MS-DEFCON 4: It’s time to get patched

Topic

New Reply

The moment you’ve all been waiting for… It looks like the October Windows patches are ready for prime time. The usual caveats — and there are many
[See the full post at: MS-DEFCON 4: It’s time to get patched]

Total of 28 users thanked author for this post. Here are last 20 listed.

Blizzard, Average-Jane, Razz, deanwmn, MrToad28, Cijan, Kate, hjf, Sessh, CADesertRat, Lori, Pixie, Myst, snalmond, Pierre77, Chessie, abbodi86, SueW, Chris B, Spiral

Reply | Quote

Replies

[LHiggins]

OK – for us slow learners with Win 10 1903, from the CW article:

“Most users running Win10 version 1903 will want to install the first (but not the second) October cumulative update.”

So do you mean the Oct 3 Cumulative update KB4524157 or the Oct 8 Cumulative update KB4517389 (from Susan’s list)? I don’t see any other October Cumulative updates on that list, and with so many to watch out for, I’m losing track – LOL!

Which should be installed – or not?

Thanks!

• This reply was modified 5 years, 5 months ago by LHiggins.

Reply | Quote

The Oct 8 cumulative update.

2 users thanked author for this post.

deanwmn, LHiggins

Reply | Quote

I guess I’m being *really* slow!….

So are you saying to install the Oct 8 Cumulative update KB4517389 and NOT install the Oct 3 Cumulative update KB4524157??

Sorry to be so dense about this one…my brain just won’t grok it!  🙂

Jim

Reply | Quote

Yes, install the Patch Tues. CU KB4517389

Reply | Quote

kb4519974 for ie is still cumulative, i assume? so i don’t need kb4524135 for both windows 7 and 8.1, right?

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

1 user thanked author for this post.

Kate

Reply | Quote

IE11 Cumulative Updates are cumulative, so you only need the latest one KB4519974.

4 users thanked author for this post.

Kate, Charlie, woody, honx

Reply | Quote

Installed kb 4519976, required 2 restarts. Let it sit for 15 minutes then installed kb 890830 no restart required but did it anyway. Restored kb4524102 from hidden and it came in unchecked again so back in hidden it went and Kb 4524157 disappeared from the hidden. Checked for updates and nothing came in.

Windows 11 Pro
Version 23H2
OS build 22631.5039

5 users thanked author for this post.

Blizzard, MrToad28, Myst, jburk07, bassmanzam

Reply | Quote

PKCano wrote:

IE11 Cumulative Updates are cumulative, so you only need the latest one KB4519974.

thx!

another question:
why does latest KB4519974 have lower number than older kb4524135?
that’s a bit confusing.

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

2 users thanked author for this post.

Kate, Charlie

Reply | Quote

Good question.
Hey, Microsoft, got an answer? 🙂

6 users thanked author for this post.

Blizzard, deanwmn, Kate, CADesertRat, Charlie, Pixie

Reply | Quote

Woody,  I just checked and it appears that the article for KB4519976, Win 7 October rollup, has been updated since your initial 10-30-19 article on the conflict that appears with installing KB4519976.  The article for KB4519976 has an Important paragraph at the beginning of the article:

IMPORTANT Verify that you have installed the recommended updates listed in the How to get this update section before installing this update. For all updates starting with August 13, 2019, we strongly recommend that you install these updates to prevent any issues.

Any mention of how to fix the issue that was in the original article appears to be removed.  Apparently, if the recommended updates are installed, there is no issue per the latest version of the article. Interestingly the article has the original update date but has been revised since that date.  I did not check any of the other monthly rollup articles so I do not know if they have been updated or not.

2 users thanked author for this post.

Microfix, jburk07

Reply | Quote

The updates mentioned are:
+ The March 12, 2019 servicing stack update (SSU) (KB4490628). This should have been installed back in March or April through Windows Update.
+ The latest SHA-2 update (KB4474419) released September 10, 2019. The SHA-2 code signing support has been required for using Windows Update since August 2019 when MS converted from SHA-1.
+ And the latest SSU (KB4516655), which is recommended and available as a checked importnat update through Windows Update once there are no more pending updates in the Important Update queue. It has to be installed exclusively (by itself) and will not show up in WU as long as there are any other pending updates (checked or unchecked).

8 users thanked author for this post.

Blizzard, deanwmn, Razz, Kate, hjf, Microfix, abbodi86, jburk07

Reply | Quote

[opti1]

@PKCano:

“+ And the latest SSU (KB4516655), which is recommended and available as a checked importnat update through Windows Update once there are no more pending updates in the Important Update queue. It has to be installed exclusively (by itself) and will not show up in WU as long as there are any other pending updates (checked or unchecked).”

(Sorry if this isn’t formatted correctly – still learning how this forum works)

Running Win7 HP SP1 64-bit, Group A, current through August updates. Skipped September following Woody’s advice.

Just so I understand, if we do not have KB4516655 installed, after we install everything else from October we should go back and ‘check for updates’ again to see if we get this one?

Edited to add this:

Also, I am confused. If KB4516655 is supposed to be installed BEFORE the KB4519976 October monthly rollup but it will not install until all pending updates are installed do we have to go and manually get KB4516655 before we check for the October updates?

As usual, thanks for all the great information and help you provide here in this forum.

Thanks!

• This reply was modified 5 years, 5 months ago by opti1.
• This reply was modified 5 years, 5 months ago by PKCano.
• This reply was modified 5 years, 5 months ago by PKCano.

Reply | Quote

If the Oct updates install, go ahead and install them, then go back and search for updates after the reboot to get the SSU.

Otherwise, HIDE the Oct updates temporarily until the SSU shows up, install it, then go back and unhide the Oct updates and install them.

Either way, the SSU won’t show up if there are any other updates in the Important queue.

3 users thanked author for this post.

Blizzard, deanwmn, opti1

Reply | Quote

I downloaded KB4516655 from the Microsoft Update Catalog along with the Sept. S.O. updates.  I did not install them.  I only installed the latest KB4474419, and the Sept. Office 2010 updates from my WU so far (last month).

My questions are:

Since I already now have KB4516655 that I got and saved from MSUC, can I just use it instead of hiding all the remaining stuff in my WU to make it appear?

If so, can I install it first, all by itself, before installing the Oct. S.O. updates?  Or must I wait and install it after installing the Oct. S.O. updates?  Or does it even matter?

Being 20 something in the 70's was far more fun than being 70 something in the insane 20's

1 user thanked author for this post.

Kate

Reply | Quote

[PKCano]

Charlie wrote:

Since I already now have KB4516655 that I got and saved from MSUC, can I just use it instead of hiding all the remaining stuff in my WU to make it appear?

Yes, then wait 5 to let the install finish and reboot. (You might want to be sure it isn’t already installed first).

Did you know you can download the SO and the IE11 CU from AKB2000003? Direct download from the catalog.

• This reply was modified 5 years, 5 months ago by PKCano.

3 users thanked author for this post.

deanwmn, Kate, Charlie

Reply | Quote

Make sure to do a full-metal backup before installing patches for 1903! This is crucial because October patches might brick the Windows Update system (as it happened on a clean install Windows 10 1903 test VM here); and Microsoft has not implemented a working and bullet-proofed recovery option for the Windows Update system!

1 user thanked author for this post.

woody

Reply | Quote

[honx]

installed so KB4520003 (win 7), KB4519990 (8.1) and ie KB4519974 on both win7 and win8.1 machines. win7 computer rebooted twice during update and both reboots took ages today.

after main updates were installed i went ahead and installed office 2010 patches, msrt and defender (8.1), all important and checked. on win7 excel 2010 patch KB4484130 also took ages to install.

both win7 and 8.1 offered important and checked servicing stacks, i installed thes as well:
win7: another incarnation of KB4516655 (2019-09 servicing stack)
win8.1: 2019-10 servicing stack KB4521864

reboot after installing office, msrt and servicing stack took not that long like reboots before. amount of time normalized, took as much time again as reboots usually take on this pc.

PC: Windows 7 Ultimate, 64bit, Group B
Notebook: Windows 8.1, 64bit, Group B

• This reply was modified 5 years, 5 months ago by honx.

3 users thanked author for this post.

Kate, Microfix, SueW

Reply | Quote

Win 7, Group A here.  In addition to the October roll up and KB4474419, and I being offered a checked Windows 7 Update KB 4522452.  Is this last one ok to install?

Reply | Quote

Woody,

1. Thanks so much for reiterating your update instructions every month on Computer World.  Some of us civilians need that,

2. You said those on v1809 should start thinking about moving to v1903.  If you were an average computer user, how long would you “think” (wait)?

Reply | Quote

I have the same question. Just wait for 1909 or update? There seems to be some issues, but they don’t seem to effect everyone.

1 user thanked author for this post.

CyGuy

Reply | Quote

1809 is good until May 2020. There is no rush. You have a while to think about it.

3 users thanked author for this post.

DriftyDonN, woody, CyGuy

Reply | Quote

[frankus333]

G’day folks

I was running Win 10 Home 1809, and I allowed the feature update to 1903, to avoid having to keep dodging the upcoming 1909 offering.  There is what seems a great improvement in the Advanced Options for pausing updates; allowing a setting of a definite date up to 35 days into the future to hold off updates.

Just wondering why this option is not recommended, instead of the process of hitting the “Pause for 7 days” three times?

Does this new setting not work as advertised?

I hope it does work properly; it looks like it will save me from having to keep WU disabled, and my wifi not automatically connecting.  (Setting wifi to metered didn’t seem to block all updating; only feature updating.)  Fingers crossed.

Cheers

• This reply was modified 5 years, 5 months ago by frankus333.
• This reply was modified 5 years, 5 months ago by frankus333.

Reply | Quote

G’day again folks

As per my above post, can anybody comment on how reliable/trustworthy this new Win 10 1903 advanced option of setting a very specific day/date to extend the pausing of updates to, as opposed to the option Woody recommends, of hitting the “Pause updates for 7 days” button three times?

If it works reliably, I envisage setting it to the weekend before patch Tuesday each month, which seems to be about when Woody raises the DefCon level.

Also just wondering whether pausing updates prevents Defender from automatically updating definitions? I thought Defender was supposed to automatically update its definitions regularly (daily, or after each reboot?), but it doesn’t seem to be doing so.

Anyway, I am enjoying being able to allow my wifi to connect automatically, and not having to disable WU after each 24 hours or so.  At last, this is the next best thing, if we can’t have reliable indefinite deferral, as per Win 7/8.1.

Cheers

Reply | Quote

Well at least my Oct 2019 IE11 patching is now done along with the Windows 7 Security Only patch that’s actually Security Only this month. So there are only 3 more months remaining for good old 7 and for consumers getting security updates.

But is there going to be any Edge/Chromium on 7 and 8/8.1 to replace IE11 with something that may be less flaky with the HTML5 standard. I’m really mostly on Firefox for the majority of my browsing but have not yet set Firefox to my default browser. IE11 is still my default browser and it’s been patched for Oct 2019 so no worries about said Zero Day that never materialized in the wild any longer. But I have been careful not to launch any application’s online help that may make use of the default browser these last few months until the Oct IE11 patch was installed.

I’m not sure if I’m keeping Firefox long term just yet so I’ll wait a little longer to make it my default browser.

1 user thanked author for this post.

SueW

Reply | Quote

Edge/Chromium will only replace inbox Edge on Windows 10
it will never replace IE11 on any Windows

while W7 is advertised in Edge/Chromium testing channels, it doesn’t seem it will have the chance of getting the stable version befoer EOS 2020

Reply | Quote

I am on HP Home Edition Win 10 v 1903. I am up to date with updates and on build 18362.418. Sitting in my  Optional updates is KB4522355 which provides fixes in previous KB’s and brings build to 18362.449 per Susan Bradley’s post of 10/30.  So should I install KB4522355 to bring build to 18362.449 or will the Optional KB 4522355 become part of the November CU and update build then?

Reply | Quote

The Win10 Updates are cumulative. SO, yes, Optional KB 4522355 will become part of the November Patch Tuesday Important Security CU, along with additional new fixes.

1 user thanked author for this post.

Pixie

Reply | Quote

Be aware of that patches shipped on the ‘second’ ‘Patch Tuesday’ are previews and should not be installed on production systems! Most of the time, those patches get updated before being shipped on the ‘first’ ‘Patch Tuesday’ of the following month.

Reply | Quote

There is no ‘second’ ‘Patch Tuesday.’

Patch Tuesday is the second (“B”) Tuesday of the month and the patches released are Sucurity Updates.

Patches released in the “C,” “D,” and “E” weeks are Previews and are non-security updates.

Reply | Quote

Stop calling them previews, they are just optional
and they fix more issues than security updates 🙂

1 user thanked author for this post.

Kirsty

Reply | Quote

Microsoft calls them previews:

The “C” and “D” releases occur the third and fourth weeks of the month, respectively. These preview releases contain only non-security updates, and are intended to provide visibility and testing of the planned non-security fixes targeted for the next month’s Update Tuesday release. These updates are then shipped as part of the following month’s “B” or Update Tuesday release.
…
In most cases, “C” and “D” releases do not need be deployed to your broader device ecosystem. Instead, you can use these releases to identify any issues that could impact your next “B” deployment and provide feedback. This helps you get a head start on testing and understanding the potential impact of updates and gives you a chance to provide suggestions before those updates are officially released, providing a smoother and more tailored experience when the “B” release comes around.
Windows 10 update servicing cadence

Reply | Quote

They are just trying to redeem the issues in Windows 10 update servicing, took them only 3 years to do that
beside, that’s just a forum post explanation, actual Windows Update only classify them as OptionalInstall 😀

i guess it’s still a fair point.

what’s funny is that Windows 10 non-security updates don’t have the “preview” wording in Windows Update, although the contained components mostly get updated later

while Windows 7/8.1 preview rollups have them, although the rollups are production-ready

1 user thanked author for this post.

Microfix

Reply | Quote

abbodi86 wrote:

while Windows 7/8.1 preview rollups have them, although the rollups are production-ready

Exactly, and I’ve found that these CAN fix issues from patch Tuesday offerings on Win7/8.1 (if something goes awry)
W10, however, is a different kettle of fish where Woody’s MS-Defcon doesn’t differentiate between in-support OSes. ‘Rock and a hard place’ at times..

Windows - commercial by definition and now function...

1 user thanked author for this post.

abbodi86

Reply | Quote

I don’t understand what prompted you to suddenly recommend patches now other than it being the end of the month. What changed recently that made you recommend an update now?

Reply | Quote

It’s a balancing act.

The question is whether the risk of getting clobbered outweighs the benefit of installing patches.

This month, there’s really no immediate benefit (feature improvement) worth sticking your neck out. Sooner or later, you have to patch. But it’s rare that a threat appears requiring immediate patching.

We reached the point where I felt comfortable recommending people get the patches installed – not for any specific benefit, but because the problems have been hashed out pretty well and, in some cases, fixed.

4 users thanked author for this post.

deanwmn, Kate, safir, SueW

Reply | Quote

Made on typo on the prior message.  The additional update I am being offered is KB2524752.  What is this and is it ok to install?

Reply | Quote

[PKCano]

KB4524752. is an EOL nag to keep reminding you of Win7 EOL.
HIDE IT!!!!

• This reply was modified 5 years, 5 months ago by PKCano.

8 users thanked author for this post.

Steve, Blizzard, aaron451, deanwmn, Kate, The Surfing Pensioner, woody, pulsar

Reply | Quote

I’m showing KB4524752, is this the one that we hide ?

Reply | Quote

Yep, I made the correction in the KB number.
You don’t want that one!

Reply | Quote

I hid all updates after my first update check to make sure there weren’t any SSUs this month.

When I went to restore this months updates there were 2 versions of the W7 monthly rollup in the hidden list.

KB4519976 was the the one I hid and KB4524157 was already in the hidden list. Whats the difference between the 2?

Reply | Quote

KB4524157 is the first, ridiculous, buggy “out of band” patch for the IE zero-day that’s never materialized. You can safely forget it.

4 users thanked author for this post.

deanwmn, Myst, jburk07, Moonbear

Reply | Quote

Thanks @Woody

I didn’t remember the KB number for the out of band patch, I’ve now added it to my skip list.

Reply | Quote

I uninstalled KB4524157. It didn’t seem to cause any problems, but the majority have either put it into hiding or just ignored it. Since I’ve not reinstalled October’s KB4519976 rollup (had an error pop up as noted in my previous comment at #1997971, so I uninstalled this latest update), my list is now at August’s KB4512506 rollup. Don’t ask, I’m exhausted, and will wait for November’s fun to start before making any more moves.

MacOS iPadOS and sometimes SOS

Reply | Quote

a patch in October that was to resolve the Start Menu Critical Error was allegedly fixed but not 100%, and now we’re told it’s time to Patch? I don’t think so.  I uninstalled all October and September patches to make the Start Menu work again.

I think holding off is best advice.  Please be more careful.

Reply | Quote

Oh, I’m careful. I fret over this moment every month.

In the case of the screwed-up Start menu, I feel comfortable now that we know the symptoms and that there are good solutions, even for (particularly for!) “normal” users.

Reply | Quote

TBH I was surprised to see Defcon at 4….
and here I thought Oct might be a skip month!
Having said that………….
October updates reporting in…..

late yesterday hid all updates and restored the following…
KB4516655 (servicing stack) this was installed 1st.
installed smoothly and rebooted after.

unhid and installed….
KB4519976 (rollup)  Note: this took a long time installing and after reboot took longer then usual for computer to restart.
Some have posted that their computer rebooted twice.  Mine did not, only once, but I have to
admit, I was a little worried for a moment.

I deceided to wait until this morning to install…
KB4524102 (.net security and quality rollup)
Installed went smoothly.

Did not install MSRT and kept hidden.  Have not installed for many months.

Dell Inspiron 660 (new hard drive installed and Windows 7 reloaded Nov. 2017)
Windows 7 Home Premium 64 bit SP 1 GROUP A
Processor: Intel i3-3240 (ivy bridge 3rd generation)
chipset Intel (R) 7 series/C216
chipset family SATA AHCI Controller -1 E02
NIC Realtek PCLE GBE Family Controller
MSE antivirus (has new name now) will switch to BitDefender soon.
Chrome browser
DSL via ethernet (landline)

5 users thanked author for this post.

deanwmn, Microfix, SueW, Myst, jburk07

Reply | Quote

G’day folks

Just wondering how to hide updates on Win 7 Pro 32 bit eeePC machine?  When I tried to install wushowhide, it tells me it is not compatible with my version of windows?

Reply | Quote

In the update queue (important or optional) , right click on the update you want to hide and choose HIDE.
To restore a hidden update, click on the “Restore Hidden Update” link on the left in Windows Update and check the box next to the update..

1 user thanked author for this post.

frankus333

Reply | Quote

Oops; sorry folks, that should have been obvious.  Thanks PKCano

Cheers

Reply | Quote

chiiild my head is spinning from all the comments Basically are you all saying I should hold off on any updates until the end of November? And what about other updates during the month of November such as defender? Thank You

Reply | Quote

Woody has set the DEFCON level at 4. That means: read his article in ComputerWorld (linked on the main blog page) withe the instructions for patching, and go ahead and patch accordingly.

1 user thanked author for this post.

woody

Reply | Quote

Reporting in, W10 Pro 1809. I updated 1 computer this morning and so far, so good.

KB4520405 .net 3.5/4.8, MSRT, KB4519338 cum to 17763.805

Still have 3 more computers to update, all W10 Pro 1809.

Don't take yourself so seriously, no one else does 🙂
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).

Reply | Quote

Finished the last of them today. All 4 updated with no problems so far. On to the next Defcon 1.  🙂

Windows now gives me the feeling of Slim Pickins riding the nuclear bomb down in Dr. Strangelove LOL

Don't take yourself so seriously, no one else does 🙂
All W10 Pro at 22H2,(2 Desktops, 1 Laptop).

2 users thanked author for this post.

jburk07, Myst

Reply | Quote

With this difference: he had real fun while his ride lasted.

Ex-Windows user (Win. 98, XP, 7); since mid-2017 using also macOS. Presently on Monterey 12.15 & sometimes running also Linux (Mint).

MacBook Pro circa mid-2015, 15" display, with 16GB 1600 GHz DDR3 RAM, 1 TB SSD, a Haswell architecture Intel CPU with 4 Cores and 8 Threads model i7-4870HQ @ 2.50GHz.
Intel Iris Pro GPU with Built-in Bus, VRAM 1.5 GB, Display 2880 x 1800 Retina, 24-Bit color.
macOS Monterey; browsers: Waterfox "Current", Vivaldi and (now and then) Chrome; security apps. Intego AV

1 user thanked author for this post.

Blizzard

Reply | Quote

[Seff]

As a heads up for those who followed Woody’s advice in September not to install that month’s updates, you need to check the numbers/dates of those being offered now. Any from September (e.g. for Windows 7 that includes the rollup KB4516065 and also KB4474419) should presumably be hidden, in order for their October replacements to appear as it is those you want to install.

As for the September .net framework update KB45514602, I installed that on one machine without any issues before the advice came not to install anything rather than just the out-of-band updates previously discussed, so that is now being offered on my second machine. Should that also be hidden as one of the September “do not install” updates or is it deemed ok and required now?

• This reply was modified 5 years, 5 months ago by Seff.

Reply | Quote

You should not hide KB4474419, you should install it. It is not issued monthly and is not a part of the Sept updates that you so not want to install.

Install KB4474419 if it is in the Important Updates and checked.

2 users thanked author for this post.

Blizzard, Seff

Reply | Quote

Thanks PK, it is dated 10th September but refers to an update made on 23rd September.

And the .net framework update KB45514602, what is the current status of that one please?

Reply | Quote

.NET should be OK to install. You should probably see KB4524102 .NET Rollup for Oct too.

2 users thanked author for this post.

Blizzard, Seff

Reply | Quote

PKCano,

On my Windows 7 X64 computer I wasn’t offered the Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows 7 SP1 and Server 2008 R2 SP1 (KB4524102) in the October updates.

It is offered in the Microsoft update catalog, and shows that KB4507004 is for version 3.5.1 and KB4507001 is for 4.5.2 . The thing is those 2 updates were offered and installed with July’s updates. The Security and Quality Rollup for .NET Framework was (KB4507420), and it installed the same 2 individual updates, KB4507004 and KB4507001 that are being offered in The October catalog update (KB4524102).

When I click on the individual files from either the October update, (Last Updated: Oct 8, 2019) or July update, (Last Updated: Jul 9, 2019) it shows the “same” support page that was last updated October 15.

My question is, why these 2 updates being offered now if they are the same as the 2 that were offered back in July?

Reply | Quote

Perhaps there was a change in the metadata and not in the binaries.

1 user thanked author for this post.

twbartender

Reply | Quote

Thanks for the quick reply. Does that mean that the 2 updates do or do not need to be reinstalled?

Reply | Quote

If they are in Windows Update and checked, let WU decide whether you need them or not. It is better to let WU install the .NET updates because it “knows” what the computer needs.

5 users thanked author for this post.

AJNorth, Blizzard, woody, Kate, twbartender

Reply | Quote

Thanks @Woody, Brought my 1903 up to 18362.449.

On a small snag – Start Menu working but Search not. Turned the ‘Disable Web Search ‘ option in Winaero off, rebooted and search was back. Reset the ‘Disable Web Search ‘ option  in Winaero again, rebooted and all working again!

Dell Inspiron 16 Plus 7640 Core Ultra 7 155H 32GB Win 11 Pro 23H2 (22631.5039)
Dell Inspiron 15 7580 i7 16GB Win 11 pro 24H2 (26100.3476),
Microsoft 365 Version 2502 (18526.20168)
Location: UK

1 user thanked author for this post.

woody

Reply | Quote

I have 2 Win 10 PCs, one on 1809 and one on 1903. Both had Automatic Updates turned off in gpedit. Following this post, I configured both in gpedit with feature updates deferred 360 days and quality updates 21 days, expecting the Oct updates to come down after my agreement to download and a reboot.

On the 1809 PC, that is exactly what happened. On the 1903 PC, nothing was offered after several reboots, and in Settings Update it still shows that Group  Policies Editor has Disabled automatic updates.

Curious. I will see if it corrects itself tomorrow, when the day changes.

Chris
Win 10 Pro x64 Group A

Reply | Quote

In Group Policy, under Windows Update, “Configure Automatic Updates” = Enabled, set the value to 2 (notify download/install)
Wait for the PC to check for updates – may be as much as 36 hours.

Reply | Quote

PKCano.

That’s indeed what I have, and I am clearly in my 36 hours. It seems I am a little impatient!

Chris
Win 10 Pro x64 Group A

Reply | Quote

A few hours later, all the updates popped up.

Note to self – be less impatient in future!

Chris
Win 10 Pro x64 Group A

Reply | Quote

Color me temporarily confused, especially after reading ‘Take charge of Windows 10 and Office 365 updating’, in Susan Bradley’s Windows Patching.

Since it’s basically myself on this Windows 10 Pro 1903 desktop I skipped past the Office update setting suggestions in the article, mainly because I don’t have Office installed. Further down, “for unmanaged home PCs” she recommends configuring Windows to defer updating for a few days by setting the day and time for automatic patch installation using gpedit:

Computer Configuration\Administrative Templates\Windows Components\Windows Update\, and then double-clicking Configure Automatic Updates, click Enable, and then enter a scheduled day and time from the drop-down lists — typically 7-Every Saturday at, say, 3 a.m.

This I’ve done as the Configure automatic updating is set to 3 (Auto download and notify for install), but what’s perplexing to me is when viewing Windows Update in Settings I now see an asterisk next to “Some settings are managed by your organization.” Below that is a bluish link to View configured update policies. Clicking on *that* displays “Wondering why you’re seeing ‘Some settings are managed by your organization’ “, and “Policies set on your device” to download the updates automatically and notify when they are ready to be installed. Source: Administrator, Type: Group Policy.

Is this the proscribed procedure, or had I messed up with one too many tweaks?

 

The duration of a minute depends on which side of the bathroom door you're on.

Reply | Quote

Sounds like expected behavior to me; what’s confusing?

However, Susan’s plan for that 3 a.m. setting was; “I then leave the system turned on, knowing that it will automatically install updates and reboot on the Saturday following Patch Tuesday — when I’m sound asleep.”

If you’re also setting to download but notify only, is there any point in having that done at 3 a.m.?

Reply | Quote

[chaloots]

As as I am unfamiliar with maneuvering W10 updates, this forum and its’ associated contributors are my only guidepost. So when I read are what in my perception to be specific recommendations I can personally contextualize I follow them. As I too choose to have the pc powered on continually, the 3AM setting sorta kinda made sense. Following previous setting suggestions gleaned from the AskWoody forum I can’t recall ever experiencing  an interruption to either install updates or reboot for them to complete.

