Posts Tagged

patches

This month’s Windows and Office security patches: Bugs and solutions

It’s been another strange patching month. The usual Patch Tuesday crop appeared. Two days later, we got a second cumulative update for Win10 1903 and 1909, KB 4551762, that’s had all sorts of documented problems. Two weeks later, on Monday, Microsoft posted a warning about (another) security hole related to jimmied Adobe fonts.

Predictably, much of the security press has gone P.T. Barnum.

The big, nasty, scary SMBv3 vulnerability

Patch Tuesday rolled out with a jump-the-gun-early warning from various antivirus manufacturers about a mysterious and initially undocumented security hole in the networking protocol SMBv3.

Later that day, Microsoft released a broad description of the SMBv3 security hole in Security Advisory ADV200005 – apparently trying to close the door after the cow escaped. And the crowd went wild. How could Microsoft tell these antivirus vendors about a forthcoming fix, then fail to deliver the fix – and not warn the AV folks in time to pull their press releases? Tales of impending doom ran rampant.

Then, on Thursday, we saw another cumulative update for Win10 versions 1903 and 1909. KB 4551762 patches the SMBv3 security hole and, being a cumulative update, includes all earlier patches. The rush was on to install the patch-of-a-patch, but we started seeing all sorts of problems: errors on installation; random reboots; performance hits; and the return of our old profile-zapping bug, which leaves folks with empty desktops and hidden files.

Here’s the punch line. (Tell me if you’ve heard this one before.) After all the sturm un drang, researchers (notably including Kevin Beaumont) discovered that they couldn’t effectively use the security hole to take over a system:

“Windows Defender, which is enabled by default, detects exploitation even if unpatched.”

As of this writing, I don’t know of any real-world attacks using the SMBv3 vulnerability. Certainly, one will appear sooner or later, but it isn’t a big deal right now.

The big, nasty, scary Adobe Type Manager font bugs

Yesterday, Microsoft released another Security Advisory. ADV200006  — Type 1 Font Parsing Remote Code Execution Vulnerability describes a security hole in the way Windows handles fonts. We’ve seen a lot of those in Windows over the years. This one came with the usual zero-day language, advising that Microsoft has seen “limited targeted attacks that could leverage un-patched vulnerabilities.” The advisory shows that every version of Windows – going back to Win7 – is vulnerable.

Once again, the blogosphere went nuts. Microsoft’s warning meeeeeeelions of Windows users that their systems are under attack!

Yeah. Sure.

When Microsoft says it’s seen “limited targeted attacks,” that means some well-heeled hacking group is using the security hole against a very specific target – usually a government agency or a high-stakes corporate group. For normal people, in normal situations, it’s not a big deal.

We’ve seen these “sky-is-falling” scenarios play out over and over again in the past year or so. Some security holes (e.g., for EternalBlue/WannaCry and BlueKeep) need to be plugged shortly after the patches are released. But in the vast majority of cases, waiting a week or two or three to install the latest crop of Windows and Office patches just makes sense.

Windows Defender ‘Items skipped during scan’

Many – but not all – Windows 10 users report that a manual scan by Windows Defender triggers this “Items skipped during scan” notification (screenshot).

Windows Defender items skipped during scan 2 Microsoft

It appears to be a bug. According to Lawrence Abrams at BleepingComputer:

“It seems that in the older Windows Defender engines network scanning was enabled by default… [in newer versions of the engine] you can see that the Windows Defender preferences show that network scanning has now been disabled by a newer engine. It is not known why Microsoft decided to make this change, but the alerts appear to just indicate that network scanning was skipped.”

Günter Born originally reported on the bug. He has come up with a manual workaround to enable network scanning.

Other developments

More on the patching front:

  • Microsoft has announced that it’s extending end-of-life for Win10 version 1709 Enterprise (and Education) to Oct. 13, 2020.
  • Abbodi86 has discovered a way to install the latest Windows 7 security patches, even if you haven’t yet set up Extended Security Updates. Many people, including Patch Lady Susan Bradley, are asking Satya Nadella to offer Win7 Extended Security Updates to all “genuine” Win7 customers, particularly because of the increase in work-from-home.
  • In the same vein, there’s a lot of discussion about throttling back on Windows auto updates, specifically to help keep work-from-home systems stable. Many advocate holding off on the inevitable Win10 version 2004 update. No indication that Microsoft has heard the pleas.

If there ever were a time for Windows patching stability, this is it.

