I sure hope you folks followed my advice and locked down Windows Update prior to yesterday’s debacle. Going through the reports of Windows 7 and 8.1 m
[See the full post at: MS-DEFCON 1: Don’t apply ANY Windows or Office patches]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
MS-DEFCON 1: Don’t apply ANY Windows or Office patches
- This topic has 143 replies, 40 voices, and was last updated 8 years, 1 month ago.
AuthorViewing 43 reply threadsAuthor-
It’s good to see that MS-DEFCON 1 can be fired up on occasion. I believe it’s the right call.
Thank you for keeping a cool head and bringing reason to the game, Woody.
I have to admit to wondering, myself, whether to step up the timescale for application of this month’s patches because of the reports of that Office zero-day. I only late last night learned that a recipient has to actively run an eMail attachment in order to be infected by it. Many sites, in their haste to sell their security packages, didn’t bother to dispel the worry that just having one of the bad eMails arrive in one’s inbox was enough to get the malware.
-Noel
-
Noel,
I’d like your take. I sent Woody an email re: the April .NET Security Only update x64. (I’m group C since the patchocalypse and I do only .NET Security Only updates when available ).
When searching the April 2017 Security Only .NET update in the MS catalogue, the search result provides a “Download” link for KB4014985…that Download button opens a window that provides 4 links that seem to NOT correlate to the KB4014985.
Do you have any thoughts on this? Do you know which of those 4 links are actually the April Security Only .NET update for Windows 7 x64?
(Could MS make this anymore confusing??)
(Not updating anything yet, just preparing)
TIA
DownloadDownload UpdatesApril, 2017 Security Only Update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 7 and Windows Server 2008 R2 for x64 (KB4014985)Original Search results link:
1 user thanked author for this post.
-
I’d like your take.
(Not updating anything yet, just preparing)
I think you’re taking the right stance. Weigh the risk and make the “go” decision when you feel you understand it well enough.
How quickly you feel you have to install security updates depends on your confidence in your own security landscape. If your computing practices and technical perimeter keep you from knocking heads with malware much if at all, then you can guess that having an unpatched system isn’t that risky. Don’t forget that Microsoft didn’t release the security patches the day after they got the code fixed either – they waited until patch Tuesday.
Regarding keeping an older system up to date with the latest functionality updates, then again you have to use your judgment. How often do you expect to install/use new software that requires the updated functionality?
Personally I have two different systems for which I have made two different decisions. I have a Win 7 system that functions as a server that I have chosen to stop at a mid-2016 level of update, because I don’t actually need to install new software and it runs for as long as needed without a glitch. I also have a Win 8.1 workstation that I use interactively and conservatively keep up to date. Right now it’s up to date with general updates from January and some more current security patches, and I’m waiting to see whether the April functionality (group A) Updates bring unacceptable downsides.
I’m also continually evaluating whether I need functionality from Windows 10 in order to continue doing business. So far I haven’t needed it, but if I should I already know the downsides and rewards because I have outfitted test systems with Windows 10 and gotten to know them.
TL;DR: Do what you can to gain knowledge, both directly and by reading what others write, then use your best judgment.
-Noel
1 user thanked author for this post.
-
-
-
-
-
Try using CPU-Z.
1 user thanked author for this post.
-
-
-
Noel,
Appreciate your response, thanks.
That said, do you have any idea on the Update catalogue providing FOUR links in the download window that do not correspond to the <span style=”color: #000000; font-family: ‘Helvetica Neue’, Helvetica, Arial, sans-serif; font-size: 14px;”>KB4014985 update.</span>
In trying to keep this simple, a user searches the MS catalogue for the April .NET Security Only update for W7 x64, the search returns the update but the download link shows FOUR different active links. Which link is the KB 4014985 ??
(Both the search result link and the result(s) of the Download link are included in my original response and included below. If you could, click through these links to see what I’m talking about. Something is not right.)
Search result…
DownloadDownload UpdatesApril, 2017 Security Only Update for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 7 and Windows Server 2008 R2 for x64 (KB4014985)1 user thanked author for this post.
-
I would guess that the number after the “ndp” is indicative.
1 user thanked author for this post.
-
Don’t give them any ideas. 🙂
Technically, that’s just about what they’re doing here. The CPU kernels/architecture updates aren’t being allowed in anything other than 10, even though 1) AMD/Intel are willing to provide them (evident by these pieces of hardware working in Linux) and 2) Win8.1 is not in Extended Support phase yet (meaning feature updates are supposed to still be provided).People call them “Microshaft” for a reason. 🙂
-
-
-
The problem of the update client is not a complicated as that. Go to this thread.
