It ain’t pretty.
[See the full post at: MS-DEFCON 3: Time to get patched but, man, what a mess this month]
|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
-
MS-DEFCON 3: Time to get patched but, man, what a mess this month
- This topic has 159 replies, 32 voices, and was last updated 8 years ago by
.
Viewing 44 reply threadsAuthorPlease wait until the article’s up before you wade through the minefield.
As always, thank you for your efforts to keep heads cooler while the dust settles and a limited number of folks take the initial risks.
The following are data points, which are NOT general endorsements of the patches, just observations from one reasonably serious Windows user in a small business environment, doing what we do here:
- For Win 8.1 x64 Pro/MCE I have a total of 11 days test time on the April “Group A” rollup update. I’m happy to report it has been stable and functional. April updates showing in this system, per WMIC qfe list:
- For Win 7 x64 Ultimate I tested the April patches for a week on a VM, and have just this morning installed the April Security Only patches for Internet Explorer and the OS on what has been an otherwise “Group W” Win 7 hardware system that has run 6 months without rebooting. The installation went smoothly (via .msu files from the catalog) and for now the system seems to be running okay, with no errors in the event logs, though only time will tell for certain. WMIC qfe list on the hardware system shows, for April:
-Noel
-
-
How I do it:
Stop the Windows Update Service
Install Security Only Quality Update, close box, install Cumulative IE11 Update.
Reboot
HIDE any telemetry patches as defined in AKB2000003
UNCHECK (not hide) the Security Monthly Quality Rollup, any driver updates, and install the rest.
-
-
-
? says:
This hack works well if you want to run the MSRT Tool w\o “snooping”. you can verify by looking at Debug in windows. -
-
-
-
-
-
Whole Windows 10 OS is already telemetry-based 🙂
there is no point in discussing or trying to avoid it in cumulative updates1 user thanked author for this post.
-
-
-
-
-
-
-
Per Step B4 in the InfoWorld article (“If you see any “Security and Quality Rollup for.Net Framework” boxes checked, leave them checked.”) – Do those of us in Group B need to continue doing that rather than downloading the Security Only update (KB4014985)?
1 user thanked author for this post.
-
-
Instead of clickong on “download” click on the “Title” link.
Then on the right, click on “More Information”
That will take you to a page that tells which patch is for your version of .NET
(You have to find out which ver. is installed on your PC) -
THANK YOU PKCano – for THIS, as I was scratching my head what to do – and also for all your other great, informative contributions you make to Woody’s forum !!!
1 user thanked author for this post.
-
-
-
First of all, “Thank You” to Woody and his experts for assisting the many somewhat computer literate users like me who rely on this forum to make sense of the plethora of changes Microsoft releases each month. I am in Group “A”, and never do anything until I see Woody has changed the DEFCON Level.
My question is in regards to KB4014981. Is it safe to install? I read it caused some problems regarding Windows Powershell which my computer has (Windows 7 Pro 64 bit), but I am not sure what it does.
Keep up the good work. You have a legion of followers who rely on you!
-
-
The cumulative Security and Quality Rollup for .NET is thought to be telemetry-free and is safe to install.
There is a Security=only Update (non-cumulative) that is available through the MS Catalog for manual install if you want to do that.
You can find the information on both on MS Software Update Services website1 user thanked author for this post.
-
-
-
-
-
-
Thank you so much. So there are advantages to running older machines, after all!
1 user thanked author for this post.
-
-
-
-
-
1 user thanked author for this post.
-
Haswells are two generations too old to worry about being blocked. You’re safe there.
1 user thanked author for this post.
-
-
In Windows Update, click on “change settings”
If there is a check box that says “Give me updates for other Microsoft Products,” check it and agree to Microsoft Update. In the box at the end (if one pops up) click on “keep current settings” NOT “recommended settings.If the box is not there, go to this website click on your version of Office, and follow the instructions to do the updates.
1 user thanked author for this post.
-
It ain’t pretty. [See the full post at: MS-DEFCON 3: Time to get patched but, man, what a mess this month]
Along with your books, you should sell T-shirts and mugs: “I Survived DEFCON-3”
2 users thanked author for this post.
I had previously used Intel’s Processor Identification Utility to determine my computer has a
Haswell processor.Today, I installed KB4014981 (.NET) and KB4015549 (Windows 7) on my system and after rebooting everything seems to be fine.
-
-
-
-
as optional there was this intel patch again and it was checked, so i unchecked it. and i hid the april preview thingamajigs, which was not checked.
In the “optional updates” list, the patches are always unchecked. UNCHECKED means it will not be installed. There is no reason to deal with the patches in the “optional updates” list at all.
It is not a good idea to hide updates. If you uncheck them they will not be installed.
1 user thanked author for this post.
-
-
-
-
-
-
-
-
-
-
-
-
-
But most of those things are UNCHECKED in the optional list. You don’t have to worry about those. You should only have to worry about the Monthly Rollup, and this month’s will disappear when next month’s comes around.
1 user thanked author for this post.
-
-
-
-
-
Not a trouble-free update this month (I’ve never had problems before).
Installed KB 4015546 by itself – after installing it requested a restart, then hung on shutdown at the usual blue screen showing “Configuring Windows Updates, 30% complete, Do not turn off your computer”. About 2 hours later I gave up and turned off the computer. It then restarted automatically and appeared to finish the configuring to 100%, then shut down and restarted automatically again, said it was configuring at 35% ( having previously claimed 100% !) and then showed the logon screen with usernames.
Then installed KB 4014661 , it hung on shutdown again at the blue screen with “Configuring Windows Updates, 30% complete, Do not turn off your computer”. Turned off the computer. It then restarted automatically and finished the configuring to 100% normally and showed the logon screen with usernames.
Then checked for updates and installed the Office, .NET and MSRT updates. Restarted without issues (but it didn’t go through the “Configuring Windows Updates, xx% complete, Do not turn off your computer” malarkey).
A check of installed updates appears to show everything was installed successfully but it is a bit concerning that it is suddenly hanging at shutdown after installation of the security update.
Are there any diagnostic checks I could/should run to ensure my system is OK?
Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie
1 user thanked author for this post.
-
Hello samak,
Try running the Belarc Advisor (one of my essential diagnostic tools): https://www.belarc.com/products_belarc_advisor . Review & discussion: https://www.lifewire.com/belarc-advisor-review-2625784 (one thing Tim Fisher seems not to have mentioned in his otherwise comprehensive discussion is that, in addition to listing missing critical updates and Hotfixes, the Belarc Advisor also detects updates that are not properly installed and functioning — even if Windows Updates suggests otherwise).
Hope this proves useful; good luck.
Cheers,
AJN
-
Yes, the check disk program to clean up any possibly mild file system corruption. Here is the easy way to check your disk, you will have to know the password to your computer’s Administrator account.
1. Open Explorer.
2. Right click on your system partition usually C: and click Properties listed on the menu.
3. Click on the Tools tab, in Error Checking click the Check button.
4. Enter your password when or if you’re asked, and follow the instructions.
5. Click the Cancel button on the Properties dialog box.
1 user thanked author for this post.
-
Hello again,
With respect to running a check disk operation (chkdsk), described above by anonymous, especially if your system drive is a SSD (solid state drive), rather than a HDD (mechanical drive), then you should first look into the drive manufacturer’s specific instructions for diagnostics and maintenance, which usually starts with a read-out of the built-in S.M.A.R.T. (Self-Monitoring, Analysis, and Reporting Technology) parameters; many manufacturers have their own tools or specific recommendations. Here are two useful articles (many others can be found via a search):
https://www.howtogeek.com/134735/how-to-see-if-your-hard-drive-is-dying/
and,
http://lifehacker.com/this-video-explains-how-to-use-smart-to-monitor-your-ha-1790792586 .
Additionally, you might also consider running the System File Checker; here are two articles on its function and use. NOTE: the first step is always to make a full backup of your drive (at the very least, all the files you cannot afford to lose):
https://www.lifewire.com/how-to-use-sfc-scannow-to-repair-windows-system-files-2626161
and,
http://www.thewindowsclub.com/how-to-run-system-file-checker-analyze-its-logs-in-windows-7-vista . (Be advised that certain custom settings, possibly including some drivers and OS updates, may need to be reintroduced afterward.)
Remember: before doing anything, read-up on the procedures you are contemplating (taking notes and / or creating your own outline of steps if necessary), have all the tools you’ll need (such as an external drive for backing-up, as well as software) then be careful and deliberate. Remember the old Chinese proverb: Measure twice; cut once.
Again, good luck.
Cheers,
AJN
1 user thanked author for this post.
-
Thanks to you and anonymous for taking the time and trouble to reply. I have done the checks and everything seems to be OK. We’ll see what happens with next month’s updates.
Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie
1 user thanked author for this post.
-
-
I’ve now installed the monthly roll-up for Windows and .Net Framework on both my Windows 7 machines, but have hidden the MSRT in each case. No issues.
I’ve also established why I haven’t been receiving Office 2010 updates since last August. Although the version number indicates it has Office 2010 SP2 installed, it was in fact listed among my hidden updates from 2013 – when I was on automatic updating so I’ve no idea how that happened. Once I installed it I got another 45 updates all of which installed ok apart from 5 which were described as not needed so presumably they’d been superseded.
1 user thanked author for this post.
-
It is safe to install the Office patches
1 user thanked author for this post.
-
DEFCON 3 and above is the go-ahead to install updates
1 user thanked author for this post.
-
Sorry, but this is the way I see DEFCONs 3 and above…
3 – Fixing security issue(s)’ severity overrides existing patch bug(s)’ severity.
4 – Some bugs remain, but easily fixed or workarounded.
5 – Fully safe.
The 0-day won’t affect me, so (with respect) I’m going to leave the April updates until either DEFCON hits 4 or 5, OR I read that the bugs are fixed/workaroundable, OR we get close to the May updates release date, whichever occurs first.
Ah… the joy of bundled patches…
Hanlon's Razor: Never attribute to malice that which can be adequately explained by stupidity.
1 user thanked author for this post.
-
-
-
Hello walker,
One trick that sometimes works is to perform the installation in Safe Mode. However, since the Windows Installer is not enabled in Safe Mode, use the utility SafeMSI.exe that comes in a tiny zip file (that you’ll want to extract under normal operation); see “SafeMSI.exe – Start Windows Installer Service in Safe Mode”: https://www.technibble.com/safemsi-exe-start-windows-installer-service-in-safe-mode/ . NOTE: before trying this procedure, run CCleaner then restart Windows; let it settle-in for a couple of minutes, reboot into Safe Mode and run SafeMSI.exe; then try installing KB4014661 again.
If that does not solve the problem, then take a look at this MS Community page, “Windows 7 update fails with code 80070308”: https://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/windows-7-update-fails-with-code-80070308/f5b42dbc-3776-4051-beb2-f4d211bb0681?page=2 which contains some suggestions — in particular, the procedure outlined in the blue box entitled “Windows Update error 80070308 solution.”
Hope this is helpful; good luck!
Cheers,
AJN
-
@AJNorth: thank you for taking the tie to post all of the information you did. Unfortunately I’m not “computer literate”, and it appears that much of it is over my head. I will check out the link you referenced, and hopefully I’ll see something that may help.
At least if the IE11 updates are cumulative, I should get what was missed with this one that i’ve had the difficulties with (???). I hope so. You are much more experienced that I am, and it makes a huge difference in your ability to deal with some of the problems which are encountered with the stand-alone downloads.
Thank you once again for providing this information! It is most appreciated! 🙂
1 user thanked author for this post.
-
Hello @walker,
You are entirely welcome!
I did not realize that you were not “computer literate” until @ch100 pointed that out to me, and I apologize for overwhelming you. Sites such as this one, with all the collective expertise available from Woody and his cadre of MVP associates (such as @ch100), are excellent sources of information and assistance.
Perhaps over time, depending on your own level of interest, you will gain information, skill and confidence. Of course, the overwhelming majority of people have a computer to use as a tool, rather than for a hobby, and it’s unfortunate that Windows requires so much care and feeding (courtesy of everyone’s friend, the Not Ready for Prime Time company in Redmond — who, if they want to know your opinion, will tell you what it is).
Take care & good luck with your rig!
Cheers,
AJN
-
-
@AJNorth: Hello, and thank you for attempting to help me get out of the “mess”, however I’m so “computer illiterate” that I don’t know nearly enough to attempt anything with which I’m not familiar. Never had any type of formal “training”, and there are many programs out there which y’all use that I know nothing about.
I do appreciate your advice, and respect your expertise, and knowledge. Thank you once again, and “Good Luck To Us All”. 🙂
1 user thanked author for this post.
If you find no joy with @AJNorth’s suggestions, have you tried right-clicking the file, and clicking Run As Administrator. Again, it may not help but is worth trying.
There is also a very slim chance the file did not download correctly, so if you haven’t tried a second download, give that a try too.
Another suggestion may be to try a clean boot, to do the install without any other software running which may interfere with it. (That link also contains details on how to reset it afterwards, for a normal boot restart.)
🙂
-
Hello Kirsty,
That is an excellent suggestion. However, my own experience has been that in some cases, the Run As Administrator option is not offered; even if it is, the Take Ownership option is almost always available, and if so, then I execute it first, then install using Run As Administrator (if available).
However, before I do either, the very first operation that I perform on a newly downloaded installer is to right-click on it, select Properties —> Unlock —> Apply —> OK; then I proceed as above (again, sometimes also resorting to the Safe Mode trick mentioned earlier).
Ain’t Windows just loads of phun [sic]?
Cheers,
AJN
-
-
TVM @walker. Sorry you were not able to install the update yet. The May update should be out very soon – I do hope that installs easily for you!
In the meantime, are you actively using IE11, or are you updating it as an OS precaution? If you are still using it, I suggest you use a different browser until you have updated it successfully.
Also, do you do malware and antivirus scans on your computer regularly? It may be worth trying a good scan, including rootkits, from another source than you regularly use.
1 user thanked author for this post.
-
@Kirsty: Thank you for your message. I NEVER use the IE11, just have been keeping it updated to ensure that all of the “other” updates to the OS are kept as they are supposed to be.
Yes, I scan the computer, and use ESET (which I note has recent announced an update to its Smart Security). Last time it announced an update, it was more for Win10 users. Hoping this time around that it will be “ready to roll” for all of its users.
Thank you, Kirsty for your helpful advice. It is always very much appreciated. 🙂
1 user thanked author for this post.
-
@Walker
I understand that you follow Group B for updating. There is a good chance that you missed some of the important patches on the way to the current state and you have no way to find out by following Group B.
If you wish to try moving to Group A as I suggested to you in another post, you would more than likely have a better experience and enhance the security of your computer in the process.1 user thanked author for this post.
-
-
Belarc Advisor would be useful if it does what it is claimed. I haven’t used it for a very long time and as such I cannot tell.
Please be aware that @walker claimed many times that even issues like DNS are difficult to understand and what I tried to offer was a simple method, already built-in Windows, without installing third-party software.
Windows Update does exactly that and there is no point in complicating things further.1 user thanked author for this post.
-
-
Thank you for the information which I think you provided once more in an earlier post.
It may be the right time to give Belarc Advisor another try.
It is difficult to test though, as I would need a partially failed update which shows as installed in Programs and Features but it is incompletely installed.
It may be forced by installing a second language on a test machine, in which case many updates already installed would need to be updated. But Windows Update will generally show the same thing.
Any idea how to produce this behaviour for a useful test?1 user thanked author for this post.
-
Hello ch100,
You are more than welcome.
As far as trying to purposefully replicate this scenario, I really haven’t a clue. These situations have occurred on a seemingly random basis, and it has actually been several months since I last experienced one (Windows 7 Pro x64); about thirty months ago or so, I ran into this on several different machines (also running Win 7 Pro x64), but the numbers of such instances have dramatically tapered off. (A few times, more than one update did not pass certification, and it turned out that some needed to be reinstalled in a particular order. And, in more than one instance, I recall having to do the reinstallation in Safe Mode.) And people wonder why Techs frequently talk to themselves… .
I hope this answer was useful; take care.
Cheers,
AJN
1 user thanked author for this post.
-
-
@ch100: Thank you so much for your reply. I am seriously considering moving to Group A, because I just cannot keep up with all of the problems that seem to be associated with the Group B. I appreciate you reiterating your previous advice, and I will once again review the problems I’ve had with the Group B.
Your outstanding expertise, and knowledge are amazing, and I appreciate you sharing it with the rest of the us. Thank you once again! 🙂
1 user thanked author for this post.
-
MS have issued non-security .net updates in the last 24hrs, as I discovered earlier today on
Description of Software Update Services and Windows Server Update Services changes in content for 2017, but the .net KB you mention (KB3102433) is from 6 months ago.The second update you were offered (KB3021917) is an upgrade preparation/telemetry/CEIP one!
