|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
ISSUE 19.34.1 • 2022-08-23 By Susan Bradley This month’s updates are a great example of why my patching advice differs for consumers and businesses. F
[See the full post at: MS-DEFCON 3: Issues with bootloader patches]
Susan Bradley Patch Lady/Prudent patcher
Is KB~12170 an individual update or the monthly CU?
Individual, not CU.
Does “not mandatory” mean I should skip this month’s CU update?
No.
I also successfully installed KB5012170, but I also disabled BitLocker after update installation.
Successful installation of KB5012170 on 4 Windows 10 21H2 machines, mostly Dell with legacy boots, but a Surface LT 2 with UEFI boot also had no problem. No Bitlocker activation on any of them; all booting from SSDs if that could make a difference. Caution might be indicated with some configurations, but many are not likely to notice anything given this mix.
The way that I am reading Susan’s advice is that one should allow Windows Update (for the average home user) to try to do its thing with the August updates. IF the installation fails for any reason, then block it.
I didn’t have any problems with it on my Win10 Pro installations (without Bitlocker activated). And the host computers’ BIOSes are up to date. But mine are test VMs.
I think Susan is suggesting for Consumers to hold off at this time.
Thank you Susan for your update and the link to blockapatch.com. I viewed the YTube vid also. As a W8.1 consumer user with UEFI/SecureBoot enabled I’m following your tip to hide the update for now. W8.1 makes it easy to hide updates, as you know. I do not like to install updates for the sake of Microsoft publishing them thus your input is valuable to me and others in making the decision. Certainly if there becomes a need for this update then I’ll download/install. Bottom line is we appreciate your help.
It’s a security update. Given that they are autofixing it, it’s not wise to not install it.
Susan Bradley Patch Lady/Prudent patcher
Hey Y’all,
Successfully installed on All 4 of my Dells.
Set Targeted Version to 21H2 for 3 of the machines and will let 22H2 load on the test bench machine when it comes out. Of course I have Reflect Images if things go south when that update occurs.
Is this a business or corporate computer? Autopilot is a deployment tool in businesses to install standardized operating systems.
Susan Bradley Patch Lady/Prudent patcher
That error has apparently affected many non-business and non-corporate computers lately.
The file mentioned doesn’t exist on most machines, so it’s not directly autopilot-related.
It seems like a bug in the Microsoft Account Sign-in Assistant service. The errors go away if that is disabled, but that breaks a bunch of Office/Outlook/Edge sync stuff:
Many persistent errors in Event Viewer … “Autopilot.dll wil error was reported”
[Nine pages of reports over four months]
None of those (AFAIK) will specify whether any available updates are optional or otherwise.
In a real sense, when using WuMgr all listed updates are optional, since none of them gets forced down your throat and you can pick and choose which ones (if any) to install. That said, I tend to treat “cumulative” and “security” updates as Recommended, and all other updates (previews, drivers) as Optional. I stay far away from Previews, and for drivers, I eventually get around to installing them unless known to cause a problem.
When using Windows Update, a preview will be optional, but will not be labelled as preview. Here is this month’s Windows 11 (21H2) Cumulative Update Preview from Check for Updates with no mention of Preview:
Here is the information in Microsoft description:
August 25, 2022—KB5016691 (OS Build 22000.918) Preview
Windows 11 Pro 21H2 x64 22000.918
No difficulties installing either of these updates and rebooted without error.
None of those (AFAIK) will specify whether any available updates are optional or otherwise.
In a real sense, when using WuMgr all listed updates are optional, since none of them gets forced down your throat and you can pick and choose which ones (if any) to install. That said, I tend to treat “cumulative” and “security” updates as Recommended, and all other updates (previews, drivers) as Optional. I stay far away from Previews, and for drivers, I eventually get around to installing them unless known to cause a problem.
Agree 100% on recommended updates. I generally shy away from all drivers updates from Microsoft but I found something about them that surprised me.
I work with a lot of Dell Optiplex PCs, many of which are “obsolete” and “outdated” according to some, though they work just fine in their settings. Anytime I have to reinstall Windows, even using Dell’s own OS-install driver installation service, I often have a couple of unknown devices left. Invariably they are obscure and there is no apparent impact of their being unknown.
However, one day not long ago, I let Windows install all the driver updates that it had waiting in the background. Much to my surprise, after the machine restarted, there were no more unknown devices.
I recommend downloading ISOs of 21H2 to ensure that you have copies should you need to perform a repair installation.
Are the directions in Squirrel away a clean copy of Windows, which was for Win 10– version 2004, still good for 21H2?
You will need a double layer DVD for the Win10 x64 ISO.
The Heidoc ISOs ar x86/x64
Yes, 2 were Dell PC’s.
