• MS-DEFCON 4: Installing just the updates

    Home » Forums » Newsletter and Homepage topics » MS-DEFCON 4: Installing just the updates


    ISSUE 20.26.1 • 2023-06-27 By Susan Bradley If you recall, earlier this month Microsoft released an update that needed some additional steps — manuall
    [See the full post at: MS-DEFCON 4: Installing just the updates]

    Susan Bradley Patch Lady/Prudent patcher

    10 users thanked author for this post.
    Viewing 30 reply threads
    • #2569067

      This one is weird KB5021130: How to manage the Netlogon protocol changes related to CVE-2022-38023.

      Read the whole article a couple of times and I don’t get it.

      April 11, 2023 – Initial enforcement phase
      The Windows updates released on or after April 11, 2023 will remove the ability to disable RPC sealing by setting value 0 to the RequireSeal registry subkey.
      June 13, 2023 – Enforcement by Default
      The RequireSeal registry subkey will be moved to Enforced mode unless Administrators explicitly configure to be under Compatibility mode. 
      July 11, 2023 – Enforcement phase
      The Windows updates released on July 11, 2023 will remove the ability to set value 1 to the RequireSeal registry subkey.
      And then it says “the registry key RequireSeal is not added by the updates – you have to to it yourself.” So if I don’t create that key, nothing will be enforced??
      Also, if I check the registry path, I notice a key RequireSignOrSeal, so what’s that doing?
    • #2569101

      So if I don’t create that key, nothing will be enforced??

      Because this is a change with immediate effect on a DC it must be done with care and planning.

      cheers, Paul

    • #2569097

      this post is currently tagged as Plus members only – please make available to all

    • #2569104

      You talk about Microsoft wanting changes to registry keys for this update.  Unless someone reads the update info, how would someone even know about this?   The average user is just going to let their PC update and that’s it.

      • #2569135

        The average user is just going to let their PC update and that’s it.

        That’s all the average user needs to do. Susan said:

        My position on this matter has been that I did not recommend taking the additional steps unless you knew that you or your firm was specifically being targeted. Microsoft’s notes indicated that it would be releasing a future update that would not require manual intervention

    • #2569109

      Hello Susan:

      The free version of the Alert doesn’t seem to have link for it.  Not that I could find anyway.


    • #2569152

      Any comment on the .NET updates issues (see MS KB article) from this past Patch Tuesday? I assume anyone applying the June updates now will get the .NET patch referenced in that MS article.

    • #2569198

      Just wanted to point out that Firefox is actually at 114.02 now.  The Master Patch list for June 27th says to update to 114.01.

      • #2569249

        I’ll be refreshing the list tonight as the optional windows updates just came out.  I’ll update the Firefox entry as well.

        Susan Bradley Patch Lady/Prudent patcher

    • #2569235

      No problems encountered with June patches via WU and catalog OoB on two 22H2 win 10 devices (x86 and x64). The ‘out of support’ Win8.1 x64 devices have had their patches and OoB patches with no adverse effects to the systems over the last couple of weeks.

      Win8.1/R2 Hybrid lives on..
      2 users thanked author for this post.
    • #2569255

      Guinea Pig Update (Moments, Moments, Moments)
      Version and build after update: Win11Pro 22H2.22621.1928

      WuMgr downloaded and installed:

      • 2023-06 Cumulative Update Preview for Windows 11 Version 22H2 for x64-based Systems (KB5027303)

      Installed without error and the system rebooted without error.
      System rebooted twice during update.

      On permanent hiatus {with backup and coffee}
      offline▸ Win10Pro 2004.19041.572 x64 i3-3220 RAM8GB HDD Firefox83.0b3 WindowsDefender
      offline▸ Acer TravelMate P215-52 RAM8GB Win11Pro 22H2.22621.1265 x64 i5-10210U SSD Firefox106.0 MicrosoftDefender
      online▸ Win11Pro 22H2.22621.1992 x64 i5-9400 RAM16GB HDD Firefox116.0b3 MicrosoftDefender
      2 users thanked author for this post.
    • #2569286

      Just a heads up.

      I installed the 2023-06 Cumulative Update Preview for Windows 11 Version 22H2 for x64-based Systems (KB5027303) today. No problems except I discovered it turned the snipping tool back on which I had turned off weeks ago.

      Edition Windows 11 Pro
      Version 23H2
      Installed on ‎10/‎19/‎2022
      OS build 22631.2715

      2 users thanked author for this post.
    • #2569420

      (reposting more accurately under the June 2023 updates post here)

      The June updates for Office 2013 seem to be missing from the latest (June 27th) updates list, which still lists the May updates.

      I’ve received the updates below to install. I’ve checked for any possible alerts about them elsewhere on the net, but find nothing, so should I assume these are OK?

