AKB 2000006: See if Microsoft is blocking Windows Update on your new computer

By @woody

Published 21 May 2017 rev 1.0

If you have a newer computer (built in, say, the past 18 months), watch out because you might get slipped a Microsoft Mickey Finn. You may have heard there’s a big controversy over Microsoft’s heavy-handed approach to coercing the well-heeled into moving to Windows 10 by completely disabling Windows Update on “7th generation” PCs (screenshot). Microsoft has been using patches since April 2017 to shut off Windows Update on computers running Intel Kaby Lake and AMD Ryzen processors. It isn’t at all clear why earlier Carrizo DDR4 machines were included in the dragnet… or even if all older Skylake-based computers are immune.

If you’re running Windows 7 or 8.1 on a PC made in the past 18 months, check to see if installing this month’s Windows patches will completely block Windows Update. That’s not as simple as it sounds because Microsoft hasn’t bothered to provide a hit list of blocked chips, or a program that’ll scan your system and tell you if running the updates will slip your PC a Mickey. Here’s the next-best alternative:

Step 1. Download and run Speccy.

It’s a free system scanner that will tell you both the type of CPU that you’re using, and the RAM memory specs (screenshot).

Step 2. Decide if it’s worth the effort.

If Speccy tells you that you’re running an Intel Kaby Lake processor, or an AMD Ryzen processor, seriously contemplate whether you want to apply this month’s security patches — or if it’s easier to just jump to Windows 10.

Step 3. Skylake seems to be OK.

If Speccy tells you that you’re running an Intel Skylake processor, you can breathe a little easier.

Although Microsoft is still being coy about whether all Skylakes will be supported with Win7 and 8.1 updates, I haven’t yet heard of anyone with a Skylake who’s been shut down.

Step 4. Celeron isn’t a shoe-in.

If Speccy tells you that you have a Celeron processor, your patching future isn’t so clear. I have a report from an Intel Celeron T3000 owner who got clobbered. Intel officially lists the Celeron 3965U as a “7th generation” chip, so it will likely be prevented from getting Win7 and 8.1 patches. I can’t find a definitive, official list of banned Celeron processors, but the Wikipedia page for Kaby Lake lists the Celeron G3930, G3930T and G3950 as being 7th generation, and thus probably banned. I say “probably” because we don’t have any official confirmation or documentation from Microsoft.

Step 5. Some AMD processors get clobbered.

If Speccy tells you that you have an AMD Carrizo CPU and DDR4 RAM memory, you’re in the crosshairs. It looks like a bug, but at this point if you install this month’s Monthly Rollup or Security-Only patch on a Carrizo DDR4 machine, Windows Update will be blocked. Nevermind that Microsoft explicitly said Carrizo chips would be supported. Carrizo DDR4 owners are collateral damage.

For those of you with modern Win7/8.1 machines who fail Microsoft’s ill-defined test, you’re caught between a rock and a hard place this month. Preventing the Word zero-day involves installing this month’s Monthly Rollup or Security-Only patch. But installing the patch also shuts down Windows Update.

@MrBrian has a detailed set of steps based on a technique from @radosuaf, that you can take to install Windows 7 or 8.1 updates, even on machines that have been blocked.