The KIR must be applied before the update is installed otherwise the KIR does nothing –
per Microsoft on the KB5016616 page : “This issue has been resolved with the Known Issue Rollback (KIR). Note: This KIR prevents the issue on Windows devices that do not have KB5015878 installed, but does not affect devices already affected by this known issue. Note that it can take up to 24 hours for the solution to be automatically pushed to consumer devices and unmanaged business devices. Restarting your Windows device may allow the solution to be applied to your device faster.”
And what are the expectations if KB5015878 isNOT installed and you install KB5016616 ? I am still confused if I should install or wait for something to install before KB5016616.
Installed August updates with no issues. BitLocker OFF. No issues with KB5012170, CU KB5016606 update.
FWIW. For those with Win10 Home editions like me who believed they do not have BitLocker, I would suggest you might want to do a search of your computer to insure it’s not preloaded and sitting there waiting to be activated. I found out to my surprise BitLocker was indeed on my new Win 10 Home Edition laptop. It was auto activated after I searched my MS account for the Recovery Key. It was not activated or turned on when I logged in to my MS account. After MS uploaded the Key, I noticed BitLocker was turned on. So much for MS info link in my Settings under Device Encryption that Bitlocker “is not available on Win 10 Home” being accurate. I turned off BitLocker and have the Recovery Key.
Normally no recovery key is needed at all until some oopsie occurs. Which is why you go for years forgetting that you HAVE bitlocker enabled. Given that it’s 22H2 prep time I’m planning a “care and checking under the hood of your PC prep checklist” and include “check if bitlocker is on or off and if on, do you know where your recovery key is?”
Susan Bradley Patch Lady/Prudent patcher
There are two ways that bitlocker is activated:
Updates do not enable bitlocker. I guarantee that KB5012170 did not enable it. Nor did printing a bitlocker recovery key. The fact that you had a bitlocker recovery key means it was already enabled at an earlier time.
Susan Bradley Patch Lady/Prudent patcher
I’ve had encryption turned on on Dells and HPs at Setup.
However, I have never seen it turned on by updates either..
I have a Win 10 Home and a Win 10 pro computer. On each I have disabled Bitlocker (control panel/system and security/administrative tools/services, and then double clicking on Bitlocker and choosing ‘disable’). Have there been reported incidents of the KB5012170 update – or for that matter any other update – actually changing the ‘disabled’ setting to something else?
I have never seen a patch or an event trigger a spontaneous enabling of bitlocker when it’s in the off position.
Susan Bradley Patch Lady/Prudent patcher
The Dell Win10 computer I set up over a year ago for a friend was with a Local ID (no MS ID involved).
One of the first things I did was to look for Bitlocker settings, because, I was aware from ASKWoody posts and other sources, that some new computers came with Bitlocker ON by default.
Sure enough, it was in the process of encrypting the drive.
I turned Bitlocker OFF and waited for the decryption to finish.
I also set up automatic backups.
Now, this User is my age. And I was setting it up because I had been taking care of their past computers for maybe 15 years. Computer use only, absolutely NO technical ability on the User’s part.
This was only the first time I ran into this situation. There are so many others since…..
The encryption had not completed.
you can’t get a key with only a local account.
For automatic device encryption, that is correct:
How was BitLocker activated on my device?
There are three common ways for BitLocker to start protecting your device:
Your device is a modern device that meets certain requirements to automatically enable device encryption: In this case your BitLocker recovery key is automatically saved to your Microsoft account before protection is activated.
An owner or administrator of your personal device activated BitLocker (also called device encryption on some devices) through the Settings app or Control Panel: In this case the user activating BitLocker either selected where to save the key or (in the case of device encryption) it was automatically saved to their Microsoft account.
A work or school organization that is managing your device (currently or in the past) activated BitLocker protection on your device: In this case the organization may have your BitLocker recovery key.
If you are logged into the running computer, you need no key to turn off/decrypt the bitlocker. You just turn it off, it decrypts the drive.
You only get asked for the bitlocker recovery key when you hack /reset the password – or on rare occasions (I’ve hit it twice on a Surface) after a reboot on a patch install – I think they were both firmware updates. The second time (two different patching events years apart) I tried turning the pc off and back on again and it didn’t ask for the recovery key the second time.
Susan Bradley Patch Lady/Prudent patcher
Realtek High Def audio.
No, updates wouldn’t touch those applications and remove them. Someone manually using a de-crapifier/powershell would, but not updates.
Susan Bradley Patch Lady/Prudent patcher
The known issue rollback is a piece of code in an update that gets rolled back when it senses an issue. In corporate settings I have to trigger a group policy to make it kick in. Given that the notation of the issue is documented as of August 19th, I don’t see how they can say that the KIR will prevent the issue, if you haven’t installed the patch that has the KIR code in it?