We’ll keep pushing on AskWoody.com.





Source link

Disappearing SMBv3 patch, non-security Office patches, and a so-far-mild Patch Tuesday

It’s been almost 24 hours since this month’s Patch Tuesday patches rolled out. The good news: Almost everybody patching individual machines reports smooth sailing.

That’s remarkable, given the host of problems with last month’s disappearing icons (temporary profile) bug and the unending litany of complaints about the last “optional, non-security, C/D Week” patch. As best I can tell, none of those problems have been officially acknowledged, and if they’re still in evidence with yesterday’s patches, people aren’t complaining about them. Yet.

To be sure, we’re still seeing the usual problems with installing the patches — Error  0x800f0900 seems particularly prolific on Reddit — but at this early juncture, I don’t see any debilitating problems.

That may well change. Many patchers have other problems on their minds and the day is still young.

Duplicated updates

I’ve seen numerous reports of duplicated updates in Windows Update lists, specifically for Windows 8.1, a .Net Quality Rollup, and the Server 2012 R2 Monthly Rollup. Seeing the same, identical patch listed twice in an update list does not inspire confidence. 

It looks like Microsoft tidied up the list overnight. At this point there are 110 “2020-03” entries in the Microsoft Update Catalog — which is to say, 110 individual patches — three fewer than there were last night.

Less is better, yes?

Extra Office updates

It looks as if Microsoft took advantage of Patch Tuesday to release additional non-security patches for Office. Usually the non-security Office patches come out on the first Tuesday of the month, but this announcement contains links to all of these new Office non-security patches:

Excel 2016

March 10, 2020, update for Excel 2016 (KB4011130)

Office 2016

March 3, 2020, update for Office 2016 (KB4484247)

Office 2016

March 10, 2020, update for Office 2016 (KB3213653)

Outlook 2016

March 10, 2020, update for Outlook 2016 (KB4462111)

PowerPoint 2016

March 10, 2020, update for PowerPoint 2016 (KB3085405)

Project 2016

March 10, 2020, update for Project 2016 (KB3085454)

Skype for Business 2016

March 3, 2020, update for Skype for Business 2016 (KB4484245)

Skype for Business 2015 (Lync 2013)

March 3, 2020, update for Skype for Business 2015 (Lync 2013) (KB4484097)

Office 2016 Language Interface Pack

March 3, 2020, update for Office 2016 Language Interface Pack (KB4484136)

Remarkably, those patches are not listed in the official Latest non-security updates for versions of Office that use Windows Installer (MSI) post.

The strange case of CVE-2020-0796 ‘CoronaBlue’ 

Yet another patch timing mishap: The SMBv3 patch described in Microsoft Security Advisory ADV200005 | Microsoft Guidance for Disabling SMBv3 Compression has been causing all sorts of consternation among admins in charge of networks running SMBv3. 

Long story short, Microsoft apparently had the patch ready to go but pulled it at the last minute. Microsoft warned security software manufacturers in advance that the patch was coming (a common practice), but didn’t yell, “Stop the presses!” in time to keep the cows in the barn. Two organizations on the inside accidentally published, then pulled, descriptions. The story raced through the blogosphere.

The hole is wormable in that it might be able to propagate without any human interaction. “Might” being the operable term: A potential exploit faces formidable challenges.

At first, Microsoft didn’t officially announce the hole, and didn’t post a fix. Then, its hand having been forced, on Tuesday night, Microsoft posted the Security Advisory, which says:

Microsoft is aware of a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target SMB Server or SMB Client.

At this point, it appears that only Server 2013 and 2019 are affected. Microsoft has a manual workaround. There aren’t any known exploits but Catalin Cimpanu at ZDNet just tweeted:

I have now seen/talked to 3 different people claiming they found the bug in less than 5 minutes. I won’t be surprised if exploits pop up online by the end of the day.

If you’re in charge of a network running SMBv3, you can catch up on the developments by reading Satnam Narang on Tenable, Sergiu Gatlan at BleepingComputer, Catalin Cimpanu at ZDNet and, in the past couple of hours, Dan Goodin at Ars Technica. There’s an active discussion on AskWoody. You should also follow @msftsecresponse on Twitter.

If you aren’t running a network with SMBv3, you can chill. There’s nothing in this month’s patches that need concern you right now.

We’re kickin’ butt and naming names on AskWoody.

Copyright © 2020 IDG Communications, Inc.





