Beginning in May, Microsoft plans to halt the delivery of all non-security updates to Windows, another step in its suspension of non-essential revisions to the OS and other important products.
The optional updates, which Microsoft designates as Windows’ C and D updates, are released during the third and fourth week of each month, respectively.
“We have been evaluating the public health situation, and we understand this is impacting our customers,” Microsoft said to some understatement in a March 24 post to the Windows 10 messaging center. “In response to these challenges we are prioritizing our focus on security updates.”
Security updates, labeled as B updates, are better known as those released on Patch Tuesday – Microsoft prefers Update Tuesday – or the second Tuesday of each month. The stoppage of C and D updates will not affect the company’s patching efforts. “There is no change to the monthly security updates; these will continue as planned to ensure business continuity and to keep our customers protected and productive,” the message read.
The C and D updates are used to test non-security fixes which are to be officially released the following month as part of the all-encompassing Patch Tuesday cumulative update. According to Microsoft, the C and D updates should not be distributed to all Windows client systems. Instead, the D update, which Microsoft ships two weeks after one Patch Tuesday and two weeks before the next, should be used to “…test the updates included in the release and provide feedback, reducing the amount of testing necessary following Update Tuesday and, thereby, improving our ability to solve issues before they even happen.”
Because they’re optional, some customers simply skip them.
Windows 10’s C updates are relatively rare. In the five months since Microsoft released Windows 10 1909, for example, the version has been served three D updates but zero C updates.
Wednesday’s May shuttering of C and D updates is the latest move by Microsoft to limit update efforts to security fixes or reduce IT overhead while the COVID-19 pandemic upends business, businesses in general and business processes. So far this month, Microsoft has extended support for Windows 10 1709 an additional six months for customers running Windows 10 Enterprise or Education, and curtailed feature upgrades for its Edge browser.
Microsoft gave no explanation as to why it’s waiting until May to suspend the non-security updates, rather than put the policy into immediate effect and thus block potential updates expected on April 21 (C) and/or April 28 (D).
Yesterday, a post on the official Windows Release Information site said that Microsoft will, at least temporarily and starting in May, stop sending out the pesky “optional, non-security, C/D Week” patches we’ve come to expect.
Those “optional” second-monthly patches are usually laden with many dozens of fixes for miscellaneous, minor bugs in Windows. For example, the second-monthly cumulative update for Win10 version 1903 released yesterday lists 31 different fixes, most of which only matter in very specific cases.
Addresses an issue that fails to return search results in the Start menu Search box for users that have no local profile.
Addresses an issue that prevents applications from closing.
…and many more of that ilk.
Starting with Win10 1903, those “optional, non-security, C/D Week” patches aren’t automatically applied to your PC. They aren’t installed when you click Check for updates, either – a horrendous relic of a bygone era. In order to install the patches these days, you have to click on a specific link just for that patch that says Download and install now.
The “optional, non-security, C/D Week” patches are nothing more than a surrogate for a Windows Insider ring devoted to testing non-security patches on a released version of Win10. Microsoft should’ve turned the patches into an Insider ring years ago. But I digress.
Here’s what I don’t get. The official announcement goes like this:
Timing for upcoming Windows optional C and D releases
We have been evaluating the public health situation, and we understand this is impacting our customers. In response to these challenges we are prioritizing our focus on security updates. Starting in May 2020, we are pausing all optional non-security releases (C and D updates) for all supported versions of Windows client and server products (Windows 10, version 1909 down through Windows Server 2008 SP2).
There is no change to the monthly security updates (B release – Update Tuesday); these will continue as planned to ensure business continuity and to keep our customers protected and productive.
That’s the whole announcement.
I see what it’s trying to do – stop releasing “optional, non-security, C/D Week” patches – and that’s a laudable goal. That means fewer people will click and install a beta test version of Win10 without realizing what they’ve stepped into. But the specific wording of the announcement still has me scratching my head.