It was published last August and has been used by literally hundreds of thousands. Note the length of the string. It goes on for over 120 pages. It works just fine. I use it at least once a week. It is a one time thing. Make certain KB3020369 is installed first, then install KB3172605. From that point onward, WU works quite well — of course that depends on how much you really want to use it, which of course is the subject of this forum.
CT
-
-
Not a bad solution. But how are you certain that it won’t find a way to turn itself back on again?
It CAN happen. I’ve personally seen it happen.
This year, for example, at the time I installed TurboTax on my Windows 8.1 workstation I shortly thereafter found unexpected entries in my firewall log that showed Windows Update had been started – even though I had set it to Disabled – and was trying to contact Microsoft (it failed, because I also reconfigure my firewall to disallow updates).
Sure enough, when I looked, I found this situation:
Looking at the details in the Windows event logs, I saw that when the TurboTax installer was started it changed my setting from Disabled to Manual, started the service, then changed it back to Disabled! Not at all what one would expect of an application installer. Coincidence? Maybe. In any case, something changed the startup type of the Windows Update service.
Moral of this story: Settings are just that – settings – and some software vendors have been losing their compulsion to heed them.
Secondary observation: A multiple layer security strategy can in some cases actually be necessary.
I myself keep the Windows Update service Disabled and my firewall configured to disallow communications with the list of servers below except when I want to apply updates. I do this on all my systems, running Win 7, 8.1, and 10, and I recommend it for those who want to retain control. I can verify that Windows Defender / MSE do keep themselves up to date without Windows Update running.
List of update servers/domains I only allow when actually doing updates (the items starting with “WU”):
-Noel
I am following PKCano’s guide, but only up to and including February (non-existent.) I am adding Office patches BEFORE March only. This is the first time my clients have had updates since last October. It may be the last time ever — ala Group W.
Note, my clients’ newest Office is Office 2010. Not one of them has bought a more recent version.
CT
1 user thanked author for this post.
-
Bigpaul, you would be wise to follow Woody’s MS-Defcon advice. Do NOT update.
CT
3 users thanked author for this post.
-
pmcjr, I would not recommend the MSRT. It rarely produces anything useful. A reasonable antivirus software installation far outstrips it. In addition, MSRT is now a suspect spyware tool used by Microsoft.
CT
-
CT is absolutely spot on.
https://www.askwoody.com/2016/telemetry-from-the-malicious-software-removal-tool/ -
-
The problem is that… I’ve never had MSRT pick up any problems.
That said, I don’t see where this MSRT is any worse than its predecessors. And Defender updates are always OK.
2 users thanked author for this post.
-
Woody, in years and years of applying MSRT to hundreds of machines, I can recall ONE instance of it turning up anything. We’re talking of thousands of instances. I strongly suspect that my choice of AV has been the reason.
That sure tells me it is pretty worthless. Why would I risk MS installing spyware in MSRT? No value to it.
CT
-
MSRT is just another means of ‘accepted via EULA’ telemetry since July 2016 IIRC
As CT has pointed out, a good up to date AV/Antimalware is suffice if you’re in the anti-snooping camp.
Windows - commercial by definition and now function...2 users thanked author for this post.
-
-
-
-
-
don’t open any Word docs attached to email messages!
In the real world, can this really be better advice than applying the patch?
Waiting to see how many millions get hit?
Many combinations of Microsoft Word and Windows support “Protected View” for documents downloaded from the internet or opened directly from the email. In these cases, the user needs to “Enable Editing” before the exploit runs. However, most users are accustomed to enabling editing.
https://www.proofpoint.com/us/threat-insight/post/dridex-campaigns-millions-recipients-unpatched-microsoft-zero-day1 user thanked author for this post.
-
In the real world, can this really be better advice than applying the patch?
Waiting to see how many millions get hit?
There is no room for hype on this forum.
If you have an inkling of the concept of “risk vs. reward” then you’ll understand that it’s what’s in play here. Who can possibly know the risk yet? Even Microsoft employees at this point have no testing to back up their positions.
Knowing what we know of Microsoft’s behavior, do you still trust them implicitly to do no harm to your system? Or do you just not care whether other folks’ computing experiences are disrupted.
Not to mention the elephant in the room…
If getting the patch out was SO incredibly important to protect those millions, why didn’t Microsoft release the patch last week? The vulnerability has been known since when?
