected analyst at the federal CERT Coordination Center, who tweeted:

I get the impression that people should perhaps pay very close attention to installing tomorrow’s Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I don’t know… just call it a hunch? ¯_(ツ)_/¯

On the other hand we have Kevin Beaumont, my favorite plucky porg down in the trenches, who says, simply:

Don’t panic re this one.

A bit of histrionic history here.

Back on Monday — not Tuesday, mind you, but Monday — Sept. 23, Microsoft released a highly publicized out-of-band patch for an “exploited” Internet Explorer 0day known as CVE-2019-1367. The fix was so badly botched that Microsoft ended up releasing four separate fixes for it, over the course of three weeks, and many (millions?) of Windows customers got caught up in the bugs. The security hole itself? It never amounted to a hill of beans.

In November we got a similar treatment for  CVE-2019-1429, a scary “exploited” monster that never materialized. In December, it was  CVE-2019-1458, which has since sunk into obscurity. Back in September, we had emergency warnings about two “exploited” security holes, CVE-2019-1214 and CVE-2019-1215. A few days later, without any announcement, Microsoft removed the “exploited” designation

Then there was the DejaBlue fiasco. Beaumont, who named the security hole and followed it closely, never found a real-world working exploit (although there were several in-the-lab, proof of concept, sorta exploits).

Granted, there have been significant security holes announced with full fanfare, including their own dedicated websites and logos. The most recent real threat came in the form of BlueKeep, announced and patched in May, which actually had a working exploit that appeared in September. Even the NSA warned about it. You had four months or so to get patched. (Full disclosure: I joined the Chicken Little crowd and recommended early patching for BlueKeep, when it wasn’t necessary.)

Many patch-it-now hardliners hearken back to WannaCry, which cut a wide swath back in May, 2017. With its origins in NSA-written hacking code, WannaCry did pose a significant threat, but Microsoft had already released its WannaCry patch, MS17-010, two months before WannaCry appeared.  

I’m not saying that you need to put on rose-colored glasses and “la-la-la” your way through today’s Patch Tuesday shenanigans. But I am saying that a certain amount of restraint could go a long way — especially given Microsoft’s track record for botched Patch Tuesdays.

Join us for a ringside seat as the patches (and problems!) roll out, on AskWoody.com.

Copyright © 2020 IDG Communications, Inc.





Source link

With Patch Tuesday arriving tomorrow, get Windows Automatic Update under control

December was a remarkable patching month. For those of you who use Windows Update, there were few surprises. (Manual updaters had it rough, though.) If you’ve been following along, you’ve already installed the December updates. Great. It’s time to get ready for January by temporarily turning off Windows Automatic Update.

If you’re a member of the “Get patched as soon as they roll out” team (a shrinking cohort, from my observation, anyway), my hat’s off to you. We need all the cannon fodder we can get. Be sure to keep us updated on AskWoody.

But if you figure there’s more danger from Pavlovian patching practices than from malware immediately following a Patch Tuesday, there are reasonably easy alternatives. Wait while we all watch the unpaid beta-testers take one for the Gipper.

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Yes, this month’s Patch Tuesday brings the last free security patches for Win7. No, you shouldn’t let them install by themselves. We’ll have a lot of coverage of Win7 weaning worries in the coming weeks.

Blocking automatic update on Win10 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1903. Microsoft released it (to some consternation) in May of last year. It had a shaky start before plunging into a four-patch debacle in September/October, but now appears to be relatively stable. There are detailed step-by-step instructions for moving to Win10 1903 in “Why — and how — I’m moving Win10 production machines to version 1903.”

If you insist on sticking with Win10 1809 (thrice bitten, thrice shy, eh?), you can block updates by following the steps in last month’s Patch Tuesday warning.

There’s a better way with Win10 versions 1903 or 1909

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause 7 days 4 Woody Leonhard/IDG

That button changes so it says, “Pause updates for 7 more days.” Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. Once set, you can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems, although the aforementioned Keystone Kops IE 0day patch bugs persisted for more than three weeks. 

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.



Source link

Just a few more updates for 2019 makes for a light December Patch Tuesday

December brings peace and joy – well, maybe – but at least Microsoft has provided us with a relatively easy Patch Tuesday update. There is an urgent update to Microsoft Internet Explorer 11 and three critical updates to the Windows platform that will require some attention this month. In addition, we have cumulative updates for the .NET and SQL server platforms that will require some testing before general deployment. That said, I think that 2020 will bring many interesting Patch Tuesdays with Microsoft’s new “staged” feature releases already included Windows 10 1909. You can find out more here on our Readiness blog infographic.