Bottom line on this kind of side effect, install the update, if sound works you weren’t impacted, if your sound is impacted, uninstall the update, block it and the fix will be in the September updates. Windows patches are uninstallable.
Susan Bradley Patch Lady/Prudent patcher
I’m tired today and may not be typing in clearly. Windows updates can be un-installed. The only exception is servicing stack updates. But any patch you install, you can un-install it/remove it.
Susan Bradley Patch Lady/Prudent patcher
To my mind you’re the voice of sanity, Susan! thanks for all you do.
Does “cannot be removed” make it clearer?
CUs can be removed after installation, SSUs cannot be removed.
CUs are Security Updates, issued on Patch (B) Tuesdays. Previews are non-Security Updates, usually issued on other Tuesdays (C, D, etc).
The SSU is bundled with (NOTpart of) the CU. It is not listed separately in Windows Update, but installs separately ( is listed separately in Installed updates).
CUs and Previews can be removed. SSUs cannot be removed.
This applies to Windows updates, not necessarily .NET or other updates.
Aside: If you observe the installation of the CU in Windows Update closely, you will see that, after the download, the progress of the installation goes from 0% to 100% in a relatively short time, then drops back to 0% and takes a longer time to reach 100% a second time. It is my guess that the first 0-100% is the installation of the SSU and the longer installation is the CU.
Aha! I always wondered why my CUs installed twice. Now I know. Thanks.
Whoever you quoted has the correct information.
wushowhide uses the Windows Update Service to search for updates.
If Windows Update is Paused or Deferred, wushowhide is unable to use WU to list updates.
August patches installed with no problems to report on Win 8.1. 🙂
Installation Successful: Windows successfully installed the following update: 2022-08 Security Update for Windows 8.1 for x64-based Systems (KB5012170)
Installation Successful: Windows successfully installed the following update: 2022-08 Security Monthly Quality Rollup for Windows 8.1 for x64-based Systems (KB5016681)
Installation Successful: Windows successfully installed the following update: 2022-08 Security and Quality Rollup for .NET Framework 3.5, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 8.1 for x64 (KB5016740)
Win 10 ver. 22H2 x64
Since no one seems to have a definitive answer as to where the KIR that fixes the loss of sound issue may or may not be at this time (see #2472787) is it safe to assume that it will be included in the September CU?
Is so, I think the I’ll pass the uncertainty of the August CU.
Per Microsoft’s own admission, the fix isn’t in the preview update for September, KB5016688, so it very well may not make it into the official September patch that will be released on September 13th. Are you willing to wait that long (perhaps, worst case, until October’s official patch) to patch a security hole because of an issue that’s fixed by KIR?
If you’ve already installed the official July patch and you still have sound, then KIR will fix your sound if you lose it after installing August’s update with no effort needed on your part aside from possibly rebooting your computer to have the KIR take effect. At least that’s how I read what MS has put out.
@Mele20 had this happen, from what I’ve read in the second paragraph of post 2472700.
Per Susan’s own post earlier today on the main blog page…
…The Known issue rollback fix is offered up from Microsoft servers, but the code to trigger the known issue rollback (as I understand it) is only in the August and later updates. Note that even in the preview updates, this known issue is still being tracked. I still think that the patch will be installed, some small percent may see audio issues and then the known issue rollback will kick in, make sure you reboot a day or two after installing updates, and the problem will go away, but I don’t have a system impacted to test my theory.
I added the bolding to the above quote for added emphasis. Goes back to what I said in my post from Sunday…if you currently have already installed the patch from July and don’t have any audio issues, then if you DO have issues after installing the August patch, Known Issue Rollback will kick in after a certain amount of time and fix the issue, but you’ll have to reboot to make it happen AFTER you’ve experienced the issue, unfortunately.
So, @Tex2265 , if you don’t currently have an audio issue and you’ve installed the July patch, then go ahead and install the August patch. If you have an audio issue after installing the August patch, Known Issue Rollback will kick in and fix the issue for you, but you’ll need to reboot your machine for the rollback process to properly complete. From what I can tell, @Mele20 experienced this first hand, as documented in post 2472700 above.
The chicken can’t fix the egg before the egg is installed.
I still say that “you can’t fix this after the patch is installed” is wrong and the known issue rollback will remedy it but it may take a reboot or two.
Susan Bradley Patch Lady/Prudent patcher
What if we are using wushowhide or similar app to control downloads since we don’t see this KIR pending? The KIR forum referenced above seems to imply that KIR’s don’t utilize the normal Windows Updater system so maybe not a problem?
TRUE, NOT a problem, so don’t worry about using any of the update assistants, as KIR works outside that framework with total disregard to your current update settings within the registry, which is what wushowhide, WUMT and WuMgr use to help you keep your update settings where you want them to be.
Steve Gibson’s InControl tool also probably makes registry changes to help you in its own way.
Q&A from the above link.