Lastly?
Have you already installed the updates on YOUR personal machine? I see that you haven’t offered your personal experience about whether your system(s) are working after the update.
In my case I have seen no problems with a fully updated Windows 10 test system, and a Windows 8.1 test system seems to have weathered the updates well also. But I’m not done testing, so my critical systems remain unpatched until I understand the risk better.
-Noel
-
-
I didn’t realize my personal experience was so important to you. Yes, I’ve installed yesterday’s Office and Windows updates on MY personal machine and I have not experienced any ill effects.
Thank you kindly for contributing something useful here.
-Noel
2 users thanked author for this post.
-
-
-
-
-
-
-
Noel,
A lot of the people who take part in this forum have had one or more experiences in their past when they worked for a major success story like IBM, NCR, DEC, HP. If you were watching, when the exodus began, the first out the door were the best. Those are the guys who have the most portability. Over time, the ones who remained, were not the strongest of the team.
I believe that is what has and continues to happen at Microsoft. That is borne out by the track record we see in Windows Update. It has been one disaster after another. Patches to the patches, etc.
So, Noel, I completely agree. The quality of product from Microsoft today is not even close to what it was a few years back.
CT
4 users thanked author for this post.
-
-
-
You have to follow your best judgment of course, but…
Do you have any liability issues by accelerating the install? Or can you just comfortably say, to someone who has had their setup scrogged, “That was Microsoft’s fault” – even though you are already aware of problems?
Remember, as the expert your clients are trusting you to do the right things for them. If you consider their data and uptime no more important than what Microsoft considers them, how are you adding value. I’d suggest whatever you choose to do for yourself you do for them.
-Noel
1 user thanked author for this post.
-
-
-
What problems in this case?
Do you know what “havoc” means?
-Noel
Yes, I have access to a dictionary thanks.
What was the point of the screen shot?
No known problems so far then?
-
The point was (and is) that there is not enough accumulated positive experience to advise people to go ahead yet.
Do you know what’s interesting?
That I’ve actually just discovered a new and potentially serious problem in my own testing:
Adobe Creative Cloud and Photoshop CC 2017 won’t install successfully on Windows 10 version 1703 build 15063 updated to .138.
I don’t know why it fails; I’ve put out some queries to see if it’s a known issue. In fact, I may not learn why. I don’t even YET know whether it’s a common problem or something specific to just an updated Win 10 system, to version 1703, or even just to one test system.
There is no question Microsoft is a different entity today than it has been in the past. It’s not important to people who care about the integrity of their computing environment what folks did decades ago or even 5 years ago. It’s important what Microsoft is delivering now, today.
Before asking another naïve one-line question please pose this one to yourself: Why do you feel acknowledgement of potential risk has to come with proof?
Ask instead: What evidence do we have that the updates don’t break something new?
And finally, please consider the meaning of this phrase: Healthy skepticism.
-Noel
4 users thanked author for this post.
-
-
Why do you feel potential risk (of updating) should outweigh actual risk (of not updating)?
Quantify both risks and one can easily make a decision (though I seriously doubt that you or anyone else can come close to quantifying the risk of being targeted by that Office zero day malware in the next few days or weeks).
Even if one were to accept that there’s a more well-defined risk of getting a malware attack than getting a b** patch, there’s no way to weigh the latter without more experience.
A few more days/weeks of A) personal testing without uncovering problems, and B) others not reporting meltdowns and it will be a better time to make a decision. And I’ll just bet Woody will change the MS-DEFCON level up to some higher number at some day in the near future.
Essentially I see this conversation as you advising making rash decisions, while I’m suggesting gathering more information and making informed decisions.
Why such a push to rush to a decision to take updates without knowing more about them? We are here, in a connected world, with an ability to learn from others’ experience. Just keep yourself from double-clicking on .rtf attachments a little longer.
-Noel
1 user thanked author for this post.
-
-
-
-
-
Not a lawyer, and didn’t stay at a holiday inn express, but I would think my liability would be higher if I didn’t install an update for an exploit actively being abused and reported across many tech sites.
Yes, we did install on 10 of our machines and noticed no issues so far. We give the client the choice but advise, based on our results so far, to go for it. We do have backups of all machines too 🙂
2 users thanked author for this post.
-
The caveat for us is we manage updates with WSUS . . . so the following should be read with that in mind. This is not quite the same scenario where you accept updates directly from MS with only the native client update management tools (which for Win10 is pretty much not much at all.)
