2 simple steps to speeding up Windows 7 update scans

Topic

New Reply

OK, they’re tedious, but they’re simple and easy to follow. Go from many hours to just a few minutes. InfoWorld Woody on Windows My thanks — and deep
[See the full post at: 2 simple steps to speeding up Windows 7 update scans]

Reply | Quote

Replies

Woody,

All I can say is “SO FAR” this month Windows Update has not taken more than 5 minutes to complete the scan. Today’s was less than 1 minute.

Thanks for the heads up on German web site for updates.

Dave

Reply | Quote

I did last month’s updates about a week ago. Dalai recommended four KB’s to install. I already had the last three and installed the first on two Win7 machines. Before all this, both machines took more than an hour to check for updates and never finished doing so. Afterwards, they both completed the job in about five minutes. Thanks to Dalai and to you!

The last few months, the Recommended Updates have included a list of Security Updates, all checked. The Optional updates have included some of our well known bad actors, like KB 2952664, but all unchecked, and the list is short. I’m not sure why, but M$ is basically showing me what I want (Security Updates only) and not much else. Maybe what I Hide is staying hidden for a change.

Reply | Quote

Clear enough, many thanks Woody.

Step 2a. Go to wu.krelay.de/en … every Patch Tuesday is odd, understandable within the circumstances but definitely a strange obligation regarding Windows Update. Not much of an obligation compared to waiting hours for HRH WinUpdate to get things going.

At least there is now a formula. But will we ever know what Microsoft has been up to in order to make one of its very own essential component be come so unusable…

Reply | Quote

Thanks Woody for the simple step by step guide. I do not need it, but there will be lots of people which do.

Step 2f is not necessary, however. By rebooting the computer Windows Update will automatically start again.

(I did not post this as a comment on InfoWorld. When I tried to log in with my Google account Gigya also wants to know my age, friends etc. I do not want to share that info for just posting a comment).

Reply | Quote

I agree completely. This is pretty much what I have done with most all my 150 client computers in July.

Good job, and thanks from many, many admirers, myself included.

CT

Reply | Quote

I decided two months ago that I had lost interest in trying to keep Windows 7 updated. The job was just becoming too hard and you did not know what extra nasties Microsoft was adding.

After a year of following all Woody’s tips and driving myself mad on July 28th, whether to grab Windows 10 and roll back, I decided to simply stick with Windows 7.

I had thought about ways to protect my current installation and searched for and found an interactive ‘smart’ firewall.

It’s a free, discontinued one, but the way it works is still valid. You can find it at:

http://www.privacyware.com/PF_support.html

Besides the usual firewall functions, it also monitors any activity that is trying to modify your system. Unlike anti-virus software, it doesn’t check against any known exploits, but alerts you whenever something suspicious is trying to happen. YOU then decide whether or not to allow it, once or always.

It works best if you disable auto-response and set it to manual. That way, a warning message will stay on your screen until you action it. It uses a ‘training’ method by default for the first 7 days, but I found it best to not use it. Instead, open all your applications the once, and tell it what you will accept or reject. You can always change your mind if it turns out you need to allow something for the program to work.

You may find Windows will lock up when you run some software the first time (especially if you are in full-screen), and you will need to do a hard reset. But the firewall will have recognized it, and it should work the second time.

I have been surprised at how many things it has picked up. It even tells me when I boot up that a program such as Chrome or my anti-virus program has been changed, and whether or not I wish to keep or discard the changes.

Maybe (and quite possibly) I am being naive, but I think it will alert me if something is trying to sneak in the back door. It certainly lets me know if a program is trying to contact an Internet IP address I have not previously approved.

Of course I make regular system images just in case, so if the worst happens, I can always go back to a previous copy of my installation.

It has protected me for 2 months now, and there is nothing on my system that shouldn’t be there. Most days I never get any warning messages, and I’ve forgotten the firewall’s even running.

Reply | Quote

Concerning the Windows Update Service, is it not easier just to set it to ‘Manual’ and leave it there permanently?

Reply | Quote

Step 2f is not necessary Woody. When the “magic patch” completes installation you’re prompted to restart. The WU service will start itself automatically.

I just now updated a family member’s computer for the July updates and KB3168965 is still doing the trick. I don’t know when that will cease, but as of 11 AM (EST) it was still alive & well.

Reply | Quote

Yep, by Jove, you’re absolutely right. I’ll edit the post. And thanks!

Reply | Quote

I’m not sure. Perhaps someone who knows wuauserv better than I can comment….

Reply | Quote

Man, I hear ya about InfoWorld comments. That’s one of the main reasons why commenting here is completely anonymous, untracked – BUT it’s also moderated.

Reply | Quote

Good question.

Reply | Quote

The search usually doesn’t revert to LONG until MS releases the patches on the second Tues. Somewhere around noon CDT in my area.

Reply | Quote

Woody, if I already installed July’s patches without following your new instructions (extremely slow by the way), and I want to get ready for August’s patches using your new instructions (waiting for your next go-ahead announcement, of course), do I need to install KB 3168965 from July or do I just wait for August’s magic patch (whenever that is identified)?

Reply | Quote

Wait for August’s magic patch. July’s old magic patch doesn’t work. Sorry I didn’t make that clearer.

Reply | Quote

I have had no problem installing Dalai’s recommended patches using Windows Update, except for the fact that they can take some time to download and install. Once the recommended monthly patch has been installed, however, WU goes back to speedy checks and downloads.

As I’ve mentioned previously, when WU bogs down, MSE can fail to find and install virus definition updates, so keeping WU running briskly has an upside for MSE as well.

Reply | Quote

Woody, as a note, we’ve also determined that 3112343 is required for any MSPs using Kaseya to manage patch deployments for clients. While it’s a Win7 Windows Update patch for greasing the pipes for Win10, it seems to be required for something related to patch scanning from Kaseya’s patch management area. We’re using Kaseya 9.2.

Even if there are later versions of the Windows Update patch installed, this patch needs to be installed first or scanning won’t work as expected with Kaseya.

Reply | Quote

Are we still at status ‘ain’t broke-don’t fix’ for ignoring KB3172605 if Windows Update check speed is still fine?

Reply | Quote

Thanks again Woody for all you do to help with the kettle of fish MS keeps aggravating us with.
There certainly is something rotten in Redmond!

Being 20 something in the 70's was far more fun than being 70 something in the insane 20's

Reply | Quote

Been following your advice for this on my old Win7 system and decided to check “Check for updates” again. Right around 30 seconds!
Thanks
Bill

Reply | Quote

Yep.

Reply | Quote

Thanks!

Reply | Quote

Woody, What is your take on the Microsoft email sent to win 7 users this morning? Sounds like an ultimatum to me. ‘We (MS) are going to spy on you regardless. Am I misreading this, Email?

Reply | Quote

Latest Windows-update for win32k.sys is KB3177725
https://support.microsoft.com/en-us/kb/3177725

The KB-article isn’t online yet, but in its Security Bulletin it’s listed as replacing the previous win32k.sys-update KB3168965 https://support.microsoft.com/en-us/kb/3168965 :
https://technet.microsoft.com/library/security/MS16-098

Reply | Quote

KB3177725 (kernel mode driver update) did it for my Win 7. Use Woody’s method – turn off WU, install, reboot.

Reply | Quote

@Woody:

I already had all of the required Updates installed, so do not need any of those listed.

Can I just wait until MS issues the August updates (for Windows 7)? It usually takes a day or two for them to appear. I’ve only had one definition update appear this morning which I DL & Installed.

Thank you, so much for the detailed information you posted on InfoWorld! 🙂

Reply | Quote

I haven’t seen the email. Care to forward it to me? woody@askwoody.com

Reply | Quote

Do you have a link for the download?

Reply | Quote

@Woody: Also a big “thank you” to those whom you mentioned above as follows:

****My thanks — and deep admiration — to Dalai, ch100, and EP**** 🙂

Reply | Quote

You bet. See the separate post. PKCano and Dalai are running it all down, even as we speak.

Reply | Quote

Setting it to Manual is a good idea if you check for updates manually. When it’s set to Manual it starts immediately when you open the WU panel, so there’s no need to start it manually when you check for updates.

Having it set to manual also stops the unnecessary constant load on your processor caused by “svchost” until you actually check for updates.

Reply | Quote

https://technet.microsoft.com/en-us/security/bulletins

Reply | Quote

You should add a link to Dalai’s site to your “Links” group on your page Woody.

Reply | Quote

Good idea.