Question:
ron S. asked
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Point of clarification. Is this feature is limited to Windows in a business setting?Are Windows Home users are left out in the cold, with broken machines?
Answer:
Eric_Vernon Microsoft replied
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
This is not limited to the business setting. Group Policy is the KIR business setting solution. For other versions of Windows outside of a business setting AND are connected to Windows Update, KIR is implemented from our cloud service.
That verifies KIR’s get offered to non-business PC’s via Microsoft’s servers with no action required by the end user (other than needing a reboot for the KIR to take effect as has been mentioned previously.)
So for the purposes of this KIR explanation, a business PC is Win10/Win11 Pro (even if you aren’t a business) and a non-business PC is Win10/Win11 Home?
Nope!
The Windows “version” has absolutely nothing to do with whether it’s considered a Business/non-Business PC.
Group Policy is the KIR business setting solution.
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
For other versions of Windows outside of a business setting AND are connected to Windows Update, KIR is implemented from our cloud service.
So any version of Windows “not using the Group Policy” is considered a “consumer PC” and will use it’s connection to the Windows Servers to obtain/install the KIR.
Group Policy is the KIR business setting solution. ¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯ For other versions of Windows outside of a business setting AND are connected to Windows Update, KIR is implemented from our cloud service.
So any version of Windows “not using the Group Policy” is considered a “consumer PC” and will use it’s connection to the Windows Servers to obtain/install the KIR.
Hmmm…. so I am a home user with Windows Pro 10 x64 and I utilize Group Policy settings to hold off monthly updates (the 2 setting, etc) until I select to allow their download in connection with wushowhide utility.
So that makes me a Business PC and I won’t be offered the KIR through the MS cloud service with no action required from the user? This gets more and more confusing.
Please advise:
The Group Policy being referred to is the specific Microsoft business level KIR Group Policy, not Group Policy in general.
For non-Business customers, the Windows Update process applies the KIR automatically, no user action required.
For Business customers, Microsoft provides an msi install file for the KIR which customers can propagate to managed systems by using their “business level” Group Policy infrastructure.
If the “business level” Group Policy has been installed on your PC, you’ll find one or more of the following entries in your Group Policy settings.
Local Computer Policy > Computer Configuration > Administrative Templates > KB ####### Issue XXX Rollback > Windows 10, version YYMM
Where ####### is the KB number with the problem, XXX is the issue number, and YYMM is the Windows version number.
Note: while it is “possible” to download and install a business level KIR msi file for a particular KB issue onto a non-business PC (if you can find the download location for it) you don’t really need to do that since it’ll get “automatically” installed on PC’s that do not use the “business level” Group Policy.
I did exactly that a year or so ago for a particular KIR before I realized I didn’t need to.
BTW, KIR’s have a limited lifespan (typically no more than a few months) and, after Microsoft issues an update that fixes the issue, are rescinded and no longer effective.
So then what? Is there any indication that MS is working on an actual fix? Will a fix be included in the September CU? Do we go un-patched until when?
MS is aware of the problem but haven’t yet indicated when they’ll issue a fix for it.
Quote from KB5016616’s know issues section
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
This issue is resolved using Known Issue Rollback (KIR). Please note that it might take up to 24 hours for the resolution to propagate automatically to consumer devices and non-managed business devices. Restarting your Windows device might help the resolution apply to your device faster.
Remember, a KIR they’ve issued will remain “in effect” until such time as they actually issue a fix (or at least what they “think” is the fix!)
Also, the KIR they issued fixes the audio problem by rolling back the specific code that caused the issue, not the entire security update.
So, taking into account what the above quote from MS about the KIR says, you “should” be good-to-go to install the update once your PC has received the KIR.
Catch is, there’s no easy way to tell if that’s happen yet or not because KIR’s aren’t recorded anywhere in Window’s history/logs.
They add a new “sub-key” to the following registry key with EnabledState & EnabledStateOptions values (mine currently has 4 different sub-keys in it.)
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FeatureManagement\Overrides\4
And, since there’s no “direct correlation” between the ID numbers used for those keys and the KB “feature” it’s intended to rollback, there’s really no way to determine if a particular KIR has been installed or not.
Read through this thread:
https://www.askwoody.com/2020/is-there-a-way-to-cheat-pause-update/
The only way I see that one can prevent the issue is to disable audio enhancements.
https://support.microsoft.com/topic/disable-audio-enhancements-0ec686c4-8d79-4588-b7e7-9287dd296f72
I utilize a separate sound card, a ASUS Xonar DGX PCI-Express 5.1 Audio.
I followed the above link and looked in all the locations noted and do not see an Audio Enhancements Tab or checkbox entry in the Advanced Tab that I do have.
I do have a separate Xonar Audio Control Panel for sound settings.
Does this mean I have “immunity” from the loss of sound issue?
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
