|
MS-DEFCON 2:
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it.
|
-
Where we stand with this month’s Windows and Office security patches
Posted on Comment on the AskWoody Lounge- This topic has 43 replies, 15 voices, and was last updated 3 years, 5 months ago.
Viewing 13 reply threads-
-
In case you missed it, there was a strange very out-of-band patch released on Monday night for Outlook 2016, KB 4011043.
1 user thanked author for this post.
-
In case you missed it, there was a strange very out-of-band patch released on Monday night for Outlook 2016, KB 4011043.
Woody,
It does NOT show up in Microsoft Catalog.
Dave
1 user thanked author for this post.
-
-
-
-
See the next post, reference to BleepingComputer…
1 user thanked author for this post.
-
-
Would disabling the Windows Search service work too? Or are the regedits necessary to stop this?
You don’t need to edit the registry to stop nor to disable the Windows Search service. Simply go into the “Services” tool of the “Administrative Tools” choice from the Control Panel (Win7). To see the Administrative Tools choice, however, you need to be in an administrator-level account or, if you choose to, run “services.msc” from the “Run” dialog box on the Start menu and simply select to run it as an Administrator.
Once you’re in the services snap-in, scroll all the way down to the listing for “Windows Search”. Double clicking on it will bring up its Properties dialog box, showing the page where you can change the startup type to “Disabled”, as well as stop the service from currently running (click the “Stop” button below the startup type drop-down box) all at once. Just make sure to click OK when you’re done making changes. Now, reboot the computer to make them effective immediately.
A word of warning if you do use the search service or have an application that uses the search service routinely: The steps above completely disable the service and will render the program(s) that use the service either somewhat or completely useless until you apply this month’s patch that fixes the vulnerability. Also, you will have to remember to re-enable the service once the patch is applied, probably, so take note of the startup type before disabling the service so you know what to set it back to after patching.
I hope this helps!
-
-
An excellent (IMHO) search utility, that does not require the Windows Search Service to be enabled, is Everything (free), which underwent a major update back in June: https://www.voidtools.com/ (the full changelog may be found at http://www.softpedia.com/progChangelog/Everything-Changelog-114264.html ).
4 users thanked author for this post.
-
-
-
BleepingComputer also have a detailed discussion on, with a link to a work-around for, CVE-2017-8620: https://www.bleepingcomputer.com/news/microsoft/microsoft-just-fixed-a-wormable-bug-in-windows-search-affecting-all-os-versions/ .
1 user thanked author for this post.
-
BleepingComputer also have a detailed discussion on, with a link to a work-around for, CVE-2017-8620: https://www.bleepingcomputer.com/news/microsoft/microsoft-just-fixed-a-wormable-bug-in-windows-search-affecting-all-os-versions/ .
From the above:
Microsoft recommends they disable the WSearch service as a workaround, but this will also disable any search functions on those machines.
What functions are disabled?
I’m running Win 8.1 and can search for files / folder names just fine via Explorer’s little search box in the upper-right without WSearch enabled. It does the search right then, with no indexing, which is what I prefer anyway.
I use Classic Shell to add a Start menu to Win 8.1 and I use it to replace the Windows start menu on Windows 7 and 10 systems, and its search box works just fine without WSearch enabled to locate things to start.
When I want to do rigorous content searches, not just for things Microsoft deems worthy of indexing, I have downloaded/installed a quite powerful free 3rd party search tool called grepWin that does a faster, more thorough content search than Microsoft’s search ever could. It even goes so far as to tell you when a file can’t be opened for searching, so you can’t accidentally miss things without knowing it.
Not terribly long ago Microsoft introduced a bug with one of its updates that manifested as an inability to search in Outlook if you had indexing enabled. I never had any problem with that patch because I had WSearch with indexing disabled already.
Here are my specific recommendations for disabling indexing in a way that leaves Windows functional (written in context for Win 8.1 with Classic Shell installed, but the steps do work for 7 and 10 as well)…
Note: These steps are reversible, but if you don’t have a good feeling that you can change deep settings on your computer confidently and know why things work or don’t work, please be careful and/or consider not making this change.
-Noel
8 users thanked author for this post.
-
I don’t believe I’ve ever used Windows Search for very long either. I used the Windows XP search back in the day, but for XP, Windows Search was an optional download that I never used. As much as people denigrated the XP search, it “just worked” for me… if I needed it to look for text within a file, it did it; if I needed to find a file with a certain string in its name, it did that too.
When I upgraded to 7, I did use the Windows Search from the start menu briefly, but I very quickly ended up with Classic Shell, which worked even better. The Windows Search was frustratingly inconsistent; sometimes it would find things, sometimes not, and I never knew the why or the when. Its habit of pretending it doesn’t know what I am asking for when I type “reg” in the search box is insulting too… it knows very well that there are a couple of programs that match exactly what I have typed, but until I get the full “regedit” in there, it twiddles its thumbs and whistles and looks at the clouds. It’s done that for other “dangerous” programs too, if I recall, but regedit is one I use the most. Don’t try to out-think me, Microsoft. Your job is to help me to do what I want with my PC, not protect me from myself.
For file system searches, I use Everything. Any filename (or bit of a filename) I type in is found in under a second. Windows search was never that fast, indexing enabled or not, and the Classic Shell search doesn’t find some of them.
That’s not to say Classic Shell search is bad. It does what I want to use it for perfectly, which is to search installed programs and system features so I don’t have to wade through layers of clicky menus (though sometimes I want to do it that way, at the possible risk of losing my “Power User” card; I think spatially, and the cascading Classic start menu works very well with the way I think. I can often “see” [not really accurate, but there’s no better term] where an option is in the start menu in my head faster than I can come up with a program name. Once I look in the right place, more or less, I see what I am looking for within a line or two, and only then does the name of the thing I want enter my consciousness).
For filesystem searches, it’s Everything all the way. I have it on my Quick Launch bar. I’m going to have to send a contribution to that dev when I can (I did already with Classic Shell). I don’t have a great deal of money, but I do want to support them where I can. Some things would be worth paying for even though they’re free.
Group "L" (KDE Neon Linux 5.20.5 User Edition)
5 users thanked author for this post.
-
Don’t try to out-think me, Microsoft. Your job is to help me to do what I want with my PC, not protect me from myself.
Thank you. Worth repeating.
-Noel
-
-
-
-
-
A very reasonable thought process.
Either I don’t know what I’m missing, or I am not simply doing the things that would invoke the side effects you mention, or I have a system that makes the side effects bearable.
I’d honestly love to hear about specific things that you or others do that depend on Windows Search (indexing). Then I could say what it is I do that’s the equivalent or similar and measure comparative performance.
When I want to search for a filename in the Explorer box, it works. When I want to search in the Classic Shell start menu, it works. When I want to search for message content in Outlook, it works.
I’m sorry, but when I search files for something, whatever it is – say the non-text term “&#@” – I want to find it, no matter whether some programmer decided indexing will deal with it. When I want a rigorous search for content inside files I wouldn’t choose Windows Search whether or not it was fast. It’s not reliable! That’s why I like grepWin. It gets the job done, and quite quickly (given that I have a high performance I/O subsystem).
And also note that I *never* want to search online using the search box in any of those places. Online searches are what Google’s site is for.
Finally, Windows is simply more reliable if you don’t try to use the more “modern” features. No one would talk about “a corrupted index”, nor would Microsoft provide a way to reset the index, if it didn’t happen.
Am I missing something important here?
-Noel
1 user thanked author for this post.
-
Late to the party ™ but I’ve had indexing and search disabled from… always! Back from xp days to current, old win7 install. Disabled as one of the (many) first things after install…
Never experienced any negative side-effects. Only positive ones!
Not missing anything to my knowledge, so interested in learning more as well…
2 users thanked author for this post.
-
Same here, I switched off Search years ago as it just seems to consume resource for little if any benefit.
If I had to do constant and extensive file searches on a regular basis it might prove to have some virtue (I don’t know) but for me it seems to be one of those solutions that’s looking for a problem
1 user thanked author for this post.
-
-
-
For those Windows 7 users who are trying to make all the changes Noel listed in the screenshots above for disabling the Search and Indexing services, please remember that File Explorer in Windows 7 is actually called “Windows Explorer”. THAT’S where you’ll find the entry about turning off the Library Features.
In other words, for Windows 7, the place to look is User Configuration/Administrative Templates/Windows Components/Windows Explorer. Just click once on the Windows Explorer title and you’ll see the settings show up in the right hand pane. You’ll probably find the “Turn off Windows Libraries features…” setting listed about halfway down the list in the right hand pane without having to scroll down at all.
1 user thanked author for this post.
-
-
So for a Windows 7 machine with a single monitor setup, does the risk of the bug outweigh the benefit of the patch?
My employer pushed out the August roll-up two days after patch Tuesday, and I’ve been running it on my work Windows 7 system without incident for almost a week. So I wonder if there’s still a benefit to waiting when it comes to my home Windows 7 system.
I’m also wondering if the “one size fits all” nature of the MS-DEFCON system is a problem. For example, this month the bugs appear more severe in Windows 10 than in Windows 7. Should users of both operating systems be subjected to the same waiting period?
-
Fair question. I don’t have a complete answer.
If I start breaking out MS-DEFCON scores for different versions of Windows (7, 8.1, 1607 and 1703, at least), should I also break them out for Office, .NET, and so on.
