Microsoft’s month of badly botched patches

Topic

New Reply

They just keep rolling in.

[See the full post at: Microsoft’s month of badly botched patches]

Reply | Quote

Replies

For me it seems to be no problem to just avoid installing the March set (which is what those who follow Woody’s MS-DEFCON setting should be doing too).

I for one appreciate that Microsoft has made the choice to hold off this month relatively easy, and I’m glad for resources like this site which serve as a great clearing house for others’ experiences.

The only recent patch I’ve installed (manually out of the Catalog) has been KB4010250, the Adobe Flash Player update, installed in early March just in case I decide I actually need to see something in flash (which so far I haven’t). Other than that my Win 8.1 system is supremely stable and functional on the December updates (installed in January).

I’m reminded of an old commercial, what was it, Mitchum antiperspirant…

I didn’t update this month, and I may not next month either.

-Noel

2 users thanked author for this post.

walker, dononline

Reply | Quote

HA! Great commercial.

https://www.youtube.com/watch?v=owGykVbfgUE

 

Reply | Quote

We do Production server maintenance and every 2 weeks on Thursday. Tomorrow is the next one. Typically I would have installed updates tomorrow (in addition to reboots), but that’s not happening this month, no way, no how. Everything from Server 2008 to 2012 R2. Guess they’ll be running unpatched another 2 weeks, if not more. I’m just glad our POS is running 7 Embedded with updates done by the POS vendor…I need less headaches where possible.

Reply | Quote

:Thumbs up!: That’s a classic…

Reply | Quote

The hits keep on coming.  A couple minutes ago I received a optional update,  KB401228 for 7 SP1 and  Server 2008 R2 SP1.

Reply | Quote

Well here is my fitting sketch relating to Microsoft’s pharmaceutical patching:

Deodorant

Windows - commercial by definition and now function...

Reply | Quote

A couple minutes ago I just reeived another update marked optional.  KB4012218. For & SP1 and  windows server 2008 R2 SP1.  The hits keep on coming.

Reply | Quote

Hickups are here to stay in updating model

5 users thanked author for this post.

walker, Pepsiboy, woody, dononline, PhotM

Reply | Quote

I’m running Win 7 64-bit and just installed KB4012218 (released 2017-03-21).  I don’t know what else it does, but it adds nagware claiming that my processor isn’t supported every time windows update checks for new updates.

Nagware links to:

https://support.microsoft.com/en-us/help/4012982/discusses-an-issue-in-which-you-receive-a-your-pc-uses-a-processor-tha

Which claims I’m running an unsupported Intel 7th generation CPU or some other erroneous AMD or Qualcomm processor.  I’m running an Intel i7-6700, Skylake, which is a 6th generation.

So no more monthly “quality” rollup for me. *Uninstall*

2 users thanked author for this post.

walker, JDeC

Reply | Quote

You installed the Preview, which you should never, never install, but nevermind.

Now that you’ve installed it and rolled it back, could you download the Security Only update for this month

http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/02/windows8.1-kb4012213-x64_5b24b9ca5a123a844ed793e0f2be974148520349.msu

Double-click on the MSU file, and tell me exactly what happens?

Thanks!

2 users thanked author for this post.

walker, JDeC

Reply | Quote

Just out of interest, @woody, what more would it take for MS-DEFCON to go down to ONE?

3 users thanked author for this post.

walker, dononline, Noel Carboni

Reply | Quote

It happens, but only rarely – primarily when there’s a patch that “everybody” is installing which is causing all sorts of problems.

Now that you mention it, though, I should consider lowering the level. Lemme sleep on it.

4 users thanked author for this post.

AJNorth, walker, PhotM, Kirsty

Reply | Quote

I have erred, and it will not be the last.  The the linked update produces:

 

Windows Update Standalone Installer

The update is not applicable to your computer

 

Reply | Quote

Only trying my luck and doing a “b” for a change

You installed the Preview, which you should never, never install, but nevermind.

Why not?
This is what is says here:
https://support.microsoft.com/en-us/help/4012218/march-2017-preview-of-monthly-quality-rollup-for-windows-7-sp1-and-windows-server-2008-r2-sp1

“The March 2017 Preview of Monthly Quality Rollup includes some new improvements and fixes for Windows 7 Service Pack 1 (SP1) and Windows Server 2008 R2 SP1 platforms. We recommend that you apply this quality rollup as part of your regular maintenance routines.”

