This week is clearly “patch the zero day” week. Yesterday we had Apple, also Chrome fix several zero days. Today we have the Microsoft version. Now
[See the full post at: September 2021 – it’s patch day!]
Susan Bradley Patch Lady/Prudent patcher
![]() |
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
SIGN IN | Not a member? | REGISTER | PLUS MEMBERSHIP |
Home » Forums » Newsletter and Homepage topics » September 2021 – it’s patch day!
This week is clearly “patch the zero day” week. Yesterday we had Apple, also Chrome fix several zero days. Today we have the Microsoft version. Now
[See the full post at: September 2021 – it’s patch day!]
Susan Bradley Patch Lady/Prudent patcher
AKB 2000003 has been updated for Group B Win7 (ESU) and Win8.1 on Sept 14, 2021.
There is a Security-only Update for those with Win7 ESU subscriptions.
There was a September IE11 CU KB5005563 for Win7. Download 32-bit or 64-bit.
September Rollup KB5005633 Download 32-bit or 64-bit for those with Win7 ESU subscriptions.
You must have at least the August 2020 Servicing Stack KB4570673 previously installed to receive these updates).
There is a July 2021 Servicing Stack KB5004378 – Download 32-bit or 64-bit for those with Win7 ESU subscriptions.
There is a revised Licensing Preparation Package KB4575903 dated 7/29/2020 for Win7 ESU subscriptions, if you need it.
There were no Security .NET updates for September. There were no Security-only .NET updates. See #2389777.
Alternatively, you can pay £24 per annum to 0patch and let them protect your Win7 machine seamlessly in the background with no monthly update paranoia to be concerned with!
Could I please suggest a Newsletter article some time from one of the experts on their assessment of how well their 0patch experience has gone thus far? I imagine one of the more knowledgeable contributors (or commenters) has given it an extensive try and it would be interesting to see their conclusions. The article could also address the effectiveness and ease of application of the ESU subscription by way of a balanced comparison.
All September CU/SO Updates:
Another attempt at resolving printnightmare scenario..3rd time lucky?
CVE-2021-26435 and CVE-2021-36965
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
Detailed overview on ghacks.net
@Alex5723 wrote:
Windows 7 – 22 vulnerabilities
Windows 8.1 – 24 vulnerabilities
Windows 10 – 32 vulnerabilities
@b wrote:
Do you imagine that there is ANY software with versions being actively developed having less vulnerabilities than versions which were long-ago mothballed?
Thats another reason why I would remain on previous, more debugged (and safer?) SW. The first reason is “superfluous” attention, that updates require. Im an old fashioned guy.
The golden rule of technician is: If it works, dont mess with settings. 🙂
Dell Latitude 3420, Intel Core i7 @ 2.8 GHz, 16GB RAM, W10 22H2 Enterprise
HAL3000, AMD Athlon 200GE @ 3,4 GHz, 8GB RAM, Fedora 29
PRUSA i3 MK3S+
Signature update for Microsoft Defender, the Malicious Software Removal Tool and
KB5005565 Cumulative Update for Windows 10 Version 21H1 for x64-based Systems.
The Cumulative Update had two stages of “Installing” going from 0 – 100%. The second stage was about three times as long as the first.
Both sides of my dual boot daily driver updated with no hiccups. My NAS will await the push from Microsoft, as usual.
Microsoft fixes remaining Windows PrintNightmare vulnerabilities
then a recent comment from that BP article came out linking to this from Reddit:
https://www.reddit.com/r/sysadmin/comments/pochxo/microsoft_fixes_remaining_windows_printnightmare/
some users there are unable to print with these Sept. 2021 patches installed and had to remove them to restore print operations
Hi
FYI KB5005565 and problems with network printers are reported in the internet:
Bleeping Computer’s Forum
————————
https://www.bleepingcomputer.com/forums/t/758380/installed-kb5005565-today-now-cant-print-to-networked-printers/
Windows 10 Help Forum
———————-
https://www.tenforums.com/windows-updates-activation/185217-possible-printer-issue-kb5005565.html
Regards.
Hi
Further info on network printers problems with September 2021 Patch Tuesday security updates:
Bleeping Computers
——————
https://www.bleepingcomputer.com/news/security/new-windows-security-updates-break-network-printing/
Regards
FYI,
Bleeping Computer – How to fix the Windows 0x0000011b network printing error
—————————————————————————-
https://www.bleepingcomputer.com/news/microsoft/how-to-fix-the-windows-0x0000011b-network-printing-error/
Regards.
I let the PC that drives my television set update every month on Patch Tuesday. It only need to load Edge and run streaming apps. The update went smoothly with no issues at all. I run Windows 10 Home (Pro on the other two workstations in the house and those updates are always deferred).
Susan/AW –
Question on cell phone notification. I already have a Plus Membership and when I tried to sign up for cell phone notification when MS-DEFCON changed it asked me to sign up for a Plus Membership (which I already have).
What gives? Is there a Double Secret Plus Membership that I have to sign up for cell phone notification? It sounds like a great idea – but in practice it seems like there are bugs that need to be worked out.
I tried to log into Plus with my UN/PW and it said I do not exist. How can my UN/PW not exist when I am logged into AW with them right now??? Am I missing something painfully obvious to everyone else?
Custom Build - Intel i5 9400 5 Core CPU & ASUS TUF Z390 Plus Motherboard
Edition Windows 10 Home
Version 22H2
Dell Laptop - Inspiron 15 11th Generation Intel(R) Core(TM) i5-1135G7 Processor
Edition Windows 11 Home
Version 23H2
Email me at sb@askwoody.com and I can help you with any issues. The sites are two independent log ins (as I didn’t want to upset anything on this site) You aren’t signing up for plus membership, you are just signing up for cell phone texting.
Susan Bradley Patch Lady/Prudent patcher
Speaking of cellphone texting, you mentioned in your full post of September 2021 – it’s patch day! the following:
” We request a small fee requested (along the lines of the decide what you want to pay as the main site has) in order to cover the costs of the monthly texting service and server hosting. ”
Susan, I’m wondering if the word requested might be superfluous in the context of the sentence?
Also, a second question. Is the MSHTML vulnerability the one that involves opening a malicious Word file in Internet Explorer? If so, should we be concerned if we no longer ever use IE?
You can always tell when I’m missing the excellent skills of Will/Roberta. Actually the MSHTML vulnerability is for opening word files in File explorer/preview pane, not Internet Explorer.
Susan Bradley Patch Lady/Prudent patcher
KB5005568
https://www.reddit.com/r/sysadmin/comments/psm76f/kb5005568_broke_vm_network_access/
In our environment, it looks like this: We have two host systems with Windows Server 2019. Various VMs on top. Two of them are terminal servers. These simply lose their network connection in between without any noticeable signs. The only solution to reconnect to the network is to hard restart the VMs. However, this only affects the terminal server VMs; it does not occur with the other VMs. Does anyone know this behavior?
Can you provide any additional info as I’m not seeing this reported.
https://groups.google.com/u/1/g/patchmanagement/c/iea5lPCvi8Q
Robert S has reported that ”
I have seen reports KB5005566 (Win10 1909) breaks Skype and Excel macros.
wusa /uninstall /KB:5005566 /quiet /warnrestart:120 /log:C:\Temp\KB5005566removal.log
Susan Bradley Patch Lady/Prudent patcher
Do you imagine that there is ANY software with versions being actively developed having less vulnerabilities than versions which were long-ago mothballed? Bugs need programmers.
Yes. There is no actively development with Windows 10/11.
The kernel is the same NT kernel and what has/is been “developed” is the GUI and shuffling around control panel functions…
So yes, we should have expected less security bugs, not more.
The kernel is the same NT kernel
Same as what? How do you know?
The kernel is the same NT kernel
Nope. The NT kernel has a filename, ntoskrnl.exe, and it’s located in C:\Windows\System32. It gets updated somewhat regularly. I mean, “Windows Update” does actually update Windows, as the name implies.
My kernel was updated yesterday, 9/14/2021, to version 10.0.19041.1327. There were quite a few files updated in the System32 folder yesterday, that is to say, for those of us who updated yesterday. Open File Explorer, navigate to C:\Windows\System32 and sort by Date modified.
The kernel is the same NT kernel
Same as what? How do you know?
The kernel is the same NT kernel
Same as what? How do you know?
An environment variable which uses the name Windows_NT is your definitive proof that not a single kernel bit has changed in 28 years? 🤦♂️
From Wikipedia:
Initial release July 27, 1993; 28 years ago (as Windows NT 3.1)
Latest release 10.0.19043.1237 (September 14, 2021; 1 day ago
So much for the effort to remove Windows bloatware. Looks like most of us are going to get stuck with the “whole enchilada” eventually, as MS removes more and more of the built-in removal tools.
Alternative browsers till the end !!!
UPDATE on EDGE 9/14/2021: After the the Sept update KB5005565, the removal of Edge seems to be no longer viable. It can still be removed, but it is restored with the updates through Windows Update. If the Edge folder at Program Files (x86)\Microsoft\Edge\ is left intact, the next CU update will fail with error code 0x800f0922.
It installed Edge v93… through Windows UPdate, so it is ignoring GP and Registry settings blocking CrEdge. Looks like the solution to maintain exclusive use of a non-MS browser as default is now a third-party app like Edge Deflector – a route I was hoping not to take!
And we are back to the same situation we were in when MS got slapped with the fine for integrating IE into the OS.
Firefox has been and remains my default browser. Edge has never been my default browser, and Windows updates have yet to remove Firefox from the selection of default browser. No hiccups.
I haven’t tried to uninstall it, because it doesn’t get in my way. I fully expect the “Special Folders” to come back with the Windows 10 21H2 update, but I can deal with them with a few mouse clicks.
Windows updates have yet to remove Firefox from the selection of default browser.
It doesn’t remove FF as the default browser. However, it does step in and use Edge for certain functions without asking, even FF is the default.
Guess you haven’t run across that (yet).
Guess you haven’t run across that (yet).
Indeed. I have yet to see evidence of Edge doing anything at all.
My guess is because Edge was removed and this update reinstalls it that it steps on FF again. Because this is fixing those MSHTML zero days https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 I’ll bet that’s why it’s laying down Edge again.
This why I say don’t even try to remove it because sooner or later because Microsoft builds their patches to ASSUME that everyone has it, you’ll get it again. Remember Microsoft does not test for, nor code for, what I’m going to call the “corner cases” (no disrepect intended, they code for the Fortune 499 – everyone but Apple) as such they do not take into account anyone who would remove parts of the operating system.
Susan Bradley Patch Lady/Prudent patcher
It does NOT remove FF as the default browser in Settings.
It just installs Edge in spite of the Group Policy and Registry settings blocking the install of Cromium Edge.
Which means, that Edge will override the default browser on certain conditions.
And further, it seems to mean you can’t get rid of CrEdge if you want to without breaking Windows Update. Installing the next CU will result in failure with error code 0x800f0922.
Chredge removal along with old edge did work but, as anticipated prior to September CU, I nuked W10
Guess that’s part of your walkthrough redundant now :¬
Concentrating efforts on various Linux distro’s seems far more rewarding these days (experimentation) as well as keeping the good-time MSFT Oses updated.
microfix
Indeed. I have yet to see evidence of Edge doing anything at all.
Have you tried loading .mhtml file using your default FF browser ?
Have you tried loading .mhtml file using your default FF browser ?
I have never used the “View in web browser” option with email.
And might I add that “View in web browser” is in no circumstance to be considered as part of “safe practices” for computer security. In my view that is a form of phishing, and to be avoided. YMMV
KB5005565 on Windows 10 networks where all computers are Windows 10, is breaking networked printing altogether. I got a call from my former place of employment asking for help, have been trying to right it for them remotely for two days now. I was getting there and then the update reinstalled itself overnight, so now starting over with the added step of trying to hide the update.
I’m seeing basically what is described in this thread:
Glen Ventura
MS-MVP 2002-2009
“What we have found in our environment is if the print server(s) had this months rollup but the clients did not printing breaks. Once the client got the rollup, printing worked.” https://old.reddit.com/r/sysadmin/comments/pochxo/microsoft_fixes_remaining_windows_printnightmare/
“Experienced this on one client pc. The solution was to create a credential for the host pc on the client machine in Credential Manager. The username must be set to guest and no password. Printing is now fixed with the update still installed on both machines.”
Susan Bradley Patch Lady/Prudent patcher
I’ve encountered network connectivity issues with my SCCM/MECM site server this morning (in addition with another another low priority server we use for piloting patches, both running Server 2019 Standard.)
No SNMP/Ping/UNC share or application/database access was possible non-locally.
Have removed patch KB5005568, and now able to remotely connect and do all of the above.
I fully expect this is a Microsoft bug!?
Since the update to Adobe Acrobat/Reader was mentioned: I ran into a problem similar to what is reported at: https://community.adobe.com/t5/acrobat-discussions/adobe-acrobat-and-reader-september-update-2021-007-20091-botched/m-p/12387606 . To quote:
“The issue is that after applying the 2021.007.20091 updates for Adobe Acrobat DC or Adobe Reader DC each time you attempt to launch the application from the shortcuts (Start Menu, or Desktop) the application performs an install/configuration before it launches. If you open a .PDF file directly it will open in Acrobat or Reader without performing the install.”
Adobe replies: “This issue has already been escalated and reported to engineering team.”
corner cases
OMG now I know. I am a Corner Case!! ⬜🔺◻🔻◽ Now just which corner??
🍻
Just because you don't know where you are going doesn't mean any road will get you there.The script files for 20H2 and 21H1 in AKB2000016 to set TRV, also set the Product Version for Windows 10. The directions are the same in AKB2000016 except for the content of the script files.
If you download the script file, and want to change to a different version or Win11:
+ Edit the script file in Notepad (or other text editor).
+ Change the TRV version to your choice (21H1, 21H2, etc), and/or change Windows 10 to Windows 11 (highlight and overwrite, do not change any of the other characters).
+ Save it as .reg (NOT .reg.txt or .txt)
PringNightmare :
Administrator credentials required every time apps attempt to print
After installing KB5005033 or a later update, certain printers in some environments using Point and Print might receive a prompt saying, “Do you trust this printer” and requiring administrator credentials to install every time an app attempts to print to a print server or a print client connects to a print server. This is caused by a print driver on the print client and the print server using the same filename, but the server has a newer version of the file. When the print client connects to the print server, it finds a newer driver file and is prompted to update the drivers on the print client, but the file in the package it is offered for installation does not include the later file version.
Workaround: Verify that you are using the latest drivers for all your printing devices and where possible, use the same version of the print driver on the print client and print server….
KB5005652—Manage new Point and Print default driver installation behavior (CVE-2021-34481)
Windows updates released August 10, 2021 and later will, by default, require administrative privilege to install drivers. We made this change in default behavior to address the risk in all Windows devices, including devices that do not use Point and Print or print functionality. For more information, see Point and Print Default Behavior Change and CVE-2021-34481.
By default, non-administrator users will no longer be able to do the following using Point and Print without an elevation of privilege to administrator:
Install new printers using drivers on a remote computer or server
Update existing printer drivers using drivers from remote computer or server…
Thanks to all for the information and feedback.
Perhaps another issue when updating Windows Pro 21H1 with the September Update, (September 14, 2021—KB5005565 (OS Builds 19041.1237, 19042.1237, and 19043.1237).
In my case, it broke the Windows Hello fingerprint login functionality on 3 machines in our office. The machines are all LG gram 17 computers: two model 17Z990-RAAS7U1, and one model 17Z90N-R.AACU1, with i7 8565U and i7-1065G7 CPUs, respectively. The machines all have fingerprint readers built into the power button, which have worked without issue since the machines were first set up.
Upon installing above update, the Windows Hello fingerprint login failed on all 3 of these machines. The work around, for these 3 machines was to remove the fingerprint data stored on the machine, and then recreate it. I tried several other steps first, including rebooting the machine, but none worked. With only two users in our office, re-entering the fingerprint login data was not a significant issue, but it could be, depending on the availability and the number of individuals involved.
BobC
“Stay tuned, deeper analysis by this weekend.” sorry, I can’t see anything to indicate this on the site.
Windows 7 esubypass working as expected, no problems to report as a homeuser with much less beaconware by default.
I have started to deploy KB5005566 to our Win10 v1909 work environment and so far we have two laptops spending over an hour trying to installing KB5005566. I ended up performing a normal Start Button>Restart which brought up the Updating Windows screen where they sat indefinitely. Forcing the computer down and bringing it back up brings the desktop with a spinning cursor that can’t click on anything. This is separate from a growing number of machines that haven’t received any patches yet that, but have decided to start freeze up entirely on users only allowing the cursor to be moved but without the ability to click anything. To patch or not patch, does it really matter with Windows 10…
Running SEP v14.3.4516.2000, with newer additional monitoring through DefenseStorm 2.1.1. Since DefenseStorm is newer for us, I’ve been keeping that in the back of my mind. Unfortunately Windows event logs have have not shed any light. So far all noted machines are running v1909 with Office 2013 except for one with 2016. Eventually I will find some kind of overlap, until then I’ll be crossing my fingers that one the these forced shutdowns doesn’t corrupt Windows.
Bleeping Computer – Windows 10 emergency update resolves KB5005565 app freezes, crashes
————————————————————————————-
https://www.bleepingcomputer.com/news/microsoft/windows-10-emergency-update-resolves-kb5005565-app-freezes-crashes/
Apps might fail to open, close unexpectedly or become unresponsive
——————————————————————
https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-21h1#1696msgdesc
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Welcome to our unique respite from the madness.
It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.
Want to Advertise in the free newsletter? How about a gift subscription in honor of a birthday? Send an email to sb@askwoody.com to ask how.
Mastodon profile for DefConPatch
Mastodon profile for AskWoody
Home • About • FAQ • Posts & Privacy • Forums • My Account
Register • Free Newsletter • Plus Membership • Gift Certificates • MS-DEFCON Alerts
Copyright ©2004-2025 by AskWoody Tech LLC. All Rights Reserved.