Patch Lady – KB4538483 revised

Topic

New Reply

KB4538483 for Windows 7 was updated on May 6th.  For my machine behind WSUS it automatically got it on May 9th (I have security approvals set to insta
[See the full post at: Patch Lady – KB4538483 revised]

Susan Bradley Patch Lady/Prudent patcher

3 users thanked author for this post.

woody, Ricard, abbodi86

Reply | Quote

Replies

[gkarasik]

Anyone care to take a shot at explaining why the Servicing Stack update that has to be rerun every month in order to get the following month’s ESU update(s isn’t simply included in the monthly ESU update(s) so we don’t have to rerun it every month on however many machines we might have to rerun it on?

GaryK

• This reply was modified 3 years, 4 months ago by gkarasik.

Reply | Quote

So far, there has been a different Win7 SSU every month.
The SSU has to be installed exclusively (by itself). It will not show up in the WU Important updates queue unless/until there are no other pending updates (checked of unchecked). There are several ways to get the SSU:
+ You can install all the other Important updates, reboot the computer, and if there are no other updates available the SSU will appear.
+ You can hide all the pending updates, check for updates, and if there are no other updates available the SSU will appear.
+ You can download the SSU and install it manually, but it still has to be installed exclusively.

2 users thanked author for this post.

Elly, abbodi86

Reply | Quote

PKCano wrote:

So far, there has been a different Win7 SSU every month.
The SSU has to be installed exclusively (by itself). It will not show up in the WU Important updates queue unless/until there are no other pending updates (checked of unchecked). There are several ways to get the SSU:
+ You can install all the other Important updates, reboot the computer, and if there are no other updates available the SSU will appear.
+ You can hide all the pending updates, check for updates, and if there are no other updates available the SSU will appear.
+ You can download the SSU and install it manually, but it still has to be installed exclusively.

I appreciate the additional detail, but I’m not seeing why the SSU, different each moth or the same, can’t–and shouldn’t–be included in the update process and its install automated. Isn’t that the major function of the RunOnce entry in RegEdit?

GaryK

1 user thanked author for this post.

bassmanzam

Reply | Quote

Servicing stack updates are always separate.  Way back a few years ago when the SSU came out and wasn’t pushed out separately it caused unbootable machines.

https://docs.microsoft.com/en-us/windows/deployment/update/servicing-stack-updates

 

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

Elly

Reply | Quote

SSU is the engine that process updates themselves, thus, it must be updated separarely

if you have WU set as automatic, SSU should be handled and installed automatically

2 users thanked author for this post.

Elly, woody

Reply | Quote

Any advice on whether this is needed if I have NOT had any issues installing the ESU or installing Feb. and Mar. security only Updates? (If it ain’t broke, I don’t want to fix it, BUT if I might need it down the road, I do want it.)

Thanks for any insight.

Win 7 Pro, 64-Bit, Group B ESU,Ivy Bridge i3-3110M, 2.4GHz, 4GB, XP Mode VM, WordPerfect

Reply | Quote

Well since Microsoft pushed it out via WSUS, I would recommend installing it.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

Ricard

Reply | Quote

Well, if Patch Lady recommends it, I’m gonna do it.

One note, though, I initially tried installing the Preparation KB 4538483 BEFORE the SSU KB 4550735 (should have looked at the dates) and got a weird error message that my “Module Installer” needed to be updated, with a link to a 2014 KB article and an update from 2011. That seemed a little strange…

So I installed the SSU first, then the Revised (2020-05) Preparation KB and all went well.

Thanks again for the advice.

Win 7 Pro, 64-Bit, Group B ESU,Ivy Bridge i3-3110M, 2.4GHz, 4GB, XP Mode VM, WordPerfect

Reply | Quote

This suggests that MS is incapable of designing a process that that is safe.

Moderator note: Edited for content

GaryK

Reply | Quote

Hello,

I am (and have been for several years) installing Win7 64-bit security only updates (Group B), most recently using the script discussed on AskWoody. I am a bit confused by the discussion of monthly SSU installations. I follow the MS-DEFCON update recommendations and read the Woody’s update summary each month. However, I feel like I have missed the SSU issue somehow.

So, can someone please confirm that I should have been installing an SSU each month prior to installing my security only updates as directed in AKB2000003? I have not seen any issues when installing the Group B monthly update.

If I should have been installing a monthly SSU, when should I have started doing this, and where can I find a list of the monthly SSU? Should I go back to whenever the SSU “start date” was and proceed back to present?

Oh, how I wish my necessary software would run in Linux (or that I had more time to figure out how to get more software to run in Linux).

Thanks,
Andy

Reply | Quote

The SSU is the update for the Windows Update mechanism itself. There has not always a new SSU released each month in the past, but there has been a new SSU each month issued with the ESU patches since Win7 EOL.

The required SSU is listed on the MS Support Page for each of the Security-only patches. SSUs are not a part of the Group B listing. But when there are new SSUs, the KB numbers have been published each month in the Patch Tuesday blog thread.

