Patch Tuesday’s tomorrow. You know what that means. I’m moving us to MS-DEFCON 2: Patch reliability is unclear. Unless you have an immediate, pressing
[See the full post at: MS-DEFCON 2: Get auto update turned off — and watch out for SMBv1 blocking complications this month]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
MS-DEFCON 2: Get auto update turned off — and watch out for SMBv1 blocking complications this month
- This topic has 61 replies, 19 voices, and was last updated 6 years, 10 months ago by
.
AuthorViewing 22 reply threadsAuthor-
It reminds me also of the bunker scenes in the last part of the “Der Untergang” (Downfall).
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
-
Not Woody, but making a prediction from recent observations. You are asking for an article that will not be written for 19 to 24 more days. Forecast reliability approximately that of the old Gypsy lady from Archer. Slightly more reliable is the prediction that we will witness actual fallout, if any, and developing coping methods over the first 11 days. Then opinion voicing and refinement over the following week. When my personal Magic 8-ball (a children’s toy answer generator) decides things are not so cloudy and the answer is YES, I might install on my own. Otherwise I will wait for Woody’s next Computerworld article for directions through the minefield. Administrators and users requiring more timely results have been well served by Patch Lady’s assessment of individual items available.
-
Oh Anonymous! A mere “Thanks” just wouldn’t do here.
So:
My uncertain (but hopeful, looking at the possible future collapse of the Schrödinger’s function in its relevant configuration space, while eagerly entangled with greatly undefined hopes that some lives may still be left to his cat) thanks, as befits such a cloudy, vaporous, ghostly and still indistinct — if vaguely scary — issue!
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV1 user thanked author for this post.
-
-
You can uninstall those patches, BUT you are going to have a problem with uninstalling KB 2952664. It has been reissued many times. When you uninstall it, the next earliest version shows up (it appears it didn’t uninstall, but it’s one earlier version you see). Bottom line, you have to remove all of them.
This has been discussed in length on this site. If you search for 2952664, you will find methods to remove it and even scripts for the purpose.
But GWX is over and Microsoft has said it will not repeat it again.
-
It is possible to see an attempted upgrade to Windows 10, even at this late date. I worked on a Windows 8.1 laptop about four months ago, and when I powered it on, the first thing it did was begin the upgrade process to Windows 10. I was able to stop the upgrade in time; I then installed GWX Control Panel and used it to erase all traces of Windows 10.
I don’t know how it happened that GWX got onto that laptop at that late date; but somehow it did. Moral of the story, there is no harm in installing GWX Control Panel and setting it to prevent an upgrade to Windows 10; and doing so might save you from having to reverse an unwanted upgrade to Windows 10.
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server1 user thanked author for this post.
-
-
-
Thanks, i guess it didn’t leave a long lasting impression when I quickly read about it a few weeks ago and to be honest, I think I waste less time not running the latest build and waste time looking at issues that will be likely fixed by the time I do run the build. I quickly glance at the threads to have an idea what to expect if I get a call from poor Home versions folks, but this issue was minor for me and easy to fix.
They have been force updated recently, maybe a week or two ago.
But still, how come this simple issue hasn’t been fixed yet? How do Microsoft expect home folks to fix that themselves if they are not IT savvy? This is such a shame.
1 user thanked author for this post.
-
How come this simple issue hasn’t been fixed yet? How do Microsoft expect home folks to fix that themselves if they are not IT savvy? This is such a shame.
Alex:
Thanks for the detailed explanation of how to address this bug.
You’re absolutely right; a non-IT person wouldn’t have a clue where to begin fixing this one. And if they tried, they would likely mess things up even more.
Jim
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server1 user thanked author for this post.
-
-
-
The vulnerability (EternalBlue/WannaCry) that was there months ago was already fixed, but since Microsoft knows best, they’re again taking it upon themselves to make your decision for you about whether SMB1 will be available.
The problems that exist in SMB1 now are not vulnerabilities in the sense that we usually use the word, which is to mean particular security bugs that can/should be fixed. They’re simply a lack of security features that reflect the age of SMB1 and the simpler time we lived in when it was current. The fix IS to use later versions… that’s what they are for.
Still, as CH100 pointed out all that time ago when the WannaCry vulnerability was patched, removing SMB1 can cause network browsing issues and other annoyances, and that the later SMB versions were not meant to replace SMB1 in the sense that SMB1 would be deleted, but to exist alongside of it so it can still do its thing (apologies to CH100 if I am paraphrasing incorrectly; it’s been a while) if needed.
In my case, and I’d guess in the case of many home networking users, none of the security features they added to SMB in later versions will mean anything to me. My network shares are open, since no one but me has physical access to any bit of the network, from the router to the ethernet cables to the PCs themselves, and I want the convenience of an open pipeline between my various PCs. None of the security features mean a thing in this case, so there’s no benefit to prohibiting SMB1 for me, with several potential downsides.
Of course, I’m not all users, but the point is (as I have said so many times since this “Windows as a
DictatorService” debacle began) that one size does not fit all. Remove it as a default option if you wish (which they did), but leave it at that. Average people who have no need for SMB1 (or understanding of what it is) are not going to inadvertently stumble into the “Turn Windows features on or off” dialog, then accidentally scroll down to SMB1, then errantly click the box to enable it, then unintentionally hit the Ok button. If someone’s going to do that, it’s for a reason, and it’s not Microsoft’s or Ned Pyle’s job to tell me, or anyone else, NO.Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)8 users thanked author for this post.
-
-
I can’t make a recommendation without knowing more details than that, and even then, it’s just one opinion among many. I present it so people can make an informed decision, but please don’t just take it (or the words from any other person) as definitive on this or any matter!
Are you using password-protected shares? If not, SMB1’s weak security features won’t harm you, since you’re not using them anyway. If you are using protected shares, how concerned are you that someone might gain access to the network without authorization? If that’s a concern for you at all, you might want to consider ditching SMB1, because its security features are not very robust. MS is not making that up… my point is that it doesn’t matter to every one of their users, yet they’re making the feature unavailable to every one of their users (of 10) just the same.
For some people, keeping SMB1 is about keeping older network devices working. A number of them don’t and will never support anything other than SMB1, so this edict from Microsoft essentially renders those pieces of hardware useless. Home users don’t even get the opportunity to block the automatic upgrade to keep their network fully functional unless they use tricks like setting the connection to metered, and even then who knows if MS will decide that this is one of those things that is important enough to ignore the metered connection setting?
When you ditch SMB1, you also ditch NetBIOS and the Computer Browser functionality. They’re old and dusty relics for sure, but they still work, and a lot of home networks still use them, since they are well suited to the simple, decentralized type of network that is often seen in the home. With Homegroups gone, and now NetBIOS and Computer Browser going away, I don’t know what is meant to replace them in home networks. I tried disabling SMB1 in my own home network back when WannaCry was in the news, and I immediately lost any ability to browse the network (that is, to see what shared items were available on the network, and from whom). I was able to connect to my shares directly by IP address easily enough, and I can also very easily set the router up to act as a DNS server so that I can access any PC on the network without knowing the IP address. That’s all I would need to build a working network, but the ability for each share to be discovered and automounted via NetBIOS is just so convenient, and the benefit of ditching SMB1 was for me so… well, nonexistent, that I never did so.
I still don’t know what’s supposed to replace CIFS/Browser (or “Bowser” as it is misspelled in the registry) and NetBIOS for home networking users who don’t know how to connect to a share other than clicking the icon associated with it, and who are used to the largely self-configuring nature of previous Windows machines when it comes to networking. While I use myself as an example of someone who would not benefit from dropping SMB1 completely, I could do it without any real hardship… I just wonder what the regular home networking users are supposed to do without it. Maybe there is something and I am just not aware of it. Even if there is, it won’t bring back functionality to those NAS devices, printers, scanners, etc., that rely on SMB1 to work, and for users who aren’t using secured shares anyway, it’s all loss and no gain to lose SMB1.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)2 users thanked author for this post.
-
-
It looks like a relatively safe-ish setup to keep SMB1 on, yes.
It boils down to whether you consider the security features of SMB essential on your network or not. If they are important, you should ditch SMB1, because its security features are so weak and easily compromised that they can pretty much be considered to be irrelevant. By running SMB1, you’re pretty close to running an unsecured network… in my case, I actually am running an unsecured network, so it doesn’t matter at all that SMB1 is weak on security.
Again, Microsoft is not lying when they say SMB1 is insecure. They’re not wrong to try to phase it out as long as people who still want to use it despite its weak security features can enable it. Windows still allows open shares to be created, and a network full of those is less secure than a password protected SMB1 network, so it seems silly to draw such a hard line on SMB1 in context.
