Confused with Susan Bradley’s 12/27/2022 update re: hidparse.sys file

Topic

New Reply

[hmw3]

I have Windows 10 21H2 (installed 12/29/2021) and recently updated with KB5019959 on Dec. 4, 2022.

In her 12/27 column, she said: “Specifically compare the files located in c:\windows\System32\drivers file to the hidparse.sys file located in c:\System32 folder”.

I have hidparse.sys in c:\windows\System32\drivers file, but there is NO  c:\System32 in Windows 10. Does she mean look in c:\windows\System32 instead?

If so, then I do NOT have a hidparse.sys file there. If that is what she means, then I assume that I can safely install the December Windows 10 updates.

Harry Ward

• This topic was modified 5 months ago by hmw3.

2 users thanked author for this post.

Microfix, Fred

Reply | Quote

Replies

Please follow https://www.askwoody.com/forums/topic/several-windows-10-versions-affected-by-blue-screen-issue/.

It seems that you need hidparse.sys version 10.0.19041.2251 in both locations c:\windows\System32\drivers and c:\windows\System32 to safely install KB5021233

1 user thanked author for this post.

Fred

Reply | Quote

Strange,

I installed the December updates yesterday without problem and checked this morning for hidparse.sys.

It is only present in c:\windows\System32\drivers (and the driver repository), and not in c:\windows\System32.

Does this mean that installation of KB5021233 deletes the copy in c:\windows\System32?

Or, if not, can it be deleted in c:\windows\System32 before installation?

Dell Inspiron 7580 i7 16GB Win 10 pro 22H2 (19045.2728), Microsoft 365 Version 2302 (16130.20332)

Reply | Quote

I am running W10 v 22H2. The hidparse.sys file was present in both locations before installation of KB5021233 and they are still present in both locations after installation.

Reply | Quote

I also read the thread and it seems there is more than one poster who only had it in the C:\Windows\System32\drivers folder and installed KB5021233  successfully. I also only have it in the drivers folder on my WIN10 21H2 and feel pretty confident in installing after my WU pause comes off on Jan 6.

Reply | Quote

You can have only one copy.

Bottom line, if it’s in both locations, it needs to match.

C:\Windows\System32

C:\Windows\System32\drivers

As Alejr says – don’t delete if you have them in both places.  If they do not match, defer the update and wait for MS to take action.

Susan Bradley Patch Lady

3 users thanked author for this post.

jleggett81, cmacrun, Specialist17

Reply | Quote

Alex5723 wrote:

It seems that you need hidparse.sys version 10.0.19041.2251 in both locations c:\windows\System32\drivers and c:\windows\System32 to safely install KB5021233

That’s not the understanding I got from reading the complete thread and KB5021233 just installed without issue in a Win10 22H2 VM that only had hidparse.sys in the C:\Windows\System32\drivers folder.

Reply | Quote

KB5021233 installed on my Windows 10 Pro 22H2 with hidparse.sys in both folders.

Reply | Quote

The understanding that I came away with was that the update could install successfully if hidparse.sys was only present in the drivers subfolder or identical copies were present in that folder and the system32 folder

Reply | Quote

Alex5723 wrote:

It seems that you need hidparse.sys version 10.0.19041.2251 in both locations c:\windows\System32\drivers and c:\windows\System32 to safely install KB5021233

This statement is not true!

Here’s how it really works…

Prior to installing KB5021233:

If your particular system has hidparse.sys in both locations…

It appears they both need to be version 10.0.19041.2251 for the update to succeed without causing a BSOD.

If your particular system only has one copy of hidparse.sys in C:\Windows\System32\drivers…

It appears the update will succeed with no problems.

Please see my Dec 26 post #2511713 for a batch file you can run to determine whether your system does or does not have a duplicate and, if so, what versions they are.

John wrote:

Does this mean that installation of KB5021233 deletes the copy in c:\windows\System32?

As has been pointed out by other users who’ve installed it with duplicate hidparse.sys files, the update does not delete the one in C:\Windows\System32.

John wrote:

Or, if not, can it be deleted in c:\windows\System32 before installation?

NO!

Microsoft’s workaround instructions “very clearly” warn doing that will cause the BSOD problem!

10 users thanked author for this post.