Once having made this gpedit change I did notice an alert window popup reminder earlier of a pending update. In this case it was for Defender, which in the past with the previous settings would have been automatically resolved. I personally would much prefer future Defender updates to auto install. With that perspective in mind, perhaps a reset of that Configure Automatic Updates gpedit back to Not Configured will work better for me.

Grazie for the perspective, b.

The duration of a minute depends on which side of the bathroom door you're on.

• This reply was modified 5 years, 5 months ago by chaloots.

1 user thanked author for this post.

b

Reply | Quote

I installed the (KB4520005)Monthly Rollup with no issues. But I also noticed the out of band rollup that was released October third (which I hid weeks ago) is gone.

 

FWIW I wasn’t going to install the out of band rollup anyway.

Reply | Quote

I skipped the September patches, which were then superseded by the October patches. But when I went to actually install them, the October patches had disappeared and the September patches were being offered to me again.

I installed the September patches and rebooted. I was then offered a Servicing Stack update which I installed. I was then told I was up-to-date, but I knew Windows Update was lying. I checked for updates and then the October roll-up was found. I installed that, and then I was truly done.

All told, I installed the following patches in this order:

Security Update KB4516065 NT AUTHORITY\SYSTEM 11/2/2019
Security Update KB4474419 NT AUTHORITY\SYSTEM 11/2/2019
Security Update KB4516655 NT AUTHORITY\SYSTEM 11/2/2019
Security Update KB4519976 NT AUTHORITY\SYSTEM 11/2/2019

2 users thanked author for this post.

jburk07, ht

Reply | Quote

KB4474419 was an additional piece of the SHA2 implementation. Without that installed WU would not offer the October updates. Without offering the October Cumulative Update the update service filled in with the September offering.

Your workaround was not wrong, just duplicative. Had you instead done the KB4474419 seperately then rechecked; the service would have given October.

1 user thanked author for this post.

ht

Reply | Quote

anonymous wrote:

KB4474419 was an additional piece of the SHA2 implementation. Without that installed WU would not offer the October updates. Without offering the October Cumulative Update the update service filled in with the September offering.

Your workaround was not wrong, just duplicative. Had you instead done the KB4474419 seperately then rechecked; the service would have given October.

That dependency did not always exist.  There was a time when I was being offered both the September 23, 2019 SHA-2 code signing support update (KB4474419) and the October 8, 2019 Monthly Rollup (KB4519976) simultaneously.  But by the time I actually went to install the patches, the September Monthly Rollup was being offered instead of the October one.

 

Reply | Quote

I am not able to explain the disparity. I too was surprised by what was offered. I did not immediately install the SHA2, because I had not yet identified it. I only knew October was missing. My first step was to hide the important tab contents to empty and recheck. My thought was to find an SSU.

There was none. Only the several Optionals. I installed the MSE definition listed by its new name and rechecked.

Still none. That is when I looked at the hidden items more closely. Now recognising the SHA2 for what it is, I restored only that. Pressing OK invokes a new recheck. Which yielded only the SHA2. Installed it, had the double reboot described by others. Allowed time for all services to settle.

When I then looked at Windows Update, the October SMQR (KB4519976) appeared on the Important tab. I never looked at the Restore list. I saw what I expected and desired, so installed it. Reboot normal and timely. Looked at Windows update once more, in case of SSU, and was given the green shield, Up to date, No important updates available.

I jumped to the conclusion that one resulted in the other without delving into the research. I responded to you presumptuously with my conclusion as if it also explained yours. I held back the details for brevity. I offer the full version now for anyone else to explain what I missed. Sorry that it was different than yours.

Reply | Quote

Installed/Uninstalled KB4519976.

Last successful update, according to me, was on Oct. 5, 2019, in between DEFCON 3/1. I have had no issues since then until today, when the error 0x8009030f showed up (ref:https://www.askwoody.com/forums/topic/another-patch-induced-bug-transport-layer-security-fails-with-error-0x8009030f/). This is when I uninstalled KB4519976. Took over an hour for Windows to reconfigure, but now all is working great, as it has been, with the last rollup being KB4524157. I had also installed KB4474419, the latest SHA-2 version, and KB4516655 (SSU) on Oct. 5.

MacOS iPadOS and sometimes SOS

4 users thanked author for this post.

Blizzard, woody, jburk07, fernlady

Reply | Quote

I have a Win 10 Home system that I just updated from 1803 to 1903.  No problems noted — at least so far (after a few hours).  I followed that update by running wushowhide; and among the updates listed as available today is KB4522741 (2019-10 Cumulative Update for .NET Framework 3.5 and 4.8).

I’m choosing to hide that update for now; since Susan makes no mention of such an update in her Master Patch List.  But I’m wondering why this particular October update is missing from the MPL.  Does anyone know why KB4522741 was omitted?  Is it safe to install or not?

Reply | Quote

i just upgraded from 1803 to 1903 went real smooth but took like 13 hours to finish installing on hp pavilion dv6 .. faster than 1803 by the way

Reply | Quote

[Seff]

Update on my first Windows 7 X64 Home desktop, not touched my second one yet:

I was originally offered the September rollup KB4516065 as it had been left, but either because I ended up hiding it (I think I did, but it’s not showing as a hidden update) or because MS changed things I was then offered instead KB4519976 which in turn was replaced by KB4524157. The latter however was unchecked, and has remained so after installing the only other update offered namely KB4474419.

The September .net framework update KB4514602 was installed on this machine last month and no new .net framework has yet been offered for October.

So currently on that machine I have only an unchecked monthly rollup which will, of course, remain uninstalled. I’ll see if anything changes between now and the November patch day.

I’ll give it a day or two to see if the first machine runs normally and if so will then look to install KB4474419 on the other machine, along with the September .net framework update KB4514602 which is still being offered on that machine, as is the September rollup KB4516065 currently. That machine also has 5 updates pending for Office 2010, all checked.

EDIT UPDATE: Following checking for updates on the first machine, the unchecked rollup KB4524157 has been replaced by the previously offered KB4519976 which is checked. Given the apparent issues with that one and the constant changes in updates offered I suspect it’s sensible to leave things now until the November patches, unless anyone has strong views to the contrary.

• This reply was modified 5 years, 5 months ago by Seff.

Reply | Quote

I had both big October updates (~200mb) in my hidden list KB4519976 and KB4524157. Upon restoring them only KB4519976 remained and it was dated 17-10-19 instead of 8 oct per the article
Win 7 SP1 HP 32-bit Group A

1 user thanked author for this post.

jburk07

Reply | Quote

PKCano wrote:

Did you know you can download the SO and the IE11 CU from AKB2000003? Direct download from the catalog.

Yes indeed!  It’s very convenient and I’ve been using it almost from when it became available. Thanks very much.

Being 20 something in the 70's was far more fun than being 70 something in the insane 20's

Reply | Quote

Yet again the file hash for KB4519974 does not match the file hash information listed on the cumulative update page which is infuriating – https://support.microsoft.com/en-us/help/4519974/cumulative-security-update-for-internet-explorer

Furthermore, when you click the link which takes you to the update catalogue it takes you to KB4524135 which is the october 3rd cumulative update! Doesn’t anyone check this stuff?

Of course, the SHA1 file hash matches the filename but filenames can be easily altered so doesn’t instil one with confidence that something hasn’t been tampered with.

Reply | Quote

Have you tried using AKB2000003 for downloading?

Reply | Quote

[T]

Oh yes, that’s always a handy resource for direct links but the file hashes still don’t match those listed on microsoft’s own site so which files, i wonder, are those hashes for? I’m just being overly cautious i guess but when file hashes don’t match one should always be extremely wary installing anything.

• This reply was modified 5 years, 5 months ago by T.

Reply | Quote

The listed file hashes are simply for older version of the same update, which is not released (i.e. last minute fix and new version)

KB articles guys did not got the memo about updated version 😀

you can manually construct the links for this older version if you want 🙂
e.g. Win 8.1 x86
http://download.windowsupdate.com/d/msdownload/update/software/secu/2019/09/windows8.1-kb4519974-x86_E6EC68645FB16A57C0890FD33FA3C3B6F9705908.msu

Reply | Quote

Yeah, so what you’re saying is we have a Hanlon’s razor situation – “Never attribute to malice that which can be adequately explained by stupidity.”

That sounds about right with these keystone cops bunch.

Reply | Quote

I wanted to download the 1903 iso to my computer , followed woody’s instructions.  I downloaded it to the Downloads folder.  Now, I see an icon under “this pc” that says “DVD drive (E:) ESD-ISO” with some of the setup files.  I didn’t choose to burn the iso , I clicked “finish”.  What do I do with this?  Why would downloading the ISO create this file or new drive?

Reply | Quote

The ISO should only get mounted as a drive like that if you open the file or double-click it.

When you want to use it to upgrade, the easiest way is to open or double-click it to mount it as a drive like that, and then run Setup.exe from that “DVD. drive (E:) ESD-ISO”.

