Just when you thought it couldn’t get any more complicated, Creators Update gets a new kind of patch, KB 4016240

Topic

New Reply

Microsoft just released another patch for Win10 Creators Update. KB 4016240 brings the 1703 build number up to 15063.250. That’s quite normal for a ne
[See the full post at: Just when you thought it couldn’t get any more complicated, Creators Update gets a new kind of patch, KB 4016240]

1 user thanked author for this post.

Reply | Quote

Replies

It’s geared towards larger organizations that use WSUS or WUFB, not to the clients that take updates directly from Microsoft Updates.

This gives system admins a bit more granularity on which classification of updates to accept for their networks month to month.  (I was one of the admins that requested this feature for business networks.)

So: Now we can choose only security updates, only critical updates, or feature updates separately and on separate schedules.  For example with this separation — I can allow criticals the day they are released, feature updates a month later, and security updates the week (say – Friday evening) they are released.

 

 

~ Group "Weekend" ~

4 users thanked author for this post.

Elly, Noel Carboni, ch100

Reply | Quote

I have not been keeping up with the Win10 patching options, but are you saying Win10 has security only patches like the security only patches for Win7 used by Group B folks? I thought Win10 was an all or nothing.

1 user thanked author for this post.

Reply | Quote

See Looks like Windows 10 is going to get something like Group B

1 user thanked author for this post.

Reply | Quote

I under stand by this post that there might be coming new non-security only patches, but does Win10 have security only patches or are security only patches always mixed in with the roll-ups? Just curious since I’m not using Win10 yet in prod.

1 user thanked author for this post.

Reply | Quote

I’m still trying to figure out how this works but based on what I’ve seen, the intent is to have two types of updates:

Non-security patches (described as “cumulative” but I don’t believe it)

Monthly cumulative updates

If that’s the case, some of what’s being said makes sense. But some doesn’t. 🙂

Far as I can tell, that’s the way Win10 has always been patched. There may be changes in the “Optional” flag for update servers, but for regular people, I don’t see how anything has changed. (And even if the “Optional” flag is set, I don’t understand how that will benefit admins. But maybe I’m just not looking at it the right way.)

1 user thanked author for this post.

Reply | Quote

NetDef wrote:

This gives system admins a bit more granularity on which classification of updates to accept for their networks month to month.

More details, please! I see where the Win7 patching method of separating Security-only and Monthly Rollup patches help with WSUS. But I don’t understand how this combination of Non-Security-Only and Monthly Rollup helps.

Are the Non-Security-Only patches really cumulative? Or is that a typo?

Thanks!

1 user thanked author for this post.

Reply | Quote

woody wrote:

NetDef wrote:

This gives system admins a bit more granularity on which classification of updates to accept for their networks month to month.

More details, please! I see where the Win7 patching method of separating Security-only and Monthly Rollup patches help with WSUS. But I don’t understand how this combination of Non-Security-Only and Monthly Rollup helps. Are the Non-Security-Only patches really cumulative? Or is that a typo? Thanks!

My understanding is they are cumulative, and are likely analogous to the Preview early patches for the current release builds.  (My understanding may not be 100% how MS would like to present them.)

The major value is we can test on a subset of our domain workstations before they are released, again much like preview, but for WSUS management.

I am not at all certain you would see these patches outside a managed update environment.

It’s worth noting that the Preview ring is not an option for machines joined to a WSUS managed network, which means for us to test that ring we have to have stand-alone workstations – which invalidates (IMO) the testing.

So in short, I <span style=”text-decoration: underline;”>think </span>what we are seeing is a WSUS friendly workaround for the Preview Ring.

~ Group "Weekend" ~

2 users thanked author for this post.

ch100

Reply | Quote

I am not at all certain you would see these patches outside a managed update environment.

I believe that the current non-security CU is released to the common Windows Update, outside of WSUS.
There may be a good reason for this behaviour, which is the classification of the current update as Critical Update instead of the more commonly intended Update.

2 users thanked author for this post.

NetDef

Reply | Quote

Always give Michael Niehaus the benefit of the doubt at MS – he’s one of the few people that gets it and is really trying to refine the way that we do patching and general OS management. He created MDT, was instrumental with nano server, etc etc.