We responded to the risk of infection from the Word 0-day vulnerability last night. We allowed the April security only roll-up on all Win 7 and the cumulative April update for Win 10 machines. We also allowed all Office security updates including the fix for CVE-2017-0199.
As of this writing, we had zero problems with any of our client workstations during and after last nights update on Win 7 Pro or Win 10 Pro or Win 10 ENT. We run a mix of Office 2010 and 2016. A rough count of workstations across all our office sites = 350.
EDIT: For Win 10 machines we are on the 1607 CBB and are (for now) rejecting the Creators Update until it becomes CBB.
~ Group "Weekend" ~
-
Update: Most of the day now — our workstations have been in heavy use — still no problems from our user base, no complaints. We’re not seeing much fallout from forcing everything to patch last night. (Other than a lack of sleep.)
I updated my ancient (6 years now – Sandy Bridge CPU) and beloved Lenovo Laptop this afternoon and it failed to patch. Got the dreaded roll-back error on bootup. It’s running Windows 10 Pro 1607 and Office 2010. This would be the machine I abuse on the road the most.
Fixed it by running sfc /scannow followed by a DISM /Online /Cleanup-Image /RestoreHealth and a second sfc /scannow. All current patches for 1607 and Office 2010 installed with no problems afterwards.
This was very likely self-inflicted . . . 🙂
~ Group "Weekend" ~
1 user thanked author for this post.
IE patch KB4014661 breaks MBSA.
While testing, we installed ie11-windows6.1-kb4014661-x64.msu. After rebooting we run MBSA to verify the patch. MBSA starts but then fails, complaining about a bad signature file. Now we don’t have a good way to verify that the vulnerability has been closed until MS either puts out a new signature file or they update kb4014661. This is on Windows Server 2008 R2. Have not verified on other supported OS platforms.
-Dan
-
Well…we have performed some isolation testing and it seems that KB4015546 may be the real culprit. Once we run Windows6.1-KB4015546-x64.msu we receive the following MBSA results:
Security assessment: Incomplete Scan
Computer name: WORKGROUP\V-HELLIUM
IP address: //snip//
Security report name: WORKGROUP – V-HELLIUM (4-12-2017 8-31 PM)
Scan date: 4/12/2017 8:31 PM
Scanned with MBSA version: 2.3.2208.0
Catalog synchronization date: 2017-04-10T21:31:59Z
Security Updates Scan ResultsIssue: Security Updates
Score: Unable to scan
Result: Cannot load security CAB file
Ha! I didn’t even get the March updates… had a look back then and “meh”…
Fun fact: my Windows 7 is an original install originating some two years after release, probably 2011? Had same problem back then on giving up good running stuff! 😀
But this install has been running ultra smooth and rock steady ever since installed! Not a hitch, break-down or what not. As good as I could ever wish for.
Nothing has threatened the stability, no virus, trojans, scripts. Nothing. And I’ve visited place, I’m not that proud of… never had a problem.
But lately? Not so much luck… started with the brilliantly executed Get Windows X campaign. Took quite some manhours to get the system back to it’s old stable state.
The irony? The only thing that ever has caused problems and that really, really scares me and is a very serious threat to my system’s stability – and my sanity – is… microSoft.
Waiting with updates and Noel’s article of how to lock down the Windows 7 system…
2 users thanked author for this post.
-
When you get deep enough into this forum and read up on the Group A/B and W(C) theory, you may just realize, like I did, that the risk of applying MS devastating patches is much greater than not applying them at all. At minimum, do NOT apply ANY patches till Woody recommends it through his MS-Defcon rating system. For example, anyone applying those patches today is playing with fire.
If you must choose Group B, do not apply any until they have aged at least one month and better yet two.
CT
-
Did you by any chance HIDE the Monthly ROLLUP. If you hide this month’s Rollup, last month’s will reappear. It is not recommended to hide updates. UNCHECK them and they will not get installed. Next month’s Monthly ROLLUP will replace it and it will disappear. If you hide them, the one that was superseded will become important and CHECKED.
1 user thanked author for this post.
-
^Easy^ Saves the misery most toil over every Tuesday.
If one is not yet exhausted reading the triads Go here and get a laugh or two.
-
-
Well, do you have them both? a screenshoot would be helpful 🙂
1 user thanked author for this post.
April 12, 2017, update for Word 2016 (KB3085439)
https://support.microsoft.com/en-us/help/30854391 user thanked author for this post.
-
Points well taken.