Source link

In spite of the disappearing Windows desktop bug, now’s a good time to install the February patches

It’s frustrating when Microsoft refuses to acknowledge a widespread bug in one of its mainstream patches. This month we’re looking at a major bug that’s drawn a tiny mention on a Microsoft Answers Forum post — and that’s it. Such is the state of Windows transparency these days.

On the plus side, though, we have enough experience with the bug to be able to recognize and fix it should you be so unlucky as to encounter it.

Other than that one glaring (if infrequent) bug, there are some minor problems, but, on the whole, now would be a good time to get your system updated. Here’s how.

Make a full backup

Make a full system image backup before you install the latest patches.

There’s a non-zero chance that the patches — even the latest, greatest patches of patches of patches — will hose your machine. Best to have a backup that you can reinstall even if your machine refuses to boot. This, in addition to the usual need for System Restore points.

There are plenty of full-image backup products, including at least two good free ones: Macrium Reflect Free and EaseUS Todo Backup

Running Win10? I’m moving to version 1909 and suggest you do, too.

If you’re running Win10 version 1803, 1809, Server 1809, Server 2019 or any earlier version of Windows 10, I urge you to upgrade to Win10 version 1903 or 1909. (You can find your version by typing winver in the Search box in the lower left corner and pressing Enter.) There are detailed instructions for making the move in the article “Why — and how — I’m moving Win10 production machines to version 1903.”

Win10 1903 is far from perfect, but it seems to be relatively stable at this point. The one huge advantage to version 1903: It lets everybody pause updates with a few simple clicks. That feature has my vote for the most important (perhaps the only important) upgrade to Win10 in the past four years. 

It looks like Microsoft has finally fixed the glaring bug in Win10 version 1909 — the one that made File Explorer’s Search box completely useless. We saw a minor improvement in the January cumulative update, but the February cumulative update, KB 4532693, seems to fix the problem completely. Of course, there’s been no acknowledgment or even a description from Microsoft, but as best I can tell File Explorer Search is working now. Yes, the bug’s been in there since 1909 shipped.

At any rate, I’m moving my production machines to 1909. Moving from Win10 version 1903 to 1909 is quite easy. After making a full backup, click Start > Settings (the gear icon) > Update & Security. If you don’t see the Download and install link shown in the screenshot, click Check for updates and it should appear.

1909 download and install now updated Woody Leonhard/IDG

Click on the link marked Download and install and wait. When you reboot, Win10 will be on version 1909, build 18363.657. That’s the build of 1909 that corresponds to the February cumulative update. It does not include the “optional, non-security, C/D Week” patch KB 4535996, which you don’t want.  

Install the Win10 February Cumulative Update

If you just moved to Win10 version 1909, per the preceding section, you already have the February Cumulative Update, KB 4532693. Breathe easy.

If you’re staying with Win10 version 1903, I certainly sympathize. If you were already running Win10 version 1909, I admire your bravery. To get the February Cumulative Update installed, click Start > Settings > Update & Security. If you see a Resume updates box (screenshot), click on it.

1903 updates paused Woody Leonhard/IDG

That’s all you need to do. Windows, in its infinite wisdom, will install the February Cumulative Update at its own pace. If you don’t see a Resume updates box, you already have the February Cumulative update and all is right in this, the best of all possible worlds.

When your machine comes back up for air, don’t panic if your desktop doesn’t look right, or you can’t log in to your usual account. You got bit by the “temporary profile” bug, which we’ve known about — and complained about — for weeks. We have three separate threads on AskWoody about solving the problem [1, 2, 3] and if you need additional help, you can always post a question. (Thx, @PKCano.)

Note: According to a report on the GratisSoftwareSite.nl site,the “optional, non-security, C/D Week” patch for Win10 version 1903 and 1909, KB 4535996, has the same profile-eating bug as its predecessor. Caveat updator.

If you see an offer that says “Optional updates available,” just ignore it. You aren’t being paid enough to beta test Microsoft’s next set of patches.

While you’re mucking about in Windows Update, it wouldn’t hurt to Pause updates, to take you out of the direct line of fire the next time Microsoft releases a buggy bunch of patches. Click Start > Settings > Update & Security. Click “Pause updates for 7 days.” Next, click on the newly revealed link, which says “Pause updates for 7 more days,” four more times. That pauses all updates for 35 days, until early April. With a little luck that’ll be long enough for Microsoft to fix any bugs it introduces in March.

