MS-DEFCON 4 – all clear to install updates

Topic

New Reply

Well it’s time to close the year and the month on patching.  If you haven’t already done so, install them now and get ready to say goodbye to Adobe Fl
[See the full post at: MS-DEFCON 4 – all clear to install updates]

Susan Bradley Patch Lady

6 users thanked author for this post.

jburk07, Pepsiboy, SueW, abbodi86, rexr, geekdom

Reply | Quote

Replies

Make your backups now:

• Sometimes updates are confusing.
• Sometimes updates are ill-behaved.

Every day is backup day.

Carpe Diem {with backup and coffee}
offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
online▸ Win11Pro 22H2.22621.1778 x64 i5-9400 RAM16GB HDD Firefox114.0b8 MicrosoftDefender

1 user thanked author for this post.

rc primak

Reply | Quote

@sb, I believe you put an incorrect link on the home page under the MSDEFCON4 post.

https://www.askwoody.com/forums/topic/computerworld-all-clear-to-install-updates should be https://www.askwoody.com/forums/topic/ms-defcon-4-all-clear-to-install-updates.

I think you mistakenly added “computerworld” to the link instead of “ms-defcon-4”.  Here’s to a Happy New Year 🙂

Win 10 ver. 22H2 x64

1 user thanked author for this post.

rc primak

Reply | Quote

Fixed it. Thanks.

1 user thanked author for this post.

JD

Reply | Quote

I have a problem with a link in that Computer World article. Since it might be off-topic here, I’ve posted the problem at #2323285,

Reply | Quote

I’ve read Ed Tittel’s article in Computer World about the way that optional updates are being handled now in Win10. (Alert: You have to register as a business before you can read the article, though.)

The article seems to indicate that this is a change in versions 2004 and 20H2. Or does it include version 1909?

Does this mean that we do not have to configure the GUI in 1909 (if the change includes 1909) or configure the Group Policy in 2004/20H2 to exclude optional updates from WU?

Reply | Quote

The settings for controlling updates that are present in the GUI (the actual window for Windows Update) in 1909 are removed from that location in 2004 and beyond.

They still exist, though, but you have to use the Group Policy editor to get to them. The Group Policy editor is only available to those running the Pro edition of Windows 10, or an enterprise edition of Windows 10. For those running Windows 10 Home, you can edit the registry in certain locations to produce the desired results.

Instructions for how to proceed with keeping Windows Update configured to your liking are located in an AKB written by @PKCano, and its number is 2000016. This covers both versions 1909 and earlier as well as 2004 and beyond. There are also instructions for those running the Home edition of Windows 10 who will need to edit the registry in certain places.

The link above, as you may have noticed, will lead you directly to the AKB article itself. Because it is quite involved, there is a separate thread dedicated exclusively to questions about the AKB contents, including folks’ questions about clarifying some of the contents. That thread is located here.

I hope this helps.

1 user thanked author for this post.

rc primak

Reply | Quote

I know all that. 🙂 That’s why I said “configure the GUI in 1909” and “configure the Group Policy in 2004/20H2”. In other words, I am aware that there are different sections in AKB2000016 for 1909 versus 2004/20H2.

I am asking how the December patch for 1909 and for 2004/20H2 affect what’s in AKB 2000016.

Reply | Quote

In what little I was able to read of Ed Tittel’s article, it seems as if all he’s doing is describing the changes in the GUI for Windows Update from 1909 to 2004 and 20H2. Hopefully the article describes just how to effect the “lost” changes in Group Policy and the registry, since they’re not in the GUI any more!

BTW, if you ever see a Computerworld article tagged in the title area with the little green tag of “Insider”, that article will require signing up for business-related stuff from Computerworld. It’s been that way for a few years, now.  🙁  because they’ve had some great stuff behind that wall.

As you’ve seen in the AKB here on AskWoody, those changes then dictate doing things a little differently in 2004 and beyond than they were done in 1909 and prior.

You’re right, though, @PKCano ‘s the best person to answer just how the December updates either will or won’t affect the settings described in the AKB.

2 users thanked author for this post.

rc primak, WCHS

Reply | Quote

I might have gotten things twisted up here. Since Susan Bradley’s latest blog was about Microsoft’s latest patches, I presumed that the latest patch (the December Patch Tuesday one) provided the new GUI screens that Tittel describes. But, from what you say here, Tittel’s article (though dated Dec 22, 2020 and included in Bradley’s blog about the latest patches), is not about the “latest” and is only a description of what is, was, and has been intrinsic to the 2004/20H2 update – i.e., was there when they were released. And that the December patch for 1909 doesn’t make these new GUI screens available in 1909.

1 user thanked author for this post.

rc primak

Reply | Quote

I would think that a monthly update would not make such a major change (adding or removing things from the GUI), but that such changes would be reserved for the Feature Updates (like from 1909 to 2004 or from 2004 to 20H2, for example). If I’m wrong on this, anyone reading this post please feel free to let me know and refresh my memory.

1 user thanked author for this post.

WCHS

Reply | Quote

There was the “Meet Now” feature update to 1909 (and later versions) recently. But, that’s what might be called a minor feature update?

A major feature update from Microsoft’s point of view, I’m sure — for the general, everyday user and for schools, Zoom and Google Meet have been making it big in the online audio and web conferencing business.

1 user thanked author for this post.

rc primak

Reply | Quote

I was wondering how that Meet Now critter showed up i the Notification Area. Now I know. And it has been duly disabled, along with Save To One Drive and People (Contacts). I HATE a cluttered Taskbar or Notification Area!

-- rc primak

1 user thanked author for this post.

rontpxz81

Reply | Quote

@pkcano: As for optional updates and drivers, what is the effect of the December patch with regard to recommendations for
a) the GUI setting for FU in 1909
b) in 1909 when preparing for 2004 (see last paragraph of #2323240), and by implication for GP settings in 2004?

I ask because the FU setting, for 1909 at least, includes the Preview category and I have it set to “1” to preclude them (the “1”, instead of “365”, since I also have TRV=1909).

Reply | Quote

I updated for December after  receiving this post, and all went well.  I was wondering whether it is safe to delay beginning my 35 day pause delay until the day before the next Patch Tuesday in January?  That way, I won’t reach the limit a week before the February Patch Tuesday, and possibly before Defcon-4 kicks in.

1 user thanked author for this post.

snalmond

Reply | Quote

That’s OK. You won’t run out of Pause that way.

2 users thanked author for this post.

snalmond, Jasmo1046

Reply | Quote

Thanks for this. Two questions if I may:

 

1. Does this mean now safe to update from 1909 to 2004 or all the way to 20H1?
2. I am concerned on CHKDSK and have several mentions of this in other threads. For here, =you mention chkdsk /scan rather than /f. There is a task called chkdsk that runs every morning on my computer and does not say which it runs. It says Proactive Scan and Actions are Custom Handler. What should be done to this? I have SSD primary and two external spinning disks.

Thanks.

Reply | Quote

rebop2020 wrote:

Does this mean now safe to update from 1909 to 2004 or all the way to 20H1?

It means it’s safe to install the December patches.

Reply | Quote

The chkdisk issue is supposedly fixed now. Though, the Update’s KB Number and description have not been updated by Microsoft.

-- rc primak

Reply | Quote

It has been noted as a known and resolved issue on KB4592438 for at least nine days.

Windows 11 Pro version 22H2 build 22621.1778 + Microsoft 365 + Edge

Reply | Quote

[rexr]

(Deleted previous post on MS’s confusing nomenclature for Win10 updates.)

 

Thanks Susan, i updated to Win10 20H2 latest cumultive update to 20H2 19042.685 on a desktop and laptop, both are non-business.

Win10 Pro 20H2,backups with Macrium Reflect home edition

• This reply was modified 2 years, 5 months ago by rexr.

Reply | Quote

2004 is NOT 1909.

2 users thanked author for this post.

WildBill, rexr

Reply | Quote

PKCano wrote:

rebop2020 wrote:

Does this mean now safe to update from 1909 to 2004 or all the way to 20H1?

It means it’s safe to install the December patches.

Sorry, still confusing. Forgive me. SO I should NOT yet update to 2004 or further? Only something that updates 1909?

Reply | Quote

Yes, that is correct, only install the monthly update(s) for December for whichever version of Windows you are on. If you are on 1909 then install the December updates for 1909, if you are on 2004 then install the December updates for 2004 for example.

The current guidance for upgrading to a newer version of Windows 10 is: DO NOT upgrade from 1909 to 2004 or 20H2 yet, and DO NOT upgrade from 2004 to 20H2 yet. If you are still on 1809 or 1903, upgrade to 1909.

2 users thanked author for this post.

WildBill, rebop2020

Reply | Quote

Susan, just a reminder – Office Updates are all still marked deferred.  Office 2016, 2013, and 2010.  I’ve got five 12/8 Office 2010 updates waiting nicely in my WU.  Are there any problems with them still?

Experience is that marvelous thing that enables you recognize a mistake as soon as you make it again.

Reply | Quote

Charlie wrote:

Susan, just a reminder – Office Updates are all still marked deferred.  Office 2016, 2013, and 2010.

Where? They’re not marked deferred in the Master Patch List.

Windows 11 Pro version 22H2 build 22621.1778 + Microsoft 365 + Edge

1 user thanked author for this post.

rc primak

Reply | Quote

Yes, the Master Patch List.  They must have just been approved and updated because I checked there before I sent my post, and they were still marked deferred at that time.  Thanks for letting me know.

Experience is that marvelous thing that enables you recognize a mistake as soon as you make it again.

1 user thanked author for this post.

rc primak

Reply | Quote

FWIW I installed 5 December Office 2010 updates on a Win 7 x64 Pro computer several days ago. No issues.

3 users thanked author for this post.

jburk07, Charlie, SueW

Reply | Quote

Bob99 wrote:

Yes, that is correct, only install the monthly update(s) for December for whichever version of Windows you are on. If you are on 1909 then install the December updates for 1909, if you are on 2004 then install the December updates for 2004 for example.

The current guidance for upgrading to a newer version of Windows 10 is: DO NOT upgrade from 1909 to 2004 or 20H2 yet, and DO NOT upgrade from 2004 to 20H2 yet. If you are still on 1809 or 1903, upgrade to 1909.

Thanks for that clarification. Much appreciated.

Reply | Quote

OK, now having checked the patchlist and my update history, wushowhide I find that I have never installed, hidden or been offered these two:

KB4559309      KB4592449

309 is the Edge update from September so that surprised me. Also, still seem to be a number of sites that “claim” that still has issues.

449  is the Dec update for 1909. I have CU’s set to delay 7 days, so I should have seen that offered by now, no?

What do you think I should do about both of these?

Thanks.

Reply | Quote

In your current situation, the current DEFCON level of 4 is for patch KB4592449, so go ahead and install that one since that is the December patch for Windows 10 1909.

Reply | Quote

Agreed. But it has not yet been offered in Win Updates. And as mentioned, the Edge update was never offered as well. That is what is making me more curious. If 449 is offered, I will accept it. But why not offered? Hmm. Maybe I will do a reboot just to see.

Reply | Quote

You could try downloading it from the Microsoft Update Catalog and installing it by itself if Windows Update doesn’t offer it to you.

There are many different reasons why Windows Update is not currently offering the update to you, but that’s beyond the scope of this thread’s topic.

Please feel free to post a question in the Windows 10 version 1909 forum and folks there will be able to help you figure out why you’re not being offered the update. Click the highlighted text above to go directly there.

Reply | Quote

Bob99 wrote:

You could try downloading it from the Microsoft Update Catalog and installing it by itself

Microsoft Update Catalog doesn’t seem to have KB4529964.

Reply | Quote

I have NO idea where Susan got that number from. The link in her Computerworld article simply refers you to a KB article that has a list on the left side of the page that eventually gives you a link to the December update for 1909 and 1903, KB4592449. I think that’s the one she meant to include in her article, but I could be wrong. What say you @SB ? 😉

@WCHS , if you want to get the December update for 1909, you can try through Windows Update or you can go get it from the Update Catalog, the choice is yours. I just checked, and the Catalog does indeed have KB4592449. Just make sure to get the correct one for your installation i.e. you probably want to ignore any listing that says anything about “ARM64” in the title.

2 users thanked author for this post.

rc primak, WCHS

Reply | Quote

Bob99 wrote:

The link in her Computerworld article simply refers you to a KB article that has a list on the left side of the page that eventually gives you a link to the December update for 1909 and 1903, KB4592449.

Yes, I had no idea of what to look for once I got to the list on the left side of the page. I was still looking for KBKB4529964 and had no inkling that, once there, I should be looking for KB4592449.

Thanks for straightening that out.

Reply | Quote

FYI: Not all KB numbers are patches. Some are only support pages with information.

2 users thanked author for this post.

rc primak, WCHS

Reply | Quote

I installed the December rollup on 2 win 8.1 Pro x64 computers last night. No issues.

2 users thanked author for this post.

JD, abbodi86

Reply | Quote

So, I have a little question: What is still wrong with 2004 and 20H2 that is making upgrading unwise?

Reply | Quote

Read Susan’s ComputerWorld article linked in the main blog post.

Reply | Quote

This is a “it depends”.  I’m running 2004 at the office/20h2 at home.  Those that have Conexant audio drivers are still blocked from 2004.  I’m waiting until January to give the all clear you need to move off 1909 just because the holidays are not always the greatest time to do major feature upgrades if people are doing other things and you can’t get help in a timely manner.

Susan Bradley Patch Lady

2 users thanked author for this post.

rc primak, Chris B

Reply | Quote

I’ll wait for my pause updates to expire to get that many more days once the patches get installed to delay Jan 2021’s patches but I do have one question about running Windows 10 with secure boot disabled as my Mint 20 dual boot install has its Realtek Wifi(Open Linux Version) driver blocked from loading if secure boot is enabled in the BIOS.

Reply | Quote

[Bob99]

… but I do have one question about running Windows 10 with secure boot disabled as my Mint 20 dual boot install has its Realtek Wifi(Open Linux Version) driver blocked from loading if secure boot is enabled in the BIOS.

Please start a new thread in the forums about that question under the specific version of Windows 10 you’re currently running (1902, 1909, 2004, 20H2, etc.) and you will get answers there.

To get you started, here’s a link to the starting point for Windows support questions. Look for the link on that page that mentions the version you’re currently using and click on it. That will put you in the correct forum for asking your question.

https://www.askwoody.com/forums/forum/askwoody-support/windows/

• This reply was modified 2 years, 5 months ago by Bob99. Reason: added link for support forums

Reply | Quote

I have 1909 installed and when I resume, Windows update force 2004 installation. I always pause, Resume and install when it’s safe to update and I Never Ever click on install that 2004 version. I think I will pause my computer for the next 3 year to not install that patch specially when I known this version have issue with my laptop.

Reply | Quote

anonymous wrote:

Windows update force 2004 installation

You can limit what version WU allows via the TRV registry entry.
See the details in AKB 2000016

cheers, Paul

1 user thanked author for this post.

rc primak

Reply | Quote

December patches installed with no problems to report on Win 8.1 🙂

Installation Successful: Windows successfully installed the following update: 2020-12 Security Monthly Quality Rollup for Windows 8.1 for x64-based Systems (KB4592484)

Win 10 ver. 22H2 x64

2 users thanked author for this post.

maisy2, DrBonzo

Reply | Quote

How do you keep Adobe Flash? I do not want it uninstall. There are several programs that still use it and need flash to be left alone. Should skip updates? Or do better is disconnect from internet?

Reply | Quote

Do you have a list of these programs?  As they will be putting you at risk.  Are you an enterprise or single user?

 

https://www.csoonline.com/video/105080/how-to-securely-prepare-for-adobe-flash-end-of-life-on-windows-10

You can skip the update temporarily, but at some point in time it should be removed.

Susan Bradley Patch Lady

Reply | Quote

How can you tell whether one has old Edge, new Edge, Legacy Edge, or Chromium Edge?
I have two icons on my Desktop for Edge.

The Blue E one in Settings says “Microsoft Edge 44.18362.449.0 and
Microsoft EdgeHTML 18.18363” The Beta one says “Version 88.0.705.29 (Official build) beta (64-bit)” Among the ones you mention in your video (old Edge, new Edge, Legacy Edge and Chromium Edge), which are these two?

I ask because you say that currently Edge and the new Edge block Flash Player, but IE and the old Edge still support it? What about Legacy Edge and Beta Edge?

Reply | Quote

You have Old legacy edge and Beta Edge.  Ultimately Microsoft plans to remove Flash completely and not support it.

Susan Bradley Patch Lady

Reply | Quote

So, we just wait until Microsoft removes it?

Or alternatively, with Windows 10 Pro, we can use GP>Local Computer Policy>Administrative Templates>Windows Components>Microsoft Edge>Allow Adobe Flash (disable) to prevent old Legacy Edge and IE from invoking Flash Player?

Is Beta Edge already coded to block Flash Player in the same way that you demonstrate in the video that the new Edge blocks it?

Reply | Quote

To be completely safe, all Flash Player components need to be removed completely from the computer. There is vulnerable code which will no longer be patched after December, 2020. Complete removal of all flash components is a tricky business, and Microsoft’s patch will not do the whole job properly.

I await articles in early 2021 which may advise as to how to fully protect ourselves against this threat.

-- rc primak

3 users thanked author for this post.

jburk07, WCHS, Charlie

Reply | Quote

I just stuck a firewall ruleset on the executable remnant of the MS integrated adobe/macromedia flash, systemwow64 folder somewhere.

Keeping IT Lean, Clean and Mean!

Reply | Quote

It won’t be much of a threat in two weeks when no one can use it:

To help secure users’ systems, Adobe will block Flash content from running in Flash Player beginning January 12, 2021.

Adobe Flash Player EOL General Information Page

Windows 11 Pro version 22H2 build 22621.1778 + Microsoft 365 + Edge

1 user thanked author for this post.

rc primak

Reply | Quote

I think that item on Adobe’s site is referring to installations based on Adobe’s installer for non-MS browsers only. In other words, installations that have been from an installer gotten directly from Adobe for Chrome, Firefox and other non Active X based browsers.

I think that’s why MS is releasing their own Flash disabler. I say disabler because as we’ve already seen here, it doesn’t yet eliminate all traces of it from a Windows installation, just the more prominent ones.

Reply | Quote

So I decided to go ahead and upgrade to Win 10 Pro 20H2 today. I got a nasty surprise. I could not get any installation method to do a non-destructive install of the Feature Update. The Windows Update installer and the Update Assistant both quit at about 83% completion with the error code which says some vital system files were missing. DISM, scf /scannow and a few troubleshooters did nothing to resolve the issue.

So I bit the bullet and prepared the Media Creation Tool, and ran the installer for a clean install. the Windows Installer insisted it had run into an unknown error, but upon restarting, I did indeed have a fresh install of Windows 10 Pro 20H2, and I am now reinstalling drivers and software before doing my final tweaks to restore my system.

How this happened was that setting the Group Policies to Notify but not download and install updates leaves the Windows Update visible queue with updates showing and ready for download.  The only way to clear unwanted updates and not download and install them from that situation is to reset the Windows Updates components, sometimes with brutal thoroughness. And this messes up future Feature Updates through Windows Update and through the Update Assistant. Requiring a clean Windows install, which itself may show errors.

This is a bitter lesson learned that we no longer really have any safe way to control when we receive Windows Updates, nor any safe way to control which updates we download and install. Wushowhide was no help in any of this. Once the downloads show up in the queue, they are destined to be installed unless extraordinary steps are taken, which messes up Windows Update for future Feature Updates.

At least this ha been my experience since the Advanced Options disappeared from the Windows Update GUI.

-- rc primak

1 user thanked author for this post.

Sueska

Reply | Quote

Oh ****! 😭🤬🤬

Just when we thought we had it covered!

However, I wonder if we’re still OK using wushowhide to hide updates before WU “realizes” they’re available so that they technically never show up in WU’s list of available updates until we’re ready to install them by unhiding them?

Reply | Quote

Did you try hiding the pending updates except the Feature upgrade, then clearing the WU queue (NOT resetting Windows Update components, just clearing the queue)? I have never seen that happen with previous upgrades, but I have not yet upgraded my 2004 to 20H2.

Did you try TargetReleaseVersion by designating 20H2?

Reply | Quote

[rc primak]

How do you clear the queue? I haven’t found any way to do this in my Windows 10 Pro since about version 1803.

The methods which worked previously don’t seem to actually clear the cache properly lately. I have just looked into a couple of online articles which try to explain and simplify the instructions which are supposed to work. If I succeed in getting anything to work in Win 10 Pro 20H2, I’ll post in the Lounge .

-- rc primak

• This reply was modified 2 years, 4 months ago by rc primak.
• This reply was modified 2 years, 4 months ago by rc primak.

Reply | Quote

AKB2000013 – read the discussion below as weii. @Matador came up with another method added on.

Reply | Quote

@Matador’s method risks getting everything downloaded, as you pointed out then. Otherwise, something similar might work.

-- rc primak

Reply | Quote

Update — I finally had an occasion to test clearing the Windows 10 update queue using documented methods a little while ago.

My mistake was taking the online advice to mean that the Software Distribution Folders themselves should be deleted. What works is deleting the contents of those Folders, but not the Folders themselves.

There’s also a trick involving renaming Catroot2, but leaving Catroot intact. All methods combined worked (there are about four variations), and all leave the Updates History intact. Combined with wushowhide, it is possible to nondestructively clear the updates queue.

Resetting Windows Update should not be necessary, as long as the Automatic Updates Service and BITS and Crypto Services are stopped, the necessary folder emptying is done, then the Services are restarted (And the PC is restarted).

-- rc primak

Reply | Quote

AKB2000013 does not involve clearing the S/W Distribution or Catroot2 folders. Read again.
It is only about clearing the Windows Update queue’s cache and causing WU to rescan, thus refreshing the cache, after hiding the unwanted updates so they no longer show up in the queue.
What’s in the queue is what is doenloaded – WYSIWYG

Reply | Quote

[WCHS]

rc primak wrote:

How do you clear the queue? I haven’t found any way to do this in my Windows 10 Pro since about version 1803.

I haven’t found a way either.

rc primak wrote:

Update — I finally had an occasion to test clearing the Windows 10 update queue using documented methods a little while ago.

Where are the “documented” methods you mention here? In the past, I’ve followed the instructions in AKB2000013 and Matador’s instructions, but they haven’t worked.

I’m still on 1909. Recently, I encountered a situation where I needed to clear the queue. Here’s the reason: I had hidden the January patches on January 12 at 4:03 PM EST so that I could install them later with the Download button when DEFCON would be 3+. But, immediately after I had hidden them at 4:03, the WU queue updated (the screen said 4:02 PM) and these January patches were listed with a Download button to install. Since I had hidden them, I wasn’t expecting Download button to appear. I checked wushowhide and they were designated as still hidden. So, I just waited for the WU queue to automatically update again. It did a day later and then the WU display was clear.

I wasn’t’ sure that waiting a day would clear things up, but that was my only choice since I had never been able to clear the queue successfully in the past and I didn’t want to chance it this time.

• This reply was modified 2 years, 4 months ago by WCHS.

Reply | Quote

From my Notes at the time:

Note the web references and follow their instructions, but be careful to avoid doing what I think I did wrong.

All these steps are not necessarily needed by everyone in every instance. Try the least-technical and least-destructive methods first, then progress deeper only if needed.

I finally got all the parts together to fix the Windows Updates Stuck In Queue issue left over by PK Cano (AskWoody Lounge Moderator)’s settings to defer Widnows 10 Windows Updates from dowloading and installing in the Pro Version, 2004 and higher. It’s an unholy mess!! But it worked today. Got rid of the CU and MSRT, as well as rehiding Silverlight. wushowhide shows all succeeded, and is also useful in setting the hidden status of the updates which I want out of the queue. It took four articles of online info to get this to work:

How to delete Downloaded, Failed & Pending Windows Updates
https://www.thewindowsclub.com/delete-downloaded-failed-pending-windows-updates

What is Catroot & Catroot2 folder? How do you reset catroot2 folder in Windows 10
https://www.thewindowsclub.com/catroot-catroot2-folder-reset-windows

FixWin for Windows 10: Repair problems and issues with a click
https://www.thewindowsclub.com/fixwin-for-windows-10

List of fixes available in FixWin 10
https://www.thewindowsclub.com/list-of-fixes-available-in-fixwin-10

There is a sequence, and Powershell or Elevated Command Prompt are used to stop Windows Services while the Folders get renamed or deleted. Mostly, contents, not whole Folders, have to be deleted. One or more Restarts will be required. Then run wushowhide before running Windows Update. Download means essentially the same thing as Look For Updates at that point.

These instructions include some steps not present in PK Cano’s AWL posts. (And the steps I took beyond those recommended steps may not be needed in most cases.)

Especially Reset Catroot2. That’s the key ingredient I was missing when I munged Win 10 Pro 1909. That and not deleting the whole Software Distribution ecosystem, but only its contents — after stopping all interfering Windows Update Services (Windows Automatic Updates, BITS and Crypto).

Copying this entry as a Sticky. DO NOT USE Automated Tools to do these jobs! Those Tools can get seriously outdated and leave the System seriously munged. NO Third-Party Tools or Scripts!

-- rc primak

1 user thanked author for this post.

WCHS

Reply | Quote

Another way to fix a misbehaving machine is to 1. let it do a feature update to the next version or 2. do an inplace repair over the top.  I’ve used both methods when dism didn’t work.

Susan Bradley Patch Lady

Reply | Quote

[sheldon]

Just wondering how does one know if the “magic” fix for chkdsk /f in KBKB4586853 had been implemented on one’s PC?  Susan mentioned in another thread that a group policy change via downloadable MSI file for commercial setups.   Should I see these changes on my PC too? I have no intention of using chkdsk /f on my SSD, but just curious.

• This reply was modified 2 years, 4 months ago by sheldon.
• This reply was modified 2 years, 4 months ago by sheldon.

1 user thanked author for this post.

SkipH

Reply | Quote

I am new to the Lounge. Still learning how to post. Susan gave the go ahead to install the December patches. I am on version 1909 using Windows 10 Home. I selected Settings > Update & Security and unpaused updates. KB4592449 was nowhere to be found. I was told that my system was up to date. The “Check for updates” link was back and 20H2 was offered for download and install.

Out of curiosity I selected the “View Update History” link and the update was not found there. On the update history page I selected “Uninstall Updates” and KB4592449 was listed and showed an install date of 12/19/2020. Does this mean that it is really installed even though it does not show in update history?

Not to confuse the issue, I am not saying that if it did install, it installed while I was paused. After a Patch Tuesday I don’t always pause the full 35 days. I pause for shorter periods of time and I guess I did not do a very good job keeping up with it. Lesson learned.

Reply | Quote

In the taskbar search box type winver and press Enter.
If it tells you you have version 1909 Build 18363.1256 you have KB4392449 already installed.

Reply | Quote

Thank you. I will make note of that.

Reply | Quote

Only doing security updates for 8.1 and no issues

Reply | Quote

sheldon wrote:

Just wondering how does one know if the “magic” fix for chkdsk /f in KBKB4586853 had been implemented on one’s PC?

The fix is on Microsoft’s server side, not as a Windows update, unless you download the GP fix.

Reply | Quote

Given chkdsk is run locally, how is the fix done MS server side?

cheers, Paul

Reply | Quote

I’ve been following the simple defer updates till near the next patch Tuesday.  But when I resume, the updates include a .NET preview with no choice about installing it.  I have not messed with any settings.  What am doing wrong?

Reply | Quote

NET previews always turn up uninvited. We suggest you hide them – they will turn up as a real patch after the “previewers” have beta tested it for MS.

cheers, Paul

Reply | Quote

[Nibbled To Death By Ducks]

Installed:

2020-12 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4592471), rechecked, was offered SSU update,

2020-12 Servicing Stack Update for Windows 7 for x64-based Systems (KB4592510)

and that one FAILED. The message was, “Windows is still installing another update.”

“The Heck you say,” (I said some other things too, but this is a family friendly forum), “you’ve been sitting here as quiet as a kitten for 10 minutes!”

Rebooted, tried again and the SSU installed fine. Huh! Guess it got a byte or bit stuck in it’s throat. Guess the reboot was a Heimlich Maneuver for it.

Well, the main chute failed, but the emergency ‘chute opened, so I guess we’re OK…never saw that one before. Ever.

OK, Mungo go back to cave and Win 7 now…. 🙂

Win7 Pro SP1 64-bit, Dell Latitude E6330, Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Greenhorn
--
"...all the people, all the time..."Peter Ustinov ad-lib in "Logan's Run"

• This reply was modified 2 years, 4 months ago by Nibbled To Death By Ducks.

Reply | Quote

Windows 10 1909 Home here, just reporting successfully installing the following December updates without hiccups on my system: KB4592449 (2020-12 CU) and Office 2013 patches.

Reply | Quote

I have updates deferred only 7 days and still have not been offered KB4592449 , nor is it in wushowhide as hidden nor showing installed. Baffled why?

 

Same with KB4559309. Not be offered or found.

What might be the issue?

Reply | Quote

In the taskbar search box, type winver and hit Enter.
What version and Build do you have?

Reply | Quote

Reply | Quote

[PKCano]

That’s February’s Build. You haven’t been getting updates since Feb 2020.
You have some setting somewhere blocking updates – Group Policy, third party Windows Update blocker/controller, something.

Look in Windows Update\Update History
When was your last update? Have any failed since then (error code if so).

What third party update blocker are you running? Have you run in the past?

• This reply was modified 2 years, 4 months ago by PKCano.

Reply | Quote

Thanks for taking an interest.

wushowhide.only one tool. I did try WUMGR once but did not like it.

I had this mess with the 2006 Printer update. I had figured what the hell, so tried to install. Three times. Failed every one so blocked in show hide.

Stopped getting Defender updates in March I think. Likely because you could no longer run even a portion of Defender with third party AV (ESET NOD32).

Had been offered 2004 several times and hidden. Now 20H2 is hidden. Along With the aforementioned printer.

Here is the list:

Feature Update 1909 11/27/2019 Success
All of the Office 2010 Quality Updates 12/17/20 Success
Cumulative .NET 3.5 and 4.8 10/20/20 Success

Realtek Driver 12/28/20 Success but I manually installed this one
M’soft printer 6/22/2006 6.1.7233.1 3 fails 11/27/20
Buncha drivers all success from 11/16/20 back

Definition updates – lotsa failures last 4/8/20
Last success 3/28/20 then a ton more failures 3/25/20

Malicious software last success 11/17/20 All successes before hand

Hidden:

Can be Hidden:

 

Reply | Quote

OK, create a Topic in the Win10 1909 Forum with the title “Unable to update Win10 v1909 since Build 18363.657” and let’s see if we can undo all the stuff you’ve been doing lately and get you fixed.

Reply | Quote

That would be great. Will do tomorrow. But not sure there is much to undo. I have looked at a lot of things, but not made changes. Let’s see where it goes.

 

Thanks.

Happy New Year.

Reply | Quote

2004 installed itself on November 6 with no subsequent problems noticed.

Winver now reads:  OS Build 19041.685

Update history (Other Updates) shows KB4586876 Cumulative Update Preview for .NET Framework 3.5 and 4.8 for Windows 10, version 2004 was installed on December 28, the day I followed Susan’s “OK to install” notice.

As I remember (though my short-term memory sucks!), there were two updates listed for downloading and installation, the NET update above and the December CU update for 2004. However, the latter has not yet (?) appeared on the Update history page (Quality Updates). I have the feeling I screwed up the download by turning off the computer after the NET install was finished and the screen had gone blank for a very very long time, and there was no further notification regarding the CU.

I generally let MS Update do its thing with no interference on my part or hiding updates via the extra programs frequently mentioned, other than the full 35-day pause at the start of each month and the Resume updates when DEFCON goes up at the end of the month.

Defender updates have arrived as usual every day, and oddly the MS Printer driver updates every day as well.

Am I up to date or not? Is there another place, e.g., Speccy or Belarc Advisor, that I can find the December CU registered?  Should I try installing the patch manually (with a link to instructions, please) or should I just let it ride until the January updates since everything seems to be working, more or less?

Reply | Quote

The upgrade contained the Dec updates. Build 19041.685 is the latest (Dec) Build.
It will show the upgrade, but not the individual CU. The Build # tells you that withing the upgrade.

1 user thanked author for this post.

Wayne

Reply | Quote

I received in WU this weekend an update for FlashPlayer for Windows 10 V. 1909. Did anyone else receive this update? Found it strange since FlashPlayer EOL was last week!

Reply | Quote

Are you sure it’s not the flash removal patch? What is the KB number?

cheers, Paul

Reply | Quote

Thanks Paul. KB4580325. Says security update for flash player 2020-10. I hid the update. Went to microsoft catalog but could not find the uninstall for flashplayer for windows 10 Version 1909.

Reply | Quote

taftbaby wrote:

Went to microsoft catalog but could not find the uninstall for flashplayer for windows 10 Version 1909.

https://www.catalog.update.microsoft.com/Search.aspx?q=remove%20flash%201909

Windows 11 Pro version 22H2 build 22621.1778 + Microsoft 365 + Edge

Reply | Quote

[blueboy714]

Help – I have Windows 10 home and I am currently on 1909 because we are at DEFCON 4.  I am trying to install my December updates and one of the updates is “Feature update to Windows 10 – version 2004.

Is MS now forcing version 2004 down people’s throat without any choice??  What the heck is going on?

Woody discussed this in an article a few months ago – https://www.computerworld.com/article/3561597/some-win10-pcs-are-apparently-being-upgraded-to-version-2004-without-consent.html

The reports I’ve seen point to a combination of factors:

• The Win10 1903 or 1909 PC must be “ready to upgrade” according to Microsoft’s magic “AI;”
• You have “Pause updates” turned on;
• Either the “Pause” expires, or you manually turn it off (possibly by altering a Registry setting, possibly by clicking “Resume updates”).

I am manually turning on the pause.

PS – I turned off the updates until I heard from those that know more than me.

Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
OS build 19045.2965

• This reply was modified 2 years, 4 months ago by blueboy714.
• This reply was modified 2 years, 4 months ago by blueboy714.
• This reply was modified 2 years, 4 months ago by blueboy714.

Reply | Quote

I have 1909 on my relatively new Lenovo laptop, and just started the update procedure after pausing it.  It is installing the 1909 update, without any hint of 2004.  So, it doesn’t appear that Microsoft is automatically forcing 2004 here.

Reply | Quote

Would you consider updating to Pro?  This is why I recommend pro, this is why I recommend using the targeted release setting.  You have much more options to control updates.  It should still be an optional update in the update window not a forced.

Susan Bradley Patch Lady

Reply | Quote

Jasmo1046 wrote:

I have 1909 on my relatively new Lenovo laptop, and just started the update procedure after pausing it.  It is installing the 1909 update, without any hint of 2004.  So, it doesn’t appear that Microsoft is automatically forcing 2004 here.

Don’t know if this help but the first 2 updates it tries to make on my PC are:

 

Feature update to Windows 10 version 2004

Intel system – 2040.100.0.1029

Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
OS build 19045.2965

Reply | Quote

Set TRV if you want to stay on the 1909 in the short term.

+Setting Target Release Version – This can be used to specify when Preview Builds and Feature Updates are received instead of using feature update deferrals

cheers, Paul

Reply | Quote

Susan Bradley wrote:

Would you consider updating to Pro?  This is why I recommend pro, this is why I recommend using the targeted release setting.  You have much more options to control updates.  It should still be an optional update in the update window not a forced.

Thanks Susan for responding. Had I known there were so many dangerous differences between home and pro when I bought Win10 I would bought pro. I wouldn’t have a problem installing 2004 other than all of the negative things I’ve heard about it and the fact that isn’t that much different from 1909.  Regarding switch from home to pro a couple questions:

Don’t you have to have all updates installed before switching from home to pro?

Can I run same programs/apps on pro that I am currently running on home?

How much time does it take to update from home to pro and what is the cost?

Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
OS build 19045.2965

Reply | Quote

Switching from Home to Pro is easy.
The cost is $100 US on the MS Store.
To switch, all you need to do is change the license key to the Pro key. the rest happens automatically.

There is a way to prevent the forced upgrade to v2004 (if it hasn’t happened yet).
In AKB2000016 Section 2 look for TargetReleaseVersion. There are two commands you need to do, to keep you on v1909. When you are ready to move to v2004, the only thing you need to do is change the 1909 in one of the commands to 2004. There are screenshots below the text to show you where the settings are.

Reply | Quote

On a machine with a SSD drive, normally it’s less than 10 minutes of time.  Everything you ran on Home runs on Pro.  You don’t have to have all updates installed.

Start, Gear settings icon, click on system, then on about, scroll down until you see the Windows 10 Home, right below that is a link to “Change product key or upgrade your edition of windows”.  You can buy a key independently from Microsoft online and enter the key there, or click on that link and go through the process to purchase a key.

Susan Bradley Patch Lady

Reply | Quote

[blueboy714]

Thank you everyone.  I ended installing 2004 so I could get December updates – it’s frustrating that MS shoves things down your throat like that.  I am a bit worried because my PC uses a lot of ASUS products – which were causing problems with some people earlier.  Fortunately ASUS must have figured out workarounds for MS 2004 bug issues and – SO FAR – every thing seems ok.  Cross my finger/knock on wood.

Thanks for the info on converting Win 10 home to pro.  I will research a bit and figure out which route I want to go for my home PC (heck – my employer is still using Win7).

Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
OS build 19045.2965

• This reply was modified 2 years, 4 months ago by blueboy714.

Reply | Quote

Exactly the same thing happened to me on my  W10 Home Dell laptop. I turned off Pause and Version 2004 proceeded to install. I was taken aback, because I hadn’t wanted or expected to install this Feature Update yet, but decided to bite the bullet and so far have had no major issues. At least the experience will give me confidence in updating my W10 Pro desktop PC (my main computer) to 2004 come the spring. So far I have put off updating the laptop to W10 Pro because I only use it as backup, but I think maybe I should. The problem is, I may need a bit of I.T. support to manage the transition (I am 70) and I can’t get that at the moment because we’re in lockdown where I live.

Reply | Quote

IM not so HO pause is not a good setting.  This is why I recommend pro.  If you have the targeted setting in place you’d get exactly what you would want on your computer.  I am going to be recommending 2004 next week so all is not lost.

Susan Bradley Patch Lady

1 user thanked author for this post.

blueboy714

Reply | Quote

Hello Surfing Pensioner, I’m a tad older than you and upgraded to W10 Pro easy peasy; I’m a half smart half dumb computer user.  However, I totally follow PK Cano’s advice on what to do with Windows 10 Pro – you can’t go wrong.  Read all the suggested information and then re-read it.  Slowly take it a step at a time and ‘Bob’s your uncle.”  The folk here on Ask Woody will steer you in the right direction. Good luck.

Reply | Quote

blueboy714 wrote:

Had I known there were so many dangerous differences between home and pro when I bought Win10 I would bought pro

There are no dangerous differences.
There is no danger in updating when MS wants you to – millions do it without issue.

It is prudent to take care with updates as you don’t want to be forced to update when you are in the middle of something important. It is also prudent to “not be the first” with any product or upgrade, just in case something isn’t quite right.

As always, backup regularly and ask for advice if you are unsure.

cheers, Paul

Reply | Quote

Susan Bradley wrote:

I am going to be recommending 2004 next week

Are you going to be recommending 2004 before next week’s patch Tuesday?

Reply | Quote

Why wait till next week, install it now if you want.

cheers, Paul

1 user thanked author for this post.

280park

Reply | Quote

Re: Successfully upgraded to Windows 10 2004

I upgraded my Windows 10 Pro version 1909 to version 2004 as follows:

1. Disconnected from internet.
2. Reset feature deferral from 365 days to 0 days.
3. Using group policy set target feature update version to 2004.
4. Reconnected to internet.
5. Using the graphical user interface of the Windows Update page clicked resume updates.

On my slow internet connection Windows 10 version 2004 took 3 hours, 17 minutes to download. Installation was much faster but involved about 4 automatic restarts. Finally, I paused updates for 35 days.

Everything seems to be working O. K. The only thing that I noticed that is a bit odd is how updates are being reported:

1. Under “View update history” the only update that is displayed is the just completed feature update to 2004. All the previous updates are gone.
2. Under “Installed Updates” in the control panel only two updates are displayed, KB4592438 (the 2004 feature update) and KB4593175 (the servicing stack update).

Reply | Quote

280park wrote:

the only update that is displayed is the just completed feature update to 2004

That is consistent with you having installed the latest fully patched version from MS.

cheers, Paul

1 user thanked author for this post.

280park

Reply | Quote