Installing Win updates on Win 7 or 8.1 computers with Kaby Lake or Ryzen CPUs

[MrBrian]

Here is my summary of radosuaf’s method for installing Windows updates on Windows 7 or 8.1 computers with Kaby Lake or Ryzen CPUs:

Steps that should be done when you wish to manually install updates with Windows Update or standalone Windows update file(s):

(Note: The recent Shadow Brokers code dump has made it clear how important it is to always have the patch for MS17-010 applied.)

 

Group A:

1. (This step should need to be done only once.) Uninstall all security-only updates (from October 2016 and later) except for the March 2017 security-only update (if it’s installed), and then reboot if asked to. To see a list that includes all of the security-only update knowledge base numbers, see https://www.askwoody.com/forums/topic/2000003-ongoing-list-of-group-b-monthly-updates-for-win7-and-8-1/.

2. If a monthly rollup from April 2017 or later is installed, or a preview monthly rollup from March 2017 or later is installed, uninstall it and reboot if asked to.

3. Repeat step 2 as many times as needed.

4. (This step should need to be done only once.) Install the March 2017 security-only update if it’s not already installed. Reboot if asked to. For links to this update, see https://www.askwoody.com/forums/topic/2000003-ongoing-list-of-group-b-monthly-updates-for-win7-and-8-1/.

5. Install all desired update(s) except monthly rollups or security-only updates. Reboot if asked to.

6. Install the desired monthly rollup. Reboot if asked to.

 

Group B:

1. Uninstall the security-only updates that have the “lock” and then reboot if asked to. As of June 2017, these security-only updates have the “lock”: April 2017 and June 2017.

2. Install all desired updates except for security-only updates that have the “lock,” and reboot if asked to.

3. Install the security-only update(s) that you uninstalled in step 1, rebooting only after the final update that you installed.

4 users thanked author for this post.

walker, HiFlyer, Pim, radosuaf

Reply | Quote

[PKCano]

abbodi86 wrote:

Can you test to see if dism /add-package with cab file works on blocked system? thanks

And MrBrian replied

MrBrian wrote:

Result: package successfully added ?

2 users thanked author for this post.

walker, MrBrian

Reply | Quote

[radosuaf]

Nice to know it works :). I’m on Skylake so that might apply to me since June or July as well. I’d just add a 1st point to set WU to “Never check for updates” – just to be sure :).

MSI H110 PC MATE * Intel Core i7-6700 * 2 x 8 GB Corsair Vengeance LPX DDR4 2133 MHz * Aorus Radeon RX 570 4GB * Samsung 840 EVO 250GB SSD * SanDisk Ultra 3D 1TB SSD * Western Digital Blue 1TB HDD * DVD RW Lite-ON iHAS 124 * Creative X-Fi XtremeGamer PCI * Windows 10 Pro 20H2 64-bit

Reply | Quote

[MrBrian]

A different method that might work for VirtualBox virtual machines: https://www.askwoody.com/forums/topic/for-you-testers-heres-how-to-spoof-a-kaby-lake-processor-inside-a-virtualbox-win7-vm/#post-108402. I’m still looking for feedback on whether it works or not.

Reply | Quote

[MrBrian]

I found a purported user report that this works: https://forums.virtualbox.org/viewtopic.php?f=2&t=82299#p390709.

Reply | Quote

[MrBrian]

There is some confusion about why I included step 3 in the Group A instructions. The reason is that after uninstalling a given monthly rollup, your computer might have an older monthly rollup that still is recent enough that it contains the CPU blocking code. Example: Suppose you installed the April 2017 monthly rollup in April, and the May 2017 monthly rollup in May. When you uninstall the May 2017 monthly rollup and reboot, the April 2017 monthly rollup may still be present.

Reply | Quote

[Volume Z]

Hi MrBrian,

how were you able to install the May Rollup with April’s CPU blocking in place? 🙂

Reply | Quote

[MrBrian]

Using the method in this topic (hopefully) :).

Reply | Quote

[Volume Z]

This means you uninstalled the April Rollup first. 🙂

Reply | Quote

[MrBrian]

Correct :).