With this change adding all of the granularity for the Enterprise folks, this should resolve a bunch of issues on the enterprise WSUS end of things for patch management.

3 users thanked author for this post.

ch100, NetDef

Reply | Quote

Totally agreed. In my book, Neihaus is one of the good guys. But he could benefit from a tough editor – one who questions what’s being communicated. Many of his posts don’t become clear until we’ve had a few months to gauge what they really say.

That isn’t a Neihaus problem. It’s a Microsoft problem.

1 user thanked author for this post.

Reply | Quote

According to the WUShowHide tool on my Win 10 (15063.138) test system there are no available updates at this time for Win 10 Creators from the online Windows Update servers, so this update truly seems to be not yet available via the normal “public beta tester” means?

-Noel

2 users thanked author for this post.

BobbyB

Reply | Quote

didnt show on my WSUS show & Hide yesterday (only Dvrs) but it was there at approx 1400MST and as soon as you “Zero” the defer updates option and hit “check” it gets installed, You might want to hold off that one though my Win10Pro V1703 VHD has gone in to a real slow down since that update. Edge has stopped working like it should (no great loss there) not seen many other complaints on the web though it could be a one off on my VHD.

PS WSUS show & Hide didnt show a slew of office2016 updates that came with kb4016240 either “curious and curiouser”

1 user thanked author for this post.

Reply | Quote

Noel Carboni wrote:

According to the WUShowHide tool on my Win 10 (15063.138) test system there are no available updates at this time for Win 10 Creators from the online Windows Update servers

BobbyB wrote:

didnt show on my WSUS show & Hide yesterday (only Dvrs) but it was there at approx 1400MST and as soon as you “Zero” the defer updates option and hit “check” it gets installed,

I’ve got it on my test machine. Noel, any chance you have the update blocked?

2 users thanked author for this post.

Noel Carboni

Reply | Quote

Thanks.

There is a chance I’ve riled up the update gods somehow. I did make a small router change last night having to do with multicast that could be affecting Windows networking.

It looks like the update servers are being contacted successfully, but something under the covers seems to be failing with an 0x80070426 error.

More investigation is in order.

-Noel

1 user thanked author for this post.

Reply | Quote

Well further to the “Major slowdown” post kb4016240 install & using WSUS show & Hide. It would appear that if you have both updates deferred settings set in in Settings->updates ETC->Advanced panel then if you run WSUS show & Hide it wont show the update in waiting i.e. kb4016240.

Basically never got to the bottom of the “major slowdown” (press. of work & all that) running post uninstall DISM clean up, restore health returns an error outlined here
http://borncity.com/win/2017/04/26/windows-10-v1703-fix-for-dism-error-0x800f081f/
I reapplied 15063 to the same VHD and sure as anything WSUS Show & Hide didnt pick up kb4016240 (see below) So it would appear that WSUS S&H cant be relied on if you have updates deferred. As for the slowdown never got to the bottom of it as removing the errant update didnt help at all. Probably to use WSUS S&H its better to use the GPedit setting to change the freq. of checking for windows updates, disable the defer setting temporarily then check.
May be they should change TGIF to TGIV (Thx Gdnss Its a Vhd 😉 )

1 user thanked author for this post.

Reply | Quote

I’ve just gotten my test system updated to 15063.250 via running KB4016240 from the catalog…

Can you describe the slowdown you saw in a bit more detail? So far I’m not seeing what appears to be a slowdown, but chances are I don’t do the same things you do with it.

I *DID* see the return of a lot of Apps that I had previously uninstalled. Good thing I have a re-tweaker script to undo that.

I need to poke around more in this version to see what else may have been reverted. Why does Microsoft make keeping up to date in Win 10 so difficult?

-Noel

1 user thanked author for this post.

Reply | Quote

@Noel settings unesponsive 1-2 mins to open, windows explorer opening files in general same as, close button works a treat (which I ended up using quite a bit) The whole demeanur of the system as a whole seemed noticably slower.
Threw it in a VHD this time as opposed to VHDX of same size 45gb probably give that a try with kb4016420 later on. Stangely it fixed the remove lock screen which never worked from a “cold boot” i.e. displayed the login background whereas before from a “cold boot” you used to get the plain Blue screen.