I probably shouldn’t go any further with that line of thought, lest I give them more ideas for features to rip out of Windows (for our own good, of course). Never mind, MS, I didn’t say a word!
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)2 users thanked author for this post.
-
-
-
-
…but you always have it set on def com 2
Ah,no, it’s not always set at MS-Defcon 2! Ok, it’s not gone above MS-Defcon 3 this year, but 😉
-
I remember when it was on MS-Defcon 5 about a year ago! What a momentous occasion!
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server1 user thanked author for this post.
-
Not often but definitely a rare Momentous occasion worth noting 🙂
4 users thanked author for this post.
-
-
-
-
Anonymous #197348 : “I cant recall a date where no buggy patches were introduced.”
Well, I can. But I’m really old. So don’t feel too bad about it.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV -
To be honest all I need is a good operating system much like XP or 7 has been in the past and not a computer what seems more and more Android like of which one is give little adjust-ability in relations to Security and MS continually spying on you.
Frank, have you considered Linux Mint? Or, for a less capable computer, Elementary OS.
Group "L" (Linux Mint)
with Windows 10 running in a remote session on my file server1 user thanked author for this post.
I don’t trust Microsoft especially after Woody saying several times that Microsoft sometimes bypasses the settings within Windows to defer updates and upgrades.
I still use the Group Policy editor to set these deferrals. Because of this the settings in Windows Update are grayed out. More important, there is a notice in yellow at the top: “*Some settings are managed by your organization.”
My reasoning is that Microsoft might want to bypass an individual, but an organization less so. They don’t want a big business complaining that their IT was flooded with issues of buggy quality updates and even buggier feature updates. Perhaps that notice says that my organization’s IT (me) is in charge of these matters and not to mess with them.
A while back, I read of a way to update group policy without a restart.
Launch an elevated Command Prompt and run the command “gpupdate/force”. This automatically causes any sort of change you made to the Group Policy to take effect.
For the most part, this works really well.Edit to remove HTML. Please use the “Text” tab in the entry box when you copy/paste.
1 user thanked author for this post.
I’ve observed this script attempting to run on our Windows 10 machines at various intervals for quite some time. I do let it run when I see it. It disables SMB1 if it detects that it has not been used for a specified period of time.
[*COMMAND*] & C:\Windows\system32\WindowsPowerShell\v1.0\Modules\SmbShare\DisableUnusedSmb1.ps1 -Scenario Client
Red Ruffnsore
1 user thanked author for this post.
-
You can turn this script off from the same place you can disable SMBv1.
In Control Panel under “Programs and Features” click on “Turn Windows features on or off” (you’re probably familiar with this tool already). Under “SMB 1.0/CIFS File Sharing Support” (click on the + to its left), untick “SMB 1.0/CIFS Automatic Removal”, click OK and Windows will delete the script and its trigger.
Doing this and ticking it again puts the script and trigger back. No reboot necessary either way.
4 users thanked author for this post.
Avoid catastrophic computer failure.
Make your backups now.On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender1 user thanked author for this post.
The metered connection trick is successfully blocking Win 1803 on my W10 Home box. The bad news is that this is also blocking my ability to install any other updates that I want, e.g. Flash, MSRT, and others that appear along with 1803 on Settings>Update Status list. It also is blocking any 1709 updates from appearing as available. I’ve used wushowhide to hide 1803 (presumably successfully), hoping that WU will refresh the pending list without 1803. No joy…1803 still there. The only option offered is “Download Now”. I ran WU Troubleshooter which identified (insultingly!) the problem as being “Pending updates — Download now”. Wushowhide is not hiding 1803 effectively. Do I have to forego ALL future updates if I wish to NOT install 1803? Suggestions sought and appreciated.
I’m in the same boat except that I have Pro instead of Home and I don’t have Wushowhide installed. I watch Susan’s patch list and go to the MS catalog site and D/L and install the relevant patches that are safe. So far so good.
Don't take yourself so seriously, no one else does 🙂
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).1 user thanked author for this post.
Peabody here.
June 12, 2018—KB4284826 (Monthly Rollup)
Windows 7 Service Pack 1
Windows Server 2008 R2 Service Pack 1Installed without error and system reboots without error.
On permanent hiatus {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender2 users thanked author for this post.
