Posts Tagged


With a fix for the ‘temporary profile’ bug still elusive, Win10 1903 and 1909 customers should check Pause Updates

By now you’ve probably heard about the disappearing-profile bug in this month’s Win10 1903 and 1909 cumulative update. The buggy patch went out on Tuesday, Feb. 11. Reports started rolling in shortly afterward about desktops that were wiped clean, wallpaper replaced, even files that disappeared. I wrote about it on Thursday morning:

Many people are in a tizzy — their desktop icons are gone, they can’t log onto their usual Admin account, and their files most definitely aren’t where they left them.

Since then we’ve seen many hundreds of complaints and dozens of articles about the mayhem. Ends up that the hapless victims had their Windows profiles swapped out, replaced by a temporary profile. The buggy patch moved their cheese and hid it where all but the most advanced Windows boffin would never find it.

Early on, Patch Lady Susan Bradley nailed the cause of the problem:

Loss of profile has historically been a race condition between the boot process and something holding files open. I personally have seen antivirus most often do this but it could be other things like antiransomware protection, group policy settings. Microsoft DOES test their patches, they really do. What they can’t do is test for the myriad of unknown ways that we set up our computers.

(Techy note: A race condition is a timing issue that arises when two or more independent programs stomp on each other. They’re very difficult to diagnose.)

Initial reports pointed the finger at a specific antivirus package as being the one that tangled with the KB 4532693 installer, but then we discovered that not all folks running that AV software were getting bit. Then we had a series of reports about local accounts (users who aren’t signed on with a Microsoft Account) getting the special treatment. Nope, that wasn’t the problem.

Microsoft hasn’t officially acknowledged the bug, as best as I can tell, aside from two posts on the Answers forum. On Feb. 12, Lawrence Abrams at BleepingComputer said that a Microsoft rep told him, “We are aware of the issue and are investigating the situation.” On Feb. 17, almost a week after the bug first appeared, Mayank Parmar at Windows Latest said:

In a conversation with Microsoft’s support team, multiple employees told us that Microsoft is aware of the issue and are actively investigating the situation. “Microsoft is aware of this known issue and our engineers are working diligently to find a solution for it,” a staff stated.

There have been multiple reports of users losing data because of the KB 4532693 patch. I haven’t seen that happen as yet, personally, so remain skeptical. Far more likely is that the data got stuffed into a .BAK or .000 or .003 folder inside the C:Users folder — the place Windows sticks profiles. If a Windows customer runs a Cleaner program while trying to fix the lost profile bug, the backup may well be gone.

Most distressing: Susan Bradley reports on a response to a Microsoft support case, in which a Microsoft technician specifically mentioned Windows Defender as a possible source of conflict:

I discussed the case with my tech lead and confirmed this to be a bug — 25270101 … find the Windows Defender Advanced Threat Protection and Microsoft Defender Antivirus services, right-click each of them, select Properties, and change Startup Type to Disabled, selecting OK after each change. Restart your device in normal mode and attempt to sign in with your original profile.

It isn’t at all clear if Defender might be part of the two-to-tango race condition. 

And, of course, neither the Knowledge Base article nor the official Windows Release Status page says a word. Nine days later and the buggy patch is still being shoveled out the Windows Automatic Update chute.

Not all is doom and gloom.

If you’re using Pause Updates in Win10 1903 or 1909 to block Microsoft’s patches, and your “Resume updates” date is far enough out — today or later — you didn’t get either this buggy patch or the monstrous KB 4524244 UEFI “patch,” which was pulled last week. But if you’re relying on Pause Updates, now would be a very good time to make sure it’s set out to the end of the month or later. Heaven only knows when (if!) Microsoft is going to re-release KB 4532693 and fix the disappearing profile problem.

For most of you, pausing updates until March 9 seems like a very good idea. (If you’re running SQL Server, though, you need to get the February patches installed. Sorry.)

To adjust your Pause Updates setting, first make sure you’re running either Win10 version 1903 or 1909 (type winver down in the Search box and press Enter). If you are, click Start > Settings > Update & Security. You should see something like the screenshot.

defer to 03 09 2020 Woody Leonhard/IDG

If your “Updates will resume on” date is before March 9, click the “Pause updates for 7 more days” link. (March 9 is a lucky number because the next Patch Tuesday is on March 10. Presumably Microsoft will fix this mess prior to that date. Presumably.)

In the past, I haven’t recommended that you extend the “Resume updates” date by pressing the “Pause updates for 7 more days” link because Microsoft has long warned that you can only extend updates after you’ve installed the currently available updates: 

After the pause limit is reached, you’ll need to install the latest updates before you can pause updates again.

I’m delighted — and surprised — to tell you that, at least in my tests, that limitation no longer applies. It appears to me as if you can go back in and pause updates for seven more days at a clip, even if you already have Pause updates set.

That’s remarkably good news.

Questions? Observations? Vituperations? We’re all ears on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

A large – but manageable – February Patch Tuesday brings critical browser updates

With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.

You can find more information in our helpful infographic here.

Known issues

Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:

  • Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
  • After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”

Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.

Major revisions

This month, two CVEs have undergone a major revision increment:

  • CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
  • CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle

Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:

  • Browsers (Microsoft IE and Edge)
  • Microsoft Windows (both desktop and server)
  • Microsoft Office (Including Web Apps and Exchange)
  • Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
  • Cloud and Devices
  • Adobe Flash Player (to be discontinued)


Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.

Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”

Add this update to your “Patch Now” schedule.

Microsoft Windows

Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.

This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.

Add these updates to your standard release schedule. 

Microsoft Office

Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.

Add these Office patches to your regularly scheduled updates

Microsoft development platforms

This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.

Add this update to your regularly scheduled patch release cadences.

Cloud and Devices

We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).

Add this device related update to your regular patch cycle.

Adobe Flash Player

I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.

This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”

Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

[HKEY_LOCAL_MACHINESOFTWAREWow6432NodeMicrosoftInternet ExplorerActiveX Compatibility{D27CDB6E-AE6D-11CF-96B8-444553540000}]

“Compatibility Flags”=dword:00000400

Add this update to your “Patch Now” release schedule.

Copyright © 2020 IDG Communications, Inc.

Source link

Thought you already paid for Win7 Extended Security Updates? Think again.

I’m hearing lots of complaints from people who spent good money to get Win7 Extended Security Updates, but don’t see this month’s patches. There’s a reason why. Microsoft didn’t bother to tell us that you need a new patch, released yesterday, in order to start receiving Win7 ESU updates. You have to download the new patch, KB 4538483, from the Microsoft Catalog, and install it manually before the updates even appear.

Folks who spent money to get the February and later patches are livid. 

Yesterday, after releasing the February updates, Microsoft modified its ESU Procedure page to add this step:

  1. Download and install the Extended Security Updates (ESU) Licensing Preparation Package. For more information, see the following articles in the Microsoft Knowledge Base:
  • 4538483 Extended Security Updates (ESU) Licensing Preparation Package for Windows 7 SP1 and Windows Server 2008 R2 SP1
  • 4538484 Extended Security Updates (ESU) Licensing Preparation Package for Windows Server 2008 SP2

The upshot: If you (or your company) paid for extended updates, unless you know by osmosis that you have to install this additional package, and then you download and install KB 4538483 manually, you won’t see any February patches. 

Adding insult to pinheaded injury, if your machine is all prepped to receive Extended Security Updates — using the instructions that were in effect before yesterday — and you don’t install KB 4538483 (or KB 4538484) manually, you won’t even see the Office patches for that machine.

This new KB 4538483 patch has to be manually installed, even if your machine has passed Microsoft’s KB 4528069 tests to verify that ESU is properly set up.

Patch Lady Susan Bradley kicks it, “While I’m glad that Microsoft offered Win7 Extended Security Updates to small businesses, I’m also concerned that I have now put small businesses at the mercy of what feels like a less-than-planned implementation.  In order to get patched by Windows Update, one has to stumble on a brand new blog post out today and download a patch only on the Catalog site. The idea behind paid-for security patches is to make it easier to be patched while you are still running Windows 7, not make it harder to get updates.”

Need help? We’re ready on

Copyright © 2020 IDG Communications, Inc.

Source link

Patch Tuesday’s tomorrow. Verify you have ‘Pause Updates’ enabled

Remember the frenzy after last month’s Patch Tuesday? How everybody and his twice-removed cousin — even the N forkin’ SA — told you to get patched immediately because of this big, spooky Crypto API security hole that was supposed to bring down  Windows As We Know It, like, right now?

Guess what. It never materialized.

To its credit, Microsoft never said the Chain of Fools/CurveBall CVE-2020-0601 fix was a “Critical” patch. That didn’t keep most of the increasingly echo-like Windows blogosphere from crying, “Fire!”

If you prefer to wait and see if the latest Windows patches turn to dreck, there are a few simple steps to take right now.

Watching out for Windows 7

The last free, pushed Win7 patches arrived a month ago.

If you paid for Win7 Extended Security Updates — yes, even a business of one can get them — you’re due a patch tomorrow. One little problem: We haven’t seen the patch and don’t know absolutely, for sure, how it’ll arrive.

If you haven’t paid for Win7 Extended Security Updates, we also don’t know what the morrow will bring. Windows 7 already has one manually downloadable patch to fix the bad patch last month (which introduced the “Stretch” black wallpaper bug) and I expect we’ll see a patch at some point to fix the “You don’t have permission to shut down this computer” bug. For now, there’s nothing pressing. See Patch Lady Susan Bradley’s Feb. 9 podcast for more details. 

I suggest you keep your powder dry by following the usual steps: Click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

We’ll watch for any goofiness and alert you, as usual.

Blocking automatic update on Win8.1

If you’re using Windows 8.1 (believed by many to be the most stable version of Windows currently on offer), click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.

Blocking automatic update on Win10 1803 or 1809

Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.

If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1903. Microsoft released it (to some consternation) in May of last year. It had a shaky start before plunging into a four-patch debacle in September/October, but now appears to be relatively stable. There are detailed step-by-step instructions for moving to Win10 1903 in “Why — and how — I’m moving Win10 production machines to version 1903.”

If you insist on sticking with Win10 1809 (thrice bitten, thrice shy, eh?), you can block updates by following the steps in December’s Patch Tuesday warning. Be acutely aware of the fact that Microsoft won’t be handing out any more security patches for 1809 Home or Pro after the May Patch Tuesday.

There’s a better way with Win10 versions 1903 or 1909

In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), if you followed my instructions last month, you already have “Pause Updates” set so patching resumes near the end of February (screenshot). 

updates paused til 2020 03 02 Woody Leonhard/IDG

Not sure if you’re sufficiently paused? To check, using an administrator account, click Start > Settings > Update & Security. If you’re paused until the end of the month or so, you don’t need to do anything. That’ll give you three weeks after Patch Tuesday to see if there are any bad bugs.

On the other hand, if pause is set to expire before the end of February, or if you don’t have a pause in effect, you should set up a patching defense perimeter that keeps patches off your machine for the rest of this month. Using that administrators account, click the “Pause updates for 7 days” button, then click it again and again, if necessary, until you’re paused out into March. (If you have a partial pause already in effect, you may need to click “Resume updates,” then reboot.)

For those of you who have been wondering about the “optional, non-security, C/D Week” KB 4532695 patch for Win10 1903 and 1909, it’s there, but you shouldn’t install it. For weeks I’ve been wondering why I didn’t see KB 4532695 offered on my 1903 machines as an additional update to “Download and install now.” @abbodi86 on finally figured it out: If you’re running Win10 1909, you’ll see KB 4532695 offered as an additional update, as one would expect. But if you’re running Win10 1903, you have to have a specific combination of hidden and blocked patches before the optional KB 4532695 is offered.

Don’t be spooked. Don’t be stampeded. And don’t install any patches that require you to click “Download and install now.” They’ll be minimally tested and available soon enough.

If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at, in very short order.

We’re at MS-DEFCON 2 on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

Microsoft blinks: Security Essentials will continue to receive updates after Jan. 14

Late last week, I talked about a discrepancy in Microsoft’s promised handling of Microsoft Security Essentials as Windows 7 reaches end of support. An internally inconsistent official announcement seemed to say that MSE signature file updates would stop — even for those who have paid for Extended Security Updates. 

Which is absurd. Why would Microsoft stop updating its antivirus program even for people who are paying to continue receiving Monthly Rollup patches?

Yesterday Microsoft held an Ask Me Anything session for the Win7 forlorn, on the Microsoft Tech Community Forum. I asked:

Can you confirm that Microsoft will really, for sure, cut off Microsoft Security Essentials malware signature updates after January 14? Even if you’re paying for Extended Support?

Microsoft engineer Mike Cure provided an official response:

MSE will continue to receive signature updates after Jan. 14.

Citing the Windows 7 support FAQ which says: 

Microsoft Security Essentials (MSE) will continue to receive signature updates after January 14, 2020. However, the MSE platform will no longer be updated.

Then on the AMA, @Brian responded by referring to the Extended Security Update FAQ, which says:

Will Microsoft Security Essentials continue to protect my PC after end of support?

No, your Windows 7 PC will not be protected by Microsoft Security Essentials (MSE) after January 14, 2020. This product is unique to Windows 7 and follows the same lifecycle dates for support.

That’s an obfuscating piece of bafflegab, subject to whimsical interpretation, as I described in the Computerworld article last week.

Mike Cure then clarified the situation by promising:

I’ll get [the ESU FAQ] corrected as soon as possible.

Except, as of early Wednesday morning, nothing’s been corrected. Those of us who actually like and rely on MSE are still hanging on a limb.

Join us for the Seven Semper Fi watch on

Copyright © 2019 IDG Communications, Inc.

Source link