|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
ISSUE 20.23 • 2023-06-05 PATCH WATCH By Susan Bradley I grew up on television shows such as Bewitched, in which Samantha, the character played by Eliz
[See the full post at: Can we control the changes to our operating systems?]
Susan Bradley Patch Lady/Prudent patcher
With these settings in place, you can defer rolled-out changes …
They’re deferred by default anyway for all managed devices (not configured having the same effect as disabled), and for everyone else they’re controlled by an easier windows update setting “Get the latest updates as soon as they’re available” (which is also off by default).
How you can configure the policy
By default, all features introduced via servicing that are behind the commercial control will be off for Windows-Update-managed devices.
…
If you choose not to enable this new control, the features behind it will be automatically turned on when a device updates to the next annual feature update.
P.S. This policy is only supported by Windows 11 version 22H2 which you still recommend should not be deployed by anyone.
My grandfather used to have “moments,” when he was lucid. Susan’s excellent article reminded me of him today. We never knew from moment to moment whether he was going to have a good day or a bad day.
Windows is more like that than not. Again, in my opinion, the average home user is going to abandon the PC because of these “moments.” Let’s look at a brief comparison between the average person using a PC or let’s say an IPad.
The IPad user turns on their machine and a little icon lets them know their is an update. They look at it, read what it “supposedly” does and can implement it at their leisure – or not. If they leave their machine on, it will not update without them.
Average user leaves their PC on. Wakes up to find it at the home screen telling you updates have taken place – but not what they really did in any meaningful way. They log into the program they use and it no longer works or they get a popup saying “Windows has enabled a security feature to protect you.” Yup, they’ve protected you from using your program and now you will spend some quality time “fixing” your computer.
Before the attacks begin. Yes, there are a hundred ways to prevent this scenario. None of them are realistic for people who only use Windows to get some basic programs. None of them are going to edit their registry, or install extra programs, or read multiple blogs. They are going to make a useability study, curse windows and buy a tablet.
Maybe it’s just the era we live in, but between the constant battle with viruses, adware, exploits, unsupported hardware (and manufacturers who are shipping broken hardware [Asus/Nvidia etc.]) Soon the homebuilt PC will be dead or dying and many will be looking at Linux or an alternative.
Me personally. I’m going a different route. Perhaps once every six to eight months I’ll look and see if I want to update. Until then I’ll just batch an image file and run a restore once a week until it’s time to make changes.
Building PCs and cars was something I did in my teens back in the 70s. Gave up the cars a decade back. Guess it’s the PCs turn.
Not all the moments are deferred by default for businesses-only some are controllable.
Home sku can’t control these by not receiving preview updates, previews are previews. Finally people are buying 22H2 and this is a heads up piece even if you don’t have 22H2.
Bottom line these moments are not as controllable as we thought they would be.
Susan Bradley Patch Lady/Prudent patcher
Although they are “off by default”, best practices, at least when following CIS guidelines, still typically set defaults to specific enabled/disabled, since you never know when someone at Microsoft may decide the default of “enabled by default” is now the norm. Of course, YMMV.
Microsoft calls them “moments,” little releases that make small changes in the operating system.
“Moments” are a Windows 11 implementation.
“Moments” are a Windows 11 implementation.
All of this makes me want more and more to stay away from Window 11.
Microsoft calls them “moments,” little releases that make small changes in the operating system.
“Moments” are a Windows 11 implementation.
Are you sure you didn’t mean ‘aberration’? 🙂
Building PCs and cars was something I did in my teens back in the 70s. Gave up the cars a decade back. Guess it’s the PCs turn.
I feel the same, more or less. When I finally moved to Windows 10 I just gave up on its ‘Windows Update’ shenanigans after just a few months… so just opted out completely and have stayed out since.
My current daily workhorse is still on Windows 10 Pro 1809 (although my other devices are on 22H2, no updates whatsoever [except Defender definitions] unless I decide so). I’ve been meaning to wipe it and clean install a newer version forever… but life gets in the way every time. It just works consistently… and that’s all I want.
I’ve dabbled with macOS and Linux on other devices for many years but they involve learning new stuff. At my time of life I can’t really be bothered with this… so I tend to use the stuff I just know intuitively.
I just want an OS that works for me, not the other way around.
I can’t stand having an OS that needs constant IV drip-feeding like it’s on life support. I’m a ‘user’, not a ‘medic’.
I was an Army medic and I’d triage Windows 11 as DOA with a DNR. 🙂
The short answer is: NOT ANY LONGER. I have been using MS OSs since DOS 3 and I can say with certainty that Microsoft’s offerings, IMHO of course, have always been sub-standard and problematic. Even in the DOS days other OSs such as DR DOS ran circles around MS DOS (and was multi-user).
