|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
ISSUE 20.04.1 • 2023-01-24 By Susan Bradley In general, the January updates have been well behaved. So far, I’m not seeing any trending issues with th
[See the full post at: MS-DEFCON 4: Patching weather is clearing]
Susan Bradley Patch Lady/Prudent patcher
2023-01 Update for Windows 11 Version 22H2 for x64-based Systems (KB4023057) has reared its ugly little head.
This update includes files and resources that address issues that affect the update processes in Windows that may prevent important Windows updates from being installed. These improvements help make sure that updates are installed seamlessly on your device, and they help improve the reliability and security of devices that are running Windows.
As I’ve said before, none of these ‘reviews’ are actually bad, what’s bad is the resetting it has done. No patch should reset things.
Susan Bradley Patch Lady/Prudent patcher
And I will be republishing the HTML version of the spreadsheet – it messed up.
Susan Bradley Patch Lady/Prudent patcher
Download InControl from GRC. Put it on your desktop. Set it for Win10 and whatever version you want (21H2, 22H2).
That will fix your problem.
To prevent Edge Chromium from automatically getting re-installed you need to set the following registry key.
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate]
"UpdateDefault"=dword:00000002
That key has four possible values and 2 = Manual updates only.
For full details, see Microsoft’s Update policy override default page.
Microsoft Edge download for installation: https://www.microsoft.com/en-us/edge/download?form=MA13FJ Microsoft Store installation method: https://apps.microsoft.com/store/detail/microsoft-edge-browser/XPFFTQ037JWMHS 1. How many other ways does Microsoft Edge install?
My point is that I don’t want Edge, so I’m not looking for ways to install it, just ways to permanently get rid of it. I’m making progress. In my registry I have
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate]
“DoNotUpdateToEdgeWithChromium”=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\EdgeUpdate]
“UpdateDefault”=dword:00000002
I also have manually deleted everything Edge in Program Files (x86).
Microsoft Edge has various ways of installing. Uninstalling it and getting rid of the remnants may be a tedious process depending on how it has been installed: via Microsoft Store, direct download, or bundled Microsoft update (which likely creates User App and Provisional App files). If Microsoft Edge has been installed through Microsoft Store and perhaps bundled update, Microsoft Edge must be removed from User Apps and Provisioned Apps.
After uninstalling Microsoft Edge, files are left behind which must be removed from EdgeCore and EdgeUpdate:
There are other files and folders left in User profiles such as Edge Wallet. I don’t know if these types of files need removal.
How Microsoft Edge is installed affects how to remove it and all remnants and perhaps prevent it from installing again.
FWIW, I am still receiving Security Intelligence updates for Windows 8.1 as of Jan. 26.
Mark
Microsoft Edge is a tenacious and pernicious virus for those of us who don’t want it… ever.
IMO it most definitely meets the criterion of malware.
Hi Susan,
When you say it’s okay to install the January updates, do you mean all of them on your Master Patch list for 01-24-23 or just the items on the 01-24-23 Master Patch list that says “Install”? I have only been updating the updates that say “Install” on the specific update lists, and always hide the ones you say to avoid or defer and don’t update/install until your Master Patch list says “Install”. Am I doing this correctly.
Thank you
Run WUmgr, click the Search button (circular arrows) and then hide any previews. Now you can relax until the next update cycle.
cheers, Paul
Hide: KB4023057, KB5012170 (It’s causing problems and is not recommended for installation on Susan’s Master Patch List), and KB5005463 (PH Health Check, another of MS’s “we’ll fix your computer like WE want it patches).
Sooo…basically KB4023057 is similar to COVID??
Where have I gone wrong here?
You haven’t. You may have seen it ready to install like this… and thought it was a regular Windows Update:
However, as you’ve found out, it doesn’t appear when you click on View installed updates. That’s because it’s not really a Windows Update or a Quality Update… just Microsoft fudging things.
As mentioned, you’ll find it in Control Panel > Programs and Features:
Alternatively, you’ll find it in Settings > Apps & Features:
A third way to uninstall it is to *right*-click on Start, choose Windows PowerShell (Admin) then, when the PowerShell console opens, enter cmd. This will drop you into an elevated CMD console. Now copy/paste the following and press RETURN/ENTER:
MsiExec.exe /X{89581302-705F-42C5-99B0-E368A845DAD5} /qn
This will uninstall KB4023057 silently.
Hope this helps…
Oh… I said it was just Microsoft fudging things. What I meant was that it’s not a ‘regular’ install for several reasons.
Although it can be uninstalled using MsiExec.exe, it’s not actually installed via a downloaded MSI file.
Instead, it uses a tiny 20KB stub installer or programming shim:
I found the uninstall string in the registry:
… but for some reason couldn’t uninstall it via PowerShell:
Start-Process "C:\Windows\System32\msiexec.exe" -ArgumentList "/x{89581302-705F-42C5-99B0-E368A845DAD5} /qn"
I suspect I may have got the syntax wrong.
I took a look at what this latest (Jan 2023) release of KB4023057 actually does from the moment I clicked on the Install now button in the Settings user interface (using Process Monitor).
Note: I ran this test on a clean install of Windows 10 Pro 22H2 that had had Windows 10 Decrapifier run on it to remove bloatware but no other changes as all, cetainly not to the Windows Update mechanism.
From clicking Install now to completion was only ~10 seconds. I looked at 3 specific areas of activity afterwards – file system, network and registry.
Network:
There was almost no network activity apart from a few UDP receives (from a IP address in Redmond) and a single UDP send from my test laptop to my router by process svchost.exe. I tend to think of UDP traffic as mostly innocuous are you there queries, much like the ping command. I saw no evidence of any outbound TCP connections, ‘phoning home’ for example.
File System:
There was very little file system activity apart from multiple WriteFile events by process SystemSettings.exe to a UpdateUX.<guid>.ETL log within C:\ProgramData\USOShared\Logs\User\. This was entirely expected.
There were also multiple CreateFile\QueryBasicInformation\CloseFile events (but no WriteFile events) in temporary file locations (like C:\Windows\Temp and C:\Windows\ServiceProfiles\NetworkServices\AppData\Local\Temp) by process svchost.exe, almost like a permission check for file access (i.e. read/write/delete). This was unexpected but not unusual except for how often the same cycle of events was repeated in the same location, almost like ‘let me just check that one more time’.
I saw no evidence of any new or changed system files related to Windows Update (or its related components like UpdateOrchestrator), i.e. this wasn’t an update to the existing mechanism.
Registry:
There was a *vast* amount of activity within the registry, the bulk of which was checking existing values.
What was surprising was the number (almost 2000) of RegSetValue events (all DWORD entries with a value of 0) which were duplicated time and time again. In my experience DWORD entries are often used as toggle switches, with 0 (zero) being OFF and 1 being ON.
Examples:
The value of HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings\PausedFeatureStatus was set 717 times to 0 by process svchost.exe.
The value of HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings\PausedQualityStatus was set 711 times to 0 by process svchost.exe.
The value of HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\StateVariables\RebootRequired was set 116 times to 0 by process svchost.exe. (I think this is the setting for whether Restart Required is shown in the Settings user interface.)
The value of HKLM\SOFTWARE\Microsoft\WindowsUpdate\UX\Settings\UxOption was set 48 times to 0 by process SystemSettings.exe. (Again, I believe this is an option within the Settings user interface but don’t know what option.)
I could be wrong here (please jump in if you disagree) but this suggests the purpose of this particular release of KB4023057 is to set certain ‘paused’ settings within Windows Update to ‘unpaused’. I don’t use any ‘pause’ methods so cannot test this further.
If anyone is interested in seeing the captured ProcMon .PML file (1.1MB) then say and I’ll post it as a .ZIP attachment.
Hope this helps…
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