Seriously, some of us have to do testing voluntarily or by mistake.
For anyone else not testing, follow Woody’s very useful advice:
You installed the Preview, which you should never, never install

1 user thanked author for this post.

walker

Reply | Quote

ch100 wrote:

…….

follow Woody’s very useful advice:
You installed the Preview, which you should never, never install

Well CH100, I, I, I, think I take strong exception to that,

I installed it and the .NET’s(4) on my W 8.1 Pro, TEST PARTITION, and it went vary well, I was very Happy with the results. So I ran right over, AND DID NOT install them onto my W 8.1 Pro Main partition!

Listen to CH100, Woody, abbodi86, PKCano and Noel they have good advice. However, if you want to participate, set yourself up a VM, Test Partition or separate Test PC(I like Bare metal myself). I believe that we could(not will) be coming into a real problematic patching time???? We will see???

Thank You for giving me the opportunity, CH100, to tease you for a purpose. I have been wondering were I would post my results without spurring on, hapless installs.

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

2 users thanked author for this post.

walker, ch100

Reply | Quote

Seems to me testing potentially errant updates is just what test partitions and virtual machines are for.

Funny thing, though… I haven’t run across a significant glitch personally with the March updates on my test VMs, probably because I don’t run any of the tools that have been described as failing with the updates installed, and because there are only so many hours in a day.

Based solely on my own testing I’d probably have gone ahead and put the updates in on my hardware systems.

That’s one of the greatest reasons why the internet is such a Good Thing: Sharing experiences.

-Noel

5 users thanked author for this post.

walker, Bill C., PhotM, lizzytish, ch100

Reply | Quote

Noel, my experience is consistent with yours. The issues which have been noticed apply to certain types of users. I think the Excel 2010 bug is the most serious of them for the core audience here.

1 user thanked author for this post.

walker

Reply | Quote

Seriously, some of us have to do testing voluntarily or by mistake

I also said this ?

1 user thanked author for this post.

walker

Reply | Quote

ch100 wrote:

We recommend that you apply this quality rollup as part of your regular maintenance routines.

I believe, but don’t know for sure, that the phrase applies to the Monthly Rollup (er, Monthly Quality Rollup) when it’s released “for real” – not when it’s in Preview.

But I could be wrong.

The Release Preview ring of the Insiders Program works similarly. But Microsoft has made the Insider program so complex it’s hard to tell what’s a canary and what’s a coyote.

3 users thanked author for this post.

walker, ch100, PhotM

Reply | Quote

woody wrote:

ch100 wrote:

We recommend that you apply this quality rollup as part of your regular maintenance routines.

I believe, but don’t know for sure, that the phrase applies to the Monthly Rollup (er, Monthly Quality Rollup) when it’s released “for real” – not when it’s in Preview.

Yes, this is probably correct.
In which case the documentation for the Preview Rollup is messed up.

Reply | Quote

RP ring for Windows 10 provide actual preview of new fixes, but the code mostly change in the next public cumulative update

while for Windows 7/8.1, the fixes code in Preview Rollup is incorporated without any change in the next Security Rollup
only the security fixes added later alter the code for the shared components

so, i believe all Monthly Quality Rollups are equal, whether Preview or Security

3 users thanked author for this post.

PhotM, walker, ch100

Reply | Quote

You need to add all those mysterious random driver updates to the list. They have been sneaking into the windows update shooting tube a lot this month. Some of them caused BSODs.

The optional list on windows updates should have a warning plastered on it that says ‘keep out, hazardous waste’.

Reply | Quote

Wow, I have not installed anything for March on my W8.1 X64 system. I was considering installing the Adobe Flash Player security update, KB4014329 because the patched vulnerabilities are rated as critical. However, since I am not cruising the net looking for dating relationships in foreign lands, I think I will hold up a bit on this one also. It seems we have these headaches with MS patching about a third of the time now and that strikes me as not supportive of the patching protocols MS is forcing upon users. Time is money and MS is consuming more of users’ time than is acceptable.

1 user thanked author for this post.