We’ll have new observations and suggestions as the month winds on.

Patch Win7, Win8.1, or associated servers

If you’ve paid for Win7 Extended Security Updates and you’re having trouble getting them installed, Microsoft has a new article called Troubleshoot issues in Extended Security Updates that may be of help. We’re also fielding questions on AskWoody.

If you haven’t paid for Extended Security Updates but want to keep WIn7 protected, 0patch has started publishing patches that cover some of the security holes plugged by the paid Extended Security Updates.

Windows 8.1 continues to be the most stable version of Windows around. To get this month’s puny Monthly Rollup installed, follow AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups. You should have one Windows patch, dated Feb. 11 (the Patch Tuesday patch). 

After you’ve installed the latest Monthly Rollup, if you’re intent on minimizing Microsoft’s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping. If you want to thoroughly cut out the telemetry, see @abbodi86’s detailed instructions in AKB 2000012: How To Neutralize Telemetry and Sustain Windows 7 and 8.1 Monthly Rollup Model.

Thanks to the dozens of volunteers on AskWoody.com who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 3 on the AskWoody Lounge.

Copyright © 2020 IDG Communications, Inc.



Source link

This month’s Windows and Office security patches: Bugs and solutions

The real stinker this month, KB 4524244, rolled out the automatic update chute for four full days until Microsoft yanked it – leaving a trail of wounded PCs, primarily HP machines, in its wake. The other big-time bug in this month’s patches, a race condition in the KB 4532693 Win10 version 1903 and 1909 cumulative update installer, hasn’t been officially acknowledged by Microsoft outside of a blog post. But at least it’s well known and understood.

Folks running SQL Server and Exchange Server networks need to get patched right away.

Win10 UEFI update KB 4524244 blockages

Patch Tuesday brought KB 4524244 for Windows 10 owners, a bizarre single-purpose patch apparently directed at one specific UEFI bootloader. I talked about it last week.

The patch was pulled on Friday, but in the interim lots of people reported problems. Most notably, many folks running HP machines with Ryzen processors saw their machines hang, followed by an HP Sure Start Recovery message saying Sure Start had “detected an unauthorized change to the Secure Boot Keys.” HP has posted a list of affected machines:

HP EliteBook 735 G5 Notebook PC, 735 G6, 745 G5, 745 G6,  755 G5, and HP ProBook 645 G4 Notebook PCs. HP EliteDesk 705 35W G4 Desktop Mini PC, 705 65W G4 Mini PC, 705 G4 Microtower PC, 705 G4 Small Form Factor PC, 705 G4 Workstation Edition, 705 G5 Desktop Mini PC, 705 G5 Small Form Factor PC, HP mt44 Mobile Thin Client, mt45 Mobile Thin Client, and HP ProDesk 405 G4 Small Form Factor PC.

If you have any of those machines and left your PC open to Microsoft’s updates during Patch Week, you got clobbered. In addition, Microsoft documents a bug in the “Reset this PC” function but doesn’t give any details.

There’s nothing you can do about it now. If KB 4524244 installed successfully, everything’s OK. If it didn’t, you need to follow HP’s removal instructions or Microsoft’s removal instructions to get things working again.

Win10 Cumulative Update KB 4532693 clears desktops, moves files

Shortly after the Patch Tuesday patches arrived, we started seeing reports from folks who installed the Win10 1903 and 1909 cumulative update, KB 4532693, saying that their desktops got wiped out. A little poking revealed that all of their customizations had been tossed – icons, wallpaper – and many of their files weren’t where they left them.

Long story short, it looks like the patch gets ensnared in a race condition bug, which I wrote about last week. We’ve never been able to pin down which other programs trigger the race condition, but at least in some cases certain antivirus and “secure banking software” programs will leave your PC with a dangling temporary profile.

Microsoft hasn’t identified the offending software. Nor has it even acknowledged the problem either on the Knowledge Base article page or the Windows Release Information status page, two places that bugs like this are traditionally documented. (Perhaps Microsoft figures it’s the other software’s problem, so it has no need to report it?)

Fortunately, there’s a Microsoft Answers forum post that addresses the problem:

Microsoft is aware of some customers logging into temporary profile after installing KB4532693, on both versions 1903 and 1909.

Rebooting into Safe Mode* and then starting back in normal Mode should resolve this issue for most customers.

You may uninstall any secure banking software or anti-virus in the temporary profile which may resolve this if the above steps do not help.

