|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
Well it’s time to close the year and the month on patching. If you haven’t already done so, install them now and get ready to say goodbye to Adobe Fl
[See the full post at: MS-DEFCON 4 – all clear to install updates]
Susan Bradley Patch Lady/Prudent patcher
Make your backups now:
Every day is backup day.
@sb, I believe you put an incorrect link on the home page under the MSDEFCON4 post.
https://www.askwoody.com/forums/topic/computerworld-all-clear-to-install-updates should be https://www.askwoody.com/forums/topic/ms-defcon-4-all-clear-to-install-updates.
I think you mistakenly added “computerworld” to the link instead of “ms-defcon-4”. Here’s to a Happy New Year 🙂
Win 10 ver. 22H2 x64
Fixed it. Thanks.
The settings for controlling updates that are present in the GUI (the actual window for Windows Update) in 1909 are removed from that location in 2004 and beyond.
They still exist, though, but you have to use the Group Policy editor to get to them. The Group Policy editor is only available to those running the Pro edition of Windows 10, or an enterprise edition of Windows 10. For those running Windows 10 Home, you can edit the registry in certain locations to produce the desired results.
Instructions for how to proceed with keeping Windows Update configured to your liking are located in an AKB written by @PKCano, and its number is 2000016. This covers both versions 1909 and earlier as well as 2004 and beyond. There are also instructions for those running the Home edition of Windows 10 who will need to edit the registry in certain places.
The link above, as you may have noticed, will lead you directly to the AKB article itself. Because it is quite involved, there is a separate thread dedicated exclusively to questions about the AKB contents, including folks’ questions about clarifying some of the contents. That thread is located here.
I hope this helps.
In what little I was able to read of Ed Tittel’s article, it seems as if all he’s doing is describing the changes in the GUI for Windows Update from 1909 to 2004 and 20H2. Hopefully the article describes just how to effect the “lost” changes in Group Policy and the registry, since they’re not in the GUI any more!
BTW, if you ever see a Computerworld article tagged in the title area with the little green tag of “Insider”, that article will require signing up for business-related stuff from Computerworld. It’s been that way for a few years, now. 🙁 because they’ve had some great stuff behind that wall.
As you’ve seen in the AKB here on AskWoody, those changes then dictate doing things a little differently in 2004 and beyond than they were done in 1909 and prior.
You’re right, though, @PKCano ‘s the best person to answer just how the December updates either will or won’t affect the settings described in the AKB.
I might have gotten things twisted up here. Since Susan Bradley’s latest blog was about Microsoft’s latest patches, I presumed that the latest patch (the December Patch Tuesday one) provided the new GUI screens that Tittel describes. But, from what you say here, Tittel’s article (though dated Dec 22, 2020 and included in Bradley’s blog about the latest patches), is not about the “latest” and is only a description of what is, was, and has been intrinsic to the 2004/20H2 update – i.e., was there when they were released. And that the December patch for 1909 doesn’t make these new GUI screens available in 1909.
I would think that a monthly update would not make such a major change (adding or removing things from the GUI), but that such changes would be reserved for the Feature Updates (like from 1909 to 2004 or from 2004 to 20H2, for example). If I’m wrong on this, anyone reading this post please feel free to let me know and refresh my memory.
There was the “Meet Now” feature update to 1909 (and later versions) recently. But, that’s what might be called a minor feature update?
A major feature update from Microsoft’s point of view, I’m sure — for the general, everyday user and for schools, Zoom and Google Meet have been making it big in the online audio and web conferencing business.
I was wondering how that Meet Now critter showed up i the Notification Area. Now I know. And it has been duly disabled, along with Save To One Drive and People (Contacts). I HATE a cluttered Taskbar or Notification Area!
-- rc primak
I updated for December after receiving this post, and all went well. I was wondering whether it is safe to delay beginning my 35 day pause delay until the day before the next Patch Tuesday in January? That way, I won’t reach the limit a week before the February Patch Tuesday, and possibly before Defcon-4 kicks in.
(Deleted previous post on MS’s confusing nomenclature for Win10 updates.)
Thanks Susan, i updated to Win10 20H2 latest cumultive update to 20H2 19042.685 on a desktop and laptop, both are non-business.
Yes, that is correct, only install the monthly update(s) for December for whichever version of Windows you are on. If you are on 1909 then install the December updates for 1909, if you are on 2004 then install the December updates for 2004 for example.
The current guidance for upgrading to a newer version of Windows 10 is: DO NOT upgrade from 1909 to 2004 or 20H2 yet, and DO NOT upgrade from 2004 to 20H2 yet. If you are still on 1809 or 1903, upgrade to 1909.
Susan, just a reminder – Office Updates are all still marked deferred. Office 2016, 2013, and 2010.
Where? They’re not marked deferred in the Master Patch List.
Yes, the Master Patch List. They must have just been approved and updated because I checked there before I sent my post, and they were still marked deferred at that time. Thanks for letting me know.
You could try downloading it from the Microsoft Update Catalog and installing it by itself
Microsoft Update Catalog doesn’t seem to have KB4529964.
I have NO idea where Susan got that number from. The link in her Computerworld article simply refers you to a KB article that has a list on the left side of the page that eventually gives you a link to the December update for 1909 and 1903, KB4592449. I think that’s the one she meant to include in her article, but I could be wrong. What say you @SB ? 😉
@WCHS , if you want to get the December update for 1909, you can try through Windows Update or you can go get it from the Update Catalog, the choice is yours. I just checked, and the Catalog does indeed have KB4592449. Just make sure to get the correct one for your installation i.e. you probably want to ignore any listing that says anything about “ARM64” in the title.
This is a “it depends”. I’m running 2004 at the office/20h2 at home. Those that have Conexant audio drivers are still blocked from 2004. I’m waiting until January to give the all clear you need to move off 1909 just because the holidays are not always the greatest time to do major feature upgrades if people are doing other things and you can’t get help in a timely manner.
Susan Bradley Patch Lady/Prudent patcher
… but I do have one question about running Windows 10 with secure boot disabled as my Mint 20 dual boot install has its Realtek Wifi(Open Linux Version) driver blocked from loading if secure boot is enabled in the BIOS.
Please start a new thread in the forums about that question under the specific version of Windows 10 you’re currently running (1902, 1909, 2004, 20H2, etc.) and you will get answers there.
To get you started, here’s a link to the starting point for Windows support questions. Look for the link on that page that mentions the version you’re currently using and click on it. That will put you in the correct forum for asking your question.
https://www.askwoody.com/forums/forum/askwoody-support/windows/
Windows update force 2004 installation
You can limit what version WU allows via the TRV registry entry.
See the details in AKB 2000016
cheers, Paul
December patches installed with no problems to report on Win 8.1 🙂
Installation Successful: Windows successfully installed the following update: 2020-12 Security Monthly Quality Rollup for Windows 8.1 for x64-based Systems (KB4592484)
Win 10 ver. 22H2 x64
How can you tell whether one has old Edge, new Edge, Legacy Edge, or Chromium Edge?
I have two icons on my Desktop for Edge.
The Blue E one in Settings says “Microsoft Edge 44.18362.449.0 and
Microsoft EdgeHTML 18.18363” The Beta one says “Version 88.0.705.29 (Official build) beta (64-bit)” Among the ones you mention in your video (old Edge, new Edge, Legacy Edge and Chromium Edge), which are these two?
I ask because you say that currently Edge and the new Edge block Flash Player, but IE and the old Edge still support it? What about Legacy Edge and Beta Edge?
To be completely safe, all Flash Player components need to be removed completely from the computer. There is vulnerable code which will no longer be patched after December, 2020. Complete removal of all flash components is a tricky business, and Microsoft’s patch will not do the whole job properly.
I await articles in early 2021 which may advise as to how to fully protect ourselves against this threat.
-- rc primak
It won’t be much of a threat in two weeks when no one can use it:
To help secure users’ systems, Adobe will block Flash content from running in Flash Player beginning January 12, 2021.
So I decided to go ahead and upgrade to Win 10 Pro 20H2 today. I got a nasty surprise. I could not get any installation method to do a non-destructive install of the Feature Update. The Windows Update installer and the Update Assistant both quit at about 83% completion with the error code which says some vital system files were missing. DISM, scf /scannow and a few troubleshooters did nothing to resolve the issue.
So I bit the bullet and prepared the Media Creation Tool, and ran the installer for a clean install. the Windows Installer insisted it had run into an unknown error, but upon restarting, I did indeed have a fresh install of Windows 10 Pro 20H2, and I am now reinstalling drivers and software before doing my final tweaks to restore my system.
How this happened was that setting the Group Policies to Notify but not download and install updates leaves the Windows Update visible queue with updates showing and ready for download. The only way to clear unwanted updates and not download and install them from that situation is to reset the Windows Updates components, sometimes with brutal thoroughness. And this messes up future Feature Updates through Windows Update and through the Update Assistant. Requiring a clean Windows install, which itself may show errors.
This is a bitter lesson learned that we no longer really have any safe way to control when we receive Windows Updates, nor any safe way to control which updates we download and install. Wushowhide was no help in any of this. Once the downloads show up in the queue, they are destined to be installed unless extraordinary steps are taken, which messes up Windows Update for future Feature Updates.
At least this ha been my experience since the Advanced Options disappeared from the Windows Update GUI.
-- rc primak
How do you clear the queue? I haven’t found any way to do this in my Windows 10 Pro since about version 1803.
The methods which worked previously don’t seem to actually clear the cache properly lately. I have just looked into a couple of online articles which try to explain and simplify the instructions which are supposed to work. If I succeed in getting anything to work in Win 10 Pro 20H2, I’ll post in the Lounge .
-- rc primak
How do you clear the queue? I haven’t found any way to do this in my Windows 10 Pro since about version 1803.
I haven’t found a way either.
Update — I finally had an occasion to test clearing the Windows 10 update queue using documented methods a little while ago.
Where are the “documented” methods you mention here? In the past, I’ve followed the instructions in AKB2000013 and Matador’s instructions, but they haven’t worked.
I’m still on 1909. Recently, I encountered a situation where I needed to clear the queue. Here’s the reason: I had hidden the January patches on January 12 at 4:03 PM EST so that I could install them later with the Download button when DEFCON would be 3+. But, immediately after I had hidden them at 4:03, the WU queue updated (the screen said 4:02 PM) and these January patches were listed with a Download button to install. Since I had hidden them, I wasn’t expecting Download button to appear. I checked wushowhide and they were designated as still hidden. So, I just waited for the WU queue to automatically update again. It did a day later and then the WU display was clear.
I wasn’t’ sure that waiting a day would clear things up, but that was my only choice since I had never been able to clear the queue successfully in the past and I didn’t want to chance it this time.
From my Notes at the time:
Note the web references and follow their instructions, but be careful to avoid doing what I think I did wrong.
All these steps are not necessarily needed by everyone in every instance. Try the least-technical and least-destructive methods first, then progress deeper only if needed.
I finally got all the parts together to fix the Windows Updates Stuck In Queue issue left over by PK Cano (AskWoody Lounge Moderator)’s settings to defer Widnows 10 Windows Updates from dowloading and installing in the Pro Version, 2004 and higher. It’s an unholy mess!! But it worked today. Got rid of the CU and MSRT, as well as rehiding Silverlight. wushowhide shows all succeeded, and is also useful in setting the hidden status of the updates which I want out of the queue. It took four articles of online info to get this to work:
How to delete Downloaded, Failed & Pending Windows Updates
https://www.thewindowsclub.com/delete-downloaded-failed-pending-windows-updates
What is Catroot & Catroot2 folder? How do you reset catroot2 folder in Windows 10
https://www.thewindowsclub.com/catroot-catroot2-folder-reset-windows
FixWin for Windows 10: Repair problems and issues with a click
https://www.thewindowsclub.com/fixwin-for-windows-10
List of fixes available in FixWin 10
https://www.thewindowsclub.com/list-of-fixes-available-in-fixwin-10
There is a sequence, and Powershell or Elevated Command Prompt are used to stop Windows Services while the Folders get renamed or deleted. Mostly, contents, not whole Folders, have to be deleted. One or more Restarts will be required. Then run wushowhide before running Windows Update. Download means essentially the same thing as Look For Updates at that point.
These instructions include some steps not present in PK Cano’s AWL posts. (And the steps I took beyond those recommended steps may not be needed in most cases.)
Especially Reset Catroot2. That’s the key ingredient I was missing when I munged Win 10 Pro 1909. That and not deleting the whole Software Distribution ecosystem, but only its contents — after stopping all interfering Windows Update Services (Windows Automatic Updates, BITS and Crypto).
Copying this entry as a Sticky. DO NOT USE Automated Tools to do these jobs! Those Tools can get seriously outdated and leave the System seriously munged. NO Third-Party Tools or Scripts!
-- rc primak
Just wondering how does one know if the “magic” fix for chkdsk /f in KBKB4586853 had been implemented on one’s PC? Susan mentioned in another thread that a group policy change via downloadable MSI file for commercial setups. Should I see these changes on my PC too? I have no intention of using chkdsk /f on my SSD, but just curious.
.
.
Installed:
2020-12 Security Monthly Quality Rollup for Windows 7 for x64-based Systems (KB4592471), rechecked, was offered SSU update,
2020-12 Servicing Stack Update for Windows 7 for x64-based Systems (KB4592510)
and that one FAILED. The message was, “Windows is still installing another update.”
“The Heck you say,” (I said some other things too, but this is a family friendly forum), “you’ve been sitting here as quiet as a kitten for 10 minutes!”
Rebooted, tried again and the SSU installed fine. Huh! Guess it got a byte or bit stuck in it’s throat. Guess the reboot was a Heimlich Maneuver for it.
Well, the main chute failed, but the emergency ‘chute opened, so I guess we’re OK…never saw that one before. Ever.
OK, Mungo go back to cave and Win 7 now…. 🙂
Win7 Pro SP1 64-bit, Dell Latitude E6330 ("The Tank"), Intel CORE i5 "Ivy Bridge", 12GB RAM, Group "0Patch", Multiple Air-Gapped backup drives in different locations. Linux Mint Newbie
--
"The more kinks you put in the plumbing, the easier it is to stop up the pipes." -Scotty
That’s February’s Build. You haven’t been getting updates since Feb 2020.
You have some setting somewhere blocking updates – Group Policy, third party Windows Update blocker/controller, something.
Look in Windows Update\Update History
When was your last update? Have any failed since then (error code if so).
What third party update blocker are you running? Have you run in the past?
Thanks for taking an interest.
wushowhide.only one tool. I did try WUMGR once but did not like it.
I had this mess with the 2006 Printer update. I had figured what the hell, so tried to install. Three times. Failed every one so blocked in show hide.
Stopped getting Defender updates in March I think. Likely because you could no longer run even a portion of Defender with third party AV (ESET NOD32).
Had been offered 2004 several times and hidden. Now 20H2 is hidden. Along With the aforementioned printer.
Here is the list:
Feature Update 1909 11/27/2019 Success
All of the Office 2010 Quality Updates 12/17/20 Success
Cumulative .NET 3.5 and 4.8 10/20/20 Success
Realtek Driver 12/28/20 Success but I manually installed this one
M’soft printer 6/22/2006 6.1.7233.1 3 fails 11/27/20
Buncha drivers all success from 11/16/20 back
Definition updates – lotsa failures last 4/8/20
Last success 3/28/20 then a ton more failures 3/25/20
Malicious software last success 11/17/20 All successes before hand
Hidden:
Can be Hidden:
The upgrade contained the Dec updates. Build 19041.685 is the latest (Dec) Build.
It will show the upgrade, but not the individual CU. The Build # tells you that withing the upgrade.
Help – I have Windows 10 home and I am currently on 1909 because we are at DEFCON 4. I am trying to install my December updates and one of the updates is “Feature update to Windows 10 – version 2004.
Is MS now forcing version 2004 down people’s throat without any choice?? What the heck is going on?
Woody discussed this in an article a few months ago – https://www.computerworld.com/article/3561597/some-win10-pcs-are-apparently-being-upgraded-to-version-2004-without-consent.html
The reports I’ve seen point to a combination of factors:
I am manually turning on the pause.
PS – I turned off the updates until I heard from those that know more than me.
Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
Dell Laptop - Inspiron 15 11th Generation Intel(R) Core(TM) i5-1135G7 Processor
Edition Windows 11 Home
Version 23H2
Thank you everyone. I ended installing 2004 so I could get December updates – it’s frustrating that MS shoves things down your throat like that. I am a bit worried because my PC uses a lot of ASUS products – which were causing problems with some people earlier. Fortunately ASUS must have figured out workarounds for MS 2004 bug issues and – SO FAR – every thing seems ok. Cross my finger/knock on wood.
Thanks for the info on converting Win 10 home to pro. I will research a bit and figure out which route I want to go for my home PC (heck – my employer is still using Win7).
Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
Dell Laptop - Inspiron 15 11th Generation Intel(R) Core(TM) i5-1135G7 Processor
Edition Windows 11 Home
Version 23H2
IM not so HO pause is not a good setting. This is why I recommend pro. If you have the targeted setting in place you’d get exactly what you would want on your computer. I am going to be recommending 2004 next week so all is not lost.
Susan Bradley Patch Lady/Prudent patcher
Why wait till next week, install it now if you want.
cheers, Paul
the only update that is displayed is the just completed feature update to 2004
That is consistent with you having installed the latest fully patched version from MS.
cheers, Paul
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