Specialist17, KP, DrBonzo, PDX5802, opti1, WCHS, geekdom, John, EricB, NaNoNyMouse

Reply | Quote

If hidparse.sys is in both locations, why not just copy the version… 2251, into both locations? From what I have read, the files will not be “touched” by widows and all should be good. Then apply the update. I only had this file in one location on my PCs and it wasn’t “touched”. Am I missing something?

Reply | Quote

sheldon wrote:

If hidparse.sys is in both locations, why not just copy the version… 2251 into both locations? Am I missing something?

Yes, Sheldon, you may very well be missing something. In a post on one of the other threads about this topic, before things got too “hairy”, @alejr explained that the “copy” command doesn’t copy ALL of a file’s information from one place to another, it just copies the basics. His post can be found here, specifically look at the very last paragraph.

Because of that possibly very critical difference, I don’t believe that you can successfully just copy the version of the file in the \drivers subdirectory to the \system32 directory by simply dragging it from one window to another using Windows Explorer/File Explorer/the GUI. Unless I’m mistaken*, that operation only duplicates the command line’s “copy” command.

*= MVPs/Managers please feel free to correct that last sentence if necessary!

Now, all we need is a definitive answer if we can just use the “xcopy” command syntax as spelled out by Microsoft before we install KB5021233, provided we find that we have a version mismatch in the two file locations of concern.

Reply | Quote

Bob99 wrote:

Because of that possibly very critical difference, I don’t believe that you can successfully just copy the version of the file in the \drivers subdirectory to the \system32 directory by simply dragging it from one window to another using Windows Explorer/File Explorer/the GUI. Unless I’m mistaken*, that operation only duplicates the command line’s “copy” command.

Please DO NOT drag the file anywhere. If you use “drag and drop” on the same drive, it will MOVE the file to the destination instead of copying it. It will remove it from the \drivers subdirectory and put it in the \system32 directory.

2 users thanked author for this post.

redMagna, Bob99

Reply | Quote

PKCano wrote:

Please DO NOT drag the file anywhere. If you use “drag and drop” on the same drive, it will MOVE the file to the destination instead of copying it. It will remove it from the \drivers subdirectory and put it in the \system32 directory.

Touché!  😉

Sorry that I forgot to mention that VERY important distinction.  😳

Reply | Quote

sheldon wrote:

If hidparse.sys is in both locations, why not just copy the version… 2251 into both locations?

Do you mean “if hidparse.sys is supposed to be in the \drivers location but is only in the System32 location, why not just xcopy the version… 2251 into the \drivers location, in advance of downloading and installing KB5021233?

I ask this because, according to @alejr in #2512313 (above), you are OK if the .2251 is:
a) in both locations: \System32\drivers AND \System32 (same version, same timestamp, i.e., they match)
b) only in one location: \System32\drivers

you might not be OK, if .2251 is:
a) only in \System32

So, if you *xcopied it in advance, would you be OK?

*See @Alejr’s proper ‘xcopy’ command and why ‘xcopy’ and not ‘copy’

Reply | Quote

@WCHS (and others)-

Please read this latest post from @cyberSAR in the “original” thread. It could be that the file version doesn’t need to be the latest one after all! The single most critical thing might be that if you have the file in both locations under scrutiny, the file versions just need to match exactly.

Reply | Quote

@Bob99
Thanks for this latest post in this specific thread. It’s hard to keep up because the conversation about the issue is in more than one thread.

I do wonder about what “match” means. Does it mean “matching in version and timestamp” (no matter the version)? Or are there more attributes than these two that constitute the “matching” criterion?

Reply | Quote

By “match”, I do indeed mean match the version number down to the last digit and I would think that time would also match as well.

Other criteria that may need to be met are an exact match in terms of the file’s access control list that helps determine who or which accounts have what type of access to a given file. This, along with other attributes that the xcopy command helps copy over from one point to another, is why Microsoft specified that command in their mitigation measure.

Reply | Quote

“Copy files and/or directory trees to another folder. XCOPY is similar to the COPY command except that it has additional switches to specify both the source and destination in detail.
XCOPY is particularly useful when copying files from CDROM to a hard drive, as it will automatically remove the read-only attribute.”

http://users.encs.concordia.ca/~bcdesai/course/commands/nt/xcopy.html

Also I thought that this update will “update” the version of hidparse.sys, but only in the “drivers” directory. That’s why I thought that if a PC has 2 copies of hidparse.sys and they weren’t up to date, then copying the correct version to the 2  locations prior to starting the update will prevent BSOD. Just a thought.