If you didn’t accidentally find that explanation, or don’t know what a temporary profile is, or how it could get secure banking software, heaven help ya. But at least Microsoft “is aware” of the problem.

What’s the big deal?

How many people were affected by those high-profile bugs? I don’t know. Judging by the number of complaints online – hardly a reliable metric – both of the problems were widespread and became apparent shortly after release.

HP could probably come up with a tally of the number of afflicted machines and whether or not those machines installed the buggy UEFI patch. But the only organization that has comprehensive numbers about these bugs is Microsoft, and it’s not talking.

Think of all of that lovely telemetry we’re providing to Microsoft.

Odds ‘n Ends

That “exploited” Internet Explorer JScript hole, CVE-2020-0674 – the one that prompted computer security “experts” to tell you that you had to get patched RIGHT NOW? It hasn’t gone anywhere. This is the second month in a row that we’ve been inundated by Chicken Little warnings about the need to get patched immediately. Look where knee-jerk installation of new patches has left folks running HP Ryzen computers, or the unidentified “secure banking software,” this month.

Those of you running Windows 7, who haven’t paid for Extended Security Updates, should know that 0patch has released a micro patch for that particular security hole. It also has an online test you can use to confirm that your Win7/IE 11 system has properly swallowed the micro fix.

To be sure, there are major security holes that need your attention, but only if you’re in charge of a network running SQL Server or Exchange Server. That latter vulnerability is particularly vexing because anyone who can get access to any Exchange account on your server can take over Exchange. Seems that somebody forgot to delete hard-coded keys.

We’re looking into a report that Win10 version 1903 running Hyper-V is throwing “Synthetic_Watchdog_Timeout” errors. There are unconfirmed reports that there will be a fix in late March.

There seems to be a way to cheat the 35-day “Pause updates” limitation imposed in Win10 version 1903 and 1909. In a nutshell, if you tell Windows to Resume Updates, then unplug the computer from the internet, you may be able to reboot and get 35 more days paused, without installing the outstanding updates. In addition, @abbodi86 has a more complex but apparently foolproof way to wipe out the 35 day limitation.

Join the patch watch on AskWoody.com.



Source link

Get the January 2020 Patch Tuesday patches installed

This month has seen a whole lotta hand waving and sky-is-falling-caliber rhetoric, but the reality is much more prosaic. If you aren’t running a major network (and thus aren’t susceptible to the imminent problems with Remote Desktop Gateway, the Citrix network bugs or the whopping 334 patches in Oracle), there’s been little reason to install this month’s updates. 

Still, work on cracking the CurveBall CVE-2020-0601 security hole continues at a furious pace. Some security companies are using CurveBall to sell more product, but the free Microsoft Defender catches at least some afflicted programs; Firefox, Chrome and Edge won’t fall for it; and pre-Win10 versions of Windows (Seven Semper Fi!) have never been exposed.

With several working proof-of-concept routines readily available — but no attacks, and indeed no sign that a general attack is imminent — patching for CurveBall falls in the “abundance of caution” bucket. Since we’ve seen few weird problems with the January patches, now seems like a good time to get patched up.

As usual, Patch Lady Susan Bradley has a detailed analysis in her Patch Watch column with a full patch-by-patch reckoning in her Master Patch List (paywall; donation requested).

Here’s how to get your system updated the (relatively) safe way.

Make a full backup

Make a full system image backup before you install the latest patches.

There’s a non-zero chance that the patches — even the latest, greatest patches of patches of patches — will hose your machine. Best to have a backup that you can reinstall even if your machine refuses to boot. This, in addition to the usual need for System Restore points.

There are plenty of full-image backup products, including at least two good free ones: Macrium Reflect Free and EaseUS Todo Backup

Patch Win7, Win8.1 or associated servers

This is the last month we’ll see free Win7 patches — or so we’ve been promised. (I find it hard to believe that Microsoft won’t patch the Win7 Internet Explorer JScript security hole CVE-2020-0674, but Microsoft, eh?)

As for those of you Win7 holdouts worried about sprouting a black wallpaper due to the Win7 January “Stretch” bug, Microsoft now advises:

We are working on a resolution and will provide an update in an upcoming release for organizations who have purchased Windows 7 Extended Security Updates (ESU).

Nice guys. 

Bottom line, for you Win7 folks: Do yourself a favor and change your wallpaper so it isn’t Stretched, before installing the buggy January patch. Follow Lawrence Abrams’s instructions on BleepingComputer.

