Replies

Thanks PK

I tried adding the registry key to another machine, using the admin account, and the same warnings came up, including the certificate warning.  It is warning that the Publisher cannot be verified, not the certificate itself.

Anyway, I continued to click through, and the other warnings came up as before, but the registry key was successfully imported.

I repeated this process with my original machine, and it successfully imported the key, with the same series of warnings prior.

The job is done, and we will see how the machines react when 22H2 comes out.

I am still baffled as to why the Publisher of the certificate from the AKB is being questioned.

1 user thanked author for this post.

PKCano

Thanks PK

That makes sense.

Is the unverifiable security certificate a problem?  I don’t want to try disabling Controlled Folder Access if it might be.

Why would a certificate from an AskWoody knowledgebase site have a problem?

Thanks Alex5723

I will pursue a fix not requiring a third party app initially.

Thanks PK

The page listing updates that can be uninstalled shows lots of Servicing Stack updates, but only a small number of other updates (23 in all, back to Oct 2020).  Most of the security updates seem to be missing from the list, except the latest one from August.  The initial list of updates in View Update History shows just the quality updates as 37 in all, back to Oct 2020.  Not sure why fewer in the uninstall list?

I retried the reg key installation in the admin account, and the same results occurred.  It still tells me it can’t verify the certificate, and can’t access the registry.  Is the certificate verification a problem?

G’day folks

I am on Win 10 Home, 21H2.  I just tried to install the registry key to stay on 21H2 as advised, using the provided link, but it would not install, with a Registry Editor error saying it could not import the file, due to “Error accessing the registry”.

The sequence after initially clicking the link was first the general warning about executable files, then next a warning about the security certificate for the file not being able to be verified, followed by the above final registry warning.

Is the certificate warning a real issue?  Should the certificate be able to be verified?

I suspect the final registry warning may be related to something about Protected Folder Access, which I can probably remove temporarily if required.  Also, I am using the limited user account, not an administrator account, if that makes a difference.  Just wondering about the certificate verification.

The feature updates haven’t been forced on my machine in the past, but these days I tend to use “Check for Updates” after the updates have installed, to see if there is a Servicing Stack Update available, so wanted to have the registry key as extra protection.

G’day folks

I have successfully updated three Win 7 machines (a 64 bit laptop, and a 32 bit laptop and desktop tower), including the SSU on all three.

I tried to update Office 365 as usual, and it told me it had done it in the usual way on each one. I run the check for updates again on each one, to confirm I get the message that Office 365 is up to date, and on all three, it goes through the update routine again, telling me it has successfully updated and I can use it again, but each time I check again, the cycle repeats.

These machines have always updated and checked correctly in the past. The two 32 bit machines are not currently connected to a licence, but this has never been a problem with updating the Office 365 software in the past.

Has anyone seen this as well? Are they correctly updating, as they report, and the check is not seeing this, or are they not updating? Is it something to do with Win 7 coming to EOL?

[frankus333]

Re last paragraph above; maybe switching back to metered connection before hitting Resume Updates would give a bit more protection while running wushowhide.

Re the ability to see optional updates; this is only when the Pause updating has been removed (Resume Updates)

All in all, a very tidy useful development

• This reply was modified 3 years, 9 months ago by frankus333.

1 user thanked author for this post.

rc primak

[frankus333]

This was my question as well, as per my previous posts:

Edit; this link goes to the top of the posts, not my post, which I had selected.  My posts start at #2003792.

https://www.askwoody.com/forums/topic/ms-defcon-2-with-patch-tuesday-tomorrow-and-a-win10-1909-upgrade-waiting-in-the-wings-nows-a-good-time-to-check-that-automatic-updates-temporarily-turned-off/#post-2003792

Also, I gleaned from Woody’s comments in the latest Computerworld article on DefCon rating set to 4 for November patching that it might be the known reliability of the technique of hitting the Pause three times, over the precise setting option, that makes it the recommended way to go. (sorry; couldn’t figure out how to copy the relevant paragraph)

Now that DefCon is at 4, I pressed the Resume Updates button, WU immediately checked for updates, and three updates (Nov CU, MSRT and a Realtek driver I allowed through) downloaded automatically, and then sat patiently waiting for the Active Hours to end. I pressed the Restart Now button and the updating completed normally. I was left with only the optional feature update to 1909 sitting there, but not trying to download; i.e.; really optional.

I think the precision of being able to easily set the pause day and date, and vary it easily if desired, is the better way to go, and what I will continue using. I am now a happy camper. I can leave my internet connection normal, unmetered, and WU updating paused to the precise Sunday before each patch Tuesday, and the only updating that occurs automatically is Defender. Optional feature (and cumulative) updates can be seen but are not a threat. The way it should be, at last!!

Edit: Oops; forgot to check how easy it is to use wushowhide as per my previous post #2004565 in above string of posts.  The Check for Updates does start immediately after Resume is pressed, so one would have to be quick to hide the unwanted update(s) in the scenario where a bad patch was part of the offering and the others were OK and desired to be downloaded.  Perhaps I can check this when Dec patches are ready for DefCon 4.

• This reply was modified 3 years, 9 months ago by frankus333.
• This reply was modified 3 years, 9 months ago by frankus333.

1 user thanked author for this post.

Cijan

G’day again folks

Looks like my hunch was correct; Defender updates don’t download automatically on metered connection. I had set my ethernet connection to unmetered a couple of days ago, and Defender updated its definitions automatically. Other updates did not present themselves, indicating that the new Pause updates feature works well, even when metering is set to off.

Now that DefCon is at 4, I pressed the Resume Updates button, WU immediately checked for updates, and three updates (Nov CU, MSRT and a Realtek driver I allowed through) downloaded automatically, and then sat patiently waiting for the Active Hours to end. I pressed the Restart Now button and the updating completed normally.

I am now a happy camper. I can leave my internet connection normal, unmetered, and WU updating paused to the precise Sunday before each patch Tuesday, and the only updating that occurs is Defender. The way it should be, at last!!

1 user thanked author for this post.

lmacri

[frankus333]

Thanks PKCano

If that Select Date pulldown has both day and date showing, as in Home, then Pro has everything Home does, to make precise sync around Patch Tuesday easy.

• This reply was modified 3 years, 10 months ago by frankus333.

[frankus333]

G’day folks

I have had a closer look over the previous posts about setting up deferral of updates in Pro and Home, and it seems to me there is a difference in the dialogue boxes offered under the Advanced Options button on the Windows Update settings page.

This may account for my sense of missing something in these exchanges.

In Pro, there are apparently two dialogue boxes (plus the Semi Annual Channel box), which allow you to set the number of days (not a specific day/date) deferral of both quality updates and feature updates. In Home, there is only 1 dialogue box, but it allows you to set a specific Pause Updates day/date, which allows easier, more precise synchronisation around Patch Tuesday each month.

If Pro doesn’t have the specific day/date selection that Home now has, that would seem to make prediction of exactly when updates will become available relative to the next Patch Tuesday less easy to calculate in Pro. I think I prefer the Home option over the more involved Pro option, as long as it is reliable (my original concern).

• This reply was modified 3 years, 10 months ago by frankus333.
• This reply was modified 3 years, 10 months ago by frankus333.

Thanks b

If Pro has the same Pause options as Home now does (plus the additional policy setting options that are recommended to be used), I still find it curious why these Pause options have never been mentioned in the recommendations as far as I have noticed.  If the Pause option is reliable, it seems an easier and more precise way to hold off updates, to a consistent predictable date (e.g.; weekend prior to Patch Tuesday, reset each month).  Hence my original question about their reliability.

I must be missing something here, but that is fine; I will continue my experiments with the new pause options, which so far seem to be working great for me. Fingers crossed.

[frankus333]

Thanks Imacri

I am using only Defender for malware protection, and it is set up as normal, with the Quick Scan option, which seems to run periodically.  I couldn’t find any setting related to the periodic scanning option you mention.  I guess that is because I don’t have another AV product installed.

I am suspecting that the updating is held off by my wifi being set to Metered. When the 7 days rolled around and I got the message that the Defender update was available, on the WU page it said something about updates being available, but charges may apply. At first I thought that the pausing updates was not working afterall, but was able to confirm with wushowhide that the “updates available” referred only to a defender definitions update. Why it waits until 7 days to alert me is unclear; why not any time an update is available?

At the time I just went ahead and removed the Metered setting and pushed the Dowmload Now button on the WU page, and Defender definitions were updated. I didn’t wait to see if they would download automatically.

My plan is to wait until the Windows updates are safe later in the month, and then remove the Metered setting and see if Defender updates automatically. In the meantime, I will probably get another prompt after the next 7 day interval, and will cautiously explore that in more detail at the time, depending on the status of Windows Updates.

If I want to update definitions at any time, I use the manual update definitions option in the Defender settings page. That doesn’t require me to remove the Metered setting.

So far the Advanced Options Pause updates I have set (to December 8th) seems to be holding off the presentation of all updates other then defender definitions, which is great.

• This reply was modified 3 years, 10 months ago by frankus333.
• This reply was modified 3 years, 10 months ago by frankus333.
• This reply was modified 3 years, 10 months ago by frankus333.

[frankus333]

Thanks Tom-R

I am planning to check this out later in the month when the updates become acceptable.  I’m hoping that the “Resume updates” button doesn’t include an immediate “Check for Updates” command, and there will be enough time to run wushowhide and deal with them.   I will leave my wifi set to Metered as well, in the hope of a little extra shielding.  Fingers crossed.

• This reply was modified 3 years, 10 months ago by frankus333.

[frankus333]

Thanks Moderator; that was what I did, twice, but it failed both times.

Cheers

Edit; it worked this time, but the search is still misfiring.

• This reply was modified 3 years, 10 months ago by frankus333.