Reply | Quote

Changing subject just a litle: received emails from MS about policy and privacy changes from ms to Win 7 users. Sounds like if you don’t signup with them they will curtain all Windows 7 software that you use and if you do sign up they will spy on you from now on. Am I just reading this wrong (from shell shock) or it it true. Please give in informed take on this these emails ( got one on xfinity email system and one on gmail, google system.

Reply | Quote

I haven’t seen the emails. Can you shoot me a copy? woody@askwoody.com

Reply | Quote

Got it. I’m up to my keester in gaters at the moment, but will look soon.

Reply | Quote

Might be another of many phishing scams not really from MS.

JF

Reply | Quote

Phishing scam????????
JF

Reply | Quote

The July “magic” patch, KB 3168965 isn’t working for me. More than 25 minutes already.
W7 SP1 Home Premium

Reply | Quote

W7 – x64
https://www.microsoft.com/en-us/download/details.aspx?id=53446

W7 – x32
https://www.microsoft.com/en-us/download/details.aspx?id=53466

Reply | Quote

Not necessary the best solution. A better one and fully supported is to leave wuauserv on Automatic (Delayed) as it is by default and configure to Never check for updates. Setting on Manual may start the service without user intervention if Windows considers so, while setting on Disabled may have undesired side-effects, although unlikely with Windows 7. This was a problem in the past though.

Reply | Quote

A friend of mine got the e-mail. It looks legit, and it contained a link to the new M$ Services Agreement that takes effect on September 15, 2016. To wit; https://www.microsoft.com/en-us/servicesagreement/upcoming.aspx

I’m not sure what triggered the e-mail that she received. I haven’t gotten one, and as far as I know, I’ve never given M$ my e-mail address.

Reply | Quote

Thanks @max for providing the relevant documentation. In WSUS or Microsoft Catalog the supersedence is not flagged and the Security Bulletin is the only reference to KB3177725 replacing KB3168965.
Maybe Microsoft should re-release the patch with the metadata implemented correctly. Otherwise, both patches should still be offered.

Reply | Quote

Thank you 🙂

Reply | Quote

THANKS!

Reply | Quote

Interesting. I wonder what’s going on?

Reply | Quote

I had KB3168965 installed on my systems and search bogged down as soon as MS released the patches today. Only thing sped it up was KB3177725. The only way I think KB3168965 would work is if you hadn’t done last month’s patches.

Reply | Quote

One of the patches this month, KB3167679 for both Win7 and Win8, is Security Update for Windows Authentication Methods. What do you suppose they’re up to now???

Reply | Quote

Same here. Been chugging away for well over an hour now and no updates. *sigh* back to the monthly quick fix…

Reply | Quote

Interesting. Looks like you need to move on to the August patch.

Reply | Quote

Truly, I am at a total stop with confusion. Seeing my W7 has been telling me I am up to date, with no updates offered since April, am I to download and install “each” and “ALL” patches listed on wu.krelaydel/en page? Do I start at the bottom of the list installing all and work my way up,or does the latest new patch do the whole job? This has been such nightmare it isn’t funny!

Reply | Quote

What exactly is meant by “curtaining” Windows 7 software? They will block the functioning of software, of programs already installed or to be installed?

Could this even be legal?

Reply | Quote

Just follow the steps in my article. Very straightforward. If you look in the comments to my article, I’ve posted the info about the August “magic” update.

Reply | Quote

Yeah, i will when it comes through. I prefer to do it through update even though it takes several hours to find, download and install. I really should do an offline install.

Reply | Quote

Microsoft’s (alleged) summary of changes to the Services Agreement is here:

https://www.microsoft.com/en-us/servicesagreement/Updates.aspx

The revised agreement itself lists the services to which it applies, and it is basically online services (although it includes things like the Edge new tab page). Windows 7 isn’t on the list (nor is 10).

I don’t see anything Orwellian. What does the email say specifically?

Reply | Quote

The email is actually a very short version of the Service Agreement in your link. I don’t think it’s particularly noteworthy, but I’ll wait for the legal eagles to take a look.

Reply | Quote

I saw some different behaviour this time… the check for updates took about two and a half hours as expected but downloading KB3177725 after selecting it took almost no time at all. Usually it’s stuck on 0% for an age but this time download was initiated almost immediately. Fascinating.

Reply | Quote

I am currently maintaining about 40 computers with Windows 7. Last month I put the bundled update KB3161608 on about 30 of the computers. Today I am noticing that those 30 machines are going through the “checking for updates” procedure in just minutes. The others are taking an hour or more.

Reply | Quote

Yep, that’s the patch that carries six tag-along patches.

Reply | Quote

Worked perfectly for my Windows 7 machines, but there really needs to be a similar fix for Windows 8.1. The night before Patch Tuesday, my Windows 8.1 laptop just sat there for close to two hours ‘checking for updates’. And while KB 3168965 was among the patches that eventually populated the list, check-marking and installing it first did nothing to shorten the scan process. I didn’t expect it to, but was hopeful.

I’ve seen a few comments on askwoody about slow Win8 scans during the past few months, but I don’t recall seeing a solution. Perhaps someone can point me in the right direction.

Reply | Quote

Hi Woody,

My experience with running the search for August 2016 security updates:

Windows 7, SP1, with all prior security updates installed – only took 23 minutes on 1 computer, and 24 minutes on another.

That’s without KB3161608 installed also, because for some reason I’ve never been offered it.

Reply | Quote

Woody,

Followed ur instructions on w7 and Wu has been grinding for more than 45min when I decided to quit

Reply | Quote

There is always the Catalog… but you have to use IE unless using the RSS trick 🙂

Reply | Quote

All due respect CH but my old laptop that has a mid-range dual core processor and minimal ram running Windows 7 one of the “svchost” processes cripples it when this service is running regardless of WU being set to never check for updates. With this service left at the default setting and WU set to never check for updates there were times it could have been more useful as a boat anchor for 15-20 minutes after a restart.

I changed the WU service setting to manual a few months ago and immediately noticed that the system is consistently responsive quickly on a cold boot or after a restart. Since I always check for updates manually and this service starts immediately when opening the WU panel it has worked quite well for me.

I have not seen anything start this service yet when set to manual other opening the WU panel. Is there something else you’re aware of that triggers this service to start?

Reply | Quote

Yep, that’s for the “advanced” course….

Reply | Quote

Did you install KB 3177725, and all the others?

Reply | Quote

Take a look at wu.krelay.de/en – Dalai has some suggestions for 8.1.

Reply | Quote

So, in the light of specifications made by some commentators later, it appears these changes affect only Microsoft SERVICES you signed into. Okay, no worries then. I have avoided these things already since many years, since long before W8. Ah wait – since ever.

(sigh of relief)

Reply | Quote

John, if you had KB3020369 installed then KB3161608 would have been offered to you.

In a thread from a few weeks ago ch100 posted: “….You just can’t install KB3161608 without KB3020369, and there are many more updates which require KB3020369.
Either install KB3020369, it has been long due or stop installing updates entirely”.

gts

Reply | Quote

@Dan;

”Windows 8.1 laptop just sat there for close to two hours ‘checking for updates’”.

Woody; ”Take a look at wu.krelay.de/en – Dalai has some suggestions for 8.1.”

Using Dalai’s lists and Woody’s steps my 8.1 has routinely completed all tasks in mere minutes.

Try it.

Reply | Quote

This seems to me to be long time if as you said, you have all Security patches up to July installed. Do you have any of the updates in the second table here http://wu.krelay.de/en/, i.e. the Windows Update client updates installed in addition to the Security Updates? The preferred one is obviously KB3138612/Kb3138615, but any other WU client update in that list should do the job.

Reply | Quote

@Woody Maybe you should clarify for everyone that https://support.microsoft.com/en-au/kb/3020369 is mandatory install before doing anything else. This info was lost somehow because this is an older update but still essential and very much prerequisite for any update installed after the release date of KB3020369.

Reply | Quote

I tried to email you but when I tried to attach the MS emails, my windows 7 said would not convert. As I am not a legal eagle (but read most of the service and privacy statements) – My take is that MS wants us to sign it or lose it (along with the changes of their attitude toward us Windows 7 users and keepers. Hope your legal department can give us an idea as to what to do.

Reply | Quote

Of course

Reply | Quote

OK. I’m stumped. It seems to work for most people…. Perhaps Dalai or ch100 or EP could lend a hand?

Reply | Quote

My legal department consists of one of my brothers, who’s a specialist in Native American Tribal law. Other than that, I rely on the same people everybody else can talk to.

Reply | Quote

Gack! Yes, that’s the servicing stack update. I kinda swept that under the rug, assuming everybody had it. I’ll go put a note in the comments on the InfoWorld article.