If you plan to do that later rather than now, you can right-click on “DVD drive (E:) ESD-ISO” and choose Eject which will unmount it as a drive.

Reply | Quote

[jburk07]

Reporting successful Group A updating results:

Last month I installed the September rollup KB4516065 and the updated SHA-2 update KB4474419 on both of our Windows 7 x64 laptops on October 3, in that brief space between Defcon 3 and back to 1. I also installed the Servicing Stack Update KB4516655 from Windows Update after the out-of-band rollup KB4524157 disappeared.

So yesterday I installed the October rollup KB4519976 on both laptops without problems. I didn’t experience the longer-than-usual installations or reboots that some did.

One of the laptops was offered the .NET rollup KB4524102, which also installed without a problem. The various Office 2010 and 2013 didn’t present any difficulties, either.

All anti-telemetry settings are still in place after the updates.

So I guess that just leaves November, December, and January to go, unless 0Patch proves to be a workable resource. (Or unless that TLS bug hits us later.) As always, I’m thankful to everyone here for their help. Good luck to all on getting through another patching month.

Linux Mint Cinnamon 21.1
Group A:
Win 10 Pro x64 v22H2 Ivy Bridge, dual boot with Linux
Win l0 Pro x64 v22H2 Haswell, dual boot with Linux
Win7 Pro x64 SP1 Haswell, 0patch Pro, dual boot with Linux,offline
Win7 Home Premium x64 SP1 Ivy Bridge, 0patch Pro,offline

• This reply was modified 5 years, 5 months ago by jburk07.

6 users thanked author for this post.

Blizzard, Microfix, dgreen, Lars220, SueW, Myst

Reply | Quote

I’ve finished the Oct. Group B SO updates today and everything went very well. Thanks again to all of you for your valuable help and guidance!

Being 20 something in the 70's was far more fun than being 70 something in the insane 20's

5 users thanked author for this post.

Kate, Microfix, Lars220, jburk07, SueW

Reply | Quote

And here’s my long list after updating late this afternoon:

[Note: I missed the 2-day window between DEFCON 3 and DEFCON 1 for September’s updates; they were not installed.]

1 – just in case, double-checked Task Scheduler — Application Experience, CEIP, and PerfTrack — all subtasks are still disabled

2 – imaged my disk with Macrium Reflect Free

3 – downloaded KB4516655 (latest SSU, dated 9/10) from the Catalog & installed it; rebooted & waited 15 minutes

4 – downloaded KB4474419 (latest SHA-2 patch, dated 9/10) from the Catalog & installed it; rebooted & waited 15 minutes

5 – downloaded Updates KB4520003 (October SO) and KB4519974 (IE11 October Cumulative)

6 – installed both Updates and then restarted. Note: my computer was configured and started twice, after which I waited 15 minutes

7 – re-checked Task Scheduler — Application Experience, CEIP, and PerfTrack — all subtasks are still disabled (as expected)

8 – updated MS Security Essentials’ Virus & Spyware Definitions manually to eliminate Windows Update’s “Optional” ‘Definition Update for Microsoft Security Essentials – KB2310138

9 – checked “Windows Update” => 7 Important (all checked): 5 Office 2010 and 2 Win 7; 3 Optional: all unchecked

10 – unchecked and hid “Important” Update KB4519976 (October Rollup)

11 – hid the unchecked Optional update KB4519972 (October Preview Rollup)

12 – hid the unchecked Optional update KB4520406 (October Preview for .NET Framework)

13 – hid the unchecked Optional update KB4524102 (October S&QR for .NET Framework)

14 – checked “Windows Update” again => 8 Important: 5 Office 2010 and 3 Win 7: all checked; 2 Optional: both unchecked

15 – unchecked and hid “Important” Update KB4519976 (September Rollup)

16 – hid the unchecked Optional update KB4516048 (September Preview Rollup)

17 – hid the unchecked Optional update KB4516551 (September Preview for .NET Framework)

18 – checked “Windows Update” again => 8 Important: 5 Office 2010 and 3 Win 7: 7 checked; 0 Optional

19 – hid the unchecked “Important” Update KB4524157 (October Rollup)

20 – checked “Windows Update” again => 7 Important: 5 Office 2010 and 2 Win 7: all checked; 0 Optional

21 – unhid 0 hidden updates to install

22 – installed 7 Updates: 5 Office 2010 (KB4484130, KB4464566, KB4475569, KB4475599, KB4475604), 2019-09 Security and Quality Rollup for .NET Framework (KB4514602) and MSRT (KB890830)

23 – rebooted and waited around 45 minutes

Note: Windows Media Player did not need to be reconfigured 😉

Many thanks to PKCano, Woody and everyone else who continue to contribute their time, expertise, and patience (!) or who post their own results!

Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'

7 users thanked author for this post.

Charlie, Kate, Microfix, dgreen, Lars220, Myst, jburk07

Reply | Quote

Here is my up-to-date updating spree. Bear with me.
Had installed/uninstalled the October rollup KB4519976 on Nov. 2. This October rollup was giving me trouble with error 0x8009030f, where it was cancelling out saying Windows cannot check for updates. I realize now this October update should have been put in the hidden list and not just uninstalling it.

A synopsis of the before to the after – Was caught in between the Defcon 3 and Defcon 1 at the time of checking for updates, on October 3, so went ahead and installed haphazardly, the “buggy” October out of band rollup KB4524157. What was I thinking? So, with that done, and after reading comments of some who hid the update, I decided to uninstall it after installing/uninstalling KB4519976. This put me back to August rollup on the list.

Today, I ran a check for updates and it failed again. Even after uninstalling the KB4519976 October rollup, it showed up in “View History”. Thinking this is why it should have been unchecked and hidden. Now, the weird thing is this – I checked again a few minutes later, this time it went through and 4 Important Updates popped up. Two 2010 Office updates and MSRT, plus the KB4519976 once again. I unchecked and hid the KB4519976 Oct. rollup, installed the MSRT, and both Office updates.

All went well with this task. I did a restart just to refresh everything, then checked for updates once more. This time the September rollup KB4516065 showed up, so I installed it. Ran a check, and no more Important updates. All green. All smiles. All is well.

A side note – I had installed the current SHA-2 update on Oct. 5, as well as the SSU KB4516655.

A shout out to @SueW, you reported in recently and it was your post that prompted me not to give up on this endeavor. It was your comment on unchecking/hiding the October KB4519976 that kicked me in the bum to wake up and get it right. Plus you were stuck in the middle of the Defcon report as I was, along with many, for the September/October updates. And to everyone else who put their efforts into this fiasco this past month and recently, thanks for posting your comments and outcome.

Looking forward to EOL. This updating thing is exhausting.

MacOS iPadOS and sometimes SOS

8 users thanked author for this post.

Blizzard, jburk07, Charlie, SueW, Kate, Microfix, dgreen, Lars220

Reply | Quote

@willygirl, I’m really glad my post helped, and that you’re squared away for another month (and counting down with the rest of us!).

I know that Group A’s monthly rollups are cumulative, and that you just installed September’s — after unchecking/hiding October’s rollup. So you’re current through September for Windows 7’s updates.

If you were to now unhide October’s rollup and then run Windows Update, I bet you’d be presented with a checked and Important October’s (cumulative) rollup. And, if installed, your system would be current through October. Or, you could wait until DEFCON 3+ for November and then install its cumulative rollup instead. Just thought I’d mention this in case you hadn’t thought about it (or you decided to ‘fuggedaboutit’).

Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'

4 users thanked author for this post.

Blizzard, jburk07, PKCano, Myst

Reply | Quote

SueW wrote:

If you were to now unhide October’s rollup and then run Windows Update, I bet you’d be presented with a checked and Important October’s (cumulative) rollup. And, if installed, your system would be current through October. Or, you could wait until DEFCON 3+ for November and then install its cumulative rollup instead. Just thought I’d mention this in case you hadn’t thought about it (or you decided to ‘fuggedaboutit’).

@SueW, I hear ya. Think I’ll wait for the Nov. cumulative update. Considering the problems KB4519976 has caused, might be best to just hang on another month. My bookie is wondering where I’ve been, told him I’m too busy gambling in Windows updating, just breaking even. Ciao and really appreciate your advice and help.

MacOS iPadOS and sometimes SOS

3 users thanked author for this post.

Blizzard, jburk07, SueW

Reply | Quote

SueW wrote:

If you were to now unhide October’s rollup and then run Windows Update, I bet you’d be presented with a checked and Important October’s (cumulative) rollup. And, if installed, your system would be current through October.

Here we are again @SueW. Thought about this and went to the MS Support page to read about the issues for both September and October. The latter seems to be void of any problems, and in fact claims to fix a problem found in the September rollup. I’m currently doing a system image, then will unhide October’s KB4519976 rollup and check for updates, it should pop up and I’ll install it. Will post the results here after everything is complete. Another check for updates to see if it’s running as it should, and that’s it, wing and a prayer. Stand by.

MacOS iPadOS and sometimes SOS

3 users thanked author for this post.

Blizzard, jburk07, SueW

Reply | Quote

@SueW your suggestion worked. The Win7 is now updated through October with KB4519976, no errors popping up. It’s all good, thanks so much! Strange days. Have a feeling it’s going to be crazy all the way to EOL for the Win7.

MacOS iPadOS and sometimes SOS

2 users thanked author for this post.

jburk07, SueW

Reply | Quote

@willygirl, Yay — thanks for letting me know!  Aren’t you glad there are only 3 more months?  Then again, there may be new challenges after EOL . . .  Glad to know that your system is now up-to-date.

Win 7 SP1 Home Premium 64-bit; Office 2010; Group B (SaS); Former 'Tech Weenie'

2 users thanked author for this post.

jburk07, Myst

Reply | Quote

KB4522741 (2019-10 Cumulative Update for .NET Framework 3.5 and 4.8) isn’t listed anywhere in the Master Patch List; and there’s almost no mention of the update here in the Lounge.  Does anyone know if that update is covered by the current DEFCON 4 status?  Is it considered safe to install for Win 10 Home 1903?

Reply | Quote

[Wayne]

FWIW, I installed this patch on November 3 and nothing bad seems to have happened. I too found it on the Update page with no mention of it anywhere for a while. I don’t remember now what caused the impulse to install it, but it seems OK.

The only update now showing is the Optional update KB4522355, which I won’t touch.

(Win 10 Home 1903)

 

• This reply was modified 5 years, 5 months ago by Wayne.

1 user thanked author for this post.

Tom-R

Reply | Quote

Jumped on the DEFCON 4 rating and did some significant updating. All has gone well. No doubt there are still things I should have done in the past but it feels good to be making progress.

Grateful to Woody, PKCano, and everyone here!

 

Windows 7 64bit Group B

1 user thanked author for this post.

jburk07

Reply | Quote

Windows 7 SP1 64bit, with Broadcom network card. Group B.

Unlike SueW’s excellent update post, I took the window of opportunity and installed September’s updates and reported same in “ms-defcon-3-get-your-september-patches-installed-but-stick-to-the-mainstream-patches”.

Installed October’s updates; IE KB4519974, SO KB4520003 and MSRT.

From the catalog; Installed KB4519974 1st, KB4520003 2nd and MSRT last.

Installed one at a time. Rebooted in between each update letting it sit 1 or 2 minutes after update was installed (when hard drive light settled down).

No network issues. No install oddities. This was a very simple monthly patch!

Rebooted 3 times and let it sit for several minutes.

I would recommend people on the last reboot to go to the desktop and let it sit 45 to 60 minutes to Process Idle Tasks and let the trusted installer (as per PKCano) do its thing.

You can also force Processing of Idle Tasks as I do if you want by the administrative command prompt: rundll32 (space) advapi32.dll,ProcessIdleTasks

You can enter that then walk away for 15 to 20 minutes. If the drive light is still on, it is still running, walk away again. Do not allow the computer to go to sleep. Reset the Power Options to 1 hour sleep if needed. Laptops make sure you are on AC power not battery!

Thanks to all here.

3 users thanked author for this post.

jburk07, Charlie, SueW

Reply | Quote

I have been away since Friday morning and upon returning last night I see that the all clear to install the October updates was given as the Defcon went to 4. I have a question: My husband’s computer is still showing the September Cumulative Update (KB4516065) and I know we went to Defcon 1 on those updates and were told not to install it…….How do I skip that update and get the October Cumulative Update to show up in the Windows Updates? Do I hide the September one?   Thanks!

Windows 7 64 bit Home Premium Group A

Reply | Quote

[PKCano]

You can try hiding the Sept Rollup, but you should go ahead and install the rest of the Sept patches that are checked and clear the Important update queue. You may need to install the SSU KB4516655 before the Oct patch will install, and it won’t show up in WU unless (until) the Important update queue is empty.

Oh, yes. Hide the EOL nag patches KB4524752 or 4493132 if they show up.

• This reply was modified 5 years, 5 months ago by PKCano.

2 users thanked author for this post.

Blizzard, KarenS

Reply | Quote

Thanks PKCano…..that is the ONLY September update showing, the other 5 updates (MS Excel, Office and Outlook, NET and MSRT) are all dated for October. The KB4516655 that you mention is not showing. What is that update and what is it for?

Reply | Quote

The SSU is the update for the Windows updating mechanism and it has to be installed exclusively (by itself). It won’t show up until there are no other pending updates (checked or unchecked) in the Important queue. That’s why you should either install or hide (even temporarily) the other updates to empty the queue. Anything hidden you want to install can be unhidden after the SSU is installed.

2 users thanked author for this post.

Blizzard, KarenS

Reply | Quote

So should I hide all 5 of the other updates showing that are dated for October (all the ones I just mentioned in my above post) or is it just for any updated dated before October that has to be hidden? OR should I go ahead and install the October Office, Outlook and Excel and the NET and MSRT leaving the Cumulative one as the only one left to install to see if that update shows up……Everything is up to date except the Cumulative Update. Sorry I am a bit confused!

Thanks to Hurricane Dorian we were without power for a week and July’s Cumulative Update got missed so when I hide the September update the July one showed up so I hide that one too and the October one finally showed up…..BUT no KB4516655 yet?

Reply | Quote

KB4516655 WILL NOT show up as long as there is ANY other (checked or unchecked) update in the Important list.
So you can:
EITHER install the October Rollup (it is cumulative and therefore contains the July, August, and September Rollups so you don’t need these) and the rest of the Oct patches
OR or you can temporarily hide the patches to empty the Important queue.
Then the SSU KB4516655 should show up.

2 users thanked author for this post.

Blizzard, KarenS

Reply | Quote

Hi all!

For those of us in Windows 7 Group B who didn’t install the September Security only update (KB 4516033) waiting for a safe Defcon level, should we install it now or the October update (KB 4520003) will suffice?

Thank you very much

Reply | Quote

The September Security-only Update KB 4516033 contains telemetry (The Compatibility Appraiser – equivalent of KB2952664).
If you do not install it, you will not have any of the other security fixes it contains, as the SOs are not cumulative.
If you do install it, you can use @abbodi86 ‘s method to Neutralize Telemetry in AKB2000012..

The October Security-only Update KB 4520003 does not contain telemetry and is safe to install under DEFCON-4.

Reply | Quote

Thank you very much PKCano.

For everyone in Windows 7 Group B, here’s what I did:

• installed KB890830 and KB4524102 (.NET Framework Roll-up) from Windows Update, and hid everything else. The last one was unchecked and optional, but I erred on the side of caution and installed it nonetheless;
• rechecked Windows Update and SSU KB4516655 popped up. I installed it;
• rechecked Windows Update and it was completely clear (I had already installed SHA-2 patch KB4474419 on September);
• proceeded to install KB4520003 (October Security Update), KB 4519974 (the latest IE11 patch, ignoring all the previous ones) and KB4516033 (September Security Update, which I skipped last month), previously downloaded from Topic 2000003, in this order;
• rechecked Windows Update and it was still completely clear.

I rebooted after each installation and let it sit for 15-20 minutes, except for the very last, when I let the PC sit in idle for 60 minutes.

After that, I re-applied batch script previously downloaded from Topic 200012 and checked again the Task Scheduler, as explained in this post.

Everything is still perfectly in order telemetry-wise, and the PC seems to be working great so far.

Hope this helps!

Thanks anyone in this wonderful site who contributed and keep contributing to this “cause”: you’re a godsend.

1 user thanked author for this post.

Chessie

Reply | Quote

I tried updating from 1809 to 1903 via Windows Update,
and it failed. This morning, it uninstalled the
changes to my computer, and I’m back to 1809 (safe
and sound).

My PC is an ASUS G75V Notebook PC with 64-bit OS.

Sunday, I backed up my PC using the free version
of Macrium Reflect before updating. I ran
wushowhide (hide), which showed only 1 update:
definitions update for Windows Defender.

I decided to update to 1903. I unmetered wifi, and
the ‘Install 1903’ option showed up on Monday morning.

It took about half an hour to download.

Before I clicked “Install”, I turned on airplane
mode.

It went along before freezing at a ‘blue Windows icon’
screen with the wheel of dots stopped at a half circle.

I pressed the power button to put the PC to sleep.
(My power plan sets power button to “Sleep”).
Pressed power button again, and it presented a
boot menu with 2 options: “Windows 10” and
“Windows 10 Installation”. I chose Installation,
and it wound up freezing again.

I put it to sleep and left it over night.

This morning (Tuesday), I pressed the power button.
Several screens followed:
– “Attempting to recover installation”
– “Undoing changes made to your computer…”
– boot window with one option: “Windows 10”
– wheel of dots with “Please wait”

And Bingo! PC is alive and back on version 1809.

I am now torn between trying to install 1903 again
with wifi enabled to see what happens, or playing it
safe by leaving it on 1809.

as of this morning (Tue-5-Nov-2019):

Edition: Windows 10 Home
Version: 1809
Installed: 7/6/2019
OS Build: 17763.737

Reply | Quote

Try these steps:
First attempt to clear any problems.
+ In an elevated Command prompt run “chkdsk /f” (without quotes). It will ask you to reboot, say “Y”
+ In an elevated Command prompt run “DISM /online / cleanup-image /restorehealth”
+ In an elevated Command prompt run “sfc /scannow”
+ Run the Windows Update Troubleshooter.
Next, attempt an installation.
+ Download the Windows Media Creation Tool. Create a bootable DVD or USB from the ISO it creates.
+ Insert the install media in the running copy of Windwos (do not boot from it) and run Setup.exe from the install media. This should give you v1903 with a fairly current Build (probably Sept).

Reply | Quote

Hello Old Coot, PKCano has excellent ideas and I would like to add you might want to run Disk Cleanup which comes with Windows. In Microsoft’s “Disk Cleanup”, press the “Clean up System Files” button, and see about removing the “old MS updates, Delivery Optimization Files and Previous Windows version OS”, reboot afterwards. Then run the Windows Update Troubleshooter.

I posted this in the past as seen below and was thanked by Woody himself. The post has a video of a man that goes into detail of what he did for his problem.

https://www.askwoody.com/forums/topic/where-we-stand-with-the-may-2019-windows-patches/#post-1762251

I hope PKC’s suggestions or mine help.

Keep us posted.

Thank you.

Reply | Quote

I have been very happy with StopUpdates10 altho it did not work on one of my 3 home PCs which were all on v1803 at the time. After upgrading all three to v1903, StopUpdates10 works everywhere. Before StopUpdates10 I was using WUShowHide and a Metered Cxn to block updates; then recently I found updates were not blocked — so not much of a help!?! I have only used PAUSE and RESUME; I have not installed the background Service.

Yes, v1903 now includes PAUSE/RESUME which I haven’t tried. For one thing it is limited to 7 days (?) while StopUpdates10 can PAUSE for any time period. If I have a choice between Microsoft and a tool I know works, guess which one I will use?

Reply | Quote

I’m confused..Running several Win7 64 PC’s..most recent update was July 2019. I expected to see the Oct updates, but current offered Win7 updates are Sept * 2019-09 (KB4516065) * 2019-09 (KB4474419) and Oct MSRT.

As of 10/29 we were on Defcon 1..2 days later Defcon 4…Quite the transformation

My default strategy in the face of this uncertainty is to wait till there’s clear skies but I’m open to suggestions to the contrary.

Reply | Quote

sounds to me like you have an SSU (service stack update) missing and will not offer newer updates unless the new SSU is in place.
PKCano is the expert on patching, who I’m sure will clarify.

Windows - commercial by definition and now function...

1 user thanked author for this post.

MrToad28

Reply | Quote

DEFCON-4 is clear skies.
+ KB4474419 is a SHA-2 patch – you need to install it.
+ MSRT is up to you – if you have been installing it in the past – install it.
+ The Monthly Rollups are cumulative. The Oct Rollup KB4519976 contains the fixes that were in Sept Rollup KB4516065 and any of the updates released later in Sept (like KB4524157), so you can hide the Sept patches and install just KB4519976.
+ If the SSU KB4516655 shows up at any time, you should install it also, but it will not show up until there are no other pending updates (checked or unchecked) in the Important update queue.

4 users thanked author for this post.

Chessie, Daddy-0, MrToad28, Microfix

Reply | Quote

PKCano wrote:

so you can hide the Sept patches and install just KB4519976.

When I hid the Sept patches, the skipped August patches showed up. So if I unhide the Sept patches and install them, will the Oct patches then follow?

Reply | Quote

Yes, the Oct Rollup will follow the Sept Rollup.
But you could hide the Aug Rollup as well.
The Rollups are cumulative, so you won’t be missing anything by just installing the latest Rollup.

1 user thanked author for this post.

MrToad28

Reply | Quote

PKCano wrote:

But you could hide the Aug Rollup as well

OK, Hid the Aug Rollup..the last installed update was July 2019..the result: Only the October MSRT shows up in important update..so again..should I go ahead and install Sept 2019 and see if Oct 2019 shows up?

Reply | Quote

It will hurt nothing to go ahead and install the Sept Rollup KB4516065

1 user thanked author for this post.

MrToad28

Reply | Quote

Thanks for the updated MS DEFCON. Win 7 64bit update with KB4519976 and KB890830 requiring 2 restarts and single restart respectively, seem to have progressed without any issues so far.

The following had previously been successfully installed.

 

Acer Aspire E1-572 64 bit  Win 7 Home Premium SP 1

ASUS GL702VS 24GB RAM Intel Core i7 64 bit Win 10 Home 22H2 OS Build 19045.3693
Windows Feature Experience Pack 1000.19053.1000.0
Not Win 11 eligible.

2 users thanked author for this post.

MrToad28, jburk07

Reply | Quote

I gave up and hid KB4519976.  I installed with no problem on one Tpad Win 7 Pro.  The clone Tpad kept failing.  No sense at all.  SHAs and pre reqs are installed.  Even installed the KB on two Win 7 Home laptops, one Lenovo and the other an HP.
As long as I can get 3rd Party software and updates, I will use Win 7 Pro.

1 user thanked author for this post.

jburk07

Reply | Quote

Win8.1 x64 reporting in:

I missed the window for the September updates.

System imaged.

Important updates showed:

Sep 2019 Security update for Adobe Flash Player (KB4516115) – done – OK

Oct 2019 SMQR (KB4520005) – done – restart – OK

Oct 2019 MSRT – done – OK

And then this appeared:

Oct 2019 Servicing Stack Update (KB4521864) – done – OK

Recommended update:

Oct 2019 SQR for NET Framework (KB4524104) – done – restart – OK

2 * previews for Oct 2019 – not touched.

All seems OK at the moment!

Thanks for the advice.

1 user thanked author for this post.

jburk07

Reply | Quote

Woody, news via the catalog:
Update to verify that eligible Windows 7 SP1 and Server 2008 R2 SP1 devices can get Extended Security Updates

https://www.catalog.update.microsoft.com/Search.aspx?q=2019-11

https://support.microsoft.com/en-us/help/4528069/update-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu

These are catalog only, and won’t be distributed via WU

Windows - commercial by definition and now function...

2 users thanked author for this post.

dgreen, PKCano

Reply | Quote

I fell in between not installing the September updates & waiting on October. When Woody raised the DEFCON to 4 I ran check for updates; the September updates and KB4474419 were there. I installed KB4474419, ran check for updates again and the October Security Monthly Quality Rollup, KB4519976 & SSU KB4516655 were there. Downloaded and installed KB4519976, took an extra long amount of time to restart, 15-20 mins. Then downloaded & installed KB4516655, SSU, which downloaded & installed without a restart. Thanks Woody & team for the help in muddling through the morass. Win 7 Pro x64, SP1, i7-Core, HP ZBook

2 users thanked author for this post.

Chessie, jburk07

Reply | Quote

Which should be installed first…

SSU 4516655 or October rollup 4519976? Or does it matter?

 

Reply | Quote

The SSU should be installed first.

HOWEVER, it has to be installed exclusively (by itself) and it will not show up in the Windows Update Important queue until/unless there are no other pending (checked or unchecked updates in the Important update queue.

SO, you can EITHER go through the trouble of hiding everything else in the Important update queue until it shows up, OR you can download it from the Catalog and install it manually, OR you can let Windows Update handle it.

2 users thanked author for this post.

Blizzard, bassmanzam

Reply | Quote

Win 7 Home x64, Office 2010 x64. Group A

Thanks PKCano, that was me. I took your advice and installed the SSU-4516655 before the Oct Rollup-4519976
——-
Please bear with me:

I never installed ANY September patches as the DEFCON was changed to 1 before I had a chance to do anything.

Yesterday, when I first checked for updates I was only offered: 6 Office 2010 patches, the Sept. Rollup -4516065, NET 4.8 (unchecked)-4503548, SHA-2-4474419 and the NAG-4493132.

I proceeded to install SHA-2 4474419 first since I read somewhere it would bring up the Oct. Rollup 4519976. No problems with this update.

When I rebooted and checked for updates, I was offered the Oct. Rollup – 4519976 and the Sept. Rollup-4516065 disappeared.
I decided to hold back on the Oct Rollup and installed the Office 2010 updates since there were no issues from what I could remember.

Today, PKCano recommended installing the SSU before the Oct Rollup. I took PKs advice and installed the SSU-4516655 from the catalog.
No issues with the install and rebooted just to be safe.

Finally, I installed the Oct. Rollup-4519976. No really issues…no double reboot..time was good on install. The only problem was the download which took about 25min.

I did one last check for updates and was left with NET 4.8 (unchecked)-4503548 and NAG-4493132

The only issue I have with the Oct. Patches is I was never offered the Sept-NET-4514602 or Oct-NET-4524102. Only the NET 4.8 which was unchecked and never installed.

Thank you PKCano for making things clearer and easier to do. A big thanks to Woody and all MVPs for guiding us through these rough waters to the EOL of Win7

 

1 user thanked author for this post.

Blizzard

Reply | Quote

[Blizzard]

My situation was very similar to bassmanzam’s.  I was having some issues with my first 32-bit Win7 machine until I read various installation experiences from this fine forum.  PKCano’s advice to grapple with the SSU first (KB4516655 proved invaluable.  I had to do the hide updates trick and recheck for updates and rehide several times before the SSU would show by itself.  Once I got the SSU installed, I began unhiding and installing the updates.  In all, I updated (Group-A style) 3 machines running Win7 Pro 32-bit.  Effectively, this is the list of updates I encountered and the order in which I installed (if Important/Checked in WU).  I elected to do only one update at a time and then restart several times and wait for Trusted Installer to conclude each time.  I understand this may not be required, but it is what I did.  All went well and machines seem stable thus far.  Phew!  Wow, I sure thank all of you contributors, MVPs, Loungers, Experts, and sundry Smart Peeps for the great help and time taken to elaborate on your own experiences and wisdom!  I managed to avoid any landmines:-)

1.  KB4516655 (SSU)  Definitely critical to get this done in exclusion of all else!
2. KB4474419 ( Sept SU/SHA-2)
3. KB4519976 (Oct8 Monthly RU)
4. MSRT (Yes, I’ve chosen to do them…)
5. KB4524102 (Oct .net SQR)
6. KB4503548 was listed important but unchecked so I did NOT install it…

• This reply was modified 5 years, 5 months ago by Blizzard.
• This reply was modified 5 years, 5 months ago by Blizzard.

Reply | Quote

Microfix wrote:

Woody, news via the catalog:
Update to verify that eligible Windows 7 SP1 and Server 2008 R2 SP1 devices can get Extended Security Updates

https://www.catalog.update.microsoft.com/Search.aspx?q=2019-11

https://support.microsoft.com/en-us/help/4528069/update-for-eligible-windows-7-and-server-2008-r2-devices-can-get-esu

These are catalog only, and won’t be distributed via WU

Microfix
I’m just a little confused about this, is it a good thing for us diehard Window 7 users in January to extended security updates?
It looks like what Group B has been doing?
If the door just opened a little for Window 7 users for January,
will someone guide us as to what needs to be done….
or….
just take the risk in January and do nothing.

1 user thanked author for this post.

LHiggins

Reply | Quote

@dgreen,
I think Susan Bradley is going to do a blog post on this soon.
Therein will be explanations, questions, answers and advice.
There is no need to install these yet for group B patchers, my advice is to wait until the blog post is up.

Windows - commercial by definition and now function...

2 users thanked author for this post.

LHiggins, dgreen

Reply | Quote

the KB4528069 ESU update for Win7 will fail to install if no “ESU key” was installed AND using a consumer edition of Win7 (aka, starter, home basic, home premium & ultimate).

KB4528069 only works (installs 100% successfully) if a valid ESU key is installed AND running either an Enterprise or Professional edition of Windows 7.

Reply | Quote

Surprisingly (although may not be official), if you check the new installed licenses for ESU keys, you will find that Ultimate edition is actually supported

Reply | Quote

From what I’ve read:
I believe you have to be a business (even a one-man business). Don’t know what qualifies a business. Don’t know if it’s limited to the Pro version.
You have to go through a Microsoft Partner to get the license/key.
There is a charge that escalates each year for up to 3 years (2023). I’ve seen $50 first year (don’t quote me).

2 users thanked author for this post.

LHiggins, dgreen

Reply | Quote

Ah, now I remember…..
Someone had posted about this extended support a few days ago.
Thank you Microfix and PKCano for your replies.
I’m Group A and……..
I’m just a regular home user. (sigh).

Reply | Quote

Hello !

I have a problem on my laptop. The space where there should be the updates is blank. I have 3 importants and 2 optionals but I can’t see what they are.

 

Reply | Quote

Forget my last message, I rebooted my PC and now I can see the updates.

I have KB4519976 (17/10/2019) and KB4524102 (08/10/2019).

Should I install 4524102 first since it’s older ?

Reply | Quote

If youi are using Windows Update, just let it install the patches. It will do so in the order required without your intervention.

1 user thanked author for this post.

Marvel Wars

Reply | Quote

But isn’t it more safe to install the updates one by one and wait a while before installing the next ?

I see a lot of person here doing that so I do the same since a while now.

Reply | Quote

You asked for advice. I gave you my recommendations.
Windows Update supersedence prevents an install from overwriting a newer version of a file with an older one and will install in the correct order.
If you choose the order, the same thing goes – newer files won’t be replaced by older ones.
The same thing goes if you install the patches one at a time or several at once – newer files won’t be replaced/overwritten by older ones.

The procedure you follow is your choice.

1 user thanked author for this post.

Marvel Wars

Reply | Quote

Oh ok I thought it was some kind of security measure to install an update then wait some time to be sure there was no problem and that it was installed correctly before installing another one. That’s why in thought it wasn’t a good thing to install several updates at once.

Reply | Quote

@Marvel Wars wrote:

The space where there should be the updates is blank. I have 3 importants and 2 optionals but I can’t see what they are.

Lookss familiar. Seems it is a common issue. If Windows System Assessment Tool (WinSAT) is not working properly, it will not show Windows Experience Index (WEI) (you can find it under Control Panel>Performance Information and Tools in Windows 7 and Vista, it has no GUI in Windows 8.1 and 10).

And, since Windows Experience Index is neccesary for Windows Update to determine which updates can be installed on the system, it will not let you check what updates are offered (and even checked) – you will see just blank space, exactly as you described.

Usually, you just need to reboot (just like you did) and it should be fine again.

Note: Sorry for qouting the majority of post, but I found it important to point the issue I am referring to.

Reply | Quote

Win 7-64 Home. Group A
I installed four checked updates today:

KB4524102
KB890830
KB4474419
KB4516065

and ignored the unchecked .Net KB4503548.

After I rebooted KB4524157 showed up unchecked. There seems to be mixed opinions in the forums about this update and although MS says it is important they sent it unchecked. Should this one be installed?
-firemind

Reply | Quote

Check if you have the Servicing Stack KB4516655 installed.
It would be better to hide KB4524157 which was a September out-of-band update.
Then check for updates again and see if the SSU KB4516655 comes down and install it.
Then install the October Rollup KB4519976 as it contains the fix that was in the oob KB4524157.

1 user thanked author for this post.

Myst

Reply | Quote

Thanks. When I hid KB4524157 and checked for updates KB4519976 was the only one listed. It took a while to patch and reboot the system and then KB4516655 was installed without a reboot.

One interesting thing was when KB4519976 was offered – all the optional updates disappeared until that update was taken care of. Pretty clear on what is needed. 🙂

-firemind

Reply | Quote

Win7 October updates: So far I’ve updated 5 W7Pro desktops & 1 Win7 home laptop using Win7 roll-ups. Since I had last updated in July, I installed the Sept updates first, then had to search for updates, hide the November update, search again and install the October update. I currently have the November roll-up hidden [so I could get back to the October roll-up] and the 2019-11 Servicing Stack Update for Windows 7 for x64-based Systems (KB4523206) on offer..which I will not install until we get to Devcon 4.

Reply | Quote

Is there a reason why KB4524102 2019-10 Security and Quality Rollup for .NET Framework does not show up in the master patch list? Am I missing something?

Dell, W10 Professional, 64-bit, Intel Core i7 Quad, Group A

HP, W7 Home Premium, 64-bit, AMD Phenom II, Group A

Reply | Quote

Two reasons,… first I don’t install 4.8 on my Windows 7’s and then secondly there is no new security content in them so I don’t install them unless there is security patches in them.

https://devblogs.microsoft.com/dotnet/net-framework-october-2019-security-and-quality-rollup/

But I’ll go back and document that I skip these no new security updates updates.

Susan Bradley Patch Lady/Prudent patcher

1 user thanked author for this post.

Sparky

Reply | Quote

Susan Bradley,

I appreciate you taking the time to explain why KB4524102 does not appear in the Master Patch List. A lot of this computer stuff is Greek to me,  so bare with my ignorance.

As for future windows 7 patches, at the moment my back is against the wall. Because I’m looking to replace my HP laptop before MS stops supporting w7 in Jan. 2020.  That means learning the windows 10 operating system and learning how to patch it. This patching stuff is complex and time consuming, at least for me it is.

Because I’ve been under the weather, I just got up to speed with the Oct. 2019 patches. Hopefully in the next few months I can find a good laptop computer candidate to lessen the learning curve.

Thanks for the help,

Sparky

Dell, W10 Professional, 64-bit, Intel Core i7 Quad, Group A

HP, W7 Home Premium, 64-bit, AMD Phenom II, Group A

Reply | Quote

Error: On previous posts, should read  “I just got up to speed with the 2019 patches.“

Dell, W10 Professional, 64-bit, Intel Core i7 Quad, Group A

HP, W7 Home Premium, 64-bit, AMD Phenom II, Group A

Reply | Quote