This update performs diagnostics in Windows 7 Service Pack 1 (SP1) in order to determine whether performance issues may be encountered when the latest Windows operating system is installed. Telemetry is sent back to Microsoft for those computers that participate in the Windows Customer Experience Improvement Program (CEIP). This update will help Microsoft and its partners deliver better system performance for customers who are seeking to install the latest Windows operating system.
If you aren’t planning to upgrade, you won’t be needing that.
1 user thanked author for this post.
-
Windows 7 SP1 x64 up-to-date until just before Apr 11 2017. Now I am being offered http://support.microsoft.com/kb/3008923
1 user thanked author for this post.
Perhaps the supersedence chain will be updated with the May updates. If this is an UNCHECKED optional, it should be ignored by default.
Regarding KB3008923, on my system, it was checked and under “Important”.
And yes, as I said, let’s see if this is corrected before or with May 9 Patch Tuesday.1 user thanked author for this post.
-
Just checked one of my machines – same thing.
Thanks1 user thanked author for this post.
-
See article on main Blog https://www.askwoody.com/forums/topic/december-2014-ie-patch-kb-3008923-is-back/
1 user thanked author for this post.
-
If you have any of the Office Viewers installed, you will get updates for their components. For example, if you have Word Viewer installed, you get some Word patches b/c the Viewer is actually a cut down version of Word.
1 user thanked author for this post.
-
-
Any proof? or just the usual FUD? 🙂
1 user thanked author for this post.
-
https://docs.microsoft.com/en-us/dotnet/articles/core/tools/telemetry
https://www.microsoft.com/net/dotnet_library_license.htm
1 user thanked author for this post.
-
-
-
Viewing 44 reply threads - This topic has 159 replies, 32 voices, and was last updated 8 years ago by
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Where’s the cache today?
by 6 hours, 11 minutes ago
-
Ascension says recent data breach affects over 430,000 patients
by 13 hours, 17 minutes ago
-
Nintendo Switch 2 has a remote killing switch
by 42 minutes ago
-
Blocking Search (on task bar) from going to web
by 6 hours, 52 minutes ago
-
Windows 10: Microsoft 365 Apps will be supported up to Oct. 10 2028
by 23 hours, 25 minutes ago
-
Add or Remove “Ask Copilot” Context Menu in Windows 11 and 10
by 23 hours, 32 minutes ago
-
regarding april update and may update
by 1 day, 1 hour ago
-
MS Passkey
by 2 hours, 57 minutes ago
-
Can’t make Opera my default browser
by 1 day, 8 hours ago
-
*Some settings are managed by your organization
by 19 hours, 25 minutes ago
-
Formatting of “Forward”ed e-mails
by 1 day, 7 hours ago
-
SmartSwitch PC Updates will only be supported through the MS Store Going Forward
by 2 days, 3 hours ago
-
CISA warns of hackers targeting critical oil infrastructure
by 2 days, 12 hours ago
-
AI slop
by 6 hours, 13 minutes ago
-
Chrome : Using AI with Enhanced Protection mode
by 2 days, 13 hours ago
-
Two blank icons
by 1 day, 1 hour ago
-
Documents, Pictures, Desktop on OneDrive in Windows 11
by 2 days, 22 hours ago
-
End of 10
by 3 days, 1 hour ago
-
Single account cannot access printer’s automatic duplex functionality
by 1 day, 23 hours ago
-
test post
by 3 days, 7 hours ago
-
Privacy and the Real ID
by 2 days, 21 hours ago
-
MS-DEFCON 2: Deferring that upgrade
by 23 hours, 38 minutes ago
-
Cant log on to oldergeeks.Com
by 3 days, 11 hours ago
-
Upgrading from Win 10
by 1 day, 23 hours ago
-
USB webcam / microphone missing after KB5050009 update
by 2 days, 2 hours ago
-
TeleMessage, a modified Signal clone used by US government has been hacked
by 4 days, 3 hours ago
-
The story of Windows Longhorn
by 3 days, 14 hours ago
-
Red x next to folder on OneDrive iPadOS
by 4 days, 5 hours ago
-
Are manuals extinct?
by 1 day, 5 hours ago
-
Canonical ditching Sudo for Rust Sudo -rs starting with Ubuntu
by 4 days, 14 hours ago
Remembering Woody