1 user thanked author for this post.

WCHS

Reply | Quote

sheldon wrote:

Also I thought that this update will “update” the version of hidparse.sys,

Thanks for explaining your thinking.
Based on what I’ve read in the various threads about this issue, the update does not change the version of hidparse.sys — i.e., in both locations (and matching) or only in one (=\System32\drivers), it’s still the same hidparse.sys from some previous month’s Tuesday CU. Maybe, it does some checking, but it doesn’t change the version (or anything else that anyone can tell).

Reply | Quote

Interesting – I guess I thought differently, but there is so much confusion. I thought I read that the hidparse.sys at “drivers” was updated at the end of the update and that is where the mismatch occurred. If the two “hidparse.sys” are different versions prior to the update, why isn’t the OS producing BSODs then? Why only after the update?

Reply | Quote

sheldon wrote:

Also I thought that this {my emphasis} update will “update” the version of hidparse.sys

sheldon wrote:

I thought I read that the hidparse.sys at “drivers” was updated at the end of the update and that is where the mismatch occurred.

From what I’ve read about “this” update (i.e., Dec’s KB5021233):
Post 2511113, where @Alejr says he has one hidparse.sys in the “supposed to be” location on his 22H2 system and that Dec’s CU KB5021233 did not change it. It has the version and date of the Nov CU.

Post 2511218, where @Alex5723 says that he has the two hidparse.sys files (confirmed by
post 2511325) on his 22H2 system and that Dec’s KB did not change them. The two files have the version and date of the Nov CU.

I don’t think running Dec’s update on a 21H2 system would change these statements.

I haven’t seen any post about Dec’s update that says that the version-properties of the hidparse.sys file (in the “supposed to be location”) or files (in both locations) had been changed to Dec’s version as a consequence of installing this update.

However, when the Nov CU update was installed, the hidparse.sys file(s) DID acquire the version-properties of the Nov CU and the date/time on which that CU was installed.

So, some monthly CUs will NOT change the version-properties of hidparse.sys and some monthly CUs WILL.

Reply | Quote

But, if the two “hidparse.sys”s are different versions prior to the update, why isn’t the OS producing BSODs then? Why only after the update?”

Reply | Quote

The version of hidparse.sys on unaffected systems is version 10.0.19041.2251 which tracks to November security updates.

Susan Bradley Patch Lady

2 users thanked author for this post.

sheldon, WCHS

Reply | Quote

And the version on infected systems is different?

Reply | Quote

sheldon wrote:

And the version on infected systems is different?

You mean “affected systems”, right?

1 user thanked author for this post.

geekdom

Reply | Quote

yes bad choice of words

Reply | Quote

KB5021233 installed without issue (including one obligatory restart, and one more for luck) on my Windows 10 Pro 22H2, with hidparse.sys existing only in my c:\windows\System32\drivers folder prior to the install. YMMV

2 users thanked author for this post.

John, DrBonzo

Reply | Quote

sheldon wrote:

If hidparse.sys is in both locations, why not just copy the version ….2251 into both locations?…Am I missing something?

@Bob99
Looks like this post beat me to the draw (see my post at #2512809, which notes the need for ‘xcopy’ instead of ‘copy’) — You might have seen this post before I did some editing, added highlighting, and added links, but there’s still a problem with the question because it asks “if hidparse.sys is in both locations.”

I think the OP means “if hidparse.sys is in only one location (where one location=\System32)” instead of “if hidparse.sys is in both locations”.

So, I think a two-part question still remains: not only “Why not xcopy hidparse.sys into \System32\drivers” but also “why not do it in advance of downloading and installing KB5021233”?

Reply | Quote

It sounds to me as if you might be overthinking things a bit. I’m not about to speak for @sheldon, so we may have to wait for an exact answer to your question.

Reply | Quote

Bob99 wrote:

It sounds to meas if you might be overthinking things a bit.

If the OP was not implying “in advance of downloading and installing the update”, I’d like to ask that question right here in this post. It makes sense to me that one could do the xcopy beforehand and head off a BSOD that might otherwise happen. But, I don’t know enough about what goes on behind the scenes of downloading, installing, restarting, and whatever else goes on between “after-the-download” and “getting-the-login-screen-after-an-update’s-business-is finished”.