Reply | Quote

@ch100
That’s not quite right. KB3020369 is required for any of the Convenience Rollups (June & July), but not for regular security patches. I don’t have KB3020369 installed on my test system and had no problems installing KB3177725 or any of the other updates in previous months.

However, the servicing stack update is offered if it’s missing, so it’s probably already on the majority of systems.

Regards
Dalai

Reply | Quote

The only reference to Windows 8.1 I see on that page is concerning update KB 3138615. It was installed on my laptop back in April. It’s entirely possible that it helped with slow scans back then, but most certainly stopped working thereafter.

Reply | Quote

Very good question – and I don’t have any idea! Perhaps someone else here can help?

Reply | Quote

KB3172614 July 2016 update rollup for Win8.1 did slightly speed up WU scans on my dad’s Toshiba laptop late last month – took between 5 to 7 minutes when checking for Win8.1 updates with either KB3161606 & KB3172614 installed.

KB3161606 & KB3172614 contain Windows Update Client v7.9.9600.18340 for Win8.1 and has similar “optimization” fixes that were included in v7.6.7601.23453 of the Windows Update Client for Win7 SP1 from KB3161608 & KB3172605.

Reply | Quote

KB3161608 is superseded/replaced by KB3172605 and yet Intel has not yet produced updated bluetooth drivers & software that are compatible with the KB3161608 and KB3172605 update rollups and Microsoft will soon release an August update rollup that will replace both KB3172605 & KB3161608. Intel has really gotta pick up the pace and make new Intel Bluetooth drivers soon.

Reply | Quote

I’m probably going to elicit some criticism here, but I have been hiding compatibility, telemetry, and Windows Client Update patches throughout the ordeal feeling they would only grease the skids for the forced upgrade. The compatibility and telemetry patches will stay hidden.

Each month, without intervention, the Windows Update search takes hours to days and incurs high CPU usage. Some people have installed the Client Update patches (and rollups with 6 useless others) in an effort to speed things up. I have not installed these. And I have not seen anything to indicate that the installation has, in itself, helped. Even with the Win Client updates installed, the search immediately bogs down as soon as MS issues the next set of patches and we have to go looking for the “miracle patch” of the month.

I have seen search speedup ONLY by installing ONLY/JUST the Security for kernel mode drivers patch (servicing stack) each month manually ahead of searching for the rest. So the Win Update Client patches (and rollups to get just the one) will remain hidden on my machines also. BTW I haven’t seen a new one issued since the end of the Win10 ordeal – the last cumulative was a combined May and June patch.

Reply | Quote

Or is it possible that the new KB3172605 don’t have the same Bluetooth problems???

Reply | Quote

OK, thanks for clarifying @Dalai. I tend to install KB2533552 and KB3020369 in this order as very first patches on any new systems with Windows 7 SP1 32 and 64 bit or Windows 2008 R2 SP1.
This is based on Microsoft’s documentation and to avoid other problems than the speed of WU and not on experience.

Reply | Quote

I recall seeing a post a while back speculating that there existed a relationship between slow 8.1 scans and the monthly IE 11 Flash Player update. Didn’t pay much attention to the theory at the time, even though my 8.1 scan times seemed to be increasing from a couple minutes to 20+ minutes.

Well, today I did a manual WU scan on my 8.1 laptop and was pleasantly stunned by the response time — less than one minute to show the August updates!!! Notably, there was no listed Flash Player update offered. Possibly a coincidence, but I’ve learned to never say never.

Reply | Quote

I can only think about missing other updates which I would find difficult to identify individually. That’s why my approach is to install almost all updates, including Recommended and Optional except for KB2952664, although I am in the process of reassessing even that patch and considering installing it just to take it out of the way if it proves not to be harmful. Let’s not forget that KB2952664 does nothing harmful by itself, it was only a pre-requisite for the patches forcing the free Windows 10 upgrade. It is probably still useful to those paying to upgrade now and in the future.

Reply | Quote

Interesting.

Reply | Quote

How many people really use Bluetooth with their laptops to be worth Intel’s time and effort?

Reply | Quote

@PKCano Why makes you think you are going to “elicit some criticism”? We are all learning 🙂
While it seems to be true and I agree with this, that the speed-up or most of it is related to various Security updates, there is always a good chance that other updates have functionality which is either not fully documented or less understood by all of us in the details. I consider updates as part of the Windows code at the end of a certain round of patch releases and this is why I am in favour of installing them all as being part of a system.
As it is likely that none of us contributed to the development of the Windows code, how can any of us fully and objectively actually assess the updating of the same code for which we don’t know all details?

Reply | Quote

Good point. Few Intel machines have Bluetooth keyboards.

Reply | Quote

Just stating my observations based on my experience. Win Update Client patches don’t SEEM to have have any affect. I really believe MS has broken WU on purpose in an effort to drive us all to Win10. I think they intentionally flip a switch when they issue a new batch of patches just to make up stand on our heads. I really think they could fox it IF THEY WANTED TO – just not flip that switch!!!

Reply | Quote

Thanks for your linked article on step-by-step instructions for improving Windows 7 update speeds. I had always been confused before when you mentioned turning off Windows Update. I didn’t realize you meant the Microsoft Services panel that tells you the settings for all the different programs. I was able to have success with the updates you suggested by simply setting Windows Update to Manual, rather than Stop. I’ll probably just leave it on Manual unless I run into problems down the road, since I never allow Windows to update without deliberate permission anyway.

Reply | Quote

They are just killing Joe User

Reply | Quote

I have this perspective too. The only difference is that most of the hidden updates I use to have were unhid so they would get the opportunity to be revised or pulled. The revision & pulling would have been missed if I hadn’t been willing to go with the idea of unhiding (thanks to ch100’s past comments). Now some of them just stay put in optional or important after being unhidden & I no longer have to worry about duplication of updates.

My only hidden one now is 3080149 & I am inclined to unhide this one soon, just to be rid of the last one. It too will stay put wherever it lands after unhiding & then I’ll just review my personal “avoid” list every month when I do updates for my 8.1 x64 machine. No more hiding, ahhh, what a relief.

Reply | Quote

Actually, I do and it’s critical.

The kbd of an otherwise quite good laptop broke and could not be replaced, so the only way to use it is a BT kbd.

Had I been on W7 and this problem came up, I would have lost its use. But it’s on W7. I am using it with a large TV screen.

Reply | Quote

Well, after reading what’s been going on with W10, my policy now is to defer ALL updates until such time in the future that’ll be safe and won’t drag hassles with it.

It’s just absurd to play MS’s game and busy ourselves with all this crap while they’re doing everything they can to mess things up and force them down our throat.

My W7 laptop works fine. My W10 1511 laptop works fine. Why mess around with them for no obvious reason?

Security? Given that I am backed up and synced on 2 computers, I’ll take the risk. It’s less costly than WU and it lets me work in peace.

My suggestion is that it’s no longer the time to insist on a up to the minute systems, unless you’re a masochist.

Reply | Quote

It is also the connectivity between mobile phones and laptops which is many times not reliable and in most situations the user is better off by using a cable.

Reply | Quote

Good point, this may be the case. Thanks for quoting 🙂

Reply | Quote

I understand the logic, but it’s too much hassle for me and given the flaky and untrustable behavior of MS, I don’t see a value that is worth that hassle.

It could well be that had all user adopted this “I won’t bother” policy”, MS would have been forced to stop the nonsense. I won’t hold my breath.

Reply | Quote

The only way that this would not be intentional is if they needed to do something to prevent this from happening and ignored it, but that would not be exactly unintentional either, ain’t it?

Whichever way you look at it, judging from their entire pattern of behavior, they wanted it this way.

Reply | Quote

Ah, but apparently that’s their objective: focus on business, not consumer (look at their phone strategy).

Except that they are not that competent to do that well either–they’re screwing business too.

Reply | Quote

Sorry for being so late in responding, but I think I’m on the other side of the globe to almost everyone else contributing here, so there’s an obvious time mismatch.

Anyway, here’s what is and isn’t installed, for what it’s worth:

KB3020369 Not installed

Regarding the updates from the second table at http://wu.krelay.de/en/:

KB3075851 Not installed
KB3083324 Not installed
KB3083710 Not installed
KB3112343 Not installed

KB3135445 Not installed
KB3138612 ** Installed **
KB3138615 Not installed

Reply | Quote

I have seen it get started (even though manual) a lot of times, I am not sure what does it. Maybe reboot, maybe “security center” (the flag icon in the tray), maybe one of the umpteen predefined scheduled crapware tasks.