Known issues

Each month, we try to highlight some of the more serious issues with this month’s and past updates to Microsoft desktop, server and development platforms. I have included a few that are likely to affect this month’s update cycle including: 

  • Office 2013 and Office 2016: You may receive the following message, “This application is not trusted to consume rights managed content. The Authenticode signature for the application is not valid. Contact your administrator for further investigation.” To resolve this issue, install Office update 3172523.
  • Windows 10 1803 onwards: When setting up a new Windows device during the Out of Box Experience (OOBE), you might be unable to create a local user when using Input Method Editor (IME). This issue might affect you if you are using the IME for Chinese, Japanese, or Korean languages. Microsoft is working on this one. IME’s are very complex keyboard input “layers” that reside across multiple builds and configurations requiring massively disparate linguistic skills to debug. From my experience with installing/configuring/breaking IME’s in Asia (in the late 90’s) I suspect that we may see this issue again.
  • Across all Windows desktop and server builds, we have the following ongoing issue, “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”.”
  • Microsoft is aware of an issue in Windows Hello for Business (WHfB) with public keys that persist after a device is removed from Active Directory, if the AD exists. After a user sets up Windows Hello for Business (WHfB), the WHfB public key is written to the on-premises Active Directory. The WHfB keys are tied to a user and a device that has been added to Azure AD, and if the device is removed, the corresponding WHfB key is considered orphaned.

And thanks to Woody Leonard (Ask Woody), for picking up on the offering of Autopilot. Just like in October, it looks like the Autopilot patch is once again being offered to all Pro machines, whether they have Autopilot or not.

Major revisions

No major revisions have been published this month from Microsoft.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms (NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player

Browsers

You now have something to talk about at the annual Christmas party. For this December update there is (only) a single reported vulnerability for all of Microsoft’s browsers. While this is an absolutely huge improvement over the sometimes “tens” of urgent “Patch Now” memory corruption vulnerabilities, this success is somewhat tempered by the fact that we are still fixing VBScript issues (CVE-2019-1485) in 2019. So, Microsoft has released a single critical update for Internet Explorer 11 that really does require urgent attention due to its link to ActiveX and its potential exploitability. Add this update to your “Patch Now” schedule, if you are still using IE11.

Windows

Microsoft has addressed a total of 21 vulnerabilities on the Windows platform for this December Patch Tuesday with three rated as critical (CVE-2019-1471, CVE-2019-1468 and ADV990001) and the remaining 18 rated as important. The critical rated vulnerabilities could lead to remote code execution scenarios with multiple vectors for bad actors to attack the compromised platform. In addition to these security issues there are several new features “included” but not released with Windows 10 1909. Microsoft offered the following explanation:

“Windows 10, versions 1903 and 1909 share a common core operating system and an identical set of system files. As a result, the new features in Windows 10, version 1909 were included in the recent monthly quality update for Windows 10, version 1903 (released October 8, 2019), but are currently in a dormant state. These new features will remain dormant until they are turned on using an enablement package, which is a small, quick-to-install “master switch” that simply activates the Windows 10, version 1909 features.”

This is revolutionary stuff, maybe a little scary. Microsoft is basically saying, “we have changed some stuff, added some stuff, and will let you know about it later.” I would really like a definitive list of new features, the impact and dependencies and a plan of when these changes are going to be implemented. Which I think most deployment engineers would consider reasonable. Given the usual holiday season staffing issues and the lack of clarity around these changes, I suggest that some testing (and waiting) may be advised before a general roll-out of these Windows updates.

Microsoft Office

December has not been so kind to the Microsoft Office suite, with six reported vulnerabilities, all rated as important by Microsoft. Microsoft does not publish the risk rating or Common Vulnerability Scoring System (CVSS) for individual Microsoft Office updates, but this patch group has a very high rating of 9.8. If you are using Office 365 then you may have experienced issues with patch downloads. The issue affects channels 1808 to 1911 and more information can be found here. There is a remote code execution scenario for Microsoft PowerPoint (CVE-2019-1462) that may need some urgent attention but the other updates should be included in your standard update release schedule. 

Microsoft Development Tools

Microsoft’s Git development application is the main victim/offender this month with five serious vulnerabilities (CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387) and one moderate and one important update. We have not seen any other updates to the Visual Studio platform or more importantly to Azure for this month. All versions of the Microsoft .Net development platform will receive a cumulative update package (KB4533002) with the special note from Microsoft stating that, “This update is included in the Quality Rollup that’s dated December 10, 2019. Parts of this update were previously released in the Quality Rollup that’s dated September 10, 2019.” I’m not sure what to do with this information. Sigh. Add this update to your standard release schedule.

