Latest Kb 4490628

Topic

New Reply

MS Just posted Kb 4490628 in W7 Important Updates for March… I did a bit of research… says it replaces Kb3177467…is this a necessary update for those of us in Group B (W7 Security Only Updates)… does it require removal of Kb3177467?

2019-03 Servicing Stack Update for Windows 7 for x64-based Systems (KB4490628)

 

Reply | Quote

Replies

Source: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4490628
AskWoody Group B SSU

This update replaces the following updates:
2018-10 Update for Windows 7 for x64-based Systems (KB3177467)
Update for Windows 7 for x64-based Systems (KB3177467)

Restart behavior: Never restarts
May request user input: No
Must be installed exclusively: Yes
Requires network connectivity: No
Uninstall Notes:
Not Uninstallable
Uninstall Steps: n/a

This just looks like the previous SSU’s that have to be installed exclusively.
Neither Susan Bradley nor Woody have given the go-ahead yet. It’s best to wait until the MS-DEFCON level raises to 3 or above, then a full methodology will be written up.

IMO it’s better to be cautious on this as the patch is permanent and we wouldn’t want your OS borked should something go wrong unless of course you image prior to patching, which I highly recommend.

Windows - commercial by definition and now function...

1 user thanked author for this post.

Elly

Reply | Quote

Article from lates Tom’s Hardware article:

With Microsoft ending Windows 7 support and security updates on January 14, 2020, it is strongly recommended to users get the SHA-2 Security Update. If this update is not installed, users will not be offered Windows updates after July 16, 2019, which could lead to security vulnerabilities.

SHA-2 Security Update info regarding W7 Users provided in above SHA-2 link:
2019 SHA-2 Code Signing Support requirement for Windows and WSUS
Content provided by Microsoft

Applies to:  Windows 7 Service Pack 1 Windows Server 2008 R2 Service Pack 1 Windows Server 2008 Service Pack 2 Windows 10, version 1607 Windows 10, version 1703 Windows 10, version 1709 Windows 10, version 1803 Windows 10, version 1809 Windows 10 Windows Server 2012 Standard Windows Server 2012 R2  Windows 8.1 Windows Server 2019, all versions Windows Server Update Services 3.0 Service Pack 2  More

Interesting info…
To protect your security, Windows operating system updates are dual-signed using both the SHA-1 and SHA-2 hash algorithms to authenticate that updates come directly from Microsoft and were not tampered with during delivery. Due to weaknesses in the SHA-1 algorithm and to align to industry standards Microsoft will only sign Windows updates using the more secure SHA-2 algorithm exclusively.
Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019. To help prepare you for this change, we will release support for SHA-2 signing in 2019. Windows Server Update Services (WSUS) 3.0 SP2 will receive SHA-2 support to properly deliver SHA-2 signed updates. Refer to the Product Updates section for the migration timeline.

Looks like we should load Kb4474419?

Regards,

Ardvark

Edit to remove HTML. Please use the “Text” tab in the post entry box when you copy/paste.

 

Reply | Quote

Yes, you will need to install the SHA-2 patch Kb4474419 by July 2019 if you wish to continue receiving updates from Windows Update.

1 user thanked author for this post.

walker

Reply | Quote

@PKCano:  I am trying to catch up again after being continuously ill for weeks and weeks, so hope you will forgive me asking questions on the very few “updates” which I have now pending.  I hope it will go as well as it did the last time when I asked for your help.

Here are the 3 updates (only those designated important).  I don’t think I’m missing any, however I’m still trying to keep up with all of the emails I’m behind.   Here are those which I have now which I would appreciate help in determining if they are safe (I see we are at Defcon 2 now as well).

2019-03,  KB 4474419, Sec. Update Win7 x64

2019-04   KB 4493472, Sec. Monthly Quality Rollup

2019-04  KB 4493132,   Update Win 7×64

Knowing your outstanding knowledge, and expertise, I am hoping you will have the answer for me.  I’m having vision problems as well, so hope I have not made any typos.  Thank you, thank you, and thank you again, as always for your “STELLAR” knowledge and in sharing it with those of us who appreciate it more than words can ever convey!  

Reply | Quote

+ HIDE 2019-04  KB 4493132 – it is a nag popup about Win7 EOL. You will need to hide it again when it shows up again.

+ HIDE temporarily 2019-04   KB 4493472 is an April patch and has not been approved for DEFCON yet.

+ Check for updates.
+ Install:
KB4489878 2019-03 Sec. Monthly Quality Rollup (if you did not install it last month)
2019-03,  KB 4474419, Sec. Update Win7 x64
MSRT (if it’s there)
+ Reboot. Wait 15 minutes. Check for updates
+ Install:
KB4490628 Servicing Stack – this should show up after all the other updates have been installed.

+ UNHIDE 2019-04   KB 4493472 (only) BUT DO NOT INSTALL IT. Wait until later this month to install this one when we are at DEFCON-3 or greater.

 

5 users thanked author for this post.

kiwisolutionz, LHiggins, walker, mjhines1, woody

Reply | Quote

Dear PKCano:    I was unable to get to your very prompt reply until now, so I  hope I don’t mess something up.   It’s been so long since I’ve gotten updated that it’s always much more difficult to get back to where I “need to be”.

I will follow your instructions to the letter and hope that I don’t make an error.   Will report back when I can get started on the task at hand. I may have a question or two on your message.    THANK YOU ONCE AGAIN, SO VERY, VERY MUCH.

1 user thanked author for this post.

PKCano

Reply | Quote

Dear PKCano:  Well, everything went exactly as you set forth in your message……

After I had taken all of the first steps, rebooted (I assume that means do the built in “restart” at the end of the installations), and then waited 20 minutes to continue with the instructions, I was unable to locate the KB 4490628 Servicing Stack.   It just wasn’t there.

Then when I tried to locate the “hidden KB 4493472, it was nowhere to be found.  I checked and it was not in the “hidden list”, so therefore I couldn’t unhide it.  The only actions I took which I normally never do is to install the update for the MSRT (because I never use it), and also noted an update to the Windows Defender which I never use.   Could this have possibly caused my “failure”?   I suspect the MSRT, and possible the WD could have been responsible, however with my lack of computer skills I have “no clue”.  This is “something that I did (I’m sure) that caused my failure.   Thank you, and thank you again, as always for your invaluable. help.    

Other than that, I cannot determine what the problem is.  I hope you may have some idea.

Reply | Quote

All the updates in the important list have to be installed or hidden before KB4490628 will show up.
Write down the KB number of any updates left in the important list, then hide them.
Check for updates.
If KB4490628 shows up, install it.
If it does not show up, unhide the updates you have written down, but do not install them.

After you do that, let me know what updates you have left in the important update list

1 user thanked author for this post.

walker

Reply | Quote

PKCano:   Thank you for the guidance you provided.   I will do my best to follow it as you have provided.    I only wish I had 1/100th of your vast store of experience and knowledge.  It is sincerely appreciated.

Reply | Quote

PKCano:   I thought a few times I was off on the wrong track, however FINALLY, I found the right way to go, thanks to your wonderful guidance!  KB4490628 is now installed, and it appears that all is as it should be.   There are no words which can adequately describe my very deep gratitude, and admiration for the wonderful help you provide.  “THANK YOU, THANK YOU, AND THANK YOU, AGAIN”. 

Reply | Quote

Dear Microfix,

Thanks for the info regarding 4490628… took you advice & just went ahead & hid the update for now…

Best regards, Ardvark

 

Reply | Quote

Dear PKCANO…I usually check the Group B update listing for KB’s on Woody’s site  & then manually download from the MS Update Catalog for Windows & IE 11 Security Update only as posted on Woody’s list… and I update my Outlook thru the File/Office Account method… All I use the Windows Update for is to be notified/reminded that there are Updates available… so, I will download it just so I get a reminder to check the Group B listing each month… I have never downloaded the “Rollups” they provide… thanks for the feedback!

Ardvark

Reply | Quote

You will need the servicing stack Kb 4490628  too when you install the SHA-2 patch.
The servicing stack has to be installed by itself, then wait 10 minutes to let the install complete, then reboot before installing any other updates.

2 users thanked author for this post.

mjhines1, walker

Reply | Quote

Dear PKCANO…

Do I need to uninstall Kb4474419 before installing Kb 4490628 and then reinstall Kb4474419?

Regards,

ardvark

Reply | Quote

No need to uninstall, just be sure you install the servicing stack by itself.

1 user thanked author for this post.

mjhines1

Reply | Quote

Dear PKCANO….

Will do! Thanks again!

ardvark

Reply | Quote

One more question… does Kb4490628  require removal of the old Stacking Kb3177467 or will the ne one just replace it?

Regards, ardvark

Reply | Quote

You can’t remove a servicing stack. Kb4490628 will just replace the older one.

Reply | Quote

PKCANO…

I guessed correctly for once! Thanks again for all of your patience& help!

Regards, ardvark

(posted thank you twice…not sure the first one made it!)

Reply | Quote