Reply | Quote

[Volume Z]

But…then you don’t have April’s and May’s blocking installed – only May’s. 🙂

Reply | Quote

[MrBrian]

Correct :). And when it’s time to install the June 2017 updates, temporarily uninstall the May 2017 monthly rollup. And when it’s time to install the July 2017 updates….

Reply | Quote

[Volume Z]

Sure, but you’re never in the situation of having to remove two blocking rollups at once. 🙂

Reply | Quote

[MrBrian]

@Volume Z: For Group A, no. For Group B, in the future there might be more than one security-related update with the CPU blocking code, although there is only one at this time.

Reply | Quote

[Volume Z]

You can’t have several of those installed either, because the blockage won’t let you run the Standalone Installer. 🙂

Reply | Quote

[MrBrian]

True, but the code might not go into effect until a reboot, and before the reboot multiple CPU blocking updates can be installed.

Reply | Quote

[MrBrian]

Test results for May 2017 updates

Reply | Quote

[radosuaf]

New solution for the block if anybody’s interested – seems to solve the problem permanently :

https://github.com/zeffy/wufuc

MSI H110 PC MATE * Intel Core i7-6700 * 2 x 8 GB Corsair Vengeance LPX DDR4 2133 MHz * Aorus Radeon RX 570 4GB * Samsung 840 EVO 250GB SSD * SanDisk Ultra 3D 1TB SSD * Western Digital Blue 1TB HDD * DVD RW Lite-ON iHAS 124 * Creative X-Fi XtremeGamer PCI * Windows 10 Pro 20H2 64-bit

2 users thanked author for this post.

hitokage, Hugo

Reply | Quote

[MrBrian]

If anybody has an affected processor and also uses the Group B update strategy, please report if this method still works for the Group B June 2017 updates.

Reply | Quote

[anonymous]

@ch100

“Group B is wrong for you and for 99% of the users here, regardless of what they believe.”

You are presuming to know the capabilities, background, experience, motives and rationale of users who frequent these threads. Also, at least in my world (gray beards), one should be careful when professing such expertise.

Many people, for example, use Ultimate in their home office while using Enterprise/Edu SKUs in their data center(s) and that includes road warriors, IT contractors, etc. Others might value privacy above all else (and some people, including me, never use social media because of this.)

Edit for content
Please follow the –Lounge Rules– no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

Reply | Quote

[MrBrian]

This is a different method. It involves 1) extracting the files in a standalone .MSU Windows update 2) using dism command to install the .cab file extracted from the .MSU file.

If you want more info, I can supply more.

1 user thanked author for this post.

HiFlyer

Reply | Quote

[MrBrian]

More information about this alternative method: How to use DISM to install a hotfix from within Windows

1 user thanked author for this post.

HiFlyer

Reply | Quote

[walker]

@Mr. Brian:

I’m getting dizzy trying to keep up with all of the various instructions from different ppl.    It’s all too much for me.    I think I’ll just try to forget the “headache” of trying to keep up with and understand what’s the ONLY method to use to overcome this untenable situation??

Thank you to all who have the capability and the expertise to come up with solutions.  Kudos to you all!!     I am more totally “lost” than ever (if that’s possible).    🙁

Reply | Quote

[ch100]

@Walker

The easy and only reliable method to have your computer in good shape is to use Windows Update.
Forget about anything that other people say here and use Windows Update to install ALL updates available, checked or not by default only when Woody says it is OK to install for that month.
Do not reinvent the wheel as a lot of other people seem to be fond of, just use the proven and reliable method of updating.
Group B is wrong for you and for 99% of the users here, regardless of what they believe.
Although technically correct, Group B is only for those using Enterprise solutions for updating and not for anyone else.

Reply | Quote

[walker]

@ch100:  Thank you for the information you sent relevant to the Group A vs Group B.   I am leaning more and more towards doing as you have suggested because I do not have the knowledge or skills required for the Group B approach.   I’m at an impasse presently due to personal problems, however I have given your advice much thought, in the past, as well as again presently.   As much as I dislike being forced into Group A, it’s just not worth the tremendous amount of time, and frustration that is facing those who attempt to follow Group B.    Thank you once again for taking the time to present what I am beginning to think of as the “common sense” approach.    Your computer skills, knowledge, and expertise are admirable and sharing this is very much appreciated.    🙂

 

 

Reply | Quote

[Author]

Posts