The best OS I ever used was IBM’s OS/2. MS Win wasn’t even in the same class as OS/2Warp4. Internal politics (thanks Lou Gerstner) got OS/2 out of the picture. Let’s skip the pitiful Win95 and Win98. Win2000 was passable but that was mostly IBM’s work to save MS’s bacon re Y2K. But now, Win10-11, are a whole new ballgame.
Under the guise of “security” Win 10 took things to a new level of hubris. Microsoft knows what you should do and how you should do it and if you don’t like it, well… When first transitioning to Win 10 Defender showed it’s ugly side by deleting (without warning or asking permission) any file it deemed a no-no. That happened to be some older .mdb files that contained customer information. If any usb or other storage held that file it was erased, too. I mean, who paid for the hardware and exorbitant licensing fee?
Two other machines have Linux and the difference in all facets of an OS between Linux and Win are too extensive to recount here. Unfortunately one of our Win10 machines is 32 bit, now verboten. Under moderate usage it routinely spits out “not enough memory to xxx” All standard resources that I can think of, swap, desktop heap size, cache size, etc. don’t help. The only remedy is a reboot – about once a day. Meanwhile the Linux machines will run literally indefinitely problem free AND don’t require defragging, which Win 10 needs too often.
Am I just touchy? Or does anyone else have issues with MS’ attitude and performance?
You are one of the few lucky people, then. If you HAVE to use Windows, then you will have to deal with a myriad of issues. MS is, if nothing else, a marketing company. All of their focus is on forcing the use of THEIR products and software. Think back to things like IE and such. We have to use Windows here because of that, with many programs that only run in the Win environment and cannot be run in things like WINE.
As each Win OS was forced on users, please advise on how the upgrades went? Easy path? Hardly. Why, even back in the days of DOS one had to use SETVER to continue to run previous software that MS said was incompatible with the new version — a lie, obviously. It’s only gotten worse, IMO.
It’s funny that you start out describing the experience of installing Service Pack 2 for XP, because that was the point I stopped trusting Windows to install anything correctly on its own. It was also the last time I used any form of Windows System Restore.
When it first came out, I did the in-place update for SP2. Huge mistake. Immediately upon completion, every Microsoft-branded program would immediately bluescreen my computer. Office, Works, even Microsoft Flight Simulator. It was all dead in the water.
So, I bought a secondary internal drive, backed everything up to it, and then did a fresh install. The internal drive was my second huge mistake. I should have used an external. Upon reinstall, I began restoring my files, and hit a weird snag where a driver didn’t install correctly. No big deal, I restored the system back an hour. Except the System Restore had an aneurism, and decided that my secondary internal drive was a potential cause of the problem. It then systematically deleted every single .exe, .bat, .dll, .cfg, etc. from the drive. At the time, this drive contained every single piece of media and graphics work I had been working on for the past few years. The only thing that prevented me from having a nervous breakdown was that it didn’t delete media files like images, audio, and video, which was what my work consisted of.
To this day, I do not know what happened. I spent four hours on the phone with Microsoft techs being shuffled between departments trying to diagnose the issue, ending with a top level tech whose only answer was to completely deny that what had happened was possible, at which point I screamed into the phone and hung up.
Fast-forward to the modern day, and we seem to have just accepted the in-place upgrade as the recommended best practice. That idea still makes my brain scream. Since that XP disaster, my “upgrade” process mutated into a yearly full back-up and fresh install of Windows, at which point I would install that year’s worth of updates. Updating a fresh install seemed to be the only way to stop it from breaking things (or at least make it a quick process to reformat if it failed).
At least, that’s what I did through Win7. At this point? I’ve just decided that whatever version of Windows my computer comes with, that is what it will die on, unless there is such a catastrophic failure that I need a fresh install. If it comes out of the box in a working configuration, I would rather not mess with it. The insane churn of terrible new features, broken drivers, and retrogressed functionality has made the risk of an outdated system feel much less severe than the risk of installing all of the new garbage. I keep an eye out for critical vulnerability updates, and other severe things of that nature, but I want Microsoft to stop mucking with Windows, and leave me a computer that functions consistently.
It’s interesting to consider, in retrospect. I got my first computer in high school, in 2001. Over the last two decades, the overwhelming majority of problems I have had with Windows computers were all caused by trying to update Windows.
Or does anyone else have issues with MS’ attitude and performance?
Yes, I have issues with MS’ attitude and performance.
