|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
While Woody has yet to declare the all clear, I’m listing the updates and giving the “business report” for consultants, admins or anyone who has to ha
[See the full post at: Patch Lady – Business view of updates]
Susan Bradley Patch Lady/Prudent patcher
If you have resync since Thursday you will have the newly revised KB.
Susan Bradley Patch Lady/Prudent patcher
The Master Patch List for Apr 2018 indicates that KB 4018359 corresponds to Office 2010. More specifically, this KB security patch is for Word 2010.
From Susan Bradley’s post:
I’ve seen comments that more and more consultants are taking the drastic steps of turning off windows update and in fact scripting a task to turn off the update services each day. I wince when I see these comments and urge consultants and those concerned about update quality to push off updates for a week but not to turn off the updating process completely.
I think the situation of remaining in or increasingly “converting” to Group W may not improve, unless Microsoft reverts to releasing individual patches, instead of (permanently problematic) rollups.
With individual patches, users & sys admins alike can, if necessary, choose to be temporarily in Group W for selective problematic patches, & install these patches later when/if the issues afflicting them are resolved.
I see what Ms. Bradley describes in that citation (consultants taking extreme measures to make sure Windows Update is, and remains, disabled) as a completely foreseeable consequence of Microsoft’s heavy-handedness. I say that because I did foresee it, but I’m not claiming any great level of insight to have thought that way back when I first learned of all of this. It was the first thing that popped into my mind when the argument was first made that “MS had to do this because people were stupid and they disabled updates,” which I’ve had someone claim as recently as yesterday over on Reddit.
Did MS really think that people who would completely disable updates, with all the risk that entails, at a time when MS had more credibility and trustworthiness than it has now or may ever have again, were simply going to throw up their hands and concede that MS is in control now?
The beginning user was probably never going to even realize the option to turn automatic updates off was present in earlier versions, but I saw someone argue that maybe a nephew or well-meaning but misguided friend would offer to “fix” the beginner’s computer, taking the liberty to disable updates on their behalf in the process.
While I’ve fixed many a beginner’s computer, I’ve certainly never done that; much of the fixing was about getting the updates to work again, not stopping them… but let’s say that some person is so convinced that updates are bad that they’d take the liberty with someone else’s computer (and while I am speaking in a consumer sense here, it could just as easily apply to a consultant doing the same with a business client’s computer as Ms. Bowman mentioned).
In the past, the well-meaning person would simply go to Windows Updates and set it to “Never check for updates (not recommended),” knowing that this would do just what it says on the tin. In a business setting, it could easily be done via GPO.
Now that Windows no longer presents that option, the well-meaning person (according to what Ms. Bowman reports) creates a task in Task Scheduler to set the Windows updating services to Disabled (triggered by a login event, perhaps), so that if Windows decides to “self heal,” which is Microsoft-speak for “do what we want instead of what the customer wants,” the service will again get disabled at the next login.
Which one of these unfortunate changes is going to be easier for someone other than the well-meaning person to discover and fix? A setting that nearly everyone knows is there, or a hacky kind of thing that requires knowledge of the Task Scheduler, which not everyone knows even exists, let alone how to check it (or that one ought to check it, even if he knows how)?
Whatever possessed people to turn updates completely off before Windows 10 arrived was certainly less convincing than the situation we have at present, where being in group “W” is beginning to look like the sane choice. People who didn’t trust updates when Microsoft still had a modicum of integrity and trust are certainly not going to be any more trusting now that Microsoft is behaving as it is.
In other words, while I don’t agree with the wisdom of completely disabling updates, Microsoft’s own actions are making the case better than anyone else ever could have. You can’t make this stuff up…
Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)
I just want to take this opportunity to say how glad I am that Susan Bradley has become such a prominent fixture here at AskWoody. Susan’s posts in Windows Secrets was one of the reasons I stayed with them for so long after being migrated from Gizmo’s TechSupportAlert. Thank you Susan Bradley!
I don’t know if Sandboxie is used much in the business world (your target audience in this post), but the Windows 8.1 32 bit versions of the April 2018 Rollup KB4093114 and Security Only update KB4093115 break the latest Sandboxie 5.24 as I reported here:
and this may be of interest to other, non-business IT support users who may read this.
The Windows 8.1 64 bit versions appear OK with respect to Sandboxie.
HTH. Garbo.
According to the Microsoft pages, KB4093118 replaces KB4100480.
This update supercedes update 4100480, Windows kernel update for CVE-2018-1038.
Still having problems with KB4093118. Using WSUS – WSUS has 4 entries for 14/12/18 for the same patch. When we roll this out to test machines we find that 3 out of 6 are ok. The failed 3 loose the network interface. Rolling back on the individual PC gets it back. Not sure if this is co incidence or not but the three machines that failed are all i3 processors – the other 3 are a mixture of i5 and older pentiums.
I have removed the approval for the 04 security quality monthly rollup in the meantime as I want to get the IE and office patches out as they all seem to be ok. I will await more comment before wasting another morning on this debacle!
If the log file is present in C:\Windows\Logs, you can also check the date and version of PCI.SYS located in C:\Windows\System32\drivers.
I actually had one system that DID not have the C:\Windows\Logs\PCIClearStaleCache.txt created, but the PCI.SYS file was updated.
On the rest of the systems (lost count) I was testing, the above log file was created and the PCI.SYS file was updated.
After it’s updated, it should be like this:
Date: 2/10/2018
Size: 181KB (185,024 bytes on the disk)
Version: 6.1.7601.24056
The previous PCI.SYS was dated 11/20/2010
If the log file isn’t present, I recommend:
1. Uninstall KB4099950.
2. Download KB4099950 from the Catalog.
3. Run the downloaded .msu file.
In order to be effective, the fix – whether it’s KB4099950 or the predecessor script – is supposed to be run before installing KB4088881, KB4088875, or KB4088878. If the fix wasn’t run before installing KB4088881, KB4088875, or KB4088878, there might be a benefit to running KB4099950 from the Catalog after installing KB4088881, KB4088875, or KB4088878 because it might make doing a manual fix for the networking issues easier. I don’t know if there is a risk in running KB4099950 from the Catalog after installing KB4088881, KB4088875, or KB4088878.
Patch Lady wrote about 1709:
“If you manually install updates by going to the Windows catalog and download updates make sure you install 4099989 first.”
Funny thing though is while 4090914 (March SSU) specifically states the required order of installation when done via catalog, the same caution is missing from 4099989 (April SSU).
I have noticed though that if the SSU is skipped, it won’t be offered by WU after manual installation of the associated Cumulative Update.
I’m assuming one can get back on track by first installing a future SSU but have seen no ill effects from the prior SSU’s I’ve skipped.
Will be interesting to see what 1803 does with this.
This is to further clarify my preceding entry.
MrBrian said this about the same issue, earlier on:
“No. KB4093108 apparently cannot cause the two recent networking issues because it doesn’t contain file pci.sys. KB4093108 apparently also doesn’t fix the two recent networking issues on computers that already have those issues.”
So, to refine my question: is “apparently” still the case, or is now “certainly” a better word for the present situation?
Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).
MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV
I cannot install monthly rollup security update KB4093118 on computers with 32bit windows 7. Installation always ends up with computers restarting right after boot. PC starts till ‘Wait Please’ message is displayed and then after few seconds it reboots. First I thought it’s and isolated incident, but this happens the same way on all computers with 32bit windows 7. I have 7 of them. So only reverted back before installing Rollup solve boot problem.
I’m on group A, all updates tried to install from WSUS and WU.
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