1 user thanked author for this post.

Reply | Quote

Hm, Settings comes right up here.

I was able to figure out why the Apps came back and kept coming back after a reboot… The system was running the App Readiness service as though I was a new user all giggling and ready for all the great new Apps.

Thank Goodness THAT’s Disabled now.

-Noel

1 user thanked author for this post.

Reply | Quote

@Noel further to you comment above well threw it in a VHD and then installed kb4016240 from the desktop and “et voila” no problems. whether its a problem with the VHDX format or VHD who can tell? as I know there’s a couple more updates apparently lurking out there (KB402001/2) I tossed a screenshot in (yeah I have been known to sleep on occasion lol 😛 )

the office got updated or started updating while I was away from my desk as normally WSUS S&H will show them. theres a couple of links youve probably seen them but for anyone else following this it may be handy

https://www.ghacks.net/2017/04/25/microsoft-to-offer-more-updates-for-windows-10/

https://www.ghacks.net/2017/04/26/kb4020001-and-kb4020002-for-windows-10-1703-released/
I am getting the impression WSUS S&H may not be the solution to all but still a mega handy tool to be sure. Probably going to go back to using block driver updates using GPOL, thats if I decide to go “live” yet with 1703 after all its still early days and theres a lot of stuff, Data & settings to be redone. 🙁

1 user thanked author for this post.

Reply | Quote

I just succumb to the fact my PC is not my PC anymore. First Microsoft made the choice to roll everything into one update path and not allow anyone but enterprise to have control. Now Microsoft decides that separating non security updates from security updates is a good thing? Isn’t that pretty much what we had before? Does it really matter to the average home user who has updates forced on their systems anyway? At least its nicer to have stuff spread out than a big update once a month. I just will never accept the fact I have to endure whatever Microsoft dishes out if I want to run Windows.

1 user thanked author for this post.

Reply | Quote

As I understand it, this really doesn’t separate out security from non-security updates. It’s kind of like a mirror image of the current situation with Win7/8.1 updates. But then there’s the Preview ring (as opposed to Rollup Previews), and my brain does another roller coaster loop.

I’ll read up on it and see if I can pull something coherent out of it.

1 user thanked author for this post.

Reply | Quote

_Reassigned Account wrote:

I just succumb to the fact my PC is not my PC anymore.

🙂

-Noel

3 users thanked author for this post.

Elly, BobbyB

Reply | Quote

To add to the Windows 10 mix, Ian Paul over at PC World has an article, published this morning, that is sure to stir things up, “Don’t install the Windows 10 Creators Update on your own, Microsoft advises (Wait for Windows Update to ensure your hardware works properly, Microsoft says)” – http://www.itnews.com/article/3192588/windows/dont-install-the-windows-10-creators-update-on-your-own-microsoft-advises.html .

1 user thanked author for this post.

Reply | Quote

Yep. I’ve been urging folks to wait until it’s cleared as “Current Branch for Business.”

Installing it now is begging for problems.

http://www.infoworld.com/article/3187755/microsoft-windows/dont-rush-to-install-windows-10-creators-update.html

http://www.infoworld.com/article/3188869/microsoft-windows/todays-the-day-to-block-windows-10-creators-update.html

2 users thanked author for this post.

AJNorth

Reply | Quote

KB4016240 messed with task view (ALT+TAB) previews and thumbnails on taskbar buttons.. https://answers.microsoft.com/en-us/windows/forum/windows_10-start/pixelated-images-in-task-switcher-after-update/0c52b3e9-ac13-433e-b261-468378473720

It’s just ridiculous that the experts at Microsoft break things that worked for ages, and then ship the junk without testing. It was an art of beauty, but the kindergardeners at Microsoft know how to break stuff..

Reply | Quote

Just imagine that they might be breaking “desktop” things on purpose to get users to like the desktop less and less. But slowly, so no one really notices.

I mean, there’s no comparison between a nicely themed desktop and the out-of-box Win 10 desktop. The system can do it – I have a nice theme. It’s pretty clear Microsoft just doesn’t want it to look nice any more.

You’re supposed to just want to sit in your favorite App all day.

-Noel

Reply | Quote