Here’s the ugly truth: Microsoft isn’t going to stop doing non-security patches. It can’t. Windows is so buggy in its current form that important things go bump in the night and need to be fixed. For example, this fix in the February “optional non-security, C/D Week” patch:
Updates an issue that prevents the Windows Search box from rendering properly.
… tackled a problem that was encountered by thousands (millions?) of users. Then there are specific bugs that cry out for fixing, like this one from yesterday:
Addresses an issue that fails to return search results in the Start menu Search box for users that have no local profile.
Win10 bugs aren’t going away any time soon, and Microsoft would be foolish to ignore them completely.
With that in mind, here’s what I think Microsoft is trying to say:
We won’t be sending out any more bundles of “optional, non-security, C/D Week” patches after April. (Hey, can we get an Insider Ring, folks?)
Patch Tuesday patches continue. Starting in June, the Patch Tuesday patches will include as few non-security patches as possible.
Of course, the point of this exercise is to improve the stability of Windows patches. I’m skeptical – after all, the non-security patches inevitably slipped into Patch Tuesday won’t be tested any more than the security patches. But there is hope. Perhaps by increasing the number of “Won’t Fix” bugs, the resulting patches will be more stable.
And there’s one huge, looming question: How does Win10 version 2004 fit into all of this? Is Microsoft saying that the latest version of Windows will ship so bug-free that it doesn’t need loads of non-security patches?
It’s always a good idea to pause Windows updates just before they hit the rollout chute. This month, we’re facing two extraordinary issues that you need to take into account. Wouldn’t hurt if you told your friends and family, too.
Take last month’s Windows patches. Please. We had one patch, KB 4524244, that slid out on Patch Tuesday, clobbered an unknown number of machines (HP PCs with Ryzen processors got hit hard), then remained in “automatic download” status until it was finally pulled on Friday. We had another patch, KB 4532693, that gobbled desktop icons and moved files while performing a nifty trick with temporary user profiles. Microsoft never did fix that one.
Those aren’t isolated incidents. We see the same pattern, over and over again. Microsoft releases patches that aren’t adequately tested. Screams of pain ensue. Microsoft fixes some of the patches, doesn’t fix others. Wash. Rinse. Repeat.
Getting out of the automatic update-induced karmic crapwheel is a mighty pain — and one that’s entirely avoidable. Just avoid the automatic updating, wait and see while crowdsourced beta-testing runs its course.
As if you needed more incentive, this month two additional problems loom.
First, the “optional, non-security, C/D Week” patch that rolled two weeks ago, KB 4535996, has had all sorts of problems. Mayank Parmar at Windows Latest and Lawrence Abrams at BleepingComputer document an impressive list of freezes, crashes, broken drivers, lousy performance, and black and blue screens. Microsoft hasn’t officially acknowledged any of the bugs.
The only bug that has been acknowledged, one that breaks the signtool.exe app in Visual Studio used to sign projects, drew a reference in one blog post from one Microsoft engineer. “We are working on a resolution and estimate a solution will be available in mid-March.”
In normal times, we’d expect the bugs in the “optional” patch to get ironed out by the time the regular cumulative update appears. The past couple of weeks, though, have been anything but normal times.
Almost all of Microsoft’s staff in the Northwest has been working from home for the past week. Microsoft announced late last week that two of its employees in the Seattle area have tested positive for COVID-19, the new coronavirus. You would think that the transition to telecommuting would be easy — after all, Microsoft’s been selling telecommuting-friendly software for decades — but word from the trenches is that there are plenty of bumps in the road.
That brings me to my second concern about this month’s patches. Even if Microsoft gets its act together and fixes the known (and unknown!) bugs in this month’s Patch Tuesday patch, we have exactly zero experience with Microsoft handling new bugs in this coronavirus-influenced work-from-home environment.