SSUs are delivered through Windows Update in the normal manner. There is no need to download them from the Catalog and install them manually.
See #2261235 for information on SSUs.

1 user thanked author for this post.

Elly

Reply | Quote

PKCano wrote:

The SSU is the update for the Windows Update mechanism itself. There has not always a new SSU released each month in the past, but there has been a new SSU each month issued with the ESU patches since Win7 EOL.

The required SSU is listed on the MS Support Page for each of the Security-only patches. SSUs are not a part of the Group B listing. But when there are new SSUs, the KB numbers have been published each month in the Patch Tuesday blog thread.

SSUs are delivered through Windows Update in the normal manner. There is no need to download them from the Catalog and install them manually.
See #2261235 for information on SSUs.

Now I’m really confused, because we’ve been told that the SSU must be installed separately after an update in order to receive the next update.

GaryK

Reply | Quote

I downloaded the SSU update from the Microsoft Catalog and just placed it in the folder with the security updates to install with the ESU script from @abbodi86. All is good.

1 user thanked author for this post.

gkarasik

Reply | Quote

davinci953 wrote:

I downloaded the SSU update from the Microsoft Catalog and just placed it in the folder with the security updates to install with the ESU script from @abbodi86. All is good.

I did a version of this with a simple bat called from registy Run.

According to various posts here, the SSU sometimes changes, so it must be DLed and copied to a specific folder and then renamed to match the bat instructions. Once installed, I delete the file. If the folder’s empty, then nothing happens.

Since I’m paying for this update service, and since the post-update SSU is so easy to automate, I’m surprised MS hasn’t automated this.

GaryK

Reply | Quote

I just saw this semi-official notice:

This patch is required.  You will not be able to install the security updates without this perquisite.  You do not need to do anything with your licenses or acquire new licenses.  If you’re already installed and active the ESU key on a system then you don’t need to re-install or reactivate that device.

(via patchmanagement.org)

2 users thanked author for this post.

Ricard, Moonbear

Reply | Quote

Unless they revise (update) the Detectoid on patch tuesday (tomorrow), the old KB4538483 should still work

1 user thanked author for this post.

woody

Reply | Quote

Is there a chance that this could interfere with using your ESU script?

Reply | Quote

Not at all

4 users thanked author for this post.

Steve, Elly, Moonbear, woody

Reply | Quote

[gkarasik]

Today’s SSU on Win7/32bit/Ent was KB4555449 (not KB4538483), which, at the time I looked for it this morning in the  Update Catalog, came up as “Could not be found.” I assume it will turn up, but it sounds like it’s a different file from last month’s SSU.

GaryK

• This reply was modified 3 years, 4 months ago by gkarasik.

Reply | Quote

Susan B, I’ve looked at the 20-05-12 windows updates.xlsx and saw that you said to defer KB4555449 Service Stack update.  Note:  both my desktop and laptop are on ESU.  My desktop has this KB as the only one in the list on Windows Update and my laptop does not list this KB at all in Windows Update (but has KB4556399 .NET update, dated 2020-05, kb4556836 Monthly rollup dated 2020-05 and KB4484384 Excel update.) I have all of the previous previous service stack updates installed.  I know that the service stack updates need to be installed by themselves so why the deferral on the service stack update?  I believe that it has been noted that you need the service stack updates to be able to see the other updates.  Is this the correct interpertation?  Thanks for your assistance.  It is greatly appreciated.

Reply | Quote

You need the April SSU before installing the May Updates.
You will need the May SSU before you install the June updates, so you can wait on that one.
The SSU won’t show up in the Windows Update queue, though, until/unless there are no other pending (checked or unchecked) updates. After you install the other updates and reboot, you will see it when you check for updates.

Reply | Quote

Patch Lady wrote:
Well since Microsoft pushed it out via WSUS, I would recommend installing it.

So ten days have passed and Microsoft doesn’t appear to have pushed it out via WU (just checked, no joy 🙁 ), so it appears revised KB4538483 unfortunately will require same annoying manual install as original KB4538483…

Is that right, or am I missing something?
And, if manual download & install is required for WU users, does revised patch really need to be installed at this time on working systems with original KB4538483 installed?

Thanks in advance. And, as always, thanks Patch Lady, abbodi86, PKCano, & all the other knowledgeable & helpful folks – both registered & anonymous – posting good info on this great site!

Reply | Quote

[L95]

I have the February version of KB4538483 on my computer.  Do I need to remove (uninstall) the February version before installing the May version?

• This reply was modified 3 years, 3 months ago by L95.

Reply | Quote

If you have the Feb KB4538483 installed, you don’t need the May patch (yet).

Reply | Quote

[L95]

PK:  Why do you say I don’t need the May version yet?  Susan Bradley recommended on May 10th  that we install it ((see Reply # 2261246 above).  Maybe I’m missing something as I haven’t had time to read through this entire blog in detail,  so I would appreciate it if you could tell me why I wouldn’t need the May version yet,  because it’s my understanding I would need it in order to be able to install the May Security updates for Windows 7,  unless maybe the May version of KB4538483 was issued after the May Security updates.  But it appears to me it was probably issued before the May Security updates.