Reply | Quote

Just compare to see if you have matching files in both directories or only the one file. If they match there will be no issue. If there is only one, there will be no issue.

Susan Bradley Patch Lady

Reply | Quote

Susan Bradley wrote:

Just compare to see if you have matching files in both directories or only the one file. If they match there will be no issue. If there is only one, there will be no issue.

But, if you DO NOT have matching files, can you “head the problem off at the pass” by doing the xcopy — to make them match — BEFORE you do the update?

4 users thanked author for this post.

redMagna, sheldon, NaNoNyMouse, Alex5723

Reply | Quote

WCHS wrote:

But, if you DO NOT have matching files, can you “head the problem off at the pass” by doing the xcopy — to make them match — BEFORE you do the update?

That question is something only Microsoft can answer and they have not done so!

To date, their only guidance to mitigate the problem is to xcopy hidparse from C:\Windows\System32\drivers to C:\Windows\System32 after you experience the BSOD.

They have not suggested you should xcopy hidparse.sys from ↔ to anywhere “before” installing the update.

In fact, the last line of their “official” workaround states:

Important It is not recommended to follow any other workaround than those recommended above. We do not recommend deleting the hidparse.sys from your Windows\System32 folder.

2 users thanked author for this post.

KP, WCHS

Reply | Quote

Wow, I went looking for a simple answer to “hidparse.sys file” and did not expect to see all of these comments.

I have a Dell laptop running Win 10 Pro, 21H2. I do not have a C:\System32 folder on my machine and do have C:\Windows\System32\drivers\ folder containing the file  hidparse.sys. I am following Susan’s simple repeated advice – only one hidparse.sys then OK to install December updates.

bsqrd

Reply | Quote

@bsqrd, you need to look in c:\windows\system32, and NOT c:\system32.

Check in there before installing please.

Dell Inspiron 7580 i7 16GB Win 10 pro 22H2 (19045.2728), Microsoft 365 Version 2302 (16130.20332)

2 users thanked author for this post.

Microfix, geekdom

Reply | Quote

John, thanks for the comment.

I have re-read Susan’s Master Patch List. What I see are two folders mentioned.

C:\Windows\System32\drivers,  this is the one with my hidparse.sys file.

C:\Systems 32, this does not exist on my machine.

Any comments?

bsqrd

1 user thanked author for this post.

Microfix

Reply | Quote

bsqrd wrote:

C:\Systems 32, this does not exist on my machine.

C:\Windows\System32

Read this post and the thread for more information:
https://www.askwoody.com/forums/topic/confused-with-susan-bradleys-12-27-2022-update-re-hidparse-sys-file/#post-2512313

Also read this post:
https://www.askwoody.com/forums/topic/confused-with-susan-bradleys-12-27-2022-update-re-hidparse-sys-file/#post-2512991

Carpe Diem {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1778 x64 i5-9400 RAM16GB HDD Firefox114.0b8 MicrosoftDefender

1 user thanked author for this post.

Microfix

Reply | Quote

@bsqrd Looks like that’s a typo in the Master Patch List summary

@geekdom has posted the correct location above

MASTER PATCH LIST SUMMARY HAS NOW BEEN CORRECTED 🙂

Keeping IT Lean, Clean and Mean!

Reply | Quote

@Microfix (and others) “Looks like a typo in the Master Patch List”

Thanks for your input. However all my comments in this thread are based on my reading of ‘Master Patch List Status of 12/27/2022’ which I made a screenprint of on 03 January 2023. I used this to make my checks and have repeated them several times since when checking other responders comments. This print matches your link MASTER PATCH SUMMARY and the entry in Master Patch List this morning. Any error  corrected was before my checks and would not influence my decision.

bsqrd

Reply | Quote

@Microfix ( and others) I owe you an apology. I noticed traffic on this thread had gone quiet so I went back to Master Patch List and now see there has been a revision since I last looked at it and made a screen print on 3 Jan 1130am.

I now see the change and I was incorrect making my earlier comments in #2514669  where I said my earlier screenprint matched your link in #2514404.

I have checked my C:\Windows\System32 folder and happy to see it does not contain the hidparse.sys file. Since I only have 1  location of the file I see this as a go ahead to do my December updates.

Thanks

Reply | Quote