• The latest KB blocklist

    Several of you post lists of “bad” Windows patches – the idea being that if you install all of the offered patches except for these bad ones on the blocklist, you’ll be minimizing Microsoft’s ongoing intrusion into your Win7 and 8.1 machines.

    There are two short lists that have appeared recently that are well worth considering. NotReallyBob offers this:

    KB3035583 = GWX
    KB3123862 = GWX helper
    KB3173040 = Full screen windows 10 ad
    KB3163589 = Full screen windows 10 ad (8.0 and 7 SP0)
    KB3022345 = telemetry
    KB3068708 = telemetry
    KB3080149 = telemetry
    KB3075249 = telemetry (consent)
    KB3090045 = GWX (reserved devices)
    KB3150513 = GWX (compatibility update)

    7 only:
    KB2952664 = GWX (compatibility update)
    KB3021917 = telemetry (imaginary performance improvements)
    KB2977759 = GWX (compatibility update)
    KB3081954 = telemetry

    8.x only:

    KB2976978 = GWX (compatibility update, superseded, tough to remove from win 8.1 U3 clean install)
    KB3072318 = GWX (OOBE)

    And ch100 counters with a much shorter list, for Win7 only:

    Kb3021917 – not sure how harmful it is, can be skipped safely though
    KB3150513 – not offered if KB2952664 is not installed

    With serious props to Noel Carboni and Windozxpert for supporting material.

    I have not recommend blocklists in the past, but these two lists are well worth considering. I’m toying with the idea of changing the MS-DEFCON system so I no longer install security patches only. With the end of Get Windows 10 coming later this month, it may be time to give non-security patches a chance.

    Just so you understand: I still recommend that you only install security patches on Win7 and 8.1 systems, but the next time MS-DEFCON 3 rolls around, I may change my tune.

    Comments/KB lists most welcome – or just tell me that I’d be making your life too complicated if I changed to a blocklist approach….