So: Once More With Feeling:
Is this all about Windows 10? Am I, with Win 7 Pro, x64, I-7 “sandy bridge” in my old only for home use PC with a dedicated router for Internet connection, free from this kind of problem, whatever it is?
I’ll really appreciate an answer concise and to the point.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV1 user thanked author for this post.
-
From a home user perspective running Windows 10, your only concern may be your router. As mentioned Microsoft has already been running scripts behind the scenes to disable SMB1 on Windows 10. Only thing folks should be aware of including Windows 7 users is if Microsoft releases a patch on this they need to wait for the green light from Askwoody. There should be no concern about completely removing SMB1 because if it breaks something, then that is a security concern that needs addressing. Only concern is any patch released by Microsoft. 🙂
Red Ruffnsore
-
-
Oscar,
Right now, there is no patch that removes SMB1 from Windows 7 or 8.1 coming down the pike. If you’re not using Windows 10, this alert about SMB1 isn’t going to affect you. It’s just about Windows 10.
No one but MS knows what patches may be planned for the future, but given that MS is doing the bare minimum with 7 and 8.1, my guess would be that MS will not roll out such a patch for the older Windows versions. If it should ever come to pass that they do, we will deal with it at that time, and as always, Woody’s MS-DEFCON will be there to assist you.
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)7 users thanked author for this post.
-
Ascaris,
A million thanks for that!
By making that simple, forthright and clear statement, in plainest English, you just have made me, and possibly all those other umpteen Windows 7 and 8.1 users that throng this site — incredibly happy!!!
Oh joy! This has noting to do with us… at least as far as one can be sure of anything that might come out of MS these days.
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV1 user thanked author for this post.
-
-
-
-
Viewing 22 reply threads - This topic has 61 replies, 19 voices, and was last updated 6 years, 10 months ago by
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Thunderbird release notes for 128 esr have disappeared
by 2 hours, 16 minutes ago
-
CISA mutes own website, shifts routine cyber alerts to X, RSS, email
by 2 hours, 45 minutes ago
-
Apple releases 18.5
by 3 hours, 4 minutes ago
-
Fedora Linux 40 will go end of life for updates and support on 2025-05-13.
by 4 hours, 11 minutes ago
-
How a new type of AI is helping police skirt facial recognition bans
by 4 hours, 48 minutes ago
-
Windows 7 ISO /Windows 10 ISO
by 11 hours, 45 minutes ago
-
No HP software folders
by 12 hours, 29 minutes ago
-
Which antivirus apps and VPNs are the most secure in 2025?
by 4 hours, 42 minutes ago
-
Stay connected anywhere
by 17 hours, 52 minutes ago
-
Copilot, under the table
by 9 hours, 5 minutes ago
-
The Windows experience
by 1 day ago
-
A tale of two operating systems
by 15 hours, 3 minutes ago
-
Microsoft : Resolving Blue Screen errors in Windows
by 1 day, 5 hours ago
-
Where’s the cache today?
by 1 day, 20 hours ago
-
Ascension says recent data breach affects over 430,000 patients
by 1 day, 13 hours ago
-
Nintendo Switch 2 has a remote killing switch
by 13 hours, 52 minutes ago
-
Blocking Search (on task bar) from going to web
by 1 day, 21 hours ago
-
Windows 10: Microsoft 365 Apps will be supported up to Oct. 10 2028
by 2 days, 14 hours ago
-
Add or Remove “Ask Copilot” Context Menu in Windows 11 and 10
by 2 days, 14 hours ago
-
regarding april update and may update
by 2 days, 15 hours ago
-
MS Passkey
by 1 day, 17 hours ago
-
Can’t make Opera my default browser
by 2 days, 23 hours ago
-
*Some settings are managed by your organization
by 2 days, 10 hours ago
-
Formatting of “Forward”ed e-mails
by 2 days, 22 hours ago
-
SmartSwitch PC Updates will only be supported through the MS Store Going Forward
by 3 days, 17 hours ago
-
CISA warns of hackers targeting critical oil infrastructure
by 4 days, 2 hours ago
-
AI slop
by 1 day, 20 hours ago
-
Chrome : Using AI with Enhanced Protection mode
by 4 days, 4 hours ago
-
Two blank icons
by 1 day, 12 hours ago
-
Documents, Pictures, Desktop on OneDrive in Windows 11
by 1 day, 14 hours ago
Remembering Woody
