New Surface Book, Surface Pro 4 firmware updates

They’re supposed to fix the (many!) lingering problems with SB and SP4.

I find it interesting that MS is releasing this as four separately identified patches. I hope — hope! — that this is the first step toward separating out Windows 10 patches, instead of cramming everything together.

Brad Sams has the early scoop.

Avoid the Windows 10 “update” KB 3140742

Just like KB 3136562, it’s a downloadable patch — available on Microsoft’s servers — that’s not yet official. The earlier patch didn’t become a real cumulative update. No reason to believe this one will, either.

Should I patch now or wait?

Just got a good question from reader IB:

Woody, I know you’re a busy guy. Thanks for all you do…
I have a basic question. I have ONE home computer, win7 pro, 64 bit (whatever that means)
I use GWX control panel, and have ZERO desire to update to win 10. Heck, I just got rid of XP less than a year ago! My windows updates are set to “let me choose” etc.

As per your advise, I always install DEFENDER updates immediately.

But my confusion is about “important” updates: I think you have told us that anything with “security” in the title needs to be installed. (I currently have a couple security for “.NET FRAMEWORK” and about 10 for WIN7 64bit…”). But in response to a comment within the last week (I forget which thread) about security updates, you said, “wait”.

So my question…when I see ‘security’ updates…should I install them immediately, or wait till DEFCON says it’s time?

Thank you.

I say, always wait for the MS-DEFCON rating to come down, then follow the specific instructions I give when the number goes down.

There’s a reason for waiting. Many problems with Microsoft’s patches don’t appear in the first few days, or even the first few weeks, in some cases. For Win7 and 8.1, Microsoft pulls and re-issues the really bad ones. For Win10, well, we’re still not sure exactly what Microsoft will do. In all cases, within a few weeks we have a pretty good idea of what’s going to clobber systems, and what’s benign.

Not infallible, mind you, but reasonably accurate.

You also need to keep in mind that very, very few patches cover holes that are being exploited. There are fixes for zero-day problems, but most zero-days these days are directed at very specific targets – government installations, military, financial institutions and the like. For you and I, zero-days are rarely a concern.

Take a look at the latest SANS Internet Storm Center list. See the column marked “Known Exploits”? There aren’t any known exploits for any of the patches (although there’s one that had a published exploit later). Even when an exploit “Proof of Concept” is published, it takes weeks or months or years for the exploit to become a problem for you and me.

If you’re carrying a hundred thousand Social Security numbers, or storing nuclear launch codes, it’s a different problem, of course. But for the vast number of people, the vast majority of the time, waiting for patches to show their fangs is a very good idea.

You need to patch sooner or later. Yes. Definitely. But you don’t need to dance to Microsoft’s tune.

Citrix verifies ongoing problems between VDA and Windows 10 build 10586 cumulative updates

If you use Citrix VDA with Windows 10, you’re in for a rough ride.

InfoWorld Woody on Windows

29 non-security patches just released

Oh boy. Here’s the Cliff Notes version:

• Update for Windows Server 2012 (KB3055343)
  https://support.microsoft.com/kb/3055343
• Update for Windows 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 7, and Windows Server 2008 R2 (KB3063109)https://support.microsoft.com/kb/3063109
• Update Rollup for Microsoft Windows MultiPoint Server 2012 (KB3075566)https://support.microsoft.com/kb/3075566
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3103699)
  https://support.microsoft.com/kb/3103699
• Update for Windows MultiPoint Server 2012 (KB3104431)
  https://support.microsoft.com/kb/3104431
• Update for Windows 8.1 and Windows Server 2012 R2 (KB3106637)
  https://support.microsoft.com/kb/3106637
• Update for Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 7, Windows Server 2008 R2, Windows Server 2008, and Windows Vista (KB3118401)
  https://support.microsoft.com/kb/3118401
• Update for Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows Server 2012, Windows 7, and Windows Server 2008 R2 (KB3121255)
  https://support.microsoft.com/kb/3121255
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3121260)
  https://support.microsoft.com/kb/3121260
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3121261)
  https://support.microsoft.com/kb/3121261
• Update for Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows Embedded 8 Standard and Windows Server 2012 (KB3123242)
  https://support.microsoft.com/kb/3123242
• Update for Windows Server 2012 R2 (KB3123595)
  https://support.microsoft.com/kb/3123595
• Update for Windows Server 2012 R2 (KB3123913)
  https://support.microsoft.com/kb/3123913
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3125210)
  https://support.microsoft.com/kb/3125210
• Update for Windows 8.1 and Windows RT 8.1 (KB3126030)
  https://support.microsoft.com/kb/3126030
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3126033)
  https://support.microsoft.com/kb/3126033
• Update for Windows Server 2012 R2 (KB3127060)
  https://support.microsoft.com/kb/3127060
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3128650)
  https://support.microsoft.com/kb/3128650
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3130896)
  https://support.microsoft.com/kb/3130896
• Update for Windows Server 2012 (KB3130902)
  https://support.microsoft.com/kb/3130902
• Update for Windows Server 2012 R2 (KB3130934)
  https://support.microsoft.com/kb/3130934
• Update for Windows Server 2012 R2 (KB3130939)
  https://support.microsoft.com/kb/3130939
• Update for Windows Embedded 8 Standard and Windows Server 2012 (KB3133679)
  https://support.microsoft.com/kb/3133679
• Update for Windows Server 2012 R2 (KB3133717)
  https://support.microsoft.com/kb/3133717
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3133924)
  https://support.microsoft.com/kb/3133924
• Update for Windows Server 2012 R2 and Windows Server 2012 (KB3134242)
  https://support.microsoft.com/kb/3134242
• Update for Windows 8.1 and Windows Server 2012 R2 (KB3134812)
  https://support.microsoft.com/kb/3134812
• Update for Windows Server 2012 R2 (KB3134813)
  https://support.microsoft.com/kb/3134813
• Update for Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 (KB3134815)
  https://support.microsoft.com/kb/3134815

Windows Update Agent and WSUS oddity

I’m no expert on WSUS, so I pass this on for general consumption. From IT:

I’m a System Admin, running SBS2011 with WSUS. In the SBS Console I have updates for Client AND Server computers set to none… On the Client Workstations that use WSUS (Not WU) I have them set to update automatically… My thinking is The clients will update automatically only after I manually OK the updates, yet this morning everything has been updated Windows updates, Office updates… Is Microsoft pulling a fast one or am I missing something?

Also please see screenshot of Windows Update Agent 7.6.7600.256 being installed as well as updates that aren’t security related (I have several of them on other screenshots) despite having security only which has since been changed to NONE, Windows update seems to only be honoring our request unless MS really wants it installed and this is using WSUS… Do a search for the windows update agent in “Installed Updates” and it won’t show up, but from my screenshot you can clearly see it was successful…

New Flash Player updates

From EP –

New Adobe Flash Player security updates were posted last Tuesday
Feb. 9 in Adobe security bulletin APSB16-04:
https://helpx.adobe.com/security/products/flash-player/apsb16-04.html
Win8.1 & Win10 users can obtain Flash Player updates from Microsoft
Windows Update.

Windows 10 cumulative update 8, KB 3135173/10586.104, resets browser and other defaults

The forced update not only knocks out the defaults, it prevents you from resetting them

“How many times does this have to happen before Microsoft separates security and non-security patches, and give us tools to block or delay patches? As long as Microsoft’s patching bugs are relatively minor, there’s little incentive to give us the tools we need. The day we get a really bad, crippling patch, there’ll be tar and feathers.”

InfoWorld Woody on Windows

Windows 10 telemetry

If you’ve been following the recent back-and-forth on Windows 10 snooping, Simon Bisson’s latest analysis on ZDNet is a must-read.

Bottom line on Windows 10 Pro :

for a PC with a standard load, logged into a Microsoft account and using Windows 10’s messaging service, we’re sending around 190 packets per hour to Microsoft servers, and around 130KB of data per hour.

Since the data’s encrypted, there’s no way to know what’s being sent.

Without unencrypting the telemetry packets Microsoft receives, we’re not going to know exactly what data it receives. But they’re small and relatively infrequent, so are unlikely to be packed with your personal data.

My take is, and always has been, that the primary question is what Microsoft actually does with the data it collects. I’m also concerned that people are upgrading to Windows 10 without recognizing that there’s been a fundamental shift in the quantity and type of data being collected. I also think that Microsoft should get out ahead of the problem and proactively tell us what they’re collecting, and give us tools to view and opt out of data collection.

It wouldn’t surprise me a bit if, five or ten years from now, companies collecting data on computer users will be required by US (or EU) law to give snoopies (er, snoopees!) access to the snooped data – much like the regulations we have now with credit reporting agencies.

Bisson’s analysis should give you Win10 customers some solace. It doesn’t completely exonerate Microsoft, but it puts the problem in some much-needed perspective.

When did “Download updates but let me choose” change?

Interesting question from EG. I haven’t been following along closely enough to give him a definitive answer. Do any of you know when (or even if) it has changed? Remember that I recommend “Notify but don’t download.” I’ve been running my Win 8.1, Vista and Win 7 (even XP) machines with that setting for a decade or two…

When did the option to “Download updates but let me choose whether to install them” change to install everything that’s pre-checked when you restart or shut down your computer?

I thought a family member had changed her settings to automatic when she called me last Wednesday about having to wait for the updates to get done installing before she could shut her computer down… and then another family member called me the following day experiencing the same problem. I accessed both of their computers over the weekend (remotely) and changed the setting to “Check for updates but let me choose whether to download and install them”, but both of these computers have been set that way for a very long time and have never installed updates upon a reboot or shut down before. They’ve always had to click the “Install updates” button before.

That Windows update option does say “let me choose whether to install them”… what happened to the “let me choose” part? They’re limited to one shot at choosing before the first reboot now? Am I overlooking a setting someplace else?

Thanks in advance Woody… for EVERYTHING you do!

Unwanted updates for Windows 7

I’ve received many variations on this request over the past few weeks:

Exchange 2010 problems with .NET 4.5.2 – KB3127229 KB3122656

Just received this from reader PA:

The latest .NET security updates for 4.5.2 have caused my Exchange environment major issues.  The document linked below refers to 4.6 and 2013 but I had both things happen to my system just hours after installing the updates. Our COO’s mailbox (of course it was him) was quarantined and honestly after working with Exchange since 5.0 with thousands of mailboxes I had never had this happen before.  Hell I didn’t know quarantine was even a thing in an Exchange environment until yesterday.  Our mailbox databases were randomly rolling to other DAG members as well.  Removing the patches (last night at about 7:00 PM) seems to have fixed the issue. We have one CAS/HT server and four mailbox database servers all participating in a DAG. Not sure yet which one or more was causing the issue.

https://support.microsoft.com/en-us/kb/3095369