Microsoft is blocking updates to Windows 7 and 8.1 on recent computers. If you are running Windows 7 or 8.1 on a PC that’s 24 months old or newer, follow the instructions in AKB 2000006 or @MrBrian’s summary of @radosuaf’s method to make sure you can use Windows Update to get updates applied.

For most Windows 7 and 8.1 users, I recommend following AKB 2000004: How to apply the Win7 and 8.1 Monthly Rollups. You should have one Windows patch, dated Jan. 14 (the Patch Tuesday patch). If you see a Monthly Rollup Preview, ignore it.

If you insist on manually installing Security-only patches for Win7 and Server 2008 (I call that the “Group B” approach on AskWoody), get the full list from @PKCano on the AskWoody site. If in doubt, ask questions on the site! It’s easy and free.

Realize that some or all of the expected patches for January may not show up or, if they do show up, may not be checked. DON’T CHECK any unchecked patches. Unless you’re very sure of yourself, DON’T GO LOOKING for additional patches. In particular, if you install the January Monthly Rollup, you won’t need (and probably won’t see) the concomitant patches for December. Don’t mess with Mother Microsoft.

If you see KB 4493132, the “Get Windows 10” nag patch, make sure it’s unchecked.

Watch out for driver updates — you’re far better off getting them from a manufacturer’s website.

After you’ve installed the latest Monthly Rollup, if you’re intent on minimizing Microsoft’s snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and 8.1 snooping. If you want to thoroughly cut out the telemetry, see @abbodi86’s detailed instructions in AKB 2000012: How To Neutralize Telemetry and Sustain Windows 7 and 8.1 Monthly Rollup Model.

If you’re worried about Windows 7 hitting end-of-support, don’t be alarmed. The first missed security patch isn’t until next month. Besides, you have lots of alternatives, and not all of them involve Windows. We watch your options intently in the Seven Semper Fi series on AskWoody.

Patch Win10 and associated servers

If you’re running Win10 version 1803, 1809, Server 1809, Server 2019, or any earlier version of Windows 10, I urge you to upgrade to Win10 version 1903. (You can find your version by typing winver in the Search box in the lower left corner and pressing Enter.) There are detailed instructions in the article Why — and how — I’m moving Win10 production machines to version 1903.

Win10 1903 is far from perfect, but it seems to be relatively stable at this point. The one huge advantage to version 1903: It lets everybody pause updates with a few simple clicks. That feature has my vote for the most important (perhaps the only important) upgrade to Win10 in the past four years.

If you insist on using Win10 version 1809, go through the steps in All’s clear to install Microsoft’s November patches to get 1809 updated. If you’re on Win10 1909, I figure you’ve jumped the gun, but the following instructions will work.

If you’ve been following my usual advice — to click “Pause updates for 7 days” three times — your machine is probably waiting further instructions, displaying an “Updates paused” notice in the Windows Update pane (Start > Settings (the gear icon) > Update & Security > Windows Update). If you see that updates have been paused, click “Resume updates.” Windows will go out and install the January cumulative update, plus any other ancillary patches (for example, for .Net) that you require.

I’m very happy to say that clicking “Resume updates” will not automatically move you to Win10 version 1909. In order to move to the next version — which continues to suffer from bugs, most notably the File Explorer Search bug — you need to click a link that says, “Download and install now.” Don’t click it.

Once you’re updated and rebooted, pause updates for 28 days: Click Start > Settings > Update & Security. Click Windows Update on the left side, then click “Pause updates for 7 days.” Next, click on the newly revealed link, which says “Pause updates for 7 more days,” and click it again, and one last time, for a total of four clicks. That pauses all updates for 28 days, until Feb. 21. With a little luck that’ll be long enough for Microsoft to fix any bugs it introduces in February.

If you see an offer of an Optional update (screenshot), don’t click Download and install now. There’s a reason why Microsoft deems such patches “optional.”

1909 download and install now Woody Leonhard/IDG

February’s Patch Tuesday is on the 11th. That’ll be the first day Win7 users will miss a security update (unless they pay for it). Expect much hand wringing and clucking, but not many fireworks.

Thanks to the dozens of volunteers on AskWoody who contribute mightily, especially @sb, @PKCano, @abbodi86 and many others.

We’ve moved to MS-DEFCON 3 on the AskWoody Lounge.

Copyright © 2020 IDG Communications, Inc.



Source link