News, tips, advice, support for Windows, Office, PCs & more. Tech help. No bull. We're community supported by donations from our Plus Members, and proud of it
Home icon Home icon Home icon Email icon RSS icon
  • latest Servicing Stack Update Win 7 SP1

    Home Forums AskWoody support Windows Windows 7 Windows 7 patches latest Servicing Stack Update Win 7 SP1

    This topic contains 19 replies, has 4 voices, and was last updated by  RDRguy 1 month, 1 week ago.

    • Author
    • #2022747 Reply


      I’m trying to make the transition from Security Only to the monthly roll ups. I’m updating from June ’19 SO to the December ’19 cumulative roll up. I think I’m missing a critical Servicing Stack Update. I’m not getting any .NET maintenance offered – who knows what else is missing.

      Looks like SSU KB4523206 was offered in November, but was not offered when I ran Windows Update > Check for Updates. Is this right? Comments?

      PS. I’m going to use @abbodi86‘s telemetry neutralization.

    • #2022763 Reply

      Da Boss

      You need:
      KB4474419 SHA-2 code support Dated Sept 2019
      KB4490628 Servicing Stack (3/12/2019 – you may have this already
      KB4516655 Servicing Stack (Sept 2019)
      KB4519976 2019-10 Rollup
      Install in that order. The SSUs have to be installed by themselves, so you are looking at 4 separate installs.
      There are also Nov, and Dec. Rollups and a Dec SSU.

      Watch out for the EOL nags KB4524752 and KB4493132 – you don’t want those.
      There is a nag built into one of the Rollups, but @abbodi altered the script to take care of it.
      Set the script up as a Scheduled Task on startup – best way to handle it.

    • #2022860 Reply


      Hello, so grateful for the great information extended by the experts on here,
      thank you. It might be not be in good form to piggyback on this thread,
      sorry, but PKCano, or someone itk, would it be possible to have a check
      list for SSU’s that should be present in Win 8.1 from say 2016? I would hate
      to be missing something as I’m new to this OS. Thank you.

      • #2022869 Reply

        Da Boss

        If your PC is up to date with Novemver SSU KB4524445, you shouldn’t need anything else.

        1 user thanked author for this post.
        • #2022883 Reply


          PKCano__Appreciating your prompt reply, I we can rest easy, thanks.:)

    • #2036790 Reply


      Thanks PK.

      I think the December Win7 SSU is actually KB4523206 released in November. The December SSUs appear to be Win10 only (from Martin Brinkmann’s site).

      I understand KB4474419 SHA-2 code support Dated Sept 2019 and the SSU’s have to be installed one-at-a-time, rebooting between each one..

      Don’t understand the KB4519976 October rollup rollup by itself though. Is there something special about it or can we go directly to the December KB4530734 rollup after the SHA-2 and SSU updates? My understanding is that the rollups are cumulative or am I missing something?

      Best regards

      • #2036793 Reply

        Da Boss

        I stopped short of the Dec updates b/c Woody hasn’t given the DEFCON approval for them yet. There is significance to the Oct Rollup, but you could install the Nov one after that.

        There is another SSU in Dec KB4531786 along with the Dec Rollup, .NET and MSRT.

        • #2036797 Reply


          How right you are, PK – KB4531786 was released on Dec. 15th.

          So, what’s special about the October rollup? Trying to understand why install it before Nov/Dec.

          Understanding might save someone else some grief.


          • #2036803 Reply

            Da Boss

            KB4519976 is one of the requirements for applying for ESU from Microsoft. I can’t find the link right now, but somewhere here in the last month Susan Bradley has listed the requirements.

            Found it – here are the requirements.

            • This reply was modified 2 months ago by  PKCano.
            • #2036823 Reply


              PK – thanks again for clarifying KB4519976 (the October 2019 rollup). We’ll definitely need it. Will surely have to download it from the Windows Catalog. Windows Update will probably only show the Dec. rollup.

    • #2039675 Reply


      Final update (great job PK!) –

      We followed PK’s instructions (below):

      “You need:
      KB4474419 SHA-2 code support Dated Sept 2019
      KB4490628 Servicing Stack (3/12/2019 – you may have this already
      KB4516655 Servicing Stack (Sept 2019)
      KB4519976 2019-10 Rollup
      Install in that order. The SSUs have to be installed by themselves, so you are looking at 4 separate installs.
      There are also Nov, and Dec. Rollups and a Dec SSU.”

      Plus the Oct. .NET rollup -KB4524102-.

      –THEN we installed in the following order, rebooting between installs. (Our sequence):

      KB4523206 Nov. SSU
      KB4525235 Nov. Rollup
      KB4531786 Dec. SSU (to position for the Dec. rollup)

      We haven’t installed the Dec. rollup yet. Waiting on the OK from Woody.

      We are now positioned for the ESU as PK and Susan Bradley indicate.

      • #2039678 Reply

        Da Boss

        FYI In my experience, the Dec Rollup will go through two reboots. I have seen this on all my test machines.

        • #2086001 Reply


          Looks like there is another SSU published in January, 2020, for Win 7 – KB4536952.


          • #2086005 Reply

            Da Boss

            Yes, you are correct. KB4536952 is the 2020-01 Servicing Stack for Win7.
            We are on DEFCON-2. Wait to install it until the DEFCON number is 3 or greater.