      • KB5002414 — Security Update for Microsoft Excel 2013
      • KB5002382 — Security Update for Microsoft Outlook 2013

      Many thanks for any help on these.

      1 user thanked author for this post.
    • #2569561

      2016 office updates some of the KB#s are incorrect.

    • #2569565

      Up until recently, I was using Windows 7 with ESUs,  but I have recently bought a Windows 10 computer to replace it,  and I’m in the process of trying to figure out how to block the monthly updates until Susan Bradley gives the OK to go ahead and update for each month.  The computer is a Windows 10 Professional Edition with Version 22H2 and an ethernet connection.  I purchased Woody’s book “Windows 10 All-in-One for Dummies”,  and that book indicated that I could use a Metered Connection method to block the updates,  and so that’s what I tried for the month of June.  So the metered connection has been on until Susan changed the DEFCON to Level 4 on June 27,  at which time I turned the metered connection off.  However, when I looked at my update history today to see whether updates were installed as a result of turning the metered connection off,  I see that there weren’t’ any updates installed after turning the metered  connection off,  but there was an update installed back on June 20,   namely security update KB5027215,  and there were also a couple of .NET Framework updates installed on June 17 and June 20 .  I was surprised by this because the book says the “…the metered connection setting guards against just about any patches except Microsoft Defender updates….”.   So I have a few questions:  (1) Why didn’t the Metered Connection setting prevent the updates that occurred on June 20 and June 17?     (2) It appears like I might need to supplement the metered connection method by also using the “Pause Updates”  method.  Is that correct?     (3)  Should I also be  disabling the Office updates for Office 2021 until such time as Susan gives the go-ahead each month for the Windows Operating System?  Or is the go-ahead for Office on a different schedule from the Windows Operating system?

      I will appreciate any advice you can provide.

      • #2569611

        Just my two cents, until/unless someone of the more experienced users on the forum can provide better/more complete answers:

        (1) My experience from when I was relying only on turning on the “Metered connection” setting to prevent updates is that WU will ignore that you are on a (supposedly) metered connection and still download certain updates. I can thus assume that KB5027215 and those .NET Framework updates are installed regardless that you have set your connection as metered. I seem to remember that also the periodical re-release of KB4023057 can bypass metered connections.

        (2) Yes, if you want to avoid updates until you are ready to install them one solution is to use the “Pause Updates” method. However, keep in mind that when the pause period ends (or you hit the “Resume Updates” button), WU will download and install all pending updates, including those you might wish to avoid (if any).

        (3) I don’t recall the approval for Office updates being on a different schedule than Windows updates. However, sometimes non-security updates for Office are released before the next Patch Tuesday and those are not included in the go-ahead to install updates from the previous Patch Tuesday. Also, I don’t have Office 2021, but assuming its updates work the same as Office 2013 updates, then you should not need to separately disable updates in Office 2021. I never had Office 2013 updates install behind my back with a metered connection and using “Pause Updates” also prevents Office 2013 updates. However, Office 2021 might be a different beast in this respect.

        BTW, in case it is helpful, I stopped using metered connection and Pause Updates entirely and now I only use WUMgr to handle the updates process on both W10 and W11. I have set WUMgr to block automatic Windows Updates, which prevents any updates (except Defender updates) from downloading and installing automatically. When we have the go-ahead to install updates, I let WUMgr download and install only the updates I really wish to install and hide anything I do not want (e.g. KB4023057).

        1 user thanked author for this post.
        • #2569677

          Also, I don’t have Office 2021, but assuming its updates work the same as Office 2013 updates, then you should not need to separately disable updates in Office 2021. I never had Office 2013 updates install behind my back with a metered connection and using “Pause Updates” also prevents Office 2013 updates. However, Office 2021 might be a different beast in this respect.

          It is different. Click-to-run updates are not via Windows Update:

          How to disable updates for Microsoft Office apps on Windows 10 & 11

          (But the master patch list always says “install” for these, not defer.)

          2 users thanked author for this post.
          • #2569706

            Thanks for the clarification b. I don’t have experience with Office 2021 and did not know it is updated via Click-to-run updates rather than Windows Update. If those updates are always listed as “install” in the Master Patch list, is it correct to say that the answer to L95’s question (3) is that there is no need to disable updates for Office 2021?

            1 user thanked author for this post.
      • #2569628

        See AKB2000016 for information on how to control updates in Win10 Pro using wushowhide.diagcab and Group Policy. There are screenshots at the bottom showing the location of the settings.

        1 user thanked author for this post.
    • #2569568

      The Patch Listing as of 28/06/2023, 04:51:19 has two Win 10 entries for KB5027215 and both reference the same versions 22H2/ 21H2.  The first says Defer – Preview patch, the second says Install.  Am I missing something?  Thanks.

    • #2569612

      Installed without issue the June updates on my Windows 10 Home 22H2 PC. Still need to update the Windows 11 Pro 22H2 machine and will update this post once done.

      2 users thanked author for this post.
    • #2569630

      Made a full disk image in Macrium Reflect, then installed this month’s updates. I had the same experiences as seen reported in this thread, insofar as the 2023-06 .NET Framework CU (KB5027538) prompted a restart before the June CU (KB5027215) had finished installing. Then, once both had completed the ‘Cleaning up’ phase took a few minutes to complete – again, as I’ve seen reported in this thread. However, I then signed in as normal and have faced no apparent issues since.

      Running sfc /verifyonly did find some integrity violations which were easily rectified with the /scannow switch and a reboot immediately afterwards. In the clear, it would seem.

      2 users thanked author for this post.
    • #2569695

      Hello Susan,  A question regarding the Master patch list for Windows 11 22h2.  The master patch list shows:

      Version 22H2 5027303 6/27/2023 Defer Install IF you have 22H2 Cumulative update Preview patch  – do not install

      This entry shows defer install but if you have 22h2 then install then it states Preview patch Do not install.  It is a bit confusing as to what one should do.  The write up states: “Co> preview releases and will make it into the July patch releases.”  So should I install the  preview or wait for the July releases?  Thanks very much for providing the information and  expertise.

    • #2569746

      Hello Everyone:

      Perhaps I am in the wrong forum, and I know that I am jumping ahead, but July 11 isn’t too far away.  I wonder if InControl will protect my computer from the Moments 3 update of Windows 11?

      Please tell me if you know.  If InControl doesn’t, what will?  Thanks.



      • #2569749

        InControl does not control individual updates. It controls version updates (Win10 -> Win11) and feature updates (like 21H2 -> 22H2).
        So far, “Moments” aren’t really controllable.

        1 user thanked author for this post.
      • #2569750

        Pro or Home?  And honestly in my testing I haven’t found the “gate” that Microsoft provides to hold back much.  Fortunately most of the “moments” have been either minor or ‘eh’ sort of things.

        Susan Bradley Patch Lady/Prudent patcher

        • #2569773

          Sorry, I should have mentioned Windows 11 Pro.  Thanks.

          How can I block it?



          • #2569811

            Look for this in group policy

            Susan Bradley Patch Lady/Prudent patcher

            1 user thanked author for this post.
            • #2569897

              Thanks, Susan.

              I will try it when I am on Windows.  I am on Ubuntu now.  I have Ubuntu Pro and updates go smoothly with Pro.

              It will be the first time I use Group Policy.



            • #2571894

              Excuse me Susan-I need you to debunk something regarding the update ending in 31? Should you skip the install if it effects the chrome browser since there’s a note about not installing the feature update?

    • #2569764

      Installed the June updates (CU KB5027215 and .NET KB5027797 and KB5027538) today on our Windows 10 Pro laptop without a problem. Winver is now 19045.3086. Thanks to everyone here for all the information.

      Linux Mint Cinnamon 21.1
      Group A:
      Win7 Pro x64 SP1 Haswell, 0patch Pro, dual boot with Linux, mostly offline
      Win7 Home Premium x64 SP1 Ivy Bridge, 0patch Pro,offline
      Win 10 Pro x64 v22H2 Ivy Bridge, dual boot with Linux

      3 users thanked author for this post.
    • #2569881
      3 users thanked author for this post.
    • #2569883

      I get a stubborn ERROR 0x800f0831 with this month’s update (KB5027215). My first update problem in a very long time, believe it or not.

      Tried everything I could find:



      Manually downloaded from catalog.update


      Windows 10 22H2 (OS Build 19045.2965)


      • #2570079

        Restart before attempting the install.
        Run these from an admin Command Prompt:
        sfc /scannow
        dism /Online /Cleanup-Image /RestoreHealth

        Try again.

        cheers, Paul

        1 user thanked author for this post.
      • #2570127

        It may not work, but you could try Settings -> System -> Troubleshoot -> Other Troubleshooters -> Windows Update.



    • #2569951

      InControl does not control individual updates. It controls version updates (Win10 -> Win11) and feature updates (like 21H2 -> 22H2).
      So far, “Moments” aren’t really controllable.

      Someone should invent a Moment Killer.😄


      1 user thanked author for this post.
    • #2570247

      22H2 Win 10 Pro desktop, ethernet/ Lan only. (Preface: June 10th, I  did inplace repair install. Went well, sfc/dism clean and operating). Use winshowhide & TRV.

      Today in prep for June updates, checked past weekly recent restore points-all gone?

      Ran sfc scannow & dism (no errors). Did Macrium b/up, double verified-no errors.