At some point I start feeling like a Volkswagen Bug enthusiast. There was a long period of decline, when it was fun and challenging to keep the old beasts running. But sooner or later, for most of us, reality set in.
1 user thanked author for this post.
-
-
This was my bible for many, many years:
https://www.amazon.com/How-Keep-Your-Volkswagen-Alive/dp/0912528001/ref=sr_1_7
1 user thanked author for this post.
-
-
-
-
Stock prices can change quickly. AOL was once so big that it got top billing in a merger with vaunted Time-Warner, but it came crashing down shortly thereafter. Today, it’s a free email provider used by two (2) people worldwide, and that merger is regarded as one of the biggest blunders in business history.
Irrational exuberance can keep things like real estate bubbles afloat for many years, but sooner or later, reality once again shows its dominance, and it all crashes to the ground. That’s not to say I think this will happen with MS… only that it might. Sometimes the latest, greatest thing really is all it’s cracked up to be, but more often, it ends up being a dud.
I don’t know whether MS deserves its current market capitalization or not. What I do know is that I keep hearing about how now Microsoft is now the innovator, how it’s the new Apple, all that kind of thing, but the only innovation I see here at ground level is new and innovative ways to make a rude finger gesture at its own customers.
The rest of the stuff is oversold hype, a la The Emperor’s New Clothes, as I see it. I think that anything including the word “cloud” is part of a fad right now, and while there is obviously some value in what they’re now calling “cloud” (as was the case when all those things were being done without the term “cloud” attached), it’s not any more innovative than it was during the 90s when they called it “thin client” or during the mainframe/terminal era when they called it “computing.” It’s still having your stuff stored on someone else’s server and having some or all of the computation delegated to someone else. It’s nothing new– it’s older than the PC, in fact. The decentralized, client-focused PC was the innovation that did away with all that stuff decades ago, but that’s the status quo now, so everything else begins to look innovative and new, even if it’s the same old stuff.
Business investors seem to really have a weakness for buzzwords and hype. If you throw in a few “thinking outside the box”es and a few “paradigm shift”s, it must be good! Now those terms are worn out, but there are always new ones to replace them. “Innovation” and “cloud” are big ones now. Sprinkle a few of the buzzwords into the prospectus and watch as the investors salivate on command…
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)1 user thanked author for this post.
-
Ascaris, one thing I learned a lot of years ago: There is no correlation what so ever between the real value in a company and its stock price. Think IBM, as it was dying, it still had a huge stock price. I have not checked lately, but I think it still does.
I have worked for some of these over-valued companies. Worked in positions in which I knew full well where all the warts were. It never failed to amaze me how gullible stock investors are, and what makes matters worse are stock peddlers who know even less about what they are shouting about.
Think the tech bubble of 2000!
CT
1 user thanked author for this post.
Its a little bit off topic but for the average user and probably quite a few power users as well. maybe time to check your mail settings. Yes I know this about Word attachments but if your ISP supports it may be switch from a POP acc (full download). to IMAP (stays on the server normally), For M$ Office Outlook users that have an outlook.com account may be “rejig” your settings to download headers only or any other account. That way before the thing gets to your machine you can actually check or trust the sender, check your mail rules are there any candidates in there that are trusted if there are can you enable automatic download? Do you share you mail app/machine? Sounds like old tired advice ehh? well yes but many’s the time stuff has been downloaded and potentially infected Word Doc’s have been opened inadvertantly. Do you use Macro’s? do you enable them? sounds like this exploit isnt about Macro’s but thats a regular target.
Got a couple sitting in the inbox right now, one who I know, one that I am not sure of as they both have attachments. Its now a consciously made effort on my part to take a leap in to the unkown and decide to download or not. Got to admit over the years I have got a little “lax” purely for convenience and speed. Ahh but apparently the “malware merchant’s out there never sleep and with M$ offing a fix in an update that is the proverbial “poison chalice” may be time to trade expediency for security 😉-
That’s a surprisingly complex question.
If your i5 is a Skylake (many are not) you need to look up the manufacturer on this list to see if you’ll get updated without incident.
If your i5 is a Kaby Lake (only released very recently), you’ll get zapped.
There’s a list of processors here that may help. Use Speccy to see which processor you have.
1 user thanked author for this post.
-
-
Actually, MS has not communicated anything about Skylake computers that are not on the list, as far as I can tell. I am in the same boat as you and have been reading a few weeks ago what I could find about those computers. What they said was that Skylake computers on the list will be supported until 2020 (Win7), but absolutely nothing about other Skylake computers. That is why I am following the Kaby Lake issue with interest, as the block may well happen soon and unexpectedly for Skylake computers that are not on the list too.
But what I have been wondering is if and how MS is able to check whether a computer is on “the list”. I know they can check for the CPU by checking the CPUID, but can they also check for the brand and type of computer?
1 user thanked author for this post.
-
I know they can check for the CPU by checking the CPUID, but can they also check for the brand and type of computer?
They can check ID string of the mainboard (I guess that’s where they’d be looking) – not sure if these are so unique you can easily distinguish between supported and non-supported OEM.
Fractal Design Pop Air * Thermaltake Toughpower GF3 750W * ASUS TUF GAMING B560M-PLUS * Intel Core i9-11900K * 4 x 8 GB G.Skill Aegis DDR4 3600 MHz CL16 * ASRock RX 6800 XT Phantom Gaming 16GB OC * XPG GAMMIX S70 BLADE 1TB * SanDisk Ultra 3D 1TB * Samsung EVO 840 250GB * DVD RW Lite-ON iHAS 124 * Windows 10 Pro 22H2 64-bit Insider * Windows 11 Pro Beta Insider1 user thanked author for this post.
-
-
-
-
-
-
-
Right! I read this and decided NOT install the April important updates. I have just clean installed Windows 7 on my laptop, done all the other Windows updates (except some optional ones I have hidden, including 4012218). Luckily I had done a system image but was about to do a second image after re-installing all my files and programs.
Windows has installed the 5 April updates WITHOUT MY PERMISSION! I still have Windows update set to download but let me choose what to install, after my clean install.
I turned off the laptop and it said Windows is installing 5 updates – what?!!!! I turned it back on and looked in installed updates and they weren’t there. They were still sitting there waiting to be installed. I turned off the laptop later that night. This morning I turned it on and now they actually have installed themselves!
I am furious – especially as I have a nice new clean install. I haven’t seen any issues yet, but do you think I should remove them again and turn Windows updates OFF?!
1 user thanked author for this post.
-
“Download but let me choose what to install” means download in the background and install on next reboot/shutdown if you don’t intervene.
You need to set it to “Search for updates but let me choose whether to download and install” of “Never check for updates.” The former searches but doesn’t download until you say so. The latter puts searching on manual and it doesn’t happen until you click on “search for updates.”1 user thanked author for this post.
-
“Download but let me choose what to install” means download in the background and install on next reboot/shutdown if you don’t intervene.
I’m not a native speaker, but this somehow goes against my understanding of English 🙂
Fractal Design Pop Air * Thermaltake Toughpower GF3 750W * ASUS TUF GAMING B560M-PLUS * Intel Core i9-11900K * 4 x 8 GB G.Skill Aegis DDR4 3600 MHz CL16 * ASRock RX 6800 XT Phantom Gaming 16GB OC * XPG GAMMIX S70 BLADE 1TB * SanDisk Ultra 3D 1TB * Samsung EVO 840 250GB * DVD RW Lite-ON iHAS 124 * Windows 10 Pro 22H2 64-bit Insider * Windows 11 Pro Beta Insider1 user thanked author for this post.
-
Yes, a lot of people have been mislead by it. WU didn’t install without his permission, he misunderstood the setting. The only way to get out of that is – when you see the yellow “!” in the Start “shutdown” button, you don’t shutdown. You go to WU and uncheck/hide what you don’t want. AND you change the setting to one of the two safe ones because the updates are already on your machine.
-
-
I have been explaining this for more than a year now. The bottom line is the only sensible setting is NEVER>….
What happens with that setting is that once you start up, updates are downloaded. Some or all of them are pre-checked for installation. If you do not uncheck them before shut down, they will have your permission to be installed by virtue of those check marks.
CT
Thanks for that info. Yes it is news to me after donkeys years lol! I did notice an exclamation mark in shutdown. Still – never happened to me before. Sneaky – it also goes against my understanding of English – and I’m English lol.
1 user thanked author for this post.
-
-
Because you probably intervened. You probably unchecked all then checked the few you wanted to install. Unchecked updates don’t get installed even they are in the “important update” list.
1 user thanked author for this post.
-
Yes, a lot of people have been mislead by it. WU didn’t install without his permission, he misunderstood the setting.
I don’t agree with this at all. In the dodgy MS world of misinformation, the words “Download but let me choose what to install” might mean “download in the background and install on next reboot/shutdown if you don’t intervene.” To any native English speaker it means “download in the background and then I will choose a time and place when I will install these items, if I choose to at all.”
Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie
Before this months patch Tuesday, I changed my Windows update setting from “check for updates but let me choose” to “never check for updates”. On Wednesday I did a manual check for updates and had 3 updates, monthly rollup, preview, netframe, plus MSRT. I think I just let them be and didn’t uncheck them.
This morning, after reading this thread, I did a manual update again.All the previous updates are gone. It says my computer is “up to date”.
Did MS pull all the patches?????Windows 7 Home Premium 64 bit 2008 R2
Group B
seriously considering Group W1 user thanked author for this post.
-
The Preview is never checked, and should be avoided at all cost.
Rule of thumb – DO NOT check anything that is already UNCHECKED. That includes all the updates in the “optional updates” list (the Preview was here) and those in the “important updates” list that are not checked by default.To see if the updates were installed, in Windows Update click on “View update history.” If the ones you don’t want are there, you can go to “Installed updates” and uninstall the ones you don’t want. They will reappear in the update queue.
PKCano I know about the “preview” update to leave uncheck.
I follow closely what is posted here, Woody’s advice, Ms-defcon,
with one exception… I am guilty of hiding updates.
However, this is just what happened.
I went to check my “hidden updates” since my last post and they were all gone.
I thought, WTH????
So I went back and changed my update settings back to “check for updates but let me choose”.
I rebooted my computer.
The Windows update did the checking…
and this is what happened..
I now have 77 important updates, and 47 optional updates. WTH?
Checked my “hidden” updates and there aren’t any.
So my “hidden” updates were now switched back to unhidden without me doing anything??
How the heck did that happen?Couldn’t update my MSE definitions as it was getting hung up earlier.
BTW My processor is Intel I3-3240 (3rd generation ivy bridge)
Seriously, this is getting very unsettling.1 user thanked author for this post.
-
The only updates to HIDE for Group B are the telemetry patches for your version of Win. See AKB2000003
For more understanding of what to install for Group B see https://www.askwoody.com/forums/topic/group-b-and-patch-blocklists/#post-106970
-
-
In the past, when you were searching for a .NET patch, the KB pointed to a specific flavor of .NET. For example, 3.1.5 or 4.5.2.
With the new rollup system that MS is deploying there is no specific MS, just the monolithic KB; in your example KB4014985. The four individual downloads you see correspond to a specific .NET version:
4014573 = .NET Framework 3.5.1
4014566 = .NET Framework 4.5.2
4014558 = .NET Framework 4.6, 4.6.1
4014552 = .NET Framework 4.6.2You need to download the version of .NET supported on your systems. .NET 3.5.1 was patched via .msu files while .NET 4x use .exe files.
r/Dan
-
-
-
-
Until recently I was in the B-group, but finding the ‘right’ and avoiding the ‘wrong’ updates in MS’ enigmatic labyrinth is too much of a hassle every month, so I switched back to ‘Inform me about new updates’ (only).
This time I did NOT wait for the green sign from Woody and -after making a back-up- installed two updates on my stand-alone Fujitsu i5 Windows 7 Pro SP1 x64 without problems so far:
KB3141529 Security Update for Microsoft Office 2007 suites
KB890830 Windows Malicious Software Removal Tool x64 – April 2017</span>Not installed yet, but presented by Windows Update:
KB4015549 Security Monthly Quality Rollup for Windows 7 for x64-based Systems
KB4014981 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 on Windows 7 and Windows Server 2008 R2 for x64Thanks Woody, Patron X
Edited to remove HTML content
1 user thanked author for this post.
-
Anon #108310
I am sorry I am still showing up as anonymous – haven’t worked out how not to be anonymous.
To not be anonymous, you can register here – it’s particularly painless, then we will be able to see your other posts easily too 🙂
Something new I’ve noticed on my Win 8.1 test system with Office…
LinkedIn (and other) eMails in Outlook 2010 now no longer show embedded images, but rather little [x] indicators and “Right-click to download pictures” nessages. Across the top are two messages in black on dark gray that seem to be pertinent…
I think the images just showed in the preview pane before the patches.
This may be considered by Microsoft to be a trifecta: It degrades the integration of an older version of Office, claims to improve user privacy, and (presumably) improves security – all at once. Makes you wonder, though, why not just fix the image display logic so it can’t be a vector to infection.
Clicking to browse in the browser, by the way, produces this:
-Noel
-
What does File, Options, Trust Center, Trust Center Settings, Automatic Download, Don’t download pictures automatically in HTML e-mail messages or RSS items show?
(You can also unblock pictures for a particular sender or domain by adding them to the Safe Senders List.)
Block or unblock automatic picture downloads in email messages
1 user thanked author for this post.
-
Did the patch just change these settings?
-Noel
-
I have been fighting that problem for over a year. It just keeps getting worse and worse. No changes seem to affect the problem. Not safe senders, not the Trust Center, nothing I can find.
I finally installed Mozilla Thunderbird. According to Thunderbird it is remote content that is being blocked. If it is a trusted email source, I just open it in Thunderbird.
I also set my server setting to allow messages to remain on the server until I delete them. I just delete them once I have them all downloaded. I did that so when on the road with a laptop, I did not have to boot it up to see those emails. I just started the desktop and they all came down. Now I just use my iPhone to delete them from the server.
1 user thanked author for this post.
pmcjr, I would not recommend the MSRT. It rarely produces anything useful. A reasonable antivirus software installation far outstrips it. In addition, MSRT is now a suspect spyware tool used by Microsoft.
Notice the MSRT stats in this blog post:
https://blogs.technet.microsoft.com/mmpc/2010/05/21/msrt-may-threat-reports-and-alureon/
-
https://answers.microsoft.com/message/9366cc04-59d6-4b37-bee9-dffcdc7c602a
so for this month, it’s KB4015195 + KB4015380 + IE9 KB4014661
Server 2008 is still supported, you can use its updates manually for Vista 🙂
The CPU brand is Intel.
http://ark.intel.com/products/88188/Intel-Core-i5-6600-Processor-6M-Cache-up-to-3_90-GHz
Unlike the motherboard, which can be manufactured by anybody using Intel chipsets, the processors are only made by Intel.
Windows 10 Pro 22H2
Viewing 43 reply threads
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Google’s Veo3 video generator. Before you ask: yes, everything is AI here
by 4 hours, 17 minutes ago
-
Flash Drive Eject Error for Still In Use
by 5 hours, 50 minutes ago
-
Windows 11 Insider Preview build 27863 released to Canary
by 23 hours, 9 minutes ago
-
Windows 11 Insider Preview build 26120.4161 (24H2) released to BETA
by 23 hours, 11 minutes ago
-
AI model turns to blackmail when engineers try to take it offline
by 2 hours, 49 minutes ago
-
Migrate off MS365 to Apple Products
by 3 hours, 38 minutes ago
-
Login screen icon
by 6 hours, 16 minutes ago
-
AI coming to everything
by 1 hour, 37 minutes ago
-
Mozilla : Pocket shuts down July 8, 2025, Fakespot shuts down on July 1, 2025
by 1 day, 14 hours ago
-
No Screen TurnOff???
by 1 day, 15 hours ago
-
Identify a dynamic range to then be used in another formula
by 1 day, 15 hours ago
-
InfoStealer Malware Data Breach Exposed 184 Million Logins and Passwords
by 2 days, 3 hours ago
-
How well does your browser block trackers?
by 1 day, 13 hours ago
-
You can’t handle me
by 13 hours, 36 minutes ago
-
Chrome Can Now Change Your Weak Passwords for You
by 1 day, 6 hours ago
-
Microsoft: Over 394,000 Windows PCs infected by Lumma malware, affects Chrome..
by 2 days, 14 hours ago
-
Signal vs Microsoft’s Recall ; By Default, Signal Doesn’t Recall
by 1 day, 18 hours ago
-
Internet Archive : This is where all of The Internet is stored
by 2 days, 15 hours ago
-
iPhone 7 Plus and the iPhone 8 on Vantage list
by 2 days, 15 hours ago
-
Lumma malware takedown
by 2 days, 3 hours ago
-
“kill switches” found in Chinese made power inverters
by 3 days ago
-
Windows 11 – InControl vs pausing Windows updates
by 2 days, 23 hours ago
-
Meet Gemini in Chrome
by 3 days, 4 hours ago
-
DuckDuckGo’s Duck.ai added GPT-4o mini
by 3 days, 4 hours ago
-
Trump signs Take It Down Act
by 3 days, 12 hours ago
-
Do you have a maintenance window?
by 1 day, 16 hours ago
-
Freshly discovered bug in OpenPGP.js undermines whole point of encrypted comms
by 2 days, 14 hours ago
-
Cox Communications and Charter Communications to merge
by 3 days, 15 hours ago
-
Help with WD usb driver on Windows 11
by 24 minutes ago
-
hibernate activation
by 4 days ago
Remembering Woody