            1 user thanked author for this post.
    • #2086047 Reply

      AskWoody Lounger

      FYI, a couple of interesting Microsoft websites concerning SSU updates …

      A listing of all current Windows 7 SP1 & up SSU updates can be found here.

      Interesting note: the Security Updates Product List for Windows 7 SP1 (1st table at top) denotes KB4523206 (Nov 12, 2019) while the most recent SSU releases (in FAQ #2 table further down) for Windows 7/Server 2008 R2 denotes KB4536952 (Jan 2020). This could be just an error in not updating the top product list table.

      2nd website describing Servicing Stack Updates can be found here.

      Not trying to beat a dead horse but … here, Microsoft recommends “installing the latest servicing stack updates for your operating system before installing the latest cumulative update” …

      Is there any special guidance?

      Microsoft recommends you install the latest servicing stack updates for your operating system before installing the latest cumulative update.

      Typically, the improvements are reliability and performance improvements that do not require any specific special guidance. If there is any significant impact, it will be present in the release notes.

      What I find interesting is that Microsoft doesn’t follow its own recommended guidance.

      When you perform a Windows Update, it seems to always present you the latest cumulative update first and then only after it’s installed (or hidden with the rest of the month’s important/recommended updates), does it present you the latest released SSU (if there happens to be one for that month).

      From this logic, unless specifically told otherwise, I guess you “are correct” if you install the SSU either “before or after” you install the latest cumulative update.

      • #2086447 Reply


        That’s because of a limitation in Win 7 updating mechanism

        if SSU was deployed and installed with other updates, it will cause a boot hang

        and they cannot possibly make all updates dependant on SSU and won’t show before it

        moreover, SSU <=> Rollup prerequisite relationship is not explicit on the same month
        meaning, December and January rollups (or security-only update) do not stricly require December and January SSUs
        instead, they only need any previous SSU, starting KB4516655 (September) or later

        1 user thanked author for this post.
        • #2086475 Reply

          AskWoody Lounger

          I agree 100% & I’m also aware that SSU updates must be installed separately as stand alone updates.

          However, MS guidance recommends SSUs before CLUs but WU implements SSUs after CLUs.

          Couldn’t WU present only the latest SSU (if not already installed) first then after it’s installed, present the rest of that month’s updates? My understanding is that a system reboot is not required for an SSU. If a reboot was required under this scenario, WU could so indicate.

          This SSU installation sequence would be in accordance with MS’s own guidance wouldn’t it?

          In any event, I’m not advocating that MS needs to (or should) change their WU implementation concerning SSU updates, just trying to address the confusion concerning the various posts sprinkled about here & there within AskWoody about the correct sequence of installing SSUs vs CLUs and/or SOs.

          As I’ve indicated here before, I’m a strong proponent of installing monthly CLUs and/or SOs first then after the reboot, installing the newly released latest SSU as this is the same exact sequence implemented by WU.

          Now that this horse is really dead, dinner bell’s ringing 🙂

          • This reply was modified 1 month, 1 week ago by  RDRguy.
          • #2086484 Reply


            No it cannot, Win7 WU client is ancient and limited
            like i said that require MS to make all January updates (including .NET) dependant on SSU, which is not feasible

            the gudance is not necessary written by the same WU deployment guys 🙂
            and it’s really ment for reading users and IT admins, regular simple users will just install whatever WU offer as important
            evevtially, SSU will show up

            generally, SSU should always be installed first, alone

            2 users thanked author for this post.
            • #2086559 Reply

              AskWoody Lounger

              @abbodi86 … again you’ve made my point.

              MS guidance guys/gals say do SSUs first but WU guys/gals implemented SSUs last hence confusion.

              Also, using WU … search for updates, hide all found updates, search for updates again, install found SSU update, unhide previously found updates (WU searches for updates again), install re-found updates. This is us forcing WU to follow MS published guidance.

              Some of us here (reading users ? / IT admins ?) are following MS guidance by using this method while using WU if/when it is known that a new SSU was released that month.

              Couldn’t MS simply change (if MS wanted or needed to) the update precedence logic meta-data to show SSU first if installing SSU first is the correct installation sequence? (again not saying MS should or needs to)

              Though I don’t do it this way, many posts here say this not only works but this is the way to do it … always do SSU first because guidance says so.

              Simple users let WU handle it simply and install updates in the order found … CLUs then SSUs. Several posts here say this also works & this is the proper way to do it.

              Being an active Group B member, I download/install SO & IE11 updates from MS Catalog & after reboot, let WU find then install all other checked important/recommended MS updates (hiding the CLU of course), then finally another WU to find/install the SSU (if any) last.

              Again, I’m only trying to point out why there’s so much confusion about what to do first and both of our 2nd paragraphs (which seem to be in total agreement) hit that proverbial nail squarely on its head. 🔨🔨🔨

              1 user thanked author for this post.
    • #2086388 Reply


      Thanks PK and RDRguy – will hold off until DEFCON-3. Seems like I’ve seen somewhere that if you hide all of your available updates, the latest offered SSU update will show up on Windows update.

      I guess the DEFCON-5 is for the Windows 10 defect in MS certificate signing. My impression is that the certificate defect doesn’t apply to Windows 7.

    Please follow the -Lounge Rules- no personal attacks, no swearing, and politics/religion are relegated to the Rants forum.

    Reply To: latest Servicing Stack Update Win 7 SP1

    You can use BBCodes to format your content.
    Your account can't use Advanced BBCodes, they will be stripped before saving.