Microsoft has a hard enough time fixing bugs when the whole crew’s in one building, in shouting distance. Heaven only knows what’s going to happen this month.
You have to patch sooner or later. But there’s even more reason this month to not be in the “sooner” cohort.
Blocking automatic update on Win7 and 8.1
Those who paid for Win7 Extended Security Updates should be plenty cautious about installing patches immediately. Those who didn’t will either ignore the patches (large majority there), or wait to see if free alternatives appear. We’ll be covering both intently on AskWoody.com.
If you’re using Windows 7 or 8.1, click Start > Control Panel > System and Security. Under Windows Update, click the “Turn automatic updating on or off” link. Click the “Change Settings” link on the left. Verify that you have Important Updates set to “Never check for updates (not recommended)” and click OK.
Blocking automatic update on Windows 10
By now, almost all of you are on Win10 version 1903 or 1909. Not sure which version of Win10 you’re running? Down in the Search box, near the Start button, type About, then click About your PC. The version number appears on the right under Windows specifications.
If you’re using Win10 1803 or 1809, I strongly urge you to move on to Win10 version 1909. If you insist on sticking with Win10 1809 (hard to blame ya!), you can block updates by following the steps in December’s Patch Tuesday warning. Be acutely aware of the fact that Microsoft won’t be handing out any more security patches for 1809 Home or Pro after the May Patch Tuesday. Two months to go.
In version 1903 or 1909 (either Home, Pro, Education or Enterprise, unless you’re attached up an update server), using an administrator account, click Start > Settings > Update & Security. If your Updates paused timer is set before March 30 (see screenshot), I urge you to click Resume Updates and let the automatic updater kick in — and do it now, before noon in Redmond on Tuesday, when the Patch Tuesday patches get released.
If Pause is set to expire before the end of March, or if you don’t have a Pause in effect, you should set up a patching defense perimeter that keep patches off your machine for the rest of this month. Using that administrators account, click the “Pause updates for 7 days” button, then click it again and again, if necessary, until you’re paused out into late March or early April.
If you see an Optional update available (you can see one in the screenshot), DON’T click “Download and install.” You’ll be bit by those bugs soon enough.
Don’t be spooked. Don’t be stampeded. And don’t install any patches that require you to click “Download and install.”
If there are any immediate widespread problems protected by this month’s Patch Tuesday — a rare occurrence, but it does happen — we’ll let you know here, and at AskWoody.com, in very short order. Otherwise, sit back secure in the knowledge that you aren’t in the first round of cannon fodder. Let’s see what problems arise.
By now you’ve probably heard about the disappearing-profile bug in this month’s Win10 1903 and 1909 cumulative update. The buggy patch went out on Tuesday, Feb. 11. Reports started rolling in shortly afterward about desktops that were wiped clean, wallpaper replaced, even files that disappeared. I wrote about it on Thursday morning:
Many people are in a tizzy — their desktop icons are gone, they can’t log onto their usual Admin account, and their files most definitely aren’t where they left them.
Since then we’ve seen many hundreds of complaints and dozens of articles about the mayhem. Ends up that the hapless victims had their Windows profiles swapped out, replaced by a temporary profile. The buggy patch moved their cheese and hid it where all but the most advanced Windows boffin would never find it.
Loss of profile has historically been a race condition between the boot process and something holding files open. I personally have seen antivirus most often do this but it could be other things like antiransomware protection, group policy settings. Microsoft DOES test their patches, they really do. What they can’t do is test for the myriad of unknown ways that we set up our computers.
(Techy note: A race condition is a timing issue that arises when two or more independent programs stomp on each other. They’re very difficult to diagnose.)
Initial reports pointed the finger at a specific antivirus package as being the one that tangled with the KB 4532693 installer, but then we discovered that not all folks running that AV software were getting bit. Then we had a series of reports about local accounts (users who aren’t signed on with a Microsoft Account) getting the special treatment. Nope, that wasn’t the problem.
