MS-DEFCON 4: Install the February updates, skip that Secure boot

Topic

New Reply

More details will be in tomorrow’s newsletter along with a Plus membership only video that discusses my patching recommendations for the month. I alwa
[See the full post at: MS-DEFCON 4: Install the February updates, skip that Secure boot]

Susan Bradley Patch Lady/Prudent patcher

5 users thanked author for this post.

jburk07, deuce120, SueW, Alex5723, abbodi86

Reply | Quote

Replies

How do you not install one  patch.   I ran wushowhide and all I have is the usual: a cumulative update and a few others, but no  KB453680.  This on win10/pro,

Reply | Quote

Guidance for Win10 Update Settings in AKB2000016.
Use wushowhide.diagcab to hide the updates you don’t want to install.
Download wushowhide.diagcab from OlderGeeks.

Put wushowhide.diagcab on your Desktop.
DO NOT extract the file.

Just double click on it, then click on “Advanced”.

Uncheck “Apply repairs automaically”

Click on “Hide updates’ and check the ones you want to hide.

Reply | Quote

PK Cano

Use wushowhide.diagcab to hide the updates you don’t want to install.
Download wushowhide.diagcab from OlderGeeks.

Put wushowhide.diagcab on your Desktop.
DO NOT extract the file

PK if I click on the download file you reference above is it going to take me to the site or is it going to download wushowhide?  Will it automatically put a short cut on my desktop?  I’ve not used this tool and don’t want to make a mistake.

Reply | Quote

That link will download the file.
Save it to your desktop – the file itself, not a link to it.
Double click on the file, it will look like the screenshots.
Click on “Advanced,” uncheck “Apply repairs automatically,” and when you click on “Hide updates” it will give you a list of available updates. Check the ones you want to hide and continue.
Once you hide them, you will have to wait for Windows Update to scan again on its own before the updates disappear from the queue.

See AKB2000016 for information on Windows Update Settings and more on wushowhide..

1 user thanked author for this post.

Pixie

Reply | Quote

PKCano wrote:

Download wushowhide.diagcab from OlderGeeks.

Just curious. Why did you suggest downloading wushowhide from OlderGeeks rather than directly from MS?

I downloaded wushowhide from MS some time ago, but I have just used your link to download it from OlderGeeks. The two files appear identical; they certainly have the same file size.

Reply | Quote

Feel free to check out the MS link now.
It doesn’t work, b/c they cut off SHA-1 access.

Reply | Quote

Today I installed KB4601319 Cum.update 2021-02 for v2004 (Pro) again.
I first installed it on February 11, but it seriously slowed down start up and login, so I uninstalled it.

Startup/restart and login are still slower than before 4601319 – also after restarting a few times.
Looking at Taskmanager something called “Antimalware Service Executable” (I’m running Windows Defender for AV) is using a lot of RAM and processor umpf after logon.

I will keep an eye on it the coming days, to see if things improve.

LMDE is my daily driver now. Old friend Win10 keeps spinning in the background

Reply | Quote

[Bob99]

How much RAM is installed in your machine?

Several folks with older machines or reduced amounts of RAM have been reporting having the same problem with the monthly updates in the last few months here, from what I’ve seen.

I’m guessing it’s due to new methods of doing things within Windows that are possibly being built into the latest patches, and just maybe machines with older processors or lesser amounts of RAM are having a hard time processing the new routines.

Just a guess, though.

On one of my machines, I began noticing a lot of disk activity surrounding the monthly updates after WU had requested to reboot the machine. Further investigation revealed the indexing service was trying to index every file that had been created (and subsequently deleted in the case of temporary files used during the installation process before requesting the reboot). I promptly dug into the settings for the indexing service and got that under control so things are back to normal.

Oh, and the anti Malware Service Executable you’re seeing is also called MsMpEng.exe, and it’s a mandatory part of windows Defender. I always see it running during the monthly updates, but it stops as soon as they’re completed. By stops, I mean it doesn’t use any of the CPU cycles. During the updates, it’s obviously checking the files the trusted installer has unpacked and is getting ready to install. Once that’s all done, it stops running until called upon again.

If this is a real concern for you, feel free to start a thread about it, and I’m sure someone here (heck, probably a few people here) will be able to help out in getting to the bottom of your slow downs after installing the patch.

• This reply was modified 4 years, 1 month ago by Bob99.
• This reply was modified 4 years, 1 month ago by Bob99.

1 user thanked author for this post.

JLamede

Reply | Quote

All right, took this as the right moment to upgrade from Windows 10 Home 1909 to 20H2, since 20H2 has been green-lighted a few weeks back. Installation through ISO downloaded with the Media Creation Tool gave me 20H2 Build no. 19042.631, thereafter I ran wushowhide and let the following updates install through Windows Update:
– KB4601319 2021-02 Cumulative update for Windows 10 Version 20H2 (took me to Build 19042.804);
– KB890830 Windows Malicious Software Removal Tool x64 v5.86;
– KB4577586 Adobe Flash Player removal;
– KB4486684, KB4493169, KB4493211 => various Office 2013 February patches.

I manually installed KB4601050 (2021-02 Cumulative Update for .NET Framework 3.5 and 4.8) downloaded through the Microsoft Update Catalog, in order to stay away from KB4601554 (2021-02 Preview Cumulative Update for .NET Framework 3.5 and 4.8) which I previously hid with wushowhide.

Using wushowhide I also hid the annoying KB4023057 and a rather long list of Intel updates which were never offered to me as long as I was on 1909, making me wonder why they suddenly became available after the update to 20H2.

So far so good, no issues detected after all of the above updating.

Reply | Quote

I manually installed KB4601050 (2021-02 Cumulative Update for .NET Framework 3.5 and 4.8) downloaded through the Microsoft Update Catalog, in order to stay away from KB4601554 (2021-02 Preview Cumulative Update for .NET Framework 3.5 and 4.8) which I previously hid with wushowhide.

Since you say that you had already hidden the .NET preview with wushowhide, you didn’t really need to go get the February Cumulative Update from the Catalog. You could have rerun wushowhide and looked in the “Hide Updates” area to see that, with the Preview hidden, you should have the February Cumulative Update listed to be hidden, I think.

I’m using Pro, so I have group policy set in a way so that I don’t get offered previews for .NET and the regular monthly updates by WU and, as a result, they don’t show up to be hidden by wushowhide either. Because of this setup, I was able to use WU to install the February .NET Cumulative Update instead of getting it from the Catalog and installing it separately.

I believe the setting(s) I have in Group Policy can be duplicated in the Home edition you have of Windows 10 by way of editing entries in the registry using instructions in AKB2000016 here on AskWoody. Those instructions are contained in the area labeled “Section 2 – For Win10 Home Users“. Please carefully read the entire section a couple of times before committing to any course of action to be sure you’re comfortable with what needs to be done and your preferred method of doing it. The instructions include items for 2004 and 20H2 users as well.

Reply | Quote

A little clarification for my post above, since it seems to need it after having reread it since posting it. 😳

Basically, what I’m trying to say in the first and second paragraphs above is that with the .NET preview hidden by wushowhide, the February regular cumulative update for .NET should be offered instead, even though it’s been “superseded” by the preview.

With being superseded by the preview in the WU hierarchy, the preview is now supposed to be offered. BUT, with the preview being hidden by wushowhide, it is now no longer available. I would think that this scenario would then cause the WU mechanism, which wushowhide uses, to then default back to the original February Cumulative Update for .NET.

However, we are talking about Microsoft here.

Reply | Quote

Thanks for both your post Anonymous, they are very helpful.

Alas, from previous experience it seems that with the .NET preview hidden by wushowhide, the ‘regular’ .NET cumulative update is not offered nor it is visible in the “Hide Updates” area of wushowhide.

I will have a careful read of AKB2000016 and see if I can replicate on Windows 10 Home your group policy setting to avoid being offered previews for .NET and the regular monthly updates: that sounds like a very good way to avoid hassles with the (.NET) preview updates.

Reply | Quote

In 2004/20H2 Microsoft is now offering drivers through the Microsoft update process.  It wasn’t offered before because Microsoft made a change to now offer them.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

I’m still on 1909 and was given an Nvidia graphics driver update with January’s Windows Updates.

Reply | Quote

Same thing happened to me back in December when I was still on 2004. I didn’t bother hiding the driver update from Nvidia because it was showing up in the Optional category, so I thought “no harm no foul”.

Well, they (MS) suddenly changed it to recommended/mandatory, because it came right down when I went to go get the December update for 2004.

Good news is, it installed with no issues at all either then or today, and I’m now on 20H2.

Reply | Quote

Susan Bradley wrote:

In 2004/20H2 Microsoft is now offering drivers through the Microsoft update process.  It wasn’t offered before because Microsoft made a change to now offer them.

Isn’t that a bad thing?   I thought the recommendation was *NOT* to let windows update install drivers…

Reply | Quote

MS have history with installing bad drivers so the recommendation is don’t, unless you have a problem.

Having installed the MS provided drivers and not experiencing problems means it’s OK to leave them in.

cheers, Paul

Reply | Quote

At 2004 – is going to 20H2 going to be recommended?

Reply | Quote

You can see my answer https://www.askwoody.com/patch-list-master/

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

thanks

Reply | Quote

So forgive me for asking but what’s the issue with Secure Boot and what is the KB number?  I am a home user using Win 10 Home Edition/2004 and I come here for help with my PC .  I have limited computer skills but can understand some things.  It used to be that Ask Woody was for the benefit of helping those less knowledgeable than technies but  could find help and solutions. I hope that has not changed.

Reply | Quote

The kb no. is 4535680 and my understanding is that this update can cause problems with Bitlocker and is simply not needed by private PC-users like you and me. I wasn’t able to anticipate it but simply uninstalled it when it hit my system. I like to keep things simple.

Reply | Quote

FWIW I am also on Windows 10 Home 2004 patched with CU 2021-02 (Build 19041.804) and was not offered via Windows Update the KB4535680 – Security update for Secure Boot DBX : January 12, 2021 which was released back in Jan 2021 during or around patch Tuesday Jan 2021.

From the following article:

“If you are still on Windows 10 1909, and want to skip it for now, use the Wushowhide tool to hide the update.
If you are on version 2004 or later, the code is already included; thus, this update will not be offered up to you.”

Re : https://www.computerworld.com/article/3603928/for-microsofts-january-patches-no-all-clear-yet.html

Some background reading:
1) https://www.askwoody.com/2021/security-update-for-secure-boot-dbx-can-be-skipped-kb4535680/
2) https://www.askwoody.com/forums/topic/security-update-for-secure-boot-dbx-can-be-skipped-kb4535680/
3) https://support.microsoft.com/en-us/help/4535680/security-update-for-secure-boot-dbx
4) https://borncity.com/win/2021/01/14/windows-sicherheitsupdate-kb4535680-fr-secure-boot-dbx/
5) https://www.bleepingcomputer.com/news/security/microsoft-fixes-secure-boot-bug-allowing-windows-rootkit-installation/

Hope this helps.

Reply | Quote

Okay guys give me a run down of what updates are safe to install on WIndows 10 Home 1909 (Also if 20H4 or whatever is called is safe to install to update-Is it safer on the windows update assistant than the windows update)? What updates are safe and what are not safe?

Reply | Quote

https://www.askwoody.com/patch-list-master/  Do you have access to that?

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

No I don’t. I’m sorry but I can’t afford to pay for a subscription to know the patch list. 🙁 I need to know what updates are good for my baby.

Reply | Quote

Any amount is welcome, even $1.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Oh okay then that’s reasonable. ;3 Also its safer to use windows update assistant to install Windows 2004/20h2 right? Better than windows update?

Reply | Quote

I personally use the ISO site https://www.microsoft.com/en-us/software-download/windows10 

I just feel it gives me more control.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

So would I press update now or the create media tool? Because I wanna do it in a simple manner. I am not very familiar with ISO.

Reply | Quote

I click on “update now” and start the upgrade from there.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Okay so when I press update now it will begin the update progress or will it download something to click on that begins the process?

Reply | Quote

It will download a file to run.

Reply | Quote

And when I download the file I click it to run so to install the update correct?

Reply | Quote

Yes.

Reply | Quote

magigreen1 wrote:

Also its safer to use windows update assistant to install Windows 2004/20h2 right? Better than windows update?

Windows Update does a perfectly good job of updating for most people. Susan prefers complete control so she opts for the ISO.

I just updated 1909 to 2004 using Windows Update and apart from being slow (2 hours) it went without a hitch.

Make an image backup to external disk before the update, just in case – and because you always need a backup. 🙂

cheers, Paul

1 user thanked author for this post.

jburk07

Reply | Quote

:3 I just need my trusty usb drive to save my important stuff on 🙂 And if anything goes wrong-I’ll just reboot and install the update version through windows update on a fresh reboot. But I will definitely get it updated tonight. Update it while I sleep, new version by morning, computer takes a couple hour nap and its good to go :3 Course I’d have to hide updates to see what to give it on 20h4 🙂

Reply | Quote

I got a USB drive to save my stuff on there 🙂 I’ll be sure to uninstall advanced system care just in case since its a third party anti-virus care center and whatnot. But I will save the program on my drive along with other ones. :3

🙂 Hopefully it installs fine for me otherwise tomorrow I’ll have to spend the day rebooting it and updating it like that one incident a year ago when doing new version.

But again I will be updating the version tonight before bed. As I sleep, the computer will version update. 🙂

Reply | Quote

As you have a USB drive, use one of the 3rd party backup apps to create an image backup to it.
You then have a way to restore from any disaster, including hardware failure.

cheers, Paul

Reply | Quote

I think the minimum subscription is 20 dollars or the equivalent (pounds in my case), but personally I can’t afford not to pay such a modest sum for the wealth of information I get here. Methinks the alternative would be hundreds of dollars (or the equivalent) in PC repair bills.

Reply | Quote

Not true! Per Susan’s post above (#2347289) any amount is welcome, even a mere $1 U.S. !

However, that says nothing about if one’s financial institution imposes a minimum transaction amount for using a credit card or debit card.  🥴

R/

Bob99

Reply | Quote

I checked the ‘Extend Membership’ options. 20 dollars is the smallest amount listed. Have a look yourself.

Reply | Quote

You apparently missed the option below that which says “Other ___ USD”.

Reply | Quote

I didn’t miss it, I rather assumed it was for those who wished to donate more! I guess that’s because I regard 20 dollars (or the equivalent) for a year’s membership as unbelievably good value. Anything less would be a “steal”. But maybe that’s just showing my age!

1 user thanked author for this post.

b

Reply | Quote

Alright, I installed the 20H4 last night and it finished this morning. Although I will have to provide an image of the updates I hid because I need some help on what updates to install especially for my computer type and if the ones I see are safe to install. I’ll provide the screenshot tomorrow.

Reply | Quote