Seff

Reply | Quote

? says:

thank goodness for Woody and all the contributors! this game of red light\green light is something else. hopefully, we will eventually get to green light? for March, i mean. at least my old reliable XP box swallowed everything hook, line and sinker and keeps on tickin’!

Reply | Quote

I installed the March Preview Rollup on 8.1 in a VM and something weird happened, the Windows Defender icon got updated to be the same as the Windows 10 one. How bizarre.

Reply | Quote

HUUUUM, I never checked that, I will have to….

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

Reply | Quote

I checked the Windows 8.1 update history and apparently the March Preview Rollup contains an update to Windows Defender. But again what I want to know is when will they start incorporating older patches into the rollups?

Reply | Quote

Woody do you know if they still plan to incorporate older patches into the rollups?

Reply | Quote

Yes but the schedule is delayed for unknown reasons. It has been happening but only on a limited scale for few months.

2 users thanked author for this post.

walker, woody

Reply | Quote

See the Feb. 8 comments at https://blogs.technet.microsoft.com/windowsitpro/2017/01/13/simplified-servicing-for-windows-7-and-windows-8-1-the-latest-improvements/.

2 users thanked author for this post.

woody, ch100

Reply | Quote

Thank you.

Reply | Quote

One word: OUCH!!!!

Reply | Quote

I have never seen so many people comment about issues to patch Tuesday on ghacks but this month there seems to be some from each OS at https://www.ghacks.net/2017/03/14/microsoft-security-updates-march-2017/#comments

They don’t post many details or how/if they fixed them though.

How safe is it for a typical end user to skip this month for a bit?

Reply | Quote

It’s difficult to answer that question without knowing more about your security situation…

Do you practice safe computing? Asked another way, does your antivirus report that it blocks malware often, rarely, or not at all?

If rarely or not at all, you’re likely safe to defer patches for a while.

Do you block ads as a rule?

If so, you’re safer from drive-by infections than if you don’t.

Note that Woody’s MS-DEFCON level is currently at 2 – he advises holding off installing the updates for everyone right now. When he moves it to 3 or beyond then you should think about installing them.

-Noel

2 users thanked author for this post.

SueW, walker

Reply | Quote

Noel Carboni wrote:

does your antivirus report that it blocks malware often, rarely, or not at all?

If rarely or not at all, you’re likely safe to defer patches for a while.

Of course, that will be relying on knowing the AV being fully up to date, in both software and definitions. Otherwise, that’s a really risky strategy (it may not be working…)

Reply | Quote

It’s definitely not time to update, with all the patch problems going on. As long as Woody’s MS-DEFCON number is at 2 or below, it is time to WAIT. Let the testers and the Guinea pigs test the waters.

When the DEFCON number goes to 3 or above, Woody will publish the instructions for patching. Then it will be safe to do so. Until then, come back, read the posts and learn what’s going on.

6 users thanked author for this post.

SueW, Pepsiboy, walker, woody, Kirsty

Reply | Quote

Thinking about this Windows update business that Microsoft has gotten itself into — the longer they go with it, the more complex the software gets and the higher the probabilities of unintended consequences.  If continued, it seems inevitable that it will descend into a quagmire that no one or no computer will be able to properly manage — or perhaps that’s already the case?  The potential complexity of the situation reminds me of the problems the British faced at Bletchly Park when they began their attack on the Enigma and Tunny ciphers during WW2.

Bill D.

Reply | Quote

I have hidden everything but Windows Windows Malicious Software Removal Tool. Is this one also to be questioned? What about Windows Defender? Where does it stop…? 

I have avoided the GWX fiasco because of this site. Thanks, all!

Reply | Quote

No need to over-react.
MSRT is harmless and it is better to install monthly.
It is only an antimalware scanner for few well-known viruses and worms, not a comprehensive antivirus solution.
It does not interfere with the other well-known antivirus products from Microsoft or other security companies because it is a one off scan on Windows 7 and a scheduled task running regularly on the newer OS, Windows 8.1 or Windows 10.

Windows Defender is OK, but if you use it on Windows 7, it is not the complete solution and you are much better off if you install Microsoft Security Essentials which is a free download for Windows 7, for personal use or very small business use. Alternatively, you could install alternative products, but it appears that the consensus in the industry is that the least intrusive and effective enough (not the best, but good enough) product is MSE.
On Windows 8.1 and Windows 10, Windows Defender is the complete solution, equivalent to MSE.
Microsoft unfortunately created this naming confusion in the process of deciding for a final name for their complete antivirus solution.
They obviously love the name Defender, but for some reason, on Windows 7 it is only an antispyware product, with limited scope.
I don’t understand why Microsoft did not release the full upgrade to MSE (named Defender for consistency with the other products) as a Feature Pack on Windows Update instead of a separate download for Windows 7, but this is rather a business decision than a technical one.

2 users thanked author for this post.

AJNorth, woody

Reply | Quote

On one computer KB 4015438 failed to install, and Windows was able finish reinstalling the thing. Even though it was a supposed to be a 1 GB download, the total download time taken was very short which was unusual; perhaps it was using the newer differential patch system.

I am pleased to have read your speculation about the new cumulative update being a future system update payload, it remains to be seen whether a Windows installation will honor it’s defer upgrades setting.

Reply | Quote

Be Advise(just in case one doesn’t realize this) Defer Upgrades refers to the Major New CB(only) Feature Upgrades(essentially new OS) NOT the CU, Cumulative Updates with new Features, Bug Fixes and Security Updates in them.

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

1 user thanked author for this post.

walker

Reply | Quote

Yes thank you. Last year before the Windows 1607 release I did configure a machine to defer feature updates, however 1607 was still downloaded and installed on the machine. So I’ll be seeing if something is broken.

1 user thanked author for this post.

PhotM

Reply | Quote

Microsoft KB4013429 breaks Hyper-V 2016 Backup
https://www.veeam.com/kb2262

Veeam KB ID: 2262

Products: Veeam Backup & Replication

Version: 9.x
Published: 2017-03-20
Last Modified: 2017-03-21

Challenge

After installing Microsoft KB4013429 update on a Hyper-V host, Hyper-V backups may fail. Removing the update may cause the host to enter a BSOD loop.

……..

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

1 user thanked author for this post.

woody

Reply | Quote

In case people have missed it, which is easily done given the overall decline in Windows Secrets since Penton took over resulting in no new Column topics being made, Susan Bradley has given some further comments on the March updates on an old forum topic here:-

http://windowssecrets.com/forums/showthread//178916-Wrapping-up-another-year-of-Windows-updating

Reply | Quote

I wish I could get Susan to participate more over here, but she’s approaching the end of the tax season, and things are crazy.

Let’s see if she’s more amenable after April 15…. I really miss her!

1 user thanked author for this post.

Seff

Reply | Quote

For Enterprise Problematic Server Patches/CU’s and Other Patches/CU’s SEE:

Forms in Dynamics CRM 2011 are broken after KB 4013073 for Internet Explorer 11 is installed
https://www.askwoody.com/forums/topic/forms-in-dynamics-crm-2011-are-broken-after-kb-4013073-for-internet-explorer-11-2/

Common Error: “Verify that the critical User Profile Application and User Profile Proxy Application timer jobs are available and have not been mistakenly deleted.” after February 2017 CU for SharePoint Server 2016
https://www.askwoody.com/forums/topic/common-error-verifying-critical-user-profile-profile-proxy-application-jos/

Released: March 2017 Quarterly Exchange Updates
https://www.askwoody.com/forums/topic/released-march-2017-quarterly-exchange-updates/

Install Firefox v52 Extended Support Release to continue managing Intune Silverlight console
https://www.askwoody.com/forums/topic/firefox-v52-extended-support-release-managing-intune-silverlight-console/

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

1 user thanked author for this post.

ch100

Reply | Quote

For Enterprise Problematic Server Patches/CU’s and Other Patches/CU’s SEE:

Forms in Dynamics CRM 2011 are broken after KB 4013073 for Internet Explorer 11 is installed
https://www.askwoody.com/forums/topic/forms-in-dynamics-crm-2011-are-broken-after-kb-4013073-for-internet-explorer-11-2/

This appears to be resolved after KB4016635 – not released on Windows Update as this issue is not relevant for non-enterprise users.