Microsoft hasn’t officially acknowledged the bug, as best as I can tell, aside from two posts on the Answers forum. On Feb. 12, Lawrence Abrams at BleepingComputer said that a Microsoft rep told him, “We are aware of the issue and are investigating the situation.” On Feb. 17, almost a week after the bug first appeared, Mayank Parmar at Windows Latest said:
In a conversation with Microsoft’s support team, multiple employees told us that Microsoft is aware of the issue and are actively investigating the situation. “Microsoft is aware of this known issue and our engineers are working diligently to find a solution for it,” a staff stated.
There have been multiple reports of users losing data because of the KB 4532693 patch. I haven’t seen that happen as yet, personally, so remain skeptical. Far more likely is that the data got stuffed into a .BAK or .000 or .003 folder inside the C:Users folder — the place Windows sticks profiles. If a Windows customer runs a Cleaner program while trying to fix the lost profile bug, the backup may well be gone.
Most distressing: Susan Bradley reports on a response to a Microsoft support case, in which a Microsoft technician specifically mentioned Windows Defender as a possible source of conflict:
I discussed the case with my tech lead and confirmed this to be a bug — 25270101 … find the Windows Defender Advanced Threat Protection and Microsoft Defender Antivirus services, right-click each of them, select Properties, and change Startup Type to Disabled, selecting OK after each change. Restart your device in normal mode and attempt to sign in with your original profile.
It isn’t at all clear if Defender might be part of the two-to-tango race condition.
If you’re using Pause Updates in Win10 1903 or 1909 to block Microsoft’s patches, and your “Resume updates” date is far enough out — today or later — you didn’t get either this buggy patch or the monstrous KB 4524244 UEFI “patch,” which was pulled last week. But if you’re relying on Pause Updates, now would be a very good time to make sure it’s set out to the end of the month or later. Heaven only knows when (if!) Microsoft is going to re-release KB 4532693 and fix the disappearing profile problem.
For most of you, pausing updates until March 9 seems like a very good idea. (If you’re running SQL Server, though, you need to get the February patches installed. Sorry.)
To adjust your Pause Updates setting, first make sure you’re running either Win10 version 1903 or 1909 (type winver down in the Search box and press Enter). If you are, click Start > Settings > Update & Security. You should see something like the screenshot.
If your “Updates will resume on” date is before March 9, click the “Pause updates for 7 more days” link. (March 9 is a lucky number because the next Patch Tuesday is on March 10. Presumably Microsoft will fix this mess prior to that date. Presumably.)
In the past, I haven’t recommended that you extend the “Resume updates” date by pressing the “Pause updates for 7 more days” link because Microsoft has long warned that you can only extend updates after you’ve installed the currently available updates:
After the pause limit is reached, you’ll need to install the latest updates before you can pause updates again.
I’m delighted — and surprised — to tell you that, at least in my tests, that limitation no longer applies. It appears to me as if you can go back in and pause updates for seven more days at a clip, even if you already have Pause updates set.
That’s remarkably good news.
Questions? Observations? Vituperations? We’re all ears on AskWoody.
With 99 reported vulnerabilities and patches to both Microsoft browsers, Office and Windows, this month’s Patch Tuesday update is not as large an administrative burden as you might initially think. We’ve rated the browser updates as a “Patch Now” update due to issues with the Chakra engine, but both Office and Windows can be scheduled according to a regular patch cadence. Unfortunately, we have another Adobe Flash update to deploy, but no critical development updates for February.
Each month, Microsoft includes a list of known issues that relate to the operating system and platforms included in this update cycle. I have referenced a few key issues that relate to the latest builds from Microsoft including:
Microsoft Cluster Shared Volumes (CSV) can still generate the error message,” “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5).” Microsoft is still working on a solution. Until a fix is released, you can try the operation as an administrator or try to “own” directories in question before the operation.
After installing some Asian language packs you may still (see KB4493509) receive the error, “0x800f0982 – PSFX_E_MATCHING_COMPONENT_NOT_FOUND.”
Microsoft has been working on a fix for both these issues for a while now; we don’t expect a resolution any time soon.
This month, two CVEs have undergone a major revision increment:
CVE-2019-1332: CVE information revised to announce the availability of Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (CU) and Microsoft SQL Server 2016 for x64-based Systems Service Pack 2 (GDR).
CVE-2019-8267: Microsoft revised this to include Internet Explorer 11 installed on all supported editions of Windows 10 Version 1809, Windows Server 2019, Windows 10 Version 1903, and Windows 10 Version 1909 because they are affected by this vulnerability. This change may affect your server update cycle
Each month, we break down the update cycle into product families (as defined by Microsoft) with the following basic groupings:
Browsers (Microsoft IE and Edge)
Microsoft Windows (both desktop and server)
Microsoft Office (Including Web Apps and Exchange)
Microsoft Development platforms ( ASP.NET Core, .NET Core and Chakra Core)
Cloud and Devices
Adobe Flash Player (to be discontinued)
Microsoft has released nine updates to both browsers (Internet Explorer and Edge) this month, with five rated as critical, two as moderate and the remaining two as important. The biggest concerns are the four critical updates to the Chakra core scripting engine that could lead to remote code execution.
Microsoft advises that these four critical vulnerabilities could lead to a scenario where “An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.”
Add this update to your “Patch Now” schedule.
Ok, this may sound like a lot of updates: Microsoft has released 79 patches to the Windows desktop and server ecosystem. Five of these updates are rated as critical and the rest are all rated as important by Microsoft. It sounds (and feels) like a lot of patches, but other than the critical updates to the Remote Desktop (RDP) platform, the administrative burden is not that great.
This patch cycle feels more like an administrative cycle than that one that addresses critical or exploited vulnerabilities. It’s “clean-up” time for Microsoft after the Christmas break and a very light January patch cycle.
Add these updates to your standard release schedule.
Microsoft has released six updates to Microsoft Office – all rated as important. The most serious for this month affects Microsoft Excel with a potential (but difficult-to-exploit) remote code execution scenario involving how Excel handles objects in memory. All of this month’s reported vulnerabilities require access to the target system and require users to take explicit action on vulnerable systems. There is an update this month to Microsoft SharePoint server which will require a reboot of all affected servers.
Add these Office patches to your regularly scheduled updates
Microsoft development platforms
This month, Microsoft has not released any updates to the many variations of .NET, but we do have one update to SQL Server that has been rated as important. CVE-2020-0618 is relatively difficult to exploit, as it requires access to the SQL server instance and requires specially crafted pages sent to the SQL Server Reporting services.
Add this update to your regularly scheduled patch release cadences.
Cloud and Devices
We have allocated this space to the recent cloud (Azure) and device updates from Microsoft. This month, Microsoft has not released any Azure related patches, but has published a Microsoft Surface (device level) patch (CVE-2020-0702) that has been rated as important (and difficult to exploit).
Add this device related update to your regular patch cycle.
Adobe Flash Player
I thought that we were done with critical Adobe Flash Player updates from Microsoft. I even instructed our development team to remove this section from our internal bulletins. Well, they (Flash Player) updates are back, with a vengeance.
This month, we see another ActiveX flaw in Flash Player (ADV20003/CVE-2020-3757) that could lead to the execution of arbitrary code on the compromised computer. According to the Adobe security bulletin, “The vulnerability exists due to a type confusion error when processing Flash content. A remote attacker can create a specially crafted .SWF file, trick the victim into playing it, trigger a type confusion error and execute arbitrary code on the target system. Successful exploitation of this vulnerability may result in complete compromise of the target system.”
Microsoft has documented a potential work-around relating to the Flash ActiveX control which includes making the following registry changes: