Posts Tagged


With a fix for the ‘temporary profile’ bug still elusive, Win10 1903 and 1909 customers should check Pause Updates

By now you’ve probably heard about the disappearing-profile bug in this month’s Win10 1903 and 1909 cumulative update. The buggy patch went out on Tuesday, Feb. 11. Reports started rolling in shortly afterward about desktops that were wiped clean, wallpaper replaced, even files that disappeared. I wrote about it on Thursday morning:

Many people are in a tizzy — their desktop icons are gone, they can’t log onto their usual Admin account, and their files most definitely aren’t where they left them.

Since then we’ve seen many hundreds of complaints and dozens of articles about the mayhem. Ends up that the hapless victims had their Windows profiles swapped out, replaced by a temporary profile. The buggy patch moved their cheese and hid it where all but the most advanced Windows boffin would never find it.

Early on, Patch Lady Susan Bradley nailed the cause of the problem:

Loss of profile has historically been a race condition between the boot process and something holding files open. I personally have seen antivirus most often do this but it could be other things like antiransomware protection, group policy settings. Microsoft DOES test their patches, they really do. What they can’t do is test for the myriad of unknown ways that we set up our computers.

(Techy note: A race condition is a timing issue that arises when two or more independent programs stomp on each other. They’re very difficult to diagnose.)

Initial reports pointed the finger at a specific antivirus package as being the one that tangled with the KB 4532693 installer, but then we discovered that not all folks running that AV software were getting bit. Then we had a series of reports about local accounts (users who aren’t signed on with a Microsoft Account) getting the special treatment. Nope, that wasn’t the problem.

Microsoft hasn’t officially acknowledged the bug, as best as I can tell, aside from two posts on the Answers forum. On Feb. 12, Lawrence Abrams at BleepingComputer said that a Microsoft rep told him, “We are aware of the issue and are investigating the situation.” On Feb. 17, almost a week after the bug first appeared, Mayank Parmar at Windows Latest said:

In a conversation with Microsoft’s support team, multiple employees told us that Microsoft is aware of the issue and are actively investigating the situation. “Microsoft is aware of this known issue and our engineers are working diligently to find a solution for it,” a staff stated.

There have been multiple reports of users losing data because of the KB 4532693 patch. I haven’t seen that happen as yet, personally, so remain skeptical. Far more likely is that the data got stuffed into a .BAK or .000 or .003 folder inside the C:Users folder — the place Windows sticks profiles. If a Windows customer runs a Cleaner program while trying to fix the lost profile bug, the backup may well be gone.

Most distressing: Susan Bradley reports on a response to a Microsoft support case, in which a Microsoft technician specifically mentioned Windows Defender as a possible source of conflict:

I discussed the case with my tech lead and confirmed this to be a bug — 25270101 … find the Windows Defender Advanced Threat Protection and Microsoft Defender Antivirus services, right-click each of them, select Properties, and change Startup Type to Disabled, selecting OK after each change. Restart your device in normal mode and attempt to sign in with your original profile.

It isn’t at all clear if Defender might be part of the two-to-tango race condition. 

And, of course, neither the Knowledge Base article nor the official Windows Release Status page says a word. Nine days later and the buggy patch is still being shoveled out the Windows Automatic Update chute.

Not all is doom and gloom.

If you’re using Pause Updates in Win10 1903 or 1909 to block Microsoft’s patches, and your “Resume updates” date is far enough out — today or later — you didn’t get either this buggy patch or the monstrous KB 4524244 UEFI “patch,” which was pulled last week. But if you’re relying on Pause Updates, now would be a very good time to make sure it’s set out to the end of the month or later. Heaven only knows when (if!) Microsoft is going to re-release KB 4532693 and fix the disappearing profile problem.

For most of you, pausing updates until March 9 seems like a very good idea. (If you’re running SQL Server, though, you need to get the February patches installed. Sorry.)

To adjust your Pause Updates setting, first make sure you’re running either Win10 version 1903 or 1909 (type winver down in the Search box and press Enter). If you are, click Start > Settings > Update & Security. You should see something like the screenshot.

defer to 03 09 2020 Woody Leonhard/IDG

If your “Updates will resume on” date is before March 9, click the “Pause updates for 7 more days” link. (March 9 is a lucky number because the next Patch Tuesday is on March 10. Presumably Microsoft will fix this mess prior to that date. Presumably.)

In the past, I haven’t recommended that you extend the “Resume updates” date by pressing the “Pause updates for 7 more days” link because Microsoft has long warned that you can only extend updates after you’ve installed the currently available updates: 

After the pause limit is reached, you’ll need to install the latest updates before you can pause updates again.

I’m delighted — and surprised — to tell you that, at least in my tests, that limitation no longer applies. It appears to me as if you can go back in and pause updates for seven more days at a clip, even if you already have Pause updates set.

That’s remarkably good news.

Questions? Observations? Vituperations? We’re all ears on AskWoody.

Copyright © 2020 IDG Communications, Inc.

Source link

February Win10 1903 and 1909 cumulative update causing desktops to disappear

Shortly after this month’s massive Patch Tuesday dump dropped, several people reported that when they rebooted after installing the patch, their desktops appeared to be wiped clean — icons went missing, wallpaper replaced, desktop data nowhere to be seen.

Last night, Lawrence Abrams on BleepingComputer came up with a comprehensive diagnosis:

Based on the reports by affected users, it appears that a bug in the KB4532693 update is loading up a temporary profile to be used during the update process and failing to restore the user’s profile when done. 

Which explains all of the symptoms I’ve seen [1, 2, 3, 4, 5].

Many people are in a tizzy — their desktop icons are gone, they can’t log onto their usual Admin account, and their files most definitely aren’t where they left them. Abrams has a bit of reassurance:

The good news is that the update is not wiping your data, but rather renaming the original user profile in the C:Users folder. If you are affected by this issue, you can look in C:Users and see if you have a renamed profile ending in .000 or .bak.

I’ve seen several reports that uninstalling the KB 4532693 patch solves the problem.

Günter Born picked up the baton overnight (U.S. time) and has come up with a tantalizing observation:

Currently I’m collecting information about the root cause. One user reported, that a bunch of 50 machines was affected, all using AVIRA antivirus, while the other machines without issues didn’t have AVIRA installed. But this is only a single voice. 

Of course, Microsoft hasn’t said anything. The official Win10 Release Information Status page hasn’t been updated since November. The Feedback Hub is useless, as usual (try searching for “KB 4532693”). The official Answers Forum doesn’t have a clue.

So we’re back to helping Microsoft crowdsource patching bug reports for its multibillion-dollar product.

Did your desktop disappear after installing this month’s patches? Are you running Avira or Avast? Please let us know on AskWoody.

I swear, if somebody tells me again how Windows patches are getting better, I’m gonna bust a blood vessel. 

Copyright © 2020 IDG Communications, Inc.

Source link

Win10 Search blackout due to ‘fiber provider’ glitch? Pull the other one, Microsoft.

If you believe that yesterday’s worldwide crash of Windows 10 Search was caused by a bad third-party fiber provider, I have a bridge to sell you.

Microsoft’s transparency in the Search black box fiasco has earned it a “five nose Pinnochio” veracity rating from Patch Lady Susan Bradley. That’s as bad as it gets.

Microsoft wants you to believe that:

… a temporary server-side issue caus[ed] Windows search to show a blank box. This issue has been resolved for most users and in some cases, you might need to restart your device. We are working diligently to fully resolve the issue and will provide an update once resolved. 

Clearly, that’s only part of the story. Here’s what we know for sure.

Windows 10 Search works even if you aren’t connected to the internet. Go ahead. Unplug your computer. See?

Bing was only tangentially involved. Many people found that they could get their Search boxes back by modifying the registry to disable Bing Search — the “feature” in Windows 10 that routes all of your Search bar searches through Microsoft’s data-gathering servers. But a large number found that zapping Bing Search didn’t bring back the Search box.

There were no official patches associated with the outage. None went out yesterday morning.

There were no Microsoft Store updates associated with the outage. Lots of searching by lots of people has turned up exactly zero evidence of changes to any Store apps leading to the chaos.

So if there were no bad patches, and Win10 Search doesn’t require an internet connection, what’s going on? 


Microsoft has been monkeying around with Search builds. What started as a snipe hunt for changing default Search text (thx, @howardagoldberg) turned into the discovery of an explosion of rapidly changing Search build numbers — 2020.02.01.6237928, 2020.02.02.6237943, many more. My main machine’s up to 2020.02.04.6238073 early Thursday morning.

The Search app has changed from an old Win32 program that’s worked pretty well since Win7 days into a new JavaScript/React UWP POS (thx, @warrenrumak). I’ve been expecting that shift since we started having problems with File Explorer Search in Win10 version 1909 months ago. I didn’t expect to see a retroactive change in Win10 version 1903, but now it appears as if UWP-itis has infected both versions.

The intent, of course, is to give us a flashy new Search “experience” that shows today’s weather, news, today in history, and new movies (thx, @b) whenever you type in the Search box. What a great idea. Not.

That’s what we know for sure. Permit me to toss out a conjecture.

Microsoft appears to be updating Search — the Search that runs on your machine — by changing things on its servers. There’s no user notification about changes, no permission requested or granted to change the Search software. No Patch Tuesday. No KB article. No cumulative updates. Not even a Windows Store entry to block. No documentation. Nothing you can do about it.

As best I can tell, this has led to a merry round of beta (alpha?) testing, where Microsoft’s test machines are our production machines.

Somehow, a bad version of Search made it into production on our machines that shows a black screen and disables the Search box entirely. When the folks at Microsoft finally figured that out, it took them about three hours to push out a new version. Remember, Search should work whether you’re connected to the internet or not. Yes, the bugs were on Microsoft’s servers — third-party fiber provider notwithstanding. But they were also on our machines.

Short version: Somebody at Microsoft is beta-testing buggy JavaScript code on our machines. Without warning. And there’s nothing we can do about it.

There’s a further conjecture: Is it possible that responsibility for the Search software was pulled out of the Windows Experience team and placed in the Windows Core team? Remember, those two groups report to entirely different masters — Joe Belfiore for Experience, Scott Guthrie for Core. Belfiore is headed out for another months-long cruise with his family, with Panos Panay picking up the baton. I have no idea what @ScottGu is doing right now. He’s been uncharacteristically silent for many months. Perhaps he fell off his bicycle.

It’s time somebody at Microsoft stepped up to the microphone and told Bradley’s Pinocchio what’s really happening.

More on

Copyright © 2020 IDG Communications, Inc.

Source link

Has your Win10 Search box gone black? Does Search even work?

Here’s a quick test. Fire up or reboot your Win10 machine. Click inside the Search box on the lower left. You should see something like the screenshot I posted on Computerworld two days ago. This morning, though, many people are reporting a completely black screen, as shown in this screenshot of a recently patched Win10 version 1903 system (Build 18362.592).

black search screen Woody Leonhard/IDG

In addition, Search simply doesn’t work: Type something in the Search box and nothing happens.

How is that possible? you ask. How can a key working piece of Windows 10 just fade to black? What did you do to break your machine?

The top-level answer is pretty simple: You didn’t do anything wrong. Microsoft reached into your Win10 PC overnight and screwed up its search function. Again. You didn’t give Microsoft permission to break Search. It just broke, all by itself.

For a more detailed explanation, specifically for Win10 version 1909, I’ll refer to @warrenrumak on AskWoody:

What really sticks out for me with some of these newer Search versions, is that they use a ton of memory. Click on the Search box and it immediately consumes 120+ MB of memory on my machine.

I did a little digging around I think I figured out why … the entire search box is now a web application built with JavaScript & React. This of course means that some kind of web rendering engine is required … it’s probably Edge.

Further exploration put the pieces together:

The search box on the Task Bar, and in Windows Explorer, both load C:WindowsSystemAppsMicrosoft.Windows.Search_(version)SearchApp.exe when you click on them. Only the UI is different.

As he pushed on his system, he triggered a compilation error (screenshot).

search javascript error Woody Leonhard/IDG

Which sure looks like a JavaScript smoking gun to me. @warrenrumak concludes:

JavaScript is used to render the filtered search results. No wonder it’s so buggy … that’s way too much unnecessary technology to render a drop-down list. 