I spent years working with Windows OS’s, moving from version to version (in an environment of 6k+ hardware installations) where IT teams were sent on MS upgrade courses at phenomenal cost to our organisation – £3.5k per seat.)
I learned direct from imported Microsofties… and my head spun as I tried to prepare for each day’s new syllabus. They travelled in the early hours of each morning in minibuses from Reading to Bristol every day… and back again, day after day. They were open, honest, direct and – if they couldn’t answer a question – came back the very next morning with an answer. I’ll admit, I bought into the MS cool aid at the time ‘cos they were so… evangelical.
Fast forward from the transitions from XP to Windows 7 (don’t mention Vista) to the very fraught corporate decision to also bypass Windows 8… and the end of our former cosy corporate relationship with Microsoft. Everything changed. Communication just died… somehow we – corporate IT – appeared to become some sort of enemy.
Instead of call backs we were directed to documentation. Instead of named contacts we were asked to post questions to, I don’t know, a kind of resource pool. Our personal relationships with Microsofties just… died, absolutely completely. We no longer existed and they were no longer available to us… we were diverted to URLs, not people.
Have you ever suddenly been asked to work in a complete vacuum, not knowing from one day to the next how best to proceed with no direction at all? Whilst being asked how to transition a local government’s hardware from one OS to another? (Whilst fending off suggestions to follow Munich’s choice to go Linux at the time?)
I guess the lawyers may have taken over but, in corporate IT, we were left in a vacuum. The message was clear… if you want to move on from Windows 7 with support from Microsoft then you need to behave.
I was only a Senior IT officer then, downgraded from my much-higher graded former position before corporate IT ravaged its weaker outliers. Whatever.
I was lucky… I was offered – and took – early retirement, utterly dispirited. Many of my colleagues at the time took the same route. We just couldn’t work without either effective tools or trust. It was bad… so I left. I felt burnt out.
There you have it… my own personal reasons for no longer liking Microsoft. IMO it’s not to be trusted. YMMV.
One only has to use a current distro of Linux to see what competent OS programming is like. Updates? Piece of cake. Upgrade to newer version? Piece of cake. Why, if you want you can even modify and compile your own kernel if you need something not mainstream. Linux repositories are loaded with tons of open source software for free. Some of it is really excellent.
And you DO have control of your operating system.
Agree, I made the switch to Linux Mint (LTS 21.1 Cinnamon) little over 5 months ago now. Rock solid system that works very well out of the box with no need for third party tools or tricks to try to prevent changes or control updates. Instead the system is designed to respect your settings and stays out of your way and does not attempt to change anything unless you initiate it yourself. It also does not attempt to monetize you in any way like Microsoft is constantly trying to do now.
For Windows specific software that is still needed I set up Windows 8.1 Pro as a virtual machine via Virtualbox (had a spare license to maintain full functionality of everything). It works very well and has no discernible performance impact on the Linux Mint host running it. It’s also a much more secure option than using Wine as it completely isolates the virtual machine from the host operating system. Whereas Wine has access to the Linux file system and can be a potential security risk.
Anyway, other than the VM of 8.1 I’m done with Microsoft on my personal systems. IMHO they have lost the plot of what an operating system is supposed to be!
“I’ve tried Linux a number of times with different distros. I’ve programmed (using C) in Linux. I don’t care for Linux because it won’t run some of my software.”
Carefully orchestrated by MS. That was the way they battled with IBM’s OS/2. Continual changes to WIn32S to stymie compatibility.
“That is my experience with Windows, all the way from 7 Ultimate to Windows 11 Pro; piece of cake. Always updates/upgrades, never a clean install for my daily driver desktop.”
How was your upgrade from XP to Win 7? Even if you could pull it off the resulting “new” OS needed re-installs of most programs, but you had to do a ground up. This machine unfortunately was set up with Win10 32-bit. It has many programs and settings done over time. Best obviously would be migrating to Win 10 64-bit. Clean install time. Days of time to re-install, tailor, tweak, etc. And, oops, no driver for this, that of the other.
“I have no need to modify the kernel, but I can easily modify the UI and get rid of the Special Folders, etc. that I neither need nor want.”
Fine, but you could if need be. MS is all proprietary and you are not doing anything that you might need. In Linux all is open for modification. If you can’t do it yourself there is an army of people who can do it for you.
When MS was transitioning to 32 bit, they faked a lot. I still have an article describing how their server offerings still had 16 bit dlls cobbled to run with a “thunk” layer as translation even though they claimed being 32-bit systems. Crashes and poor performance was the result.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