I’d rather stick with one overall red light/green light system. As long as we don’t get caught up in any security risks associated with just-patched security holes, it’s a reasonably good approach.
Or, to put it another way, when your company applied the August 2017 patches to your Win7 machine, did you see any benefit? 🙂
1 user thanked author for this post.
-
If I start breaking out MS-DEFCON scores for different versions of Windows (7, 8.1, 1607 and 1703, at least), should I also break them out for Office, .NET, and so on.
I’d rather stick with one overall red light/green light system. As long as we don’t get caught up in any security risks associated with just-patched security holes, it’s a reasonably good approach.
>Or, to put it another way, when your company applied the August 2017 patches to your Win7 machine, did you see any benefit?
I’d have to say there was no tangible benefit. The benefits would be: 1.) piece of mind and 2.) no more nagging from the system tray.
-
-
Lower risk of infection is certainly a difficult thing to directly observe as a benefit.
On the other hand, it’s entirely possible that just using a good browser, a decent anti-malware subsystem, and not opening attachments in eMail will protect you more than enough from malware to weather the few weeks of DEFCON-2 delay.
Add ad/tracking blocking, disabling of execution of ActiveX and restricting things from running in iFrames and you take it up another few notches.
To gauge your risk, ask yourself this: How many actual infections or reports of blocked infections from my anti-malware software am I typically seeing when I use my computer or device as I do normally? If you haven’t seen one in months or longer, you can use that to estimate the chances you’ll be hit by the next discovered vulnerability any time soon.
-Noel
2 users thanked author for this post.
-
To gauge your risk, ask yourself this: How many actual infections or reports of blocked infections from my anti-malware software am I typically seeing when I use my computer or device as I do normally? If you haven’t seen one in months or longer, you can use that to estimate the chances you’ll be hit by the next discovered vulnerability any time soon.
The problem is that web sites can get compromised and previously safe behavior can suddenly put you at risk.
For example, the current wallpaper in my desktop background slideshow is an image I downloaded years ago. I’m reminded that I recently tried to open it from an old bookmark, so I could post a link to it in another forum. Seamonkey warned me that the website was now unsafe and blocked me from going there. If that site was hosting a vulnerability that was patched in the August updates, I could have been in a world of hurt.
-
-
-
-
I use Windows Search many, many times a day. I have so many files, even with a nice clean hierarchy of folders, it is much faster to bring up the folders by typing their name or the name of a file I want to work on or often the content I am looking for by using Windows Search. I don’t want to open a box, click, type, press ok or anything. I need very quick access to files just by pressing the Windows key and then start typing. Windows Search has been for me the biggest productivity boon going from XP up to any version of Windows later.
Do you realize that it does that even without the indexing service (Windows Search) running? I can’t speak to relative performance nor the use of the stock start menu, but with an SSD-equipped and relatively powerful system, I really don’t find myself waiting on anything. I suspect we work similarly to one another. If I type gpedit in the Classic Shell search box, it’s right there instantly.
Name some specific things you do and I’ll do them (or something as similar as possible) and report back the exact timing.
Classic Shell works awesomely well on Win 10 by the way, as it did on 8 and 7. I very much like that I still have hierarchy of menus and the same workflow as always, which feels more productive than any rendition of Microsoft’s start menu that has ever been released.
-Noel
1 user thanked author for this post.
-
-
I have never used Classic Shell, so I cannot provide any information about the functionality in which you are interested. It may be a good piece of software, but it was just too much trouble for me to try it out. Maybe in the future 🙂
1 user thanked author for this post.
-
-
-
-
This bug which has been addressed in the latest (preview) CU for Windows 10 1607 and 2016 just released is of concern only to Enterprise users, and informative for anyone else. It affects Citrix XenApp running on Windows 2016, same build with Windows 10 1607. Users launching published desktops from XenApp on Windows 2016 would experience something similar with Windows 10 Enterprise 2016 LTSB. Similar, but obviously not identical. The issue is related to published applications and not to published desktops though, although the experience and the seamless windows design have very much the look of Windows 10.
https://support.microsoft.com/en-au/help/4034661/windows-10-update-kb4034661
Addressed issue where a black screen appears when launching an application on Citrix XenApp that was deployed from Windows Server 2016. For more details, read CTX225819.
Binary Fix and Known Issues When Launching an Application Published from Windows Server 2016
https://support.citrix.com/article/CTX225819Citrix and Microsoft have identified an issue when launching seamless applications from a Server VDA running Windows Server 2016. When a user launches an application published from this VDA, Citrix Receiver displays a black screen covering the work space of the monitor for several seconds before launching the application.
1 user thanked author for this post.
-
I need very quick access to files just by pressing the Windows key and then start typing.
As you note later in your post, the Classic Shell search does this too.
I’ve never even tried the Windows 8.x or Windows 10 search functions from the start menu/screen. I put Classic Shell on 8.1 before I even tried to figure out how to use that bizarre UI (better just to vanquish it), and in the case of 10, I upgraded from 7 and it just carried over Classic Shell from the previous installation.
As far as Everything, you can set it to have a hotkey too. ALT-F is no harder to me than Shift-Win (which I use to bring up the start menu; I have the straight Win key disabled, as I inadvertently hit it WAY too often to have it pop up the start menu each time).
Ultimately, if something works for you, then there’s no reason to look elsewhere, and when you used Windows 7, I would say if you were happy with it, then there’s no need for alternative. It’s not surprising that 10 messed that up for you… it seems like that’s the norm rather than the exception (and that may well have been the case in 8.x, which I am not aware of even though I’m using 8.1 right now, heh).
Group "L" (KDE Neon Linux 5.20.5 User Edition)
3 users thanked author for this post.
-
8.1 was fine and maybe even the early 10 before they forced Cortana as the only interface to Windows Search.
1 user thanked author for this post.
-
-
Either I don’t know what I’m missing, or I am not simply doing the things that would invoke the side effects you mention, or I have a system that makes the side effects bearable.
I think what applies to you is mainly “I am not simply doing the things that would invoke the side effects you mention”.
Just to mention one instance, few years ago Outlook 2013 msi installer was crashing when Windows Search was disabled or even worse, on servers running Terminal Server or Citrix, would crash too. I think this was patched since then, but I am not quite 100% certain. It is known that Windows Search is not even recommended to be installed on server versions due to performance issues, but it is available, mostly for the smallest file servers if required. The workaround was to install Windows Search, install Office 2013 and uninstall or disable Windows Search after the fact. This was on servers.
Outlook Instant Search does not work with Windows Search disabled and the only correct procedure to avoid issues is to set certain Group Policies.
As you see, my examples are mostly related to Outlook which many people may not use. There are complex interactions with Outlook and Exchange and Search depending if Outlook in in Online mode (currently supported only on Terminal Server but discouraged even there) and Offline mode.
On the file servers mentioned earlier, if Documents or other System/User Profile folder is redirected and Windows Search is not installed, there is a warning and some obscure features are not available. However, it is not very common to install Windows Search in servers as mentioned before except for the very smallest implementations.1 user thanked author for this post.
-
I think the fact “Windows search is not even recommended to be installed on server versions” probably means that except for rare occurences of issues with programs that are relying on it and forgot it might not be there on servers, the side effects should be minimal. Thanks for the info.
1 user thanked author for this post.
-
-
The last 6 Windows 7 updates listed at Windows 7 SP1 and Windows Server 2008 R2 SP1 update history have a WordPad issue documented: “The WordPad application can sometimes crash on launch after installing KB[xxxxxxx].
Viewing 13 reply threads
Welcome to our unique respite from the madness.
It's easy to post questions about Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments. Click here for details and to sign up.
Recent Replies
Bob99 on Find the cable modem that’s just right for your ISP
1 minute agoOscarCP on What Linux is and why it has persisted
10 minutes agocarpintero on Giving you the choice
13 minutes ago- 14 minutes ago
DriftyDonN on Find the cable modem that’s just right for your ISP
23 minutes agoKirsty on Fiber optic not available; options please
29 minutes ago- 38 minutes ago
- 45 minutes ago
- 51 minutes ago
Drcard:)) on Using Windows 10 Backup Option
1 hour, 1 minute ago- 1 hour, 12 minutes ago
- 1 hour, 16 minutes ago
- 1 hour, 28 minutes ago
- 1 hour, 36 minutes ago
mn-- on What Linux is and why it has persisted
1 hour, 50 minutes agoanonymous on Adobe Flash Not working for School test
1 hour, 53 minutes agoEP on Security update for Secure Boot DBX can be skipped (KB4535680)
1 hour, 56 minutes ago- 2 hours, 45 minutes ago
WShlewton on Windows Defender In Win 10 Concern
2 hours, 51 minutes agodmt_3904 on Nitro data breach – what does it mean to me?
3 hours, 7 minutes ago- 3 hours, 14 minutes ago
- 3 hours, 24 minutes ago
NetDef on Attention partners Microsoft really is coming for your clients this time
3 hours, 26 minutes agob on Minor Lounge Button Tweaks
3 hours, 27 minutes ago- 3 hours, 33 minutes ago
- 3 hours, 36 minutes ago
- 3 hours, 43 minutes ago
- 3 hours, 50 minutes ago
- 4 hours, 1 minute ago
- 4 hours, 3 minutes ago