Which brings me around to the question we’ve all been asking for the past few months: What’s wrong with Search in Win10 version 1909? @warrenrumak has a theory that sure rings true with me:

There is a lot of evidence in the JavaScript source to suggest that it was built by the Bing team. If I had to guess, I’d say that what happened here was that the desktop search experience was moved from the Windows team to the Bing web team, and they just don’t have the skills to build desktop programs with efficient C++.

And, it looks like there is a mechanism to update the JavaScript code from a remote server, without actually upgrading the Search application itself.

Maybe this also explains why the bugs with the new Windows Explorer search bar haven’t been acknowledged by the Windows team … could very well be that the Windows team doesn’t even own that code anymore!

We still haven’t resolved the question of what triggers a change in the text down in the Search box. Since writing about this two days ago, Howard Goldberg has extended the list of observed Search default texts:

  • Type here to search (vast majority, at least so it seems)
  • Search the web and PC (at least one from the original post)
  • Start your search (at least 1 confirmed with screenshot)
  • Start a Web Search (at least 3 confirmed)
  • Search (at least one confirmed with screenshot)

As for the black Search box, Goldberg has two different Win10 1909 systems, one of which works:

I went through both of my Win10 systems. … Cortana and Search settings are all configured identifically.

On one system, search is still ‘working.’ On my other system, it’s blank.

An anonymous poster now says that disabling Bing in Win10 Search, followed by a reboot, fixed the problem.

Whatever happened, it’s an unholy mess — and it’s being pushed without notification, without permission. Where’s the Windows team on all of this? Oh. That’s right. There isn’t a Windows team anymore.

Breaking Windows as a Service …

Catch the latest on

Copyright © 2020 IDG Communications, Inc.

Source link

The ‘optional, non-security’ update for Win10 version 1909, KB 4532695, runs zero for two

Last week Microsoft released KB 4532695, a dual-purpose Win10 version 1903 and 1909 “optional, non-security, C/D Week” patch. Most of us expected a fix for the File Explorer Search bar bugs that have been described and dissected (but not officially acknowledged) for more than two months

I, personally, also held out hope that Microsoft would fix yet another bug in the Internet Explorer JScript engine that warranted a Security Advisory in January. Yes, I know that the “optional, non-security” patches aren’t supposed to fix security holes, but … hope springs eternal.

On the File Explorer Search bugs: Windows guru Rafael Rivera tweeted shortly after the patch hit:

Unfortunately, it’s still a crummy experience. For example, it takes two clicks at times to reset the caret position, stopping you dead in your tracks. Search box continues to be a façade that can’t be right-clicked until it’s activated (e.g. via left-click). Advanced Query Syntax keywords, operators, and filters are no longer highlighted in blue, either. And deleting items didn’t make it in. I doubt we’ll see that get serviced; we’ll likely have to wait for 20H1 release [Win10 version 2004] to get that [feature].

Mayank Parmar, on Windows Latest, says:

Microsoft has yet to acknowledge the new problems with Explorer and there don’t appear to be any workarounds. If you have installed Windows 10 November 2019 Update [version 1909], you have to accept the possibility of experiencing issues with File Explorer and Control Panel.

As best I can tell, Microsoft has never acknowledged the bugs, in spite of fixing them in a series of updates for the still-in-beta Win10 version 2004. They aren’t mentioned on the Release Information Status page.

On the JScript fix, I initially said that KB 4532695 changes the jscript.dll file that’s at the center of the numerous security holes, and hoped that it fixed this latest JScript bug. My hopes were dashed when Mitja Kolsek, of 0patch fame, tweeted:

We tested it and KB4532695 does NOT modify jscript.dll. It does modify mshtml.dll (which we micropatched) but not in a way that would prevent jscript.dll from getting loaded. So it’s really unlikely that this KB does anything for CVE-2020-0674.

Zero for two.

KB 4532695 has drawn lots (and lots!) of fire in the press for putting “Millions” of Win10 users at risk for blue screens. From what I’ve seen, it’s not considerably worse than most “optional, non-security” Win10 patches — but it’s undeniably having lots and lots of installation problems

Fortunately, you’ll only get the patch if you download and install it manually, or if you get suckered into clicking “Download and install now” on an Optional updates available notification.

We’re watching you, KB 4532695, on

Copyright © 2020 IDG Communications, Inc.

Source link