What is not clear though, there is a components of CRM online which means essentially that users access CRM over the internet.
If such users are affected, then I would expect the fix to be released on Windows Update too, because by definition such users are external and may not be managed by enterprise updating tools.

1 user thanked author for this post.

PhotM

Reply | Quote

Frankly CH100,

None of this is very clear to me???? I do know one thing that Microsoft seems to be sending the average users(or less) to the Catalog more and more(unless they want to manipulate them), Go figure????

I personally don’t believe I run into any CRM in my travels, but if I do, I will hop over to the Catalog.

Now there are additional question here that I don’t recall hearing? What happens in April or May? Do all these updates end up in a CU? Is that how they are going to handle the general user needs?

Now CH100, I have you back at more Questions then Answers??? Sorry

However I also have a solution:

On Twitter:

https://twitter.com/LouMM

Louis Maresca
@LouMM

Developing software extends my passion to see people succeed. principal engineer @ Microsoft. CoHost on TWiET https://t.co/DkVMRdx928

Redmond, WA
https://t.co/MIfULxbii4
Joined January 2009

CH100, Woody, or others….

Louis Maresca is a CRM Manager at Microsoft in Redmond. I know of him from TWiT.tv as a cohost of “This Week in Enterprise Tech” a show on the Network.

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

Reply | Quote

W7 SP1 – Group B

Do these circumstances (where everybody has to hold off installing patches because they are breaking things) mean that you are actually safer running W7 than W8.1 / 10 because at least you can update Flash Player and protect yourself from those vulnerabilities without exposing yourself to the MicroShambles?

 

Windows 10 Home 22H2, Acer Aspire TC-1660 desktop + LibreOffice, non-techie

Reply | Quote

I am on W 8.0/8.1 and I update Flash all the time?????

OOOOOOOOOHHHHH You must be an avid IE user, for me that is my 4 th fall back Browser and now that MS Sites don’t require it for the most part I never use it.

Try a different Browser, NON Microsoft….

--------------------------------------

1. Tower Totals: 2xSSD ~512GB, 2xHHD 20 TB, Memory 32GB

SSDs: 6xOS Partitions, 2xW8.1 Main & Test, 2x10.0 Test, Pro, x64

CPU i7 2600 K, SandyBridge/CougarPoint, 4 cores, 8 Threads, 3.4 GHz
Graphics Radeon RX 580, RX 580 ONLY Over Clocked
More perishable

2xMonitors Asus DVI, Sony 55" UHD TV HDMI

1. NUC 5i7 2cores, 4 Thread, Memory 8GB, 3.1 GHz, M2SSD 140GB
1xOS W8.1 Pro, NAS Dependent, Same Sony above.

-----------------

Reply | Quote

You should update it anyway. Many behind the scenes uses of IE in Windows, not just for browsing. I have read WU uses it, but don’t know if that is true. Many software programs use it as a back end. Be aware of other browsers used as a back end also. I recently installed a portable application and got Geek Buddy, or at least, some of its components. I think the program uses Comodo as a back end. Picked up by Malwarebytes as a PUP.

1 user thanked author for this post.

Noel Carboni

Reply | Quote

Windows 10 ruined our database…

https://www.theregister.co.uk/2017/03/24/microsoft_windows_10_update/

Reply | Quote

Ahoy Captain Woody!

Sainty here.

Just the usual THANK YOU for your excellent navigation of  the Micro-Berg!

When The MS Titanic does finally sink at least there will be some survivors!

Thanks to you and your excellent crew of contributors.

Then all aboard The SS Apple, perhaps?

Until then thanks again from me and me old win7  tub “Toshy”!

Yo Ho Ho!

Sainty ????

1 user thanked author for this post.

AlanH

Reply | Quote

I got hit by the bug in the KB3178674 patch. All equations by MathType are shifted out of line. The most recent patch seems to restore the equations to normal. But when I convert the Word document to PDF, or print it, the same misalignment is STILL there. It looks peculiar. The first couple of equations seem OK, and the following ones got progressively misaligned that by the time you get to the 10th equation, it is totally out of the paragraph! I have performed a repair on the 2016 Office program and rebooted my PC, but it was not fixed. Any idea? Thanks!

Reply | Quote

I haven’t heard of that.

You installed this month’s security patch?

Reply | Quote