Newsletter Archives

• May’s messy updates

  Posted on May 15, 2023 at 02:42 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Although the May releases for both Windows and Apple have not introduced side effects or hiccups so far, they haven’t been as problem-free as they should have been.

  Apple released the first of its “rapid response” updates, announced last June and supposedly allowing the company to deploy important security-only software updates without demanding a reboot.

  Read the full story in our Plus Newsletter (20.20.0, 2023-05-15).

  Patch Watch Apple, Exchange Server, Newsletters, Patch Lady Posts, Rapid Security Responses, Secure Boot, Windows 10

• MS-DEFCON 2: Prepare for April showers

  Posted on April 6, 2023 at 02:45 CDT by Susan Bradley • Comment in the Forums

  

  ISSUE 20.14.1 • 2023-04-06

  

  By Susan Bradley

  The next round of updates is coming soon and may be confusing.

  For one thing, it now appears that Windows 10 and Windows 11 updates will diverge. That is reason enough for me to raise the MS-DEFCON level to 2.

  Any confusion instantly causes me to recommend deferring updates.

  It does not appear that the forthcoming updates for Windows 10 will introduce any changes. They will include only security patches. Microsoft stated:

  After March 2023, there are no more optional, non-security preview releases for the supported editions of Windows 10, version 20H2 and Windows 10, version 21H2. Only monthly security update releases will continue for these versions.

  Anyone can read the full MS-DEFCON Alert (20.14.1, 2023-04-06).

  AskWoody Plus Alert, MS-DEFCON Alerts, Exchange Server, Microsoft Store, MS-DEFCON, MS-DEFCON 2, Patch Lady Posts, Snipping Tool, Windows, Windows 10, Windows 11

• The sky is not falling

  Posted on March 20, 2023 at 02:41 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  You may have seen the headlines: Outlook is getting a patch for a zero-day attack that can’t be fixed just by turning off the preview pane.

  Don’t panic. The risk is greatest if you are connecting Outlook to an on-premises Exchange server.

  Importantly, the attacks have been seen only in targeted firms. The risk is higher for government agencies. Microsoft has even provided a script to determine whether you are at risk.

  Read the full story in our Plus Newsletter (20.12.0, 2023-03-20).

  Patch Watch Exchange Server, Microsoft Outlook, Newsletters, Patch Lady Posts, Patch Watch

• MS-DEFCON 4: Wrapping up a short month

  Posted on February 28, 2023 at 02:45 CST by Susan Bradley • Comment in the Forums

  

  ISSUE 20.09.1 • 2023-02-28

  

  By Susan Bradley

  February’s patches affected you either severely, or not at all.

  The good news: If you are a consumer, home user, or business that does not use Windows Server 2022 or any version of on-premises Exchange server, you will be just fine installing the updates at this time. Therefore, I am very comfortable with lowering the MS-DEFCON level to 4.

  However, if you are a business patcher with Windows Server 2022 hosted in VMware, you may have been significantly impacted. In addition, patch administrators are still dealing with the side effects of the Exchange updates.

  Anyone can read the full MS-DEFCON Alert (20.09.1, 2023-02-28).

  AskWoody Plus Alert, MS-DEFCON Alerts, Exchange Server, MS-DEFCON, MS-DEFCON 4, VMWare, Windows Server 2022, Windows Update, Windows Update block

• January’s patching cyclone

  Posted on January 16, 2023 at 02:42 CST by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  We’re a bit soggy and wet at the AskWoody Tech LLC Global Headquarters here in central California.

  We’ve had nearly a week of rain, and more is coming. I shouldn’t complain — severe drought has brought our state’s water supply down to historically low levels, so the water is needed and much appreciated. But when Microsoft rains down upon us at the same time, the total deluge is a bit much.

  For January, Microsoft fixed 98 security vulnerabilities, said goodbye (for the final time) to the much-beloved Windows 7, also said goodbye to the less used (but popular among its buffs) Windows 8.1, and actually released updates to Microsoft’s on-premises mail server, Exchange.

  Read the full story in our Plus Newsletter (20.03.0, 2023-01-16).

  Patch Watch Exchange Server, Newsletters, Patch Lady Posts, Patch Watch, windows 7, Windows 8

• Dealing with printers

  Posted on March 22, 2021 at 01:00 CDT by Susan Bradley • Comment in the Forums

  PATCH WATCH

  

  By Susan Bradley

  Keeping printers up to date

  Once upon a time, I purchased an HP LaserJet 4L printer that would just keep on printing, year after year, until the plastic door on the top of the printer finally broke off. After my initial installation, the printer driver was never updated.

  Read the full story in the AskWoody Plus Newsletter 18.11.0 (2021-03-22).

  AskWoody Plus Newsletter, Patch Watch AskWoody Plus Newsletter, Blue screens of death, Exchange Server, Patch Lady Posts, printers

• MS-DEFCON 2 — It’s time to defer March updates

  Posted on March 8, 2021 at 14:45 CST by Susan Bradley • Comment in the Forums

  ISSUE 18.9.1 • 2021-03-08

  

  

  By Susan Bradley

  It’s the start of the patching week.

  We are a day away from the official start of patching season. While Microsoft started the March patching madness early, with a critical patch needed for its mail servers, we have yet to see what’s in store for those of us that merely use their Windows as workstations.

  Read the full story in the AskWoody Plus Alert 18.9.1 (2021-03-08).
  Learn more about MS-DEFCON!

  AskWoody Plus Newsletter, Windows Patches/Security AskWoody Plus Newsletter, Exchange Server, MS-DEFCON 2

• Exchange Server elevation of privilege bug acknowledged

  Posted on February 6, 2019 at 12:04 CST by woody • Comment in the Forums

  Remember the 0day exploit in Microsoft Exchange that we talked about two weeks ago?

  As I suspected, your Exchange Server is only vulnerable to a man-in-the-middle attack. It isn’t an all-purpose attack: The miscreant has to be able to sit in the middle of an interaction with the Server.

  Microsoft finally has an explanation in ADV190007 | Guidance for “PrivExchange” Elevation of Privilege Vulnerability.

  A planned update is in development. If you determine that your system is at high risk then you should evaluate the proposed workaround.

  The workaround is a one-line PowerShell script that @b talked about last week.

  Windows Patches/Security 0day, Exchange Server, PrivExchange