Microsoft SQL Server gets a special mention this month with two cumulative updates released (CU 18 KB 4527377 and CU 11 KB 4527378). As Microsoft employs the “pure cumulative” model to all SQL Server patches and releases, all previously released hotfixes (including Critical On Demand patches) are included and “more thoroughly” tested. You can read more about Microsoft SQL Server patch strategies and models here and here respectively. Unless you have a critical dependency on the GIT application, then please add this month’s update to your standard release schedule. 

Adobe

Adobe has addressed 17 critical security updates which are not included in this month’s Microsoft Patch Tuesday as all of these issues relate to product level issues (Adobe Reader and Acrobat) rather than widely used desktop and server components (i.e. Flash). Affected applications include Acrobat Reader, Photoshop, Illustrator and Brackets. In Adobe Acrobat and Reader, Adobe fixed 14 critical arbitrary code execution flaws, including out-of-bounds write glitches, use after free flaws, untrusted pointer dereference vulnerabilities, heap overflow errors, buffer errors and a security bypass. You can find more APSB19-55 This a huge month for Adobe security issues – but not a big issue for desktop deployment engineers. For December, may I add, it is definitely not “margarita time”…but you don’t have to deploy any urgent desktop or server updates courtesy of Adobe.

I wanted to spend a few moments thanking everyone for their feedback and their attention over the past year. I love writing about this stuff, and I hope that I have helped a few people out, and maybe saved someone a little time each month. Thank you – and I look forward to more updates, more patches and much more in 2020.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.



Source link

Patch Tuesday brings a reprise of the Autopilot debacle, now quashed, and another Win7 nag

Patch Tuesday in December rarely brings anything worthwhile — everybody’s on vacation, or wants to be on vacation — and this month’s no exception. We got patches for 36 separately identified security holes and two new advisories, full of sound and fury but covering very little.

The one “exploited” security hole — CVE-2019-1458 Win32k Elevation of Privilege Vulnerability — shouldn’t cause any heartburn. Microsoft says:

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.

Then Microsoft gives the hole an “Important” severity rating, a big step below the “Critical” that’s de rigeur. Short version: Although you need to patch sooner or later, you don’t need to worry about any of the security holes right now.

The return of Autopilot

Remember back in October when Microsoft mysteriously pushed out a patch for Autopilot, a little-known app that helps companies set up new machines? I wrote about it in “Microsoft pushes, then yanks, rogue kinda-security patch KB 4523786, ostensibly for Autopilot.” 

Looks like the cows are out of the barn again. Microsoft released KB 4532441 yesterday, the latest “Cumulative update for Autopilot in Windows 10, versions 1903 and 1909: December 10, 2019.” Once again, many folks saw that they were being offered the patch (although this time it apparently only went out to 1903 and 1909 Pro customers). Once again, the patch was offered repeatedly, even after it was installed properly. Once again, Microsoft yanked the patch, then updated the KB article to say:

This update was available through Windows Update. However, we have removed it because it was being offered incorrectly. When an organization registers or configures a device for Windows Autopilot deployment, the device setup automatically updates Windows Autopilot to the latest version.

Note There is no effect on Windows Autopilot being offered to Windows 10 devices. If you were offered this update and do not use Autopilot, installing this update will not affect you. Windows Autopilot update should not be offered to Windows 10 Home.

Those who cannot remember the past are condemned to repeat it.

Odd and sundry patches

In addition to the usual laundry list of patches, we also saw:

A new Malicious Software Removal Tool. Folks who downloaded the patches early may have missed it, because MS didn’t push it until several hours after the initial patching payload.

Updates for .Net Framework 3.5.x, 4.6.x, 4.7.x, 4.8 and more. Dozens of them. Martin Brinkmann has the full list on ghacks.net.

As well as the usual assortment of Office security patches.

There are new Servicing Stack Updates for Server 2008 and Server 2012, with manual download links as usual in ADV990001. If you don’t know about Servicing Stack Updates, don’t sweat it.

The easily dismissed Win7 End of life nag

December’s Windows 7/Server 2008 R2 Monthly Rollup brings a full-screen nag for upgrading to Windows 10, due to appear starting on January 15. Here’s what Microsoft says:

IMPORTANT Starting on January 15, 2020, a full-screen notification will appear that describes the risk of continuing to use Windows 7 Service Pack 1 after it reaches end of support on January 14, 2020. The notification will remain on the screen until you interact with it. This notification will only appear on the following editions of Windows 7 Service Pack 1:

Note The notification will not appear on domain-joined machines or machines in kiosk mode.