Observations on mix of Win8.1(NT6.03) and Win7(NT6.01).

Reply | Quote

@Ed I don’t tend to change the default state of services as this is likely to create even more problems when less expected. The only Windows 7 service which I think should be disabled and I routinely disable is Windows Media Player Network Sharing Service. Another candidate is Superfetch when C drive is SSD, but this is not a black and white one and the implications should be understood well, better left for Windows 7 to manage for most users.
However, each installation is different and with your setup and applications installed things may work better with your setup.

Reply | Quote

@John “but I think I’m on the other side of the globe to almost everyone else contributing here”
This may not be the case 🙂
In the list from the second table at http://wu.krelay.de/en only the update which you have installed is required.
You need to install KB3020369 as a generic update, not only for the speed-up and try first to install KB2533552 “Install this update to enable future updates to install successfully on all editions of Windows 7 or Windows Server 2008 R2.”
Do you have IE11 installed?
What about .NET Framework 3.5.1 and 4.5.2?

Reply | Quote

@PKCano “I really believe MS has broken WU on purpose in an effort to drive us all to Win10.”
This would be extremely dangerous in a legal sense. Such a decision would leave evidence and I don’t believe this to be the case. It is just a side-effect of poor maintenance and I can reproduce the problem easily by manipulating in WSUS what is presented to the WU agent and what not. Being fully patched works around this issue because there is less calculation to be performed and old patched are just ignored, being flagged “superseded”.

Reply | Quote

@fp Your approach might be the most sane of all 🙂

Reply | Quote

@Render Thank you for your comments and confirmation of the procedure 🙂

Reply | Quote

word

Reply | Quote

Do you have 3112343 installed? I’m trying to determine if installing this ends up speeding up the patch indexing.

Reply | Quote

I don’t think it’s a question of intentionally sabotaging Windows 7 installations. I think it’s a combination of “why spend money on this old stuff” and “if they don’t install all the optional patches, let ’em eat cake.”

Reply | Quote

We have a, uh, geographically dispersed audience. John might be surprised to know that I lived in Phuket for 13 years, just moved to Nashville a couple of years ago. 🙂

Reply | Quote

@woody You totally nailed it! 🙂

Reply | Quote

@ch100 Thanks for your feedback; very much appreciated. Now I’d like some more help, if you don’t mind.

KB2533552 is already installed.

KB3020369 isn’t hidden, and never gets listed in Windows Update. Should I download it from the link on the KB3020369 web page and install it?

Yes, I have IE11 installed.

.NET Framework – 3.5.3 and 4.6.1 (as far as I can ascertain, following instructions from https://msdn.microsoft.com/en-us/library/hh925568(v=vs.110).aspx (“How to: Determine Which .NET Framework Versions Are Installed”).

Any comments, suggestions (as long as they’re polite, of course :-)) will be most welcome.

Reply | Quote

I was finally able to exercise downgrade rights from win10 pro to win7 pro on my laptop using the information provided here. Hooray!

It was necessary to apply the updates specified in the article to a pristine win7 sp1 install. When I tried to shortcut things by first installing kb3125574 (the ‘sp2’ convenience rollup), windows update would hang every time. After I figured that out and tried again, windows update finished in a few minutes and 160+ important updates were applied. Oddly enough, sp1 was among those updates, even though I used an sp1 iso for the install.

Now I’m staring at 67 optional updates in wu, wondering what to do about them. Some are listed in regular font, some are italicized. What’s the difference?

Many thanks!

Reply | Quote

Italics means that Microsoft “recommends” them – which means that Microsoft would like to push them onto your machine but since you don’t have the box “Check for updates but let me choose whether to download and install them” checked in Windows Update, it can’t.

As for what to do about them… we have two very different camps here. One says ignore all of the optionals. Another says install the optionals, but skip certain ones. I tend more toward the former, but if you want to try the latter, looks at this post from last month:

https://www.askwoody.com/2016/the-latest-kb-blacklist/

Reply | Quote

I may not understand the way Microsoft writes it, but I think MS16-098v1.0 is wrong:(https://technet.microsoft.com/library/security/MS16-098)

They say 3177725 replaces 3168965 but only one file gets replaced, and it the Win32k.sys file. I understand that 3177725 does NOT replace 3168965 but updates it?

http://support.microsoft.com/kb/3177725
http://support.microsoft.com/kb/3168965

Reply | Quote

Ref Infoworld Woody-on-Windows link – 2 easy steps to speed up Windows 7 Update scans ………….
http://www.infoworld.com/article/3105605/microsoft-windows/2-easy-steps-to-speed-up-windows-7-update-scans.html

Turning OFF Win Update per instruction 1d. I netted only “Stopping” – not STOPPED in Services – UNTIL I Re-booted, THEN I saw Stopped. Until I re-Booted trying to install KB 3177725 only showed something like “Looking in updates” that went in a perpetual circle.

Maybe Only my machine but FYI.

Reply | Quote

Maybe we should clarify that some of those updates related to Windows 10 free upgrade are no longer available.
My current block list contains only KB2952664 and nothing else.
I am currently evaluating KB2952664 as it may not cause any trouble if the Windows 10 upgrade patches are no longer available. KB2952664 was only a pre-requisite for them.

Reply | Quote

PKCano,

I have followed the same path as you have, regarding selecting/avoiding updates for Win 7. I share your suspicions.

I also share your reasoning that they are doing many of these roadblocks, cockups, mistakes on purpose.
They are too big, too smart, too strategic to be relentlessly screwing things up for,
and wasting the time (and computer hardware life) of,
a huge, important customer segment,
for a year and a half,
without meaning to.

(Or at least, without apologizing and promising to do better. I can remember a time when companies tried to serve customers well, and to keep their promises and agreements.
Their customer “goodwill” and reputation has been destroyed with a lot of folks. They appear not to care.)

Reply | Quote

How can people who witnessed
their surreptitiously changing the “x” in the righthand corner of a box from the longstanding meaning of “stop this procedure and close this box without changing anything on my system”
to the new, suprise meaning of “I agree to your making massive changes to my system without your explaining to me that I am agreeing to that”
think that they are not deliberately trying to force people on older versions of Windows to Windows 10 by hook and by crook?
They’ve worked out lots of sneaky ways to herd people into the spot where they want them.
Making Windows 7 hard/inconvenient/complicated/frustrating to maintain is just another way.

Reply | Quote

@John Trying to be polite 🙂

.NET Framework 3.5.3 does not exist as far as I know and it must be a typo. You probably have 3.5.1 which is OK.
I am not sure why KB3020369 is not installed and is not offered at the same time.
Please go to Control Panel, Select View by: Small icons, Select Programs and features, View installed updates and either sort by name and search in the list or better type in the search box KB3020369 as is, no space between KB and the number.
Or else you can download it and try to install. It will tell you if it applies or not. Just make sure that the version downloaded is for the correct version, 32-bit or 64-bit.

Reply | Quote

I will go against Dalai’s latest research here and say that I have just received Susan’s newsletter and her experience is consistent with mine. KB3177725 is not required for improving the speed of the scan, although there are no known issues with the patch.
This patch should be applied anyway for other reasons now or when the MS-DEFCON will change to 3 or higher, so no action to be taken now by those including me who have already applied it.
The master patch for speeding scans should still be the July 2016 patch https://support.microsoft.com/en-us/kb/3168965 and everything else as listed on Dalai’s site at http://wu.krelay.de/en/ or http://wu.krelay.de/

Reply | Quote

As long as they get away with it, why exactly should they not do it?

Reply | Quote

@ch100 Thanks for your ever so polite reply. 🙂

I followed your instructions and there was no match for KB3020369 in the Control Panel “Programs and features” search window, so I downloaded the 3020369 (32-bit) installer.

It installed without any problems, and gave the “Installation successful” message on completion.

Once again, thank you for your kind assistance.

Reply | Quote

Well, I guess it depends on the other patches installed on the system. Maybe it’s not needed when the recommended and/or optional updates are installed. But I’m going to make additional tests on a newly installed system tomorrow to see if I overlooked something, like not waiting long enough before aborting the search.

Reply | Quote

Um, no. If “they” knew of a fix to WU, yet willfully withheld it from users because they wanted to trigger OS 10 upgrades, not only is that clearly intentional, but unprofessional and unlikely, IMO.

I mean, if an OS 10 shift is their desire (or mandate), why not just inform users of that, offer a free upgrade, and stop supporting OS 7, among others, completely?
Why subject users to the WU patch/fix funhouse?

What I don’t get, is that MS can’t seem go produce a fix (or anything, for that matter) that’s 1) user-friendly to employ and 2) effective.

Reply | Quote

+1

Reply | Quote

It’s largely a question of semantics. In this case, you can install 3177725 even if you’ve never installed 3168965.

Reply | Quote

My two cents: I have installed/reinstalled HUNDREDS of Windows 7 using the legit digital river version during the years, after a new install the first batch of 280 or so updates took roughly 4 hours, then the next batch and so on..it was basically a whole workday before everything was updated. Since Windows 10 came along, that workdayis now 3 workdays. I’m typing this watching a laptop chug away searching frantically for updates for 28 hours now, and that’s just the first batch. I find this hilarious. No, I am not going to use any of the speedup tricks that install Windows 10 plumbing, telemetry and who knows what. I have aaaaaaaaaall the time in the world, and I have my long list of updates to avoid and I’m not afraid to use it. I’m kicking a** and taking numbers! But yeah, this is how Redmond treats Windows 7 users, our update server is a USB 1.0 stick connected to a NMT cellphone powered by a bicycle connected pedalling generator operated by a drunk guy named Lazy Frank somewhere in the Rocky mountains. Still, I’m doing this without blinking.

Reply | Quote

What, Lazy Frank got a promotion?

Reply | Quote

I have been experimenting with Win7 and Win8.1 machines on which I hid the compatibility, telemetry and Win Update Client patches. This is what I’ve done:
Disconnect from the Internet.
Stop WU service.
Unhide all patches.
Reconnect Internet.
Reboot (WU turns back on with restart)
Search for updates.

Of all the patches that I hid (see my list here https://www.askwoody.com/2016/the-latest-kb-blacklist/ ) the only ones that are now offered (except the rollups) are:
Win7 KB2952664 (compatibility), KB3021917 (compatibility and telemetry), KB3068708 (CEIP) and KB3080149 (telemetry)
Win8.1 KB2976978 (eq. KB2952664), KB3044247 (enable upgrade), KB3068708 (CEIP), and KB3080149 (telemetry).

All of the others, including all the monthly Win Update Client patches with the exception of KB3138612 (Win7 rollup) and KB3138614 (Win8.1 rollup), are no longer offered. The two rollups seem to include earlier Win Update Client changes made before the Win10 push ended. I don’t believe there have been the monthly changes made after the end of GWX. To me, this SEEMS to confirm my suspicion that the changes were aimed at greasing the skids for Win10 – the reason I hid them in the first place.

I have decided to go ahead and install the rollups. So, my block list now only includes the four patches mentioned above for each platform.

Reply | Quote

Lazy Frank is moving up in life! =) Serving 65% of the planets computers with updates AND getting exercise while doing so. We could all learn from Lazy Frank.

Reply | Quote

I’ve done some more tests. I installed the latest stand-alone update agent (KB3138612) and the five updates from previous month, rebooted and let the system check for updates. After more than 30 minutes I aborted the process by stopping WU service; it would probably sit there another two hours, which is just unacceptable.

Then I installed KB3177725 and let the system check for updates again. It was finished after 6.5 minutes, which is consistent with previous months.

Conclusion:
At least for newly installed systems KB3177725 is needed to reduce the search time. Perhaps it’s different on fully patched systems. I don’t have the time to do additional tests on a fully patched system each month; it’s time-consuming as it is (half a day each month).

So, the recommendations may still vary in the future, but I guess we have to live with that – unless MS cleans up this mess which is unlikely.

Reply | Quote

My Win 7 Home Premium build 7601 (2009) has been downloading updates (using Woody’s advice on speedups) at a reasonable rate. These updates come in individually and with the use of GWX Control Panel (running 24/7) I have had no bad MS updates allowed. I can download and install what I want in about 30 minutes, including reboot. The one thing I don’t do is tempt MS, mainly because I don’t have the luxury of a test computer (wish I did). I follow Woody’s advice, use GWX Control Panel 24/7 and have a minimum of troubles.

Reply | Quote

Adding to what I just posted: My control panel has listed 138 programs on this HP 1TB Win 7 computer.

Reply | Quote

VERY interesting. I wonder if they’ll ever fix it?

Reply | Quote

🙂 🙂 🙂

Reply | Quote

So on Win7 you are now blocking just KB2952664 (compatibility), KB3021917 (compatibility and telemetry), KB3068708 (CEIP) and KB3080149 (telemetry).

You’re installing all the other optional patches, and not having any problems?

I assume you still have CEIP turned off – and I wonder if that affects any of those patches.

ch100, do you have a different point of view?

I’m very interested because this will affect my recommendation when we finally get to MS-DEFCON3. It’d sure be nice if I could call of the dogs because Microsoft’s seen the errors of its snooping ways.

Reply | Quote

Follow up story: The clients laptop that was waiting for the updates. “Is my laptop ready?” ummm, sorry no..give me a week or five. “Whaddayamean??” I dunno what’s going on in Redmond but they completely refuse to give your LEGAL LICENSED laptop any updates. “what….., what now?” Well, Solus installs in 2 minutes and the updates take another 20 seconds. “What’s Solus?” It’s Linux, same programs you use, but without you having to worry about viruses and such. “Why didn’t you put that then in the first place?” ummm..because I thought, you know, OFFICE and whatnot. I thought it’s better to not mess with what you know. “Look man, I want a working laptop and I want it now haha” ok, gimme a few seconds, one Solus coming up! …now I will wait for the final verdict in a day or two..I showed the basics: “huh? its ON already? oooh ok, start meny oooh Chrome is there, Libre, VLC oooh that’s where you install more stuff jaaa jaaa I got this. Thanks man!” ..I sometimes underestimate the ones that actually use these things. Shame on me.

Reply | Quote

Yes, but is KB3177725 fixing ALL that KB3168965 fixed or only a subset? I understand that KB3177725 does not supersede KB3168965 in the Catalog.

I sometimes see in the Windows Update Catalog a patch marked as superseded, so after installing the newer patch, I DISM uninstall the superseded one.

For KB2533552, it’s superseded by KB3020369. However, KB2533552 is still a dependency of KB3042058, but the article says KB3020369 is? Removing KB2533552 did Bad Things(tm).

Now, the WUClient has to unmess this tangle? I guess the update tree has to be better managed, the patches better connected, and not make patches to fix bugs in patches. Replace it instead!

Oh well, pigs will fly or I’ll be dead before that happens. I give 5 years before Microsoft dies :-p

Reply | Quote

Don’t open the gates just the lamb may turn into a dragon again quickly!

Reply | Quote

On ALL the people I have been helping, I have recommended (or put my hands on their computers) unchecking “Give me recommended the way I get important.”

But on MY OWN COMPUTERS I have left recommended checked. Each month I have been going through the recommended updates one by one and blocking the ones I chose. You have my list.

There has been a bunch of stuff I probably (or most certainly) did not need, particularly on the Win8.1 machines (all are Pro). My Win7s are mostly Ultimate and Pro, one Home Premium, and the test machine was Home Premium. I have had no problems.

Most the updates I hid disappeared (as above) and I am left with only the four hidden on each platform.

I have been working to cut loose all the Users in my “flock.” On the whole, they cannot handle manual updates – they are not technically capable, can’t remember to do it, don’t care, it’s over their head, beyond them to cull updates or initiate the process manually. I’m dealing with Joe User – you’d be surprised (or maybe not). So, with the exception of a few who have caught on, I am starting to move them back to automatic.

I am disconnecting them from the Internet, turning off WU, unhiding all updates, checking the “recommended” box, installing KB3177725 manually, reconnecting the Internet, rebooting, then searching for updates. When they come up, I am rehiding the four above, and installing the rest. When there are no more updates, I am putting them back on Automatic.

Don’t get me wrong. MY COMPUTERS are not going on Automatic and I will continue to monitor updates to be (relatively) sure MS is not pulling some other tricks. If necessary, I will revert to coaching the heard.

But I think, for now anyway, the fire is out.

Reply | Quote

Fascinating. Another religious convert!

Reply | Quote

HA! Microsoft won’t die, but it will transmogrify. The Microsoft we’ll see in five years will be completely different from the one we see now.

My big question is what Windows will look like then.

Reply | Quote

Glad to hear a success story!

I still love my Chromebook…..

Reply | Quote

KB3177725 contains only win32k.sys, KB3168965 contains win32k.sys and acres.dll (and some other files). So the newer update doesn’t fully replace the older one, and that’s why the older one is still needed (tested this on Tuesday already).

Reply | Quote

Just had a read of the web page definite food for thought certainly taught me quite a bit. Now Suitably bookmarked. reason for having a “mosey” over there was I have used these 2 for quite a while kb3138612 (which made the list) and kb947821 they an be run as “point and click” or added using DISM. If you install from the desktop remember to disconnect any network connections first otherwise they take forever kb947821 takes a long time approx. 15 mins so one of the few updates that is probably faster to add by DISM either way add kb3138612 1st then kb947821. really this is more targeted towards older x86 machines running win7 sp1. my buddy brought me an XP 2001 vintage machine x86 and wanted to run win7,knowing I had one in the corner (in fact this one)added the above to the install image and installed and in about 5 mins up popped all the updates. including the really obscure driver files that are nearly, if not, impossible to find out there on the “ole interweb” so this post is very nearly in praise of windows update and I am probably going to get banned for this post 😉 Its the law of probability really that M$ can actually get it right once in a while be it by accident or design.

Reply | Quote

PKCano, thanks for your updates, they are helpful.

Reply | Quote

Yes, the sleeping lion in the corner might just have one eye half open! 😉

Reply | Quote

After installing KB2952664, the next offered is KB3150513, which is a kind of add-on for KB2952664. So consider KB3150513 as being on my current block(black) list too, only that this one becomes visible only after KB2952664 is installed which ideally should not be installed, at least not yet.
The other updates which I don’t consider on the black list any longer are expired and not offered anymore.

Reply | Quote

Yes, but in fact KB3168965 is offered even after installing KB3177725 which was confirmed to me by Dalai few days ago and which he posted here too.
The supersedence list in Microsoft Catalog says the same and WSUS which should be the same thing which is in the Catalog says the same too.

@ve2mrx is correct in saying that MS16-098 should be updated as it contains incorrect information.

Reply | Quote

@ve2mrx
If you find DISM as being too much effort, use Disk Cleanup (%windir%system32cleanmgr.exe) which does the job automatically. Restart after running Disk Cleanup even if it does not ask for it. Confirm the necessity of restarting with the Setup Event Log if needed.

“For KB2533552, it’s superseded by KB3020369”

According to the doco, this is only for 64-bit OS. I have the same doubt like you as Windows Update restores KB2533552 as “Service Pack 1” while WSUS does not.
This is the reason why I repeatedly posted here “install KB2533552 and next KB3020369 in this order”. And I believe this to be mandatory for a well maintained Windows 7 with SP1 and Windows 2008 R2 with SP1 system. Sometimes it is just too much information to be provided to less technical users and the action may be lost in the details if this is happening. I think Woody has the right balance in his “for Dummies” approach.

Reply | Quote

Like a big Cloud. One of these maybe science.nationalgeographic.com/science/photos/clouds
🙂

Reply | Quote

Woody. I know it’s scary. And not lucrative. Take Solus for a spin. I double dare ya.

Reply | Quote

The monthly Windows Update Client patches supersede each other and it is normal that @PKCano cannot see the old ones anymore. As a test, if the highest in the chain is hidden, the next in line (not expired yet) will be offered at the next scan and so on. This may be the reason why Microsoft is reluctant to remove old patches, because some people prefer them instead of the latest, having as side-effect the known issues with slow scans for WU.
CEIP should be disabled globally in all instances, same with Error Reporting. For me is purely for performance reasons, other people have other reasons. There are few additional scheduled tasks which according to the description are not doing anything if CEIP is disabled globally, however VMWare still recommends disabling them to reduce traffic. Those tasks are under Application Experience (AitAgent) and the 3 tasks under Customer Experience Improvement Program.
I don’t think disabling CEIP has any influence over WU and the updates which @PKCano avoids seem to be independent.

Reply | Quote

@PKCano If you want to keep it simple, I think it is safe enough to install everything without block lists by now.
The assumption here is that CEIP and the associated tasks – see my other post in this thread for details – are disabled.
I would also recommend disabling the Error Reporting as it fills the disk with unneeded temporary files and generally slows down the computer.
The best way to disable CEIP and Error Reporting is from Action Center, Error Reporting should be disabled for all users, not only the current one. The alternative way is by configuring the local group policies where they are available.

Reply | Quote

@PKCano @woody I think it is OK to leave Recommended and Optional not installed and still have good functionality. It is mandatory to install every Important (not only Security) patch to be in a supported configuration. The downside is only loss of certain features which are implemented by some of the Recommended and Optional patches. Who has the patience to research every patch, can install only what is needed. I prefer to trust Microsoft and install everything for practical reasons.

I think what changed my view overnight were the images for Windows 2012 R2 Release 3 and Release 4 which without being called service packs, can be seen like big rollups for Enteprise and developers. They contain a mixture of Recommended and Optional in addition to Security and other updates. If Microsoft does include Recommended and Optional in their base code, I would think that it would be very difficult for a third-party not having access to the internal information to make a correct functional assessment.
Again, I am more interested in the performance of the operating system than the other considerations which are very legitimate and other users are entitled to a different approach.

Reply | Quote

Clarification: “recommended” is not the same as “optional.” I have checked “Give me recommended” and installed the ones that have fallen out as checked under important updates (with the exception of those hidden). See below.

I have not installed all the unchecked optional patches – the unchecked optionals remain unchecked optionals.

And yse, CEIP has always been off.

Reply | Quote

I’ll think about it – but I’ve really, really got my hands full with Windows!

Reply | Quote

I don’t ban anyone for their posts, as long as they’re germane. Even the trolls get their say. Although I have to admit I’m tempted at times.

Reply | Quote

Thanks @PKCano, it was understood from your post that you made reference to the Recommended updates. I included Optional in my post because I find some of them useful, mainly the RDP 8/8.1 updates but also the WU client update is sometimes released as Optional early and change to Recommended or even Important later.
Optional means literally “optional” and there is no push or requirement for any of them to be installed if they are not found useful. It is worth mentioning that there are only 6 current Optional patches for Windows 7 as far as I know (maybe few more including superseded updates), but there are many more, maybe 100 Recommended updates.
To clarify once more for everyone, the Recommended updates are those which come in italic when they are not selected and under Important when selected. Some may still be unselected by default at least for a while and those unselected by default should be really treated as optional until such time that they may change state. This means that the responsibility for their functionality is gently transferred from Microsoft to the end user.

Reply | Quote

CEIP is SUPPOSED to be disabled, but since GWX I have my doubts. I know for a fact that KB2952664 (and probably others) made changes to the tasks. Check the Task Scheduler under Application Experience, Autochk, and Customer Experience Improvement Program and see how recently the tasks have been executed. Hmmm…. I have those tasks disabled. Home Premium users can get to those, even they don’t have access to group policy, and avoid Registry editing.

And I’m still not keen on MS telemetry (snooping) patches either.

So will continue to block those four updates.

In the Action Center, “Check for solutions to problem reports is “off”, but I make sure the Error Reporting is cleaned out with CCleaner – it’s a check box on the front page. Sometimes there is substance there.

Although I have the technical knowledge to (carefully) edit the Registry, use group policy, and otherwise manipulate the system, my methods tend to be those Joe User can deal with – like check this box, click on “Run CCleaner” once a week (only the front page, not the Reg cleanup and other functions). I am RETIRED corporate IT, but what I’m dealing with now is mostly Home Premium, home networks, and technically challenged Joe Users.

Reply | Quote

Hi all,

Thanks to Woody and to http://wu.krelay.de/en/ for this. I was losing my mind.

I’ve written a script in batch (of all things) to use wmic check for the list of patches, display the ones you are missing, and offer to download the missing ones (using bitsadmin!). It doesn’t do anything nefarious and I’m hoping it has no bugs. It doesn’t do a pause so if you see a black screen flicker, you’re doing it wrong – run it from a command shell. I put it on my google drive share here: https://drive.google.com/file/d/0B6tfItr218zFVTB5aUEyMDl1Yjg/view?usp=sharing

If you understand batch, you’ll see what a horrible thing its doing in there – it has the patch list at the end and does findstr on itself 🙂

Reply | Quote

Apologies. I think using a “.bat” extention in a download is a bad idea – it results in all sorts of moaning from download managers. Here’s a link to a .txt version:

https://drive.google.com/open?id=0B6tfItr218zFbDRGLUhldTRJSG8

Rename the file to .bat before running it.

Reply | Quote

KB3177725 may be the “magic” speed-up patch for August, but there’s a caveat on the corresponding Microsoft web page. “Known issues: After you apply this security update and you print multiple documents in succession, the first two documents may print successfully. However, the third and subsequent documents may not print.”

Google the patch number, and you’ll find some howling about printing problems.

One step forward, one step back?

Reply | Quote

I got that mail to.

I have an Enterprise version of MS Office 2013 and I use the free office software vi Android (both registered).

Those are the only two reasons I can think of why I received that mail. Everything else i have from MS I block.

Reply | Quote

I am not “recommending” to install any of the telemetry patches that you and few other readers have on their list. I only say that I install them for the purpose of evaluating, without being overly concerned about their effect.
Noel Carboni posted in the past his findings based on firewall monitoring and if nothing changed recently, I think that post can be considered authoritative in relation to the network traffic related to telemetry performed in Windows 7.

Reply | Quote

@PKCano Thanks for mentioning the Autochk Scheduled Task. I missed that one. 🙂

Reply | Quote

Oy. I didn’t notice that one.

Sometimes ya cain’t win for losin’…..

Reply | Quote

This article is at Revision 3.0.
“Article ID: 3177725 – Last Review: 08/12/2016 17:37:00 – Revision: 3.0”

@woody That info may be more recent than the initial assessment.
Thanks for pointing to it @Marty

Reply | Quote

@Woody & @ Marty:

Any update that is known to have possible adverse effects on users should not even be issued IMHO. 🙁

Good “catch” on this one, Marty!!

Reply | Quote

I think this is a game nobody can win, so nobody should play.

That’s the only way to force companies not to impose these games on their customers.

Reply | Quote

For Disk Cleanup to be able to clean updates, you need to install KB2852386, “Disk Cleanup Wizard addon lets users delete outdated Windows updates on Windows 7 SP1 or Windows Server 2008 R2 SP1”. It’s a recommended update.

I usually run the Disk Cleanup first, and my cleaning script after. I made it a combination of manual whitelist and automated blacklist. It follows @Woody’s recommendations and some recommended/optionals I picked based on value.

What would be nice would be to have something like dpkg for Windows Update. Maybe in a couple years, Wine will replace Windows completely :-p

Reply | Quote

Re: KB3177725

7725 arrived at my Win8.1 laptop as important (checked) yesterday. (WU is never check & ‘give me important’ unchecked).

WU check (before install of 7725) produced 8 important and 12 optional KBs in 4 minutes. Search time after installing all 8 important stayed the same.

I do not print from this laptop.

Any other print problem reports/MS fixes?

Reply | Quote

Re: KB3177725 added.

Just found this:

“Important Update, 12 August 2016 12:09pm PST: Microsoft has confirmed this problem is due to a bug in their code. They are currently working on a hotfix for the issue. ETA for the hotfix is TBD. Updates will be posted as soon as they are available.

If you would like to be notified when this page is updated please “Follow” the Community post Notifications for “Windows Update causing BarTender errors.”

https://support.seagullscientific.com/hc/en-us/articles/225047808-Windows-Update-causing-BarTender-errors

Reply | Quote

Also see http://answers.microsoft.com/en-us/windows/forum/windows_10-other_settings/kb3176493-for-windows-10-and-kb3177725-for-windows/1280fc29-68ff-4328-83b2-e42704633262

Thanks for the heads up!

Reply | Quote

[Edited – thanks, ch100] Got an article coming up on Monday morning. Basic advice: If you don’t print multiple copies of things, don’t worry about it.

If you’re hell-bent on installing August’s patches (which I DON’T RECOMMEND), install KB 3177725, run your scans, then uninstall 3177725.

Most people should just sit back and wait – and don’t worry about it. There’s a reason why we’re at MS-DEFCON 2.

Reply | Quote

@woody
“Basic advice: If you don’t print multiple copies of things, don’t worry about it. But if you want to be safe, install KB 3177725, run your scans, then uninstall 3177725.”

This can’t be serious 🙂 It is too much work to be worth the trouble!

Reply | Quote

It’s a mighty pain. Better suggestion?

Reply | Quote

Just don’t worry about it until the next MS-DEFCON rating. Set WU to Never check…
If it is installed, just leave it alone until Microsoft either “hotfixes” it or retires it, in which case the recommendation would be to uninstall.
But install, scan and uninstall?
Who tries to do their own thing outside of MS-DEFCON should be able to make their own decision.

Reply | Quote

The krelay method did not work for me. When I tried to install on of the updates the installer got stuck with this message “Searching for updates on this computer” After about an hour I gave up. What to do?

Reply | Quote

That generally happens when you didn’t get the Windows Update service stopped.

Go back through the steps and check carefully. Be sure you get the patch I forgot to include (sorry about that): https://support.microsoft.com/en-us/kb/3020369

Reply | Quote

You’re right. I’ll go back and mend my wayward ways….

Reply | Quote

After going from 3.1 to now…I will never, EVER buy a Microsoft product again! Playing games with WIN7 updates…think may a law suit might be in order.

Reply | Quote

KB3020369 was the first one I tried. And Windows Update was shut down. And now some of the updates are marked as cancelled and end up on the C: root as strange folders with names líke this 3cea17235e57c190925d86e4dd. The seem to contain installation files for the updates. So far four of them. One update was installed when I shut down the computer and the usual message “Please do not power off or unplug your machine”. So I waited for that and it installed nicely. But there was no indication that it was downloaded. Maybe this is the future. Installing updates when shutting down?

Reply | Quote

Make sure you have Windows Update set to Never check for updates.

Reply | Quote

@PKCano,

As a “Josephine User” (in a slightly advanced stream, perhaps) myself :-),
I appreciate your dual explanations of how you are approaching this stuff for your own computers and how you are approaching it for your “flock”. My approach is generally somewhere in the middle of your two, and it helps me to get my bearings to learn what your approaches have been.

Just today, I learned two things from your comments which I hadn’t known about before, about the CCleaner checkbox option in Cleaner/System/Error Reporting, and about the Error Reporting settings in Action Center. I tightened both of those up today, for the first time.

Reply | Quote

No, did not work, I set it to never check for updates and followed the procedure. No success. But, when I shut down the machine another two updates did install. But not 3020369! So, I suppose I have to do it like that shut down, sneak install etc. Only 9 to go! Any ideas?

Reply | Quote

I’ve managed to go from a fresh win7 pro sp1 install to fully patched in a bit over 1.5 hours. This was done in a vm (on a fast linux host) using the kb3125574 ‘sp2’ patch rollup and Dalai’s recently revised patch list and install script.

After the initial sp1 install, I double-clicked on the .msu files for kb3020369 and kb3125574 to install them. After a reboot, I changed the windows update settings to ‘never check’ and stopped the windows update service. Then, in an admin cmd window, I ran Dalai’s InstallPrereqMsu.cmd script. Two of the patches failed to install, but this turned out not to be a problem.

After a reboot, I changed the windows update settings to ‘check but let me choose whether to download’ and ‘give me recommended the same way I receive important updates.’ Then I clicked Check for Updates and the first batch of available updates was presented in under 5 minutes.

It was then a matter of installing updates, rebooting and checking again until there weren’t any left. I installed everything that was checkmarked, nothing that wasn’t, and in the end there were 2 ‘important’ (kb3021917, kb971033) and 6 ‘optional’ (kb2574819,kb2592687,kb2830477,kb3102429,
kb3161102,kb3172605) updates left, but these were things wouldn’t really want anyway. That’s my definition of ‘fully patched.’

The install was done without a cd key, so there are only 3 days until the forced activation, which will fail. That’s a shame, because I’d really like to see if windows update continues to work properly come the next patch Tuesday. I suspect it would, as I’ve only seen the ‘hang’ problem when I’ve tried to pick and choose updates to avoid telemetry and gwx. Well, that, and also on fresh, unpatched sp1 installs.

I tried the above approach before and failed, but I was using Dalai’s previous patch list. In the interests of science, it would be wonderful if someone could confirm my experiment 🙂

HTH, YMMV, etc.

Reply | Quote

Anybody facing a clean machine?

Reply | Quote

I’m baffled. Ch100? Dalai? PKCano? Anybody have some ideas?

Reply | Quote

I suspect the user is not allowing enough time for the updates to complete. Computers are not instantaneous response machines and run tasks in the background and so on. The long digits and letters folder name is a temporary folder where WU downloads and expands files. It can be ignored or deleted in most cases only as the built-in Administrator account. It is safer to leave it alone at least for now.
The installation at shutdown was discussed previously here and is related to the setting “Download but let me choose…”. Please confgure to Never check for updates and scan manually every time.
Now please reset your SoftwareDatabase as discussed before or do a search on Google for the procedure and start all over again. You will be fine if you will install EVERYTHING except for the Language Packs (those are offered only if you run Ultimate or Enteprise).

Reply | Quote

@Steven “The install was done without a cd key, so there are only 3 days until the forced activation, which will fail.”

Try slmgr -rearm which will buy you more time. It can be run 3 times for 90 days in total as far as I know and is all legal and fully documented and supported.

Well done with the patching, although I am not so convinced about KB3125574. While it works, I prefer to keep the code base as mainstream as possible so I prefer the Windows Update and/or WSUS. KB3125574 handles supersedence differently, even if only slightly. For the same reason, keeping the system mainstream, I would install KB3021917, while disabling CEIP and the tasks associated. I would also install the Optionals, but I use the RDP 8 functionality, so it is “optional”, no problems at all if not installing them.

Reply | Quote

Yesterday I almost gave up. But this morning I tried again and Windows Update told me that no updates were available for my computer. But only three updates installed so far. Looking more and more like a complete reinstall of Windows? Or perhaps a repair disk first. But I certainly gave update a lot of time. I have had the computer running several hours every day to no avail.

Next computer will almost certainly be a Linux. A pity I have been using Windows since 1993 (Win 3.1, NT4, Win 2000, Win XP). But enough is enough!

Reply | Quote

I share your frustration – and I love my Chromebook. But don’t think that you need to reinstall!

There’s no reason at all to install August patches just yet. You’re jumping the gun. Wait a week or two until all the bugs have worked out – we already have three known bugs with this month’s patches. Wait for MS-DEFCON 3. Don’t knock yourself out for something that isn’t worth doing in the first place!

Reply | Quote

Make sure that you use the right package. Windows 7 has 2 packages for each update. One is for 32-bit and the other one for 64-bit versions of Windows.
Ideally you should be able to use Windows Update and forget about versioning and manual updates and installs.
Check if you have enough space (25% free) on drive C. This is one of the issues that happen more often than expected. Space can be saved by removing hibernation file, system restore and reducing the page file size. On systems with 8GB RAM, the savings only from what I mentioned are about 20GB of space on the C: drive and proportionally less on systems with less memory. Not very well known stuff.

Reply | Quote

@Leif Lagerstedt: I share your opinion! My next computer will most likely not being what I’ve been having nightmares with for several months.

It’s not worth it, and it appears that there is something that it not as it should be.

We are so fortunate to have Woody, et al to always be there to help us! 🙂

Reply | Quote

Excellent advice. Thanks, ch100.

Reply | Quote

Of course! I use only 64b versions of the updates and everything else that supports 64bit. I have about 60% free on C:. And 8GB Ram! But good advice anyhow. Thanks!
Am now considering Wsuoffline Will that work?

Reply | Quote

I don’t know anything about Wsuoffline, but several people here have some experience.

Reply | Quote

Wait…..SO let me get this straight: First you download KB 3177725, install august patch, then uninstall kb3177725 so your printer is safe and can print multiple pages?

Reply | Quote

Yep – but only if you really, really want to install the August patches. I don’t see any patches there that merit a quick installation, don’t see any looming security threats — but I do see three patches with known problems.

Best to wait for the MS-DEFCON level to get to 3.

Reply | Quote

@Leif Lagerstedt:
Since WSUS Offline Update also just uses the Windows Update mechanism (only offline), you’ll probably run into the same issues. OTOH you won’t know for sure until you’ve tried it.

WSUS Offline has some more prerequisite updates on its list than there are on mine – currently these are KB3020369 (servicing stack), KB3172605 (July convenience rollup) and KB2552343. Maybe these help, maybe not.

Reply | Quote

Well I suppose I can wait ONE MORE week and then I am installing the updates. Seriously-I usually put my updates in on the 3rd week, but I guess I can do it next week be it Saturday or Sunday Night.

Reply | Quote

Thanks @ch100, I’ll try the rearm thing soon. My experience has been that, when you enter a valid key during the install, you get 30 days before forced activation. But if you don’t enter a key at all (i.e. you click Skip when prompted for one) you get only 3 days. I have a valid key that I could use, and it would probably work, but it’s associated with an activated machine that I really, really need to keep working. I’ve heard that there are ‘default’ keys you can use for this sort of thing, but don’t know where to look for them. My expertise is with unix/linux and my ignorance of windows is vast. But like others here, I’m the IT department for friends and family and try to do right by them, hence all of the testing. Plus, I’m just curious.

Thanks again!

Reply | Quote

@Steven There are default keys only if you use a volume licence distribution. They are public, but also come with the ISO, so you would need them only if entering a different key at some stage after installation. Even more, with an Enterprise version, technically you can use it forever non-activated with few limitations, some related to blocking you from installing the Recommended and Optional updates, the purpose being to block you from having the benefit of getting enhancements and new features until activation. Yes, it is correct. Microsoft blocks you from installing Recommended updates if you are not activated, while a lot of people here, if not most of them avoid the Recommended updates with a fully activated version.

Reply | Quote

@Woody: I’m still sitting with only a few updates listed, none of which I can get installed. There are actually only 4 updates listed, the other 2 are the Malicious Ware Removal Tool, and a definition update.

Will there be anymore recommendations as to how to get the updates I have pending to install? The last update shows 8-9-16. It’s crazy.

Thank you for any guidance with this nightmare problem. I don’t want to install any of these updates, however I’m hoping that i can find a way to even “get” the most recent updates on the computer, which I’m sure are out there.

This has been the worst month of all for the MS “searching for updates” insanity. 🙁

Reply | Quote

@Woody – – – – edit to the above post. I did not mean I want to get these installed, other than the KB3177725, and this is only to make the “never ending searching for updates” disappear, and get all new updates “listed”. It’s been over a week already, and it’s still showing last check for updates as 8-9-16.

The “search for updates” is totally useless. 🙁

Reply | Quote

As mentioned in another context, relax. The MSRT installs itself, as does the definition update – you don’t need to do anything.

Reply | Quote

@Woody: Thank you for the recommendation. I’m just hoping and praying that something changes, very soon. I appreciate your guidance, as always. Thank you so much! 🙂

Reply | Quote

Nice, man! I couldn’t seem to resolve my Win 7 client update issue, even when using all the info from here or http://wu.krelay.de/en. Who knows if I missed something, but this script worked great!

As far as I can tell, it fixed my issue after following your instructions. Update scan took <4min after running it and rebooting.

Thanks again!!

Reply | Quote

I like it! Can you put some sort of date on the batch file, so people know (in this case) that it works as of August, 2016?

Not sure how things are going to change in October, but we may need this kind of approach for awhile.

Thanks!

Reply | Quote

@Woody @ch100: I did get the “magic patch” installed finally. I was very, very careful and it went smoothly. Your instructions were FLAWLESS.

I agree that it is very possible that I made an error when I was attempting to perform all of the steps. I also agree with ch100 that “user is not allowing enough time”.

Everything is running normally. This appears to have been a “user error”. Had to give it “one more try” before giving up. Now just waiting for MS-DEFCON 3.

Thank you for the invaluable recommendations! 🙂

Reply | Quote

My comment is a little late, but the update solution published on the krelay site worked perfectly for me on a small network (8) of Win7 Pro computers that were last updated last year.

But I had to add 3 “new” Windows 7 machines (virgin Win7 install) to the network, and the very first “searching for updates” and “downloading updates” are taking over 24 hours and stalling no matter what I’ve tried!

Reply | Quote

Hi, Woody!

Right now, I think the best approach is to follow Canadian Tech’s advice here:

http://answers.microsoft.com/en-us/windows/forum/windows_7-update/windows-7-update-solution/f39a65fa-9d10-42e7-9bc0-7f5096b36d0c?page=1&auth=1

Reply | Quote

For new machines, use Canadian Tech’s approach as it is enough to get WU started.
For established machines missing patches, use Dalai’s approach as it has extra updates which are useful for the slow WU issue.
A lot of the issues are related to Windows Update Agent 7.6.7600.320 which is pushed automatically if there is no superseding (later) Windows Update Agent installed. Currently the best Windows Update agents come with KB3138612 or KB3172605 and one of them needs to be installed first thing. Eventually both will be installed as part of WU, as while they overlap in some parts, they do not supersede each other.

Reply | Quote

Hi Conor,
Your script is marvelous and resolve my problem on Win 7 SP1 x64 after many many try of tools during deuw weeks.

Perhaps you can merge this procedure with InstallPrereqMsu.cmd for stop WU service and execute wusa.exe. (I am an old programmer)

But this future integrated tool may afraid some people.

Thanks for your script.

Reply | Quote