• This reply was modified 3 years, 3 months ago by L95.
• This reply was modified 3 years, 3 months ago by L95.

Reply | Quote

You don’t need it to install the May patches.
But in any case, you should not have to uninstall the Feb patch first before installing it.

1 user thanked author for this post.

L95

Reply | Quote

L95 wrote:
Do I need to uninstall the February version of KB4538483 before installing the May version?

No, absolutely not.

Hope this helps.

1 user thanked author for this post.

L95

Reply | Quote

PK:  Thanks for your response.  Can you please tell me when I will need the May version?  Will I need it for installing the June Security updates, once Woody gives the clearance for installing those?

Reply | Quote

Don’t know the answer to that until the June patches come out and have been vetted. You will hear about it here if you need it.

1 user thanked author for this post.

L95

Reply | Quote

PK:  Thanks again for your response.  I did some checking on my own regarding the May security-only update by looking at the KB article on the Microsoft website for KB4556843 (dated May 12, 2020),  and  it says that one of the prerequisites is “the Extended Security Updates (ESU) Licensing Preparation Package (KB4538483) released February 11, 2020″.   So it appears that you are correct when you say it’s only the February version that is needed for the May updates.  But then it goes on and says “The ESU licensing preparation package will be offered to you from WSUS.”    So I’m wondering why did Susan Bradley say on May 10, 2020 that Microsoft pushed out the May (revised) version of KB4538483 via WSUS?   It appears to me that on May 10th when Susan created this blog,  Microsoft was pushing the May (revised) version,  but by May 12th,  Microsoft went back to the old (February) version.  Can you please clear this up for me,  as to why Microsoft decided to switch back to the old February version?

Reply | Quote

WSUS is the Windows Server Update Service for managed business computers. The updates they receive are controlled through a server with IT control/selection.

You are probably updating Windows Update. Consumers have different needs and different controls.

1 user thanked author for this post.

L95

Reply | Quote

PK:  On May 11th,  you wrote:  “There has not always a new SSU released each month in the past, but there has been a new SSU each month issued with the ESU patches since Win7 EOL.”  (see Post # 2261326 above).  When I installed my May updates yesterday,  I was not offered any SSU even though I did a re-check for updates.  It might be because of what you said on  May 19th: “The SSU won’t show up in the Windows Update queue, though, until/unless there are no other pending (checked or unchecked) updates.  After you install the other updates and reboot, you will see it when you check for updates.”    I did have a couple of unchecked boxes,  namely a security rollup update for .NET Framework  and a non-security update for MS Office.   The reason I didn’t check those boxes is that your  AKB2000003 says  “don’t check any unchecked boxes”.   So I have a couple of questions:  (1)  Was there an SSU for the May 2020 Patch Tuesday, and if so,  what should I do to get it?   (2)  Should I check the box for the security rollup for .NET Framework,  in view of the fact that it’s a security update (even though your AKB2000003 says “don’t check any unchecked boxes”)?

I’ll appreciate your response.

Reply | Quote

Right-click on the unchecked updates and HIDE them.
Once they are no longer in the queue and you check for updates, the SSU will appear.
You can unhide the updates after you install the SSU if you want to, or leave them hidden.

1 user thanked author for this post.

L95

Reply | Quote

PK:  OK thanks.  However,  I’m not 100%  clear about your response to my Question #2.  Namely,  I’m wondering whether should I install the .NET Framework update,  even though it’s unchecked.   The reason I’m wondering about this is is that it’s a security update.   But if you say I should’t install it,  then I won’t.   Could you please confirm that I shouldn’t install it?  And it might also be educational to me if you could explain why Microsoft would offer me something without a check mark in the first place,  especially if it’s a security update.

Reply | Quote

We don’t recommend installing unchecked updates.
MS has left them unchecked for a reason.
They will either disappear, or MS will eventually check them. If they are checked, then install them.

1 user thanked author for this post.

L95

Reply | Quote

PK:  You wrote on June 3, 2020 in Posting #2269173 above:  “Don’t know the answer to that until the June patches come out and have been vetted. You will hear about it here if you need it.”    The June patches are out now,  and Woody has given us the clearance to install them.   I haven’t seen anything that says I would need the May 2020 version of KB4538483.   Have you?

Further evidence that February version is still OK is to look at the Microsoft KB article for the security-only update for  June.   The security-only update is KB4561669,  and that KB article says one of the prerequisites is “the Extended Security Updates (ESU) Licensing Preparation Package (KB4538483) released February 11, 2020″.   So it says there that the prerequisite is the February version.  If you haven’t seen anything I would need the May 2020 version,  then I’ll just use the February 2020 version like I did last month.

Reply | Quote

Keep using the Feb version. I haven’t seen anything about the May version being required if you already have the Feb version.

You will have to have the May SSU KB4555449 installed as a prereq though.

Reply | Quote

Spoiler alert: contents of the revised KB4538483 are already included in June updates (whether Monthly Rollup or Security Only)

KB4538483 itself (either versions) is still required to recieve ESU updates through WU

Reply | Quote