The Security-only patch, KB 4530692, includes the nag, which is embodied in the program EOSNotify.exe. Apparently the nag will only appear once, take up the whole screen and, once you’ve dismissed it, never return again. You’ll be forgiven if you recall similar promises during the “Get Windows 10” GWX campaign.

For those of you who can’t be bothered to dismiss the nag screen (or worry that it won’t go away as easily as Microsoft says), you can set this registry key:

HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionEOSNotify

To have the value “DiscontinueEOS”=dword:00000001

We’ll be covering that nag and its aftereffects extensively as details unfold. Remember that more than a quarter of all Windows users are on Win7.

Watch the bugs come out of the, uh, woodwork on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link

Patch Tuesday’s coming! Protect your machine by pausing updates

The past couple of months have gone reasonably well in the Automatic Update world — we saw a convincing Keystone Kops rendition in September, which continued into October, but November was relatively benign (unless you’re using Access). 

My guess is that December will be relatively quiet, too, because so many Microsofties are on vacation. But you never know. Microsoft, eh?

Yes, you have to get patched eventually. But there’s very little reason to jump head first into the pernicious patching pit. Get Automatic Update disentangled for a while — defer it, pause it, put a cork in it — and wait while we all watch the unpaid beta-testers take one for the Gipper.

Blocking automatic update on Win7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re on Win10 version 1803, it’s time to pack your bags and move on. Microsoft’s pushing hard to get your machine to version 1909 right now, but you don’t have to dance to the ‘Softies’ tune. I talk about your options in “Running Win10 version 1803 or 1809? You have options. Here’s how to control your upgrade.” Once you’ve decided where to land, move on to 1809 or 1903 or 1909 before you temporarily block this month’s patches. @PKCano has a newly updated list of 1803 upgrade deferral settings and their effects on AskWoody.

If you’re using Win10 Pro version 1809, I recommend an update blocking  technique that Microsoft shows for “Broad Release” in its obscure Build deployment rings for Windows 10 updates — which is intended for admins, but applies to you, too. (Thx, @zero2dash.)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. You see the settings in the screenshot. 

1809 sac 365 15 2 Woody Leonhard/IDG

Step 3. The first box — “Semi-Annual Channel” — is no longer recognized by Microsoft. It has changed the terminology over and over again. In our newly redefined update world, choosing “Semi-Annual Channel” adds 60 days to the “feature update” setting discussed in the next step. I recommend that you nod, wink and, in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, roll the “feature update” deferral setting all the way up to 365 days. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 425 days after a new version is released (60 days for Semi-Annual Channel + 365 days deferral) before upgrading and re-installing Windows on your machine.

Of course, nobody expects Microsoft to refrain from upgrading your 1809 machine until July 19, 2020 ( = version 1903 release date + 425 days): Even though those settings appear here, Microsoft has already warned that it’s going to push your 1809 machine onto 1909. We just don’t know exactly how hard it’s going to push quite yet.

My production machines are still on 1809, awaiting the results of this month’s 1903 patches — I’m still not convinced that 1903 is stable enough — so don’t feel left out if you haven’t yet moved on. If you’d like to block a forced upgrade to 1909 for the foreseeable future, follow the instructions in How to block the Windows 10 November 2019 Update, version 1909, from installing.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or reissued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

In the past I’ve recommended that you avoid clicking “Check for updates” simply because, up until a few months ago, clicking “Check for updates” would automatically install everything Microsoft had backed up for your machine, without giving you a chance to peruse the items on offer. It now appears as if Microsoft has seen the error of its ways, and no longer crams everything on your machine, should you have the temerity to “Check.” Still, I’m a superstitious old cuss with a long memory. I won’t be clicking “Check for updates” any time soon.

If there are any real howlers — months where the cumulative updates were irretrievably bad, and never got any better, as they were in July 2018 — we’ll let you know, loud and clear. 

Tired old approach for Win10 Home 1809

If you have Win10 Home, version 1809, your only reasonable option (other than installing a third-party patch blocker) is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic. Worryingly, there are some reports that Microsoft is pushing for upgrades even if they go over metered connections.

To set your Ethernet connection as metered: Using an administrator account, click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Using an administrator account, click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. 

There’s a better way with Win10 versions 1903 or 1909

I’m close to installing 1903 on my production machines, but haven’t yet made the plunge. It still hasn’t been stable enough, for long enough, to get my wholehearted endorsement. If you’ve already upgraded to 1903 or 1909, though, your patching life is considerably simpler

In version 1903 or 1909 (either Home or Pro), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause updates 1 Woody Leonhard/IDG

That button changes so it says Pause updates for 7 more days. Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. Once set, you can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems.

Grab a box of popcorn and join us for the monthly Patch Wake on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link

Critical updates to Excel and publicly disclosed exploits make for an urgent November Patch Tuesday

It doesn’t always take the drama of a zero-day vulnerability like we saw in September to get our attention. Make no mistake: This is still a really big update for the Windows platform. Two vulnerabilities deserve our attention. The first (CVE-2019-1429) relates to a vulnerability in the Microsoft Script Engine which has been reported as publicly exploited. And the second, (CVE-2019-1457)  is a publicly reported exploit in Microsoft Excel. We also think that the critical update to Exchange Server (CVE-2019-1373) will require immediate attention.

Though we are getting some pretty urgent patching requirements for older builds (especially Windows 7), Microsoft appears to have learnt from past lessons, as most later builds are largely immune to these attacks. This has two real benefits. First, having more secure systems is generally a good thing. Second, the IT department doesn’t have to rush out urgent fixes and can take the time to properly test and stage their desktop and server platform changes. You can find out more with our helpful infographic found here.

Known issues

Microsoft has documented a few known issues for this November Patch Tuesday, which we have broken down into two sections including:

Office update issues:

  • 4484113: After installing this update, you may see a “File failed to upload” error when saving files to a network location. To fix this issue, install KB 3085368
  • 4523171: Exchange services may remain in a disabled state after you install this security update. This condition does not indicate that the update is not installed correctly. This condition may occur if the service control scripts experience a problem when they try to return Exchange services to their usual state.

Windows 10 and Server 2019:

  • 4523205: There are a number of issues relating to Input Method Editors (IME) and Asian language packages for the Server installation process. For more information on these issues please refer to KB4026923.

Also, we are still seeing reports of the following error message: “Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. Microsoft has been working on this issue for four months now, and there is no fix expected soon.

Major revisions

No major Microsoft update revisions (at the time of writing) have been published.

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( NET Core, .NET Core and Chakra Core)
  • Adobe Flash Player

Browsers

The core Microsoft Scripting Engine (including VBScript) appears to be the concern this month, with the three critical rated patches (CVE-2019-1429, CVE-2019-1390 and CVE-2019-1427) and three other patches rates as important. For the past few years, we have seen too many patches to both Scripting engines – most leading to relatively exploitable remote code execution scenarios. Unfortunately, this month there has been reports of a Microsoft Script engine vulnerability exploited in the wild (CVE-2019-1429) and that like the other related vulnerabilities could lead to arbitrary code execution in the user’s security context. There is even an ActiveX web-based attack for this vulnerability , which I thought was not really “allowed” anymore. Add these Microsoft browser updates to your “Patch Now” release cycle.

Windows

Make no mistake, this is a big update for the Microsoft Windows platform, with 57 patches, six rated as critical. The six critical patches could lead to a remote code execution scenario, with Microsoft’s Hyper-V virtualization platform receiving the most attention this month. Given our experience with these types of updates in the past, we believe that the Windows font library patch (CVE-2019-1441) could be a likely candidate for potential application compatibility issues. If you are running Windows 7, this is a Patch Now update. If you are running Windows 10 (preferably later than 1803) then there are significant changes to the Hyper-V platform that will require testing. Schedule this Windows update, with a staggered release schedule for your Windows 10 desktops.

Microsoft Office

This is an unusual month for Microsoft Office updates. As usual, Microsoft has released (this month – nine) updates for Office that affect Exchange Server, Excel and Office Online. As usual, there are a number of Spoofing (CVE-2019-1445 and CVE-2019-1447) and Security Feature Bypass vulnerabilities (CVE-2019-1442 and CVE-2019-1449) addressed in the monthly security roll-up. Unusually, there has been a publicly reported exploit for Excel (CVE-2019-1457) that though difficult to exploit, an attacker can still rely on non-secure Excel macros and the fact that users will still download and open Excel files sent to them from strangers. As a result of this, please add this month’s Microsoft Office update to your “Patch Now” release cycle.

Development tools

This is a relatively quiet month for Microsoft developer tools updates with just two patches (CVE-2019-1370 and CVE-2019-1425), both rated as important by Microsoft. Affecting the open source Open Enclave SDK toolkit and Visual Studio, these two vulnerabilities may lead to an elevation of privilege security issue. Fortunately, the Visual Studio vulnerability has already been separately addressed by two NPM advisories: Arbitrary File Overwrite and the fstream version. Add this update to your regular developer update schedule.

Adobe

No Adobe updates for this month. If this continues into January, we will remove this section from our updates going forwards. But for now, it’s Margarita time.

This article is published as part of the IDG Contributor Network. Want to Join?

Copyright © 2019 IDG Communications, Inc.



Source link

Patch Tuesday arrives with Access error, 1909 in tow, and a promise of no more ‘optional’ patches this year

The patches haven’t yet been out for 24 hours and already we’re seeing a lot of activity. Here’s where we stand with the initial wave of problems.

Malicious Software Removal Tool installation error 800B0109 

Many early patchers found that the MSRT, KB 890830, kept installing itself over and over again. Poster IndyPilot80 says:

It sits at “Installing: 0%” for a couple minutes then goes away. When I hit “Check for Updates” it shows up again and does the same thing.

There are hundreds of reports online of people who found that the MSRT installer threw an 800B0109 and wouldn’t install; or installed but then reinstalled on reboot; showed up multiple times in the Installed Updates list; didn’t show up in the Installed Updates list in spite of running; and several variations on those themes.

Ends up, it was all Microsoft’s fault. By last night, MSRT was behaving itself.

Access ‘3340 query is corrupted’ errors

Günter Born first described this problem, based on reports on German-language sites, including deskmodder.de:

Microsoft Office security updates released on Patchday (November 12, 2019) cause Access to fail to access databases. An error 3340 ‘Query is corrupted’ will be dropped. …

It appears that a security update for the CVE-2019-1402 vulnerability in each version of Microsoft Office causes this error. Here is the list of Office security updates that you can uninstall.

Office 2010: Description of the security update for Office 2010: November 12, 2019 (KB4484127)

Office 2013: Description of the security update for Office 2013: November 12, 2019 (KB4484119)

Office 2016: Description of the security update for Office 2016: November 12, 2019 (KB4484113)

At least from what I’ve seen so far, uninstalling this security update seems to allow database access again.

Born says that he’s reported the problem to Microsoft, but it doesn’t yet appear on the official Fixes or workarounds for recent issues in Access list.

Re-release of Win10 version 1809

It isn’t clear to me why Microsoft re-released its most stable version of Win10 (at least, I’m still using 1809 on my production machines), but a new one’s out, apparently. At the same time Microsoft announced the re-release of 1809, it also reset the countdown date for version 1809 support:

On November 13, 2018, we re-released the Windows 10 October Update (version 1809), Windows Server 2019, and Windows Server, version 1809. We encourage you to wait until the feature update is offered to your device automatically. …  

Note for Commercial Customers: November 13 marks the revised start of the servicing timeline for the Semi-Annual Channel (“Targeted”) release for Windows 10, version 1809, Windows Server 2019, and Windows Server, version 1809.  Beginning with this release, all future feature updates of Windows 10 Enterprise and Education editions that release around September will have a 30-month servicing timeline.

And you thought Microsoft had abandoned the ridiculous “Semi-Annual Channel (“Targeted”)” bafflegab.

Servicing Stack Updates

Microsoft released new updates for the Servicing Stack on all supported versions of Windows. Notably, Win7 and 8.1 also have new SSUs. (You only have to worry about SSUs if you manually download and install updates. If you use Windows Update, they should be installed automatically. Should.) There’s a complete list of the new SSUs in Security Advisory ADV990001.

Another mysterious ‘exploited’ Internet Explorer security hole

Tell me if this sounds familiar

Yesterday’s patches includes one for an Internet Explorer security hole, dubbed  CVE-2019-1429, an “exploited” vulnerability. Just like the August “exploited” IE zero-day Keystone Kops episode, this appears to be a genuine flaw in IE. Just like the August doppelganger, Microsoft isn’t telling us very much. 

Dustin Childs says it best in his Zero Day Initiative post:

This patch for IE corrects a vulnerability in the way that the scripting engine handles objects in memory. This vague description for memory corruption means that an attacker can execute their code if an affected browser visits a malicious web page or opens a specially crafted Office document. That second vector means you need this patch even if you don’t use IE. Microsoft gives no information on the nature of the active attacks, but they are likely limited at this time. 

No doubt the Chicken Littles of the Windows reporting industry will bill this as a huge threat to 800 million Windows users — or some such drivel. In fact, it’s likely the discovered exploit appeared in a honed attack directed at a major governmental or industrial target.

Until we hear more about it (we haven’t heard of any attacks based on August’s exploit, have we?), you should be fine.

A reprieve from ‘optional non-security’ updates for the rest of the year

This should come as good news for Windows patchers of all stripes.

Microsoft has officially announced that it’s giving up on its practice of releasing (at least) two cumulative updates per month, through the end of this year. Tucked away in a neglected corner of the Windows Release Information page lies this little gem:

Timing of Windows 10 optional update releases (November/December 2019)

There will be no more optional “C” or “D” releases for the balance of this calendar year. Note There will be a December Security Update Tuesday release, as usual.

For those of you who don’t speak the A-B-C-D-E jargon, that means we won’t have second cumulative updates in November or December. The “optional, non-security” patches (which frequently contain fixes for bugs introduced by security updates) are a strange artifact that solidified in early 2017. Prior to that, Microsoft released one cumulative update on the second Tuesday of most months, then patched again at an arbitrary time, should the need arise — primarily to fix bugs introduced by the first patch.

Starting in 2017 or so (it’s difficult to pinpoint a date), somebody decided that it would be good to give Windows patchers a preview of the next month’s non-security patches, generally during the 3rd or 4th week of the month (thus, “C” and “D” week). The approach resembled something of an Insider Preview shot at the next month’s non-security patches. You could get a preview of the next month’s patches, but only if you downloaded and installed them manually, or (horrors!) became a Seeker and clicked “Check for updates.”

It looks like Microsoft is shutting that down, at least for the next two months, and I say good riddance. If there’s to be an Insider Preview ring for each version of Win10, I’m all for it — let people opt in, and give them a reliable way to report bugs. But playing footsie with Seekers just hangs too many innocent bystanders out to dry.

It isn’t clear if we’ll be spared the same indignity with Windows 7 and 8.1 “Monthly Rollup Previews.” Stay tuned.

The end of 1803 and the rise of 1909

As widely advertised, this month’s cumulative update for Win10 version 1803 is destined to be its last (unless we have a major security problem and Microsoft changes things). If you’re running Win10 version 1803, there’s no need to panic; in the normal course of events, you wouldn’t get another security patch until next month anyway. I’ll have more about the journey from 1803 in a subsequent column.

Those who have installed the Win10 1903 November cumulative update, KB 4524570, and rebooted, will see an offer on your Windows Update setting page (screenshot).

1903 after reboot installing 449 Woody Leonhard/IDG

Right now, there’s no pressing reason to click that “Download and install now” link. Let’s wait and see what problems arise. 

Quite a haul for the first 24 hours, eh? 

Thx, @abbodi86, @PKCano, @gborn and many more

Join us for the usual patching follies on AskWoody.com.

Copyright © 2019 IDG Communications, Inc.



Source link

Patch Tuesday alert: Make sure Windows Auto Update is temporarily disabled

For those of you who haven’t patched since May, there’s exceedingly bad news on the horizon. Per Catalin Cimpanu at ZDNet, Metasploit’s working-but-just-barely BlueKeep exploit is about to get a significant bug fix. That’ll put BlueKeep infection capabilities in the hands of mere mortals. The script kiddies won’t be far behind.

If you’re using — or you know someone who’s using — Windows XP, Vista, Win7, Server 2003, Server 2008 or Server 2008 R2, get patched nowThe fix is easy. Even  Aunt Martha can handle it.

Think of it this way. Would you rather spend the holidays with Aunt Martha over tea and crumpets, or cleaning a BlueKeep infection off her cute little PC? Your choice.

Yes, you have to get patched eventually. But there’s very little reason to jump head first into the pernicious patching pit. Sit back and watch like a pro. Get automatic update disentangled for a while, and wait while we all watch the unpaid beta testers take one (or more) for the Gipper.

Blocking automatic update on Windows 7 and 8.1

If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 Pro 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re on Win10 Pro version 1803, you have three options: Stick with version 1803 a while longer (the last scheduled patch for 1803 arrives Tuesday); upgrade to version 1809; or go for 1903, which has had teething problems lately. I have details on the options, what they entail, and how to pursue them here: Is Windows pushing you to upgrade? Don’t be bullied. There’s a middle path.

If you’re using Win10 Pro version 1809, or if you’re on Pro 1803 and want to stay there a bit longer, I suggest an update blocking technique that Microsoft recommends for “Broad Release” in its obscure Build deployment rings for Windows 10 updates –  it’s intended for admins, but applies to you, too. (Thx, @zero2dash)

Step 1. Using an administrative account, click Start > Settings > Update & Security. 

Step 2. On the left, choose Windows Update. On the right, click the link for Advanced options. If you’re using Win10 version 1803 or 1809, you see the settings in the screenshot. 

1809 sac 365 15 Microsoft

Step 3. The first box – “Semi-Annual Channel” – is no longer recognized by Microsoft. It’s changed the terminology over and over. In our newly-redefined update world, choosing “Semi-Annual Channel” adds 60 days to the “feature update” setting discussed in the next step. I recommend that you nod, wink and, in the first box, choose Semi-Annual Channel.

Step 4. To further delay new versions until they’ve been minimally tested, roll the “feature update” deferral setting all the way up to 365 days. That tells the Windows Updater (unless Microsoft makes another “mistake,” as it has numerous times in the past) that it should wait until 425 days after a new version is released (60 days for Semi-Annual Channel + 365 days deferral) before upgrading and re-installing Windows on your machine.

Of course, nobody expects Microsoft to keep its mitts off your 1803 machine until Jan. 12, 2020 (that’s the version 1809 release date + 425 days) or refrain from upgrading your 1809 machine until July 19, 2020 (version 1903 release date + 425 days): Even though those settings appear here, Microsoft is sure to ignore them and blast you onto the next version, somehow, at some point. We just don’t know how or when quite yet.

If you’d like to block a forced upgrade to 1903 for the foreseeable future, follow the instructions in How to block the Windows 10 May 2019 Update, version 1903, from installing.

We also don’t know exactly when Microsoft will start pushing the inevitable upgrade to Win10 version 1909. While it’s likely that the upgrade will be far less traumatic than every Win10 upgrade in the past, you might want to hedge your bets on this one, too. To keep 1909 off your machine until you’re good ‘n ready to take it, follow the instructions in How to block the Windows 10 November 2019 Update, version 1909, from installing.

Step 5. To delay cumulative updates, set the “quality update” deferral to 15 days or so. (“Quality update” = cumulative update = bug fix.) In my experience, Microsoft usually yanks bad Win10 cumulative updates within a couple of weeks of their initial release. By setting this to 10 or 15 or 20 days, Win10 will update itself after the major screams of pain have subsided and (with some luck) the bad cumulative updates have been pulled or re-issued. Notably, in February 2019, it took Microsoft 18 days to fix its first-Tuesday bugs.

Step 6. Just “X” out of the settings pane. You don’t need to explicitly save anything.

In the past I’ve recommended that you avoid clicking “Check for updates” simply because, until a few months ago, clicking “Check for updates” would automatically install everything Microsoft had backed up for your machine without giving you a chance to peruse the items on offer. It now appears as if Microsoft has seen the error of its ways, and no longer dumps everything on your machine, should you have the temerity to “Check.” Still, I’m a superstitious old cuss with a long memory. I won’t be clicking “Check for updates” any time soon.

If there are any real howlers – months where the cumulative updates were irretrievably bad, and never got any better, as they were in July 2018 – we’ll let you know, loud and clear. 

Tired old approach for Win10 Home 1803 and 1809

If you have Win10 Home, version 1803 or 1809, your only reasonable option (other than installing a third-party patch blocker) is to set your internet connection to “metered.” Metered connections are an update-blocking kludge that seems to work to fend off cumulative updates, but as best I can tell still doesn’t have Microsoft’s official endorsement as a cumulative update prophylactic. Worryingly, there are some reports that Microsoft is pushing for upgrades even if they go over metered connections.

To set your Ethernet connection as metered: Using an administrator account, click Start > Settings > Network & Internet. On the left, choose Ethernet. On the right, click on your Ethernet connection. Then move the slider for Metered connection to On.

To set your Wi-Fi connection as metered: Using an administrator account, click Start > Settings > Network & Internet. On the left, choose Wi-Fi. On the right, click on your Wi-Fi connection. Move the slider for Metered connection to On.

If you set your internet connection to metered, you need to watch closely as the month unfolds, and judge when it’s safe to let the demons in the door. At that point, turn “metered” off, and just let your machine update itself. Don’t click Check for updates.

There’s a better way with Win10 version 1903

I’m close to installing 1903 on my production machines, but haven’t yet made the plunge. It still hasn’t been stable enough, for long enough, to get my wholehearted endorsement. If you’ve already upgraded to 1903, though, your patching life is considerably simpler

In version 1903 (either Home or Pro), using an administrator account, click Start > Settings > Update & Security. At the top, click the Pause updates for 7 days button. 

1903 pause 7 days Microsoft

That button changes so it says Pause updates for seven more days. Click it two more times, for a total of 21 paused days. That defers all updates on your machines until 21 days after you click the button. You can’t extend the deferral any longer unless you install all the outstanding cumulative updates to that point.

Historically, 21 days has sufficed to avoid the worst problems.

It looks like Win10 version 1909 will be distributed just like a cumulative update later this month, possibly on Patch Tuesday. We’ll have more details as the update/upgrade/version/service pack unfolds.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2019 IDG Communications, Inc.



Source link