Microsoft: New non-security updates prevent attack on Win10 Servers running IIS

Topic

New Reply

Now you know why I’m skeptical of the “optional non-security” description about the second monthly Win10 cumulative updates. Ends up that the patches
[See the full post at: Microsoft: New non-security updates prevent attack on Win10 Servers running IIS]

1 user thanked author for this post.

abbodi86

Reply | Quote

Replies

The KB article has since been published.

1 user thanked author for this post.

woody

Reply | Quote

woody wrote:

Ends up that the patches are not “optional” (click Check for updates and see what happens)

Isn’t that the only way “optional” has ever worked on Windows 10 for the last four years?

We also release optional updates in the third and fourth weeks of the month, respectively known as “C” and “D” releases. These are validated, production-quality optional releases, primarily for commercial customers and advanced users “seeking” updates.
Windows monthly security and quality updates overview

Reply | Quote

Ok, I have questions for the members.  In regards to Microsoft’s statement on their “When appropriately set, above two limits together help to terminate the malicious connection violating those limits and form a threshold for legitimate connections” what is the recommended settings / limits I would want to start at as MS doesn’t provide any guidance?  And a follow up question, what event log entries or users feedback would be useful to understand whether further adjustments are needed?

In my scenario I have OWA running on Exchange / Windows 2016 which I get requires IIS to serve the OWA page, that being said, other than keeping the system up to date, I’m not sure what next steps are once I apply KB 4480776.

Advice is appreciated, Thanks.

IT Manager Geek

Reply | Quote

Has anyone gotten these updates to show up in SCCM/WSUS yet?

Reply | Quote