      Proceeded with unhiding and installing June updates CU, .Net as per patch page. Took 30 min. Ignored the .Net ‘restart’ prompt to wait for CU to install.

      Post restart, ran sfc=100 errors. (Sfc logs show none). Restart. Ran  Dism found no errors, yet the dism log shows a-plenty of fixes. Restart.

      Have yet to check all stgs, will report if anything untoward. Thought I’d post as others were having issues with lost restore pts. Only other anomaly was Edge update today did very odd things to Ublock Origin extension (faint red dotted lines & wouldn’t update filters. Restart rectified, thus reinstall not nec.) Note: I only use this PC/Edge for this site-this is no longer my daily device. Not many programs on here, count on one hand.

      • #2570251

        I know they are defcon 4 here now, but would you all say this update is safe? I am hearing a lot of strange tings about this one. I can point to no common error but many seems to have their pc messed up really bad. Better to wait and install after the 11th?

        • #2570256

          Not seeing any bad stuff reported here and my two boxes updated fine.

          Waiting until the 11th puts you into July update territory. I’d make an image backup and then update.

          cheers, Paul

        • #2570257

          I report here my anomalies, ‘edge cases’ aka not the norm. For Susan to track. The numerous followers at AW that have success don’t always post. I would surely update with June’s (as Paul said, with a backup if possible). Don’t hold off, it can only get….? 🙃 Post if you encounter a problem, the crew here will help you.

          PS the lost restore pts occurred when I went online today pre updating. Held since.

    • #2570759

      Updated 3 Win 10 pro & one Win 11 pro without incident.

      1 user thanked author for this post.
    • #2570766

      I installed the following updates on 3 Win 10 Pro systems last week:

      2023-06 Cumulative Update for .NET 3.5, 4.8 and 4.8.1   KB5027538

      2023-06 Cumulative Update for Win 10 22H2 x64   KB5027215  (Build 19045.3086)

      Windows Malicious Software Removal Tool x64 – v5.114   KB890830

      No problems have been noticed.

      1 user thanked author for this post.
    • #2570827

      Updated 2 W10 Pro and 1 W10 Home over the weekend each with the Monthly Rollup (KB5027215), .NET 3.5, 4.8, and 4.8.1 (KB5027538), and the MSRT. I did not install any of the .NET out of band patches.

      All is well, although took about 20% longer than usual.

      1 user thanked author for this post.
    • #2570901


      .NET 6.0.19 (KB5028613) June 22, 2023
      labelled Critical Updates as oppose to Security Update for .NET 6.0.18


      1 user thanked author for this post.
    • #2571763

      Question! Is it safe to install update

    • #2571856

      I use Google Chrome as my browser and, if I install the update, I might lose access to my Chrome.

      Not if Chrome is the default browser. If it isn’t make Chrome default.

      • #2571893

        I think Chrome is my default browser. I mean, I use it every day and made it my prime browser.

        Also, if you saw my attachment, there is a note by the update number regarding not installing the feature update and I saw posts on how it effects Chrome browser users.

        • #2571900

          The feature update referred to is 11/22H2, so the comment is now outdated.

          • #2571902

            So it’s safe to install the cumulative update, but what about Chrome? Like I said, I haven’t installed it yet because people had issues trying to open Chrome.

    • #2571916

      Can someone explain what’s going on with the June cumulative update? Is it safe to install? Do I have to set Chrome to my default browser before installing the update and is the conflict only when Malwarebytes conflicts with Chrome because I don’t have Nalwarebytes on my PC?

      I’m a little confused and need some clarification on this before Sunday.

      • #2571933

        You need to install June updates which are safe before July 11.
        Chrome isn’t a problem

        • #2571935

          Okay So once I install the updates, even the June cumulative, nothing will happen to Chrome right? I didn’t set it as default browser and I don’t have Malwarebytes on my computer so I should be okay to install without any issues right? Just want to make absolutely sure.

          • #2571945

            As pointed out in the original link to this problem and all those posts your search found, it only effects Chrome if you’re using certain 3rd party anti-virus S/W (primarily Malwarebytes) and the “temporary” work-around was to make Chrome your default browser.

            Malwarebytes, and other 3rd party anti-virus providers, have issued updates since this problem first appeared that fixed the problem without having to change anything about how Chrome works.

            So, if your anti-virus product is “up-to-date“, you should be good-to-go.

            Of course, as always, it’s your call whether to install an update or not.

            1 user thanked author for this post.
    • #2572774

      A bunch of out-of-band .NET updates were released on July 5th for older .NET versions like 3.5/3.51 and 2.0/3.0 for Server 2008 SP2.


      Only install if experiencing this specific issue; otherwise it’s not necessary to download & install these out-of-band .net updates.

    Viewing 30 reply threads
    Reply To: MS-DEFCON 4: Installing just the updates

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: