Unable to update Win10 v1909 since Build 18363.657

Topic

New Reply

Creating this topic to consolidate issues I am having with updates that are a little scattered around this site. Thanks for taking an interest and asking for this topic.

I am here with Version:

One thing I may not have mentioned is I have never been offered an “optional” update in Windows Update nor has a feature update appeared separately from the other updates in Windows Update. Hope that makes sense. All are in one group.

What really has prompted this latest issue is that I have not been offered KB4592449 CU for 1909 nor KB4559309 Edge Update to CHREDGE.

I have GPEDIT set to defer Feature Updates 45 days and Quality Updates 7 Days. I use wushowhide. I once used for a day or so WUMGR but did not like it. Currently:

And…

I have been offered other updates and successfully installed them. For examples:

Feature Update 1909 11/27/2019 Success
All of the Office 2010 Quality Updates 12/17/20 Success
Cumulative .NET 3.5 and 4.8 10/20/20 Success

Buncha drivers all success from 11/16/20 back ( based on rec’s here, will no longer be installing drivers from Win Update. Nor .NET previews)

AS to failures, I had this mess with the 2006 Printer update. I had figured what the h***, so tried to install. Three times. Failed every one so blocked in show hide.
M’soft printer 6/22/2006 6.1.7233.1 3 fails 11/27/20

I stopped getting Defender updates in March I think. Likely because you could no longer run even a portion of Defender with third party AV (ESET NOD32).
Definition updates – lotsa failures last 4/8/20
Last success 3/28/20 then a ton more failures 3/25/20

Malicious software last success 11/17/20 All successes before hand.

What do you think? I could install 20H2 and see if all corrects itself. I have been holding off for the “all clear” as well as in avoidance of all the things I have seen feature updates reset that I will check (like System Restore, GP policies, default programs, etc. I have a list of 60 things to check after each Feature Update.) . Or…

Thanks.
~Bob

Reply | Quote

Replies

Forgot to say, the delay in the update from 1903 to 1909 was my choice. The skipping of 2004 was my choice to delay and is no longer offered me as 20H2 is. So I have been getting offers for Feature Updates I have chosen to defer. But have not seen the above mention two updates.

Reply | Quote

Not 20H2 yet – it’s not ready.

Reply | Quote

Best way I can think to do that.

Reply | Quote

OK, start with the three settings in Group Policy listed here.

This will protect you from v2004 and v20H2 while we do the rest.
STOP fooling with all the other stuff until we get updates sorted out.
Come back when you finish that and we’ll try to get updates going.

Reply | Quote

Fooling with what other stuff? I don’t think I am fooling with anything. Explain please.

 

Will review the link tomorrow. Thanks.

Reply | Quote

There is one more Group Policy setting to make:

+ Navigate to Local Computer Policy>Computer Configuration>Administrative Templates>Windows Components>Windows Update (dbl click) DO not include drivers with Windows Update. Click the radio button “Enabled”

Everything else under Windows Update and Windows Update for Business should be “Not configured” except those four settings.

Reply | Quote

These are the next things we are going to do, but check in with me before you start and between each step.

+ If you have set the 4 Group Policy settings, then set the pulldown switches in Windows Update\Advanced Settings to Quality and Feature deferrals = 0 (zero)

+ Turn of Fast Startup
Control Panel\Power Options “Choose what the power button does.
You may have to look under “Settings that are currently unavailable” – be sure to save the settings.

+ Run “Disk Cleanup”
Start Menu\Windows Administrative Tools. Right click on “Disk Cleanup” and “Run as administrator“. Check everything BUT Downloads (but check Downloaded Program Files), Shader Cache, and Language resources. Delete the files.

+ Run file checks to verify the System Files
Let me know the content of any error messages.
In an elevated command prompt (type cmd.exe in the taskbar search box, right click on it and “Run as Administrator) copy/paste esch of these commands in and hit enter:
DISM /online /cleanup-image /restorehealth
sfc /scannow
They might take a while to run.

+ Reset Windows Update
Reboot the computer.
Let me know the content of any error messages.
In an elevated command prompt, copy/paste each of these commands one at a time and hit Enter:
net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver
Ren C:\Windows\SoftwareDistribution SoftwareDistribution.2101
net start wuauserv
net start cryptSvc
net start bits
net start msiserver
Reboot the computer.

Depending on the outcome of these checks, we decide where to go from here.

2 users thanked author for this post.

Coldheart9020, doriel

Reply | Quote

Sorry. Have not read. Several personal issues non computer related. Maybe a day or two. Then I can sort out and reply.

Just one BTW, the title of this thread was requested, not my choice. There have been updates as you can see above. Just not those two.

Back when I can….

~Bob

Reply | Quote

The title of the thread is good. You had updates for other things, but you Win10 v1909 OS has not been updated since Build 18363.657 (the current is Build 18363.1256)

Don’t forget, January Patch Tuesday is the 12th – one week from today.

Reply | Quote

Hi PK (do you go by PK?). Sorry, personal life a bit crazy still so have not read nor tried or followed. I shall but not sure when.

 

However, just to note, I had 20H2 hidden. Today it popped up again as new and I hid again. Nothing else offered, but I do have CU’s delayed 7 days so likely next week if ever.

Back when I can.

Reply | Quote

When you do make it back, give me a heads up.

Then start with these two posts: #2324609 and #2324620.
Let me know when you’ve done that and we’ll talk about the instructions in #2324661.

Reply | Quote

OK, I think I have cleared enough time and space to focus back on Updates and this topic. First of all – thanks for helping. Would be great to get things straight though no idea how they got out of whack. And note I have been using Windows since 1.0 and then 3.1 so have a lot of experience and can follow along easily.
_______________________________________________________________

OK, two days ago I got offered 20H2 again. I hid it with wushowhide. Interesting that there were also two drivers (Nvidia and Intel) to hide though they did not appear in Windows Update as I had driver updates turned off in GPEdit. I was surprised to see them in wushowhide.

Going to do a new full backup then read all your replies here that I have not yet read and take one step at a time.

1. OK, start with the three settings in Group Policy listed here.

   + Navigate to Local Computer Policy>Computer Configuration>Administrative Templates>Windows Components>Windows Update (dbl click) Configure Automatic Updates. Click the radio button “Enabled” and in the top pulldown set the value “2.”

   Skipping ahead: + Navigate to Local Computer Policy>Computer Configuration> Administrative Templates>Windows Components>Windows Update (dbl click) DO not include drivers with Windows Update. Click the radio button “Enabled”

   I have ALWAYS had those set that way. Done….

2. + Navigate to Local Computer Policy>Computer Configuration>Administrative Templates> Windows Components>Windows Update>Windows Update for Business (dbl click)>Select the Target Feature Update Version Click the radio button “Enabled” and 1909 in the box.

   Then: + Navigate to Local Computer Policy>Computer Configuration>Administrative Templates>Windows Components>Windows Update>Windows Update for Business (dbl click)> Select when Quality Updates are Received Click the radio button “Enabled” and type 0 (zero) in the top box. Leave the “Pause” box blank.OK, being on 1909 I do not have Target Release. I do have:

I assume I should remove my GPEdit postponements of CU and Feature Updates of 7 and 45 days.

I am on 1909 and unsure the best way to add Target Release Date. Seems there is more than one way to do that. So let’s start clarifications there. How do you suggest? Do I need to be offline when I do that? What if anything should I do to wushowhide before of after I do that?

Thanks!

 

 

Reply | Quote

Make these changes in Group Policy:
+ Under Windows Update for Business, set the TargetReleaseVersion as shown in the top screenshot in #2286499 to the version you want.
If you do not have TargetReleaseVersion setting available there, use Susan’s reg file or the PowerShell commands described in Section 2 of AKB2000016 to add it to the Registry. Be sure the settings are there and correct. See the bottom screenshot in link above.

+ Under Windows Update for Business, set Select when Preview Builds and Feature Updates are received as shown in the second screenshot in #2275043 ****but use the setting of 0 or 1 instead of 365. Be sure to include the Semi-Annual Channel setting.

+ You can leave the Quality deferral at 0 as it will not be in effect.

Once you get those things done, you can set the pulldown switches in the Settings App Windows Update\Advanced Settings both to 0.

That should hold you on version 1909.

Reply | Quote

[rebop2020]

I used the powershell commands elevated. They appeared successful and in the registry but no Target Release entry is in GPEdit???

Do I need a reboot?

And after that is sorted, I will make the other changes.But do tell me what if anything will need to be done to wushowhide after  I update those settings/

• This reply was modified 4 years ago by rebop2020.

Reply | Quote

whshowhide still works the same as it always did.
With the “2” setting in GP, the updates sit in the queue until you click the “Download” (not “check for updates”) button. You can use wushowhide to hide anything there you don’t want, then clear the queue, then install.

Once you upgrade to 2004, the TRV settings should become available in GP. The pulldown switches will disappear from the GUI also.

Reply | Quote

Thanks.

This was not addressed:

I used the powershell commands elevated. They appeared successful and in the registry but no Target Release entry is in GPEdit???

Do I need a reboot?

Then you say:

“whshowhide still works the same as it always did.”

Of course. But after these changes do I need to unhide anything? That is unclear.

 

 

Reply | Quote

One more timely question. Above you say:

 

Everything else under Windows Update and Windows Update for Business should be “Not configured” except those four settings.

Does that include “Select when Preview Builds and Feature Updates are received”? At this moment I have it enabled and 0.

Thanks.

Reply | Quote

PKCano wrote:

+ Under Windows Update for Business, set Select when Preview Builds and Feature Updates are received as shown in the second screenshot in #2275043 ****but use the setting of 0 or 1 instead of 365. Be sure to include the Semi-Annual Channel setting.

Read the whole thing, including the last sentence. 🙂

Reply | Quote

Sorry . Missed that. Thought I had the 4 settings covered.

So once again, back to this that remains for now:

rebop2020 wrote:

Thanks.

This was not addressed:

I used the powershell commands elevated. They appeared successful and in the registry but no Target Release entry is in GPEdit???

Do I need a reboot?

Then you say:

“whshowhide still works the same as it always did.”

Of course. But after these changes do I need to unhide anything? That is unclear.

 

 

Once I get beyond these, can move on. Trying to be precise to your instructions as we move forward. Did not see a request to reboot, yet the setting is not there in GPEdit. And still unsure if I need (or desire) to unhide anything.

 

Thanks.

Reply | Quote

PKCano wrote:

Once you upgrade to 2004, the TRV settings should become available in GP. The pulldown switches will disappear from the GUI also.

You won’t get the TRV settings in GP until you upgrade to 2004. But the Registry settings will work the same.

Yes, reboot to be sure the settings are activated.

Reply | Quote

OK. Thanks.

And nothing to do with wushowhide even though there are a half dozen things hidden including 20H2?

And after that, I will reboot and take a break until tomorrow.

 

Reply | Quote

PROBLEM

Rebooted and I get a message we need to fix your microsoft account. Click here to fic it. Never saw this before . What’s up????

I always logged in as local user if I recall.

 

 

Reply | Quote

???
You didn’t do any updates, did you?
Try Ctrl-Alt-Del and reboot – see if it goes away.

Reply | Quote

I did no updates.

I did nothing other than what is above.

I DID do the two Office 2010 updates early this morning.

Have you seen this before? I am googling it now:

https://www.trickyways.com/2019/06/fix-microsoft-account-problem-we-need-you-to-fix-your-microsoft-account/

https://answers.microsoft.com/en-us/windows/forum/all/please-fix-we-need-to-fix-your-microsoft-account/b4911a14-e556-4d37-9b69-72432a96a278

https://windowsreport.com/you-need-to-fix-your-microsoft-account/

Just reading those Are you SURE a reboot is safe at this point?

 

 

 

Reply | Quote

Never ran into this before.
Try the “shared esperience” and the “log out log back in” in the first two links first.
If those don’t work, try the #6 in the third link.

Reply | Quote

This is why I hate updates.

Will do.

Back in a bit. I hope this gets solved before the weekend. Hate to stay in a lurch.

Reply | Quote

I don;t think I have ever seen this before. Maybe, but. And I am signed in. How else could I get to Windows?

Reply | Quote

All my account settings like correct. I have NOT clciked the notification yet. Still reading.

 

Coincidence? Or something I changed to bring this about?

 

Reply | Quote

Look at shared experience and at the setting in #6 in the third link https://windowsreport.com/you-need-to-fix-your-microsoft-account/

Reply | Quote

METHOD 1: Go to Settings > System > Shared Experiences. Turn off Nearby Sharing and Share across devices options.

 

Both of these were off. It also says on the system page of settings that “All accounts are working correctly.”

I have neither dismissed nor clicked the notification yet.

6. Change to local account is ALREADY a local account. The option I see is to change to Microsoft account. I do not want that.

Reply | Quote

Seems I have two logical choices right now. Click the notification:

Which is where I just was with no errors noted. Or Log out and in again and hope I can login again.

 

Your thoughts?

 

Reply | Quote

And no password changed by me of course.

 

Reply | Quote

Here’s an interesting quote:

If you get a notification that you have a “Microsoft account problem,” you don’t have a problem and you don’t have to fix anything. You haven’t been hacked and you don’t have a virus. Microsoft is testing your patience.

(Update 09/2020: Try the tips in this article but they may not work. For some people – including on my own computers for the last few months – this notice still appears even after turning everything off. The only suggestion I have left is to ignore it.)

 

Reading this article now. Sorry for so many posts but an amazing coincidence we work on updates and this pops up for the first time ever.

 

Reply | Quote

This seems to be a good link PK:

https://www.bruceb.com/2019/09/how-to-get-rid-of-the-microsoft-account-problem-notification/

Still reading.

Reply | Quote

OK, Clicked the notification which took me to the Shared Experiences where we already found out no errors to be fixed! Notification gone. So what remains is to reboot and see if it comes back. Cross your fingers. And still reading as I do all this.

Reply | Quote

Read #6 in that last link.
If you don’t find anything else amiss, I’d suggest log out and log back in.

Reply | Quote

OK. Its gone.

I clicked the notification, took me to Shared Experiences. All was good, made no changes. Then closed settings, rebooted and done.

But this is interesting. Temp showed the following logs:

They have to do with root/IMdriver

LenovoIMController

More as above with deleting the manifest an time based events

And remove IMControllerInstallerService

So all of these happened on those two last boots. And I have most if not all auto installs and updates squashed everywhere,. So perhaps the above caused it.

But sigh of relief it is gone. I’ll reboot tomorrow morning and check again.

Thanks for riding along on this one with me.

 

So, just to check off a little more before I make a gin and tonic 🙂

You say in your instructions:

+ If you have set the 4 Group Policy settings, then set the pulldown switches in Windows UpdateAdvanced Settings to Quality and Feature deferrals = 0 (zero)

Were grayed out from the GPEdit settings. Done.

+ Turn of Fast Startup
Control PanelPower Options “Choose what the power button does.
You may have to look under “Settings that are currently unavailable” – be sure to save the settings.

This setting causes other problems so I have had it off forever. Lenovo Vantage has a similar setting called Easy Resume. That causes BSOD’s. Off as well.

Let’s leave it there for now. Are you checking here this weekend? If so I will do some more tomorrow.

Thanks.

Reply | Quote

I think I live here 🙂

2 users thanked author for this post.

WSEssjay, rebop2020

Reply | Quote

 

OK, next. You say:

 

+ Run “Disk Cleanup”
Start Menu\Windows Administrative Tools. Right click on “Disk Cleanup” and “Run as administrator“. Check everything BUT Downloads (but check Downloaded Program Files), Shader Cache, and Language resources. Delete the files.

Done. But you did not mention System Files to clean!

I have 274MB of Windows Update Cleanup and 398 MB of Windows Upgrade Log Files. I would want to be very sure I would not miss these if I cleaned them.

Add:

22.1 MB of Device Driver packages
Same Would want to be very sure if you suggest I do these. Will wait until I hear for next steps tomorrow.

Reply | Quote

rebop2020 wrote:

Start Menu\Windows Administrative Tools. Right click on “Disk Cleanup” and “Run as administrator“.

If you had done this, you would have been in the System files to clean up.

rebop2020 wrote:

Check everything BUT

There is a list of the “BUT” check boxes.
You need to do this before you go on from this step.

Reply | Quote

Nope. There is an additional button: OOOOPS. you are right!! I got to this with a search for Disk Cleanup which goes to a different screen.

 

Done….

DISM was run before this. SFC not yet.

Gonna take this opportunity to mention a few changes after the Login Notification AND DISM (don’t know which is/was the cause)

1. My NAS which is mapped lost its password and had to be reentered on reboot
2. .log files default app was changed to Notepad
3. All I have found so far. Not looking, but noticing changes as they are presented.
4. I received notifications of new updates I had not seen before. One of interest the 1909 cum update!

1. So, before I even read you latest comments, should any here be run or hidden since I likely will go to at least 2004 as we finalize all of this (assuming we ever do 🙂
2. Should I run SFC before any of this or after?

Off to read you other posts here.

Reply | Quote

Wow. Was just blocked from posting as a potentially damaging action!!!

I tried to do this:(let me try to edit any exe

You say: Let me know the content of any error messages.
In an elevated command prompt (type cmd.exX in the taskbar search box, right click on it and “Run as Administrator) copy/paste esch of these commands in and hit enter:
*DISM /online /cleanup-image /restorehealth*

OK. I have always preferred running DISM /online /cleanup-image /ScanHealth and looking at he CBS logs. When I did I saw errors in snippingtool.lnk and new servicing stack required. So I ran restorehealth.

ESET prevented files from downloading spo had to disable for a few moments. Completed successfully. An awful lot of WULIB downloaded.

 

 

Reply | Quote

rebop2020 wrote:

*DISM /online /cleanup-image /restorehealth*

This was the command I suggested you run.

Reply | Quote

Totally understood. I was saying I like to run “scanhealth” and see what it finds before I let it run “restorehealth”. I like to be informed. I’m sure you have noticed 🙂

Reply | Quote

Ran an sfc/VERIFYONLY to see what it would find. It found integrity errors.

The errors are attached. Some I am concerned about and need assurance cannot create more issues than it will solve. I do not understand how directories can have two owners or two security settings. And when it comes to the START menu, I have mine HIGHLY customized.

What do you think before I run scannow?

 

Couple of examples from the file:

2021-02-12 21:10:46, Info CSI 0000007e Warning: Overlap: Directory \??\C:\WINDOWS\System32\drivers\en-US\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]’en-US’, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-Foundation-Default-Security.Resources, version 10.0.18362.1, arch amd64, culture [l:5]’en-US’, nonSxS, pkt {l:8 b:31bf3856ad364e35}

Likely OK, no?

2021-02-12 21:11:15, Info CSI 00000104 Warning: Overlap: Directory \??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ is owned twice or has its security set twice
Original owner: Microsoft-Windows-shell32, version 10.0.18362.628, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}
New owner: Microsoft-Windows-shell32, version 10.0.18362.628, arch amd64, nonSxS, pkt {l:8 b:31bf3856ad364e35}

HMM, seems like old owner and new owner is the same in both (all?)

This one is interesting:

2021-02-12 21:14:11, Error CBS Package “Package_for_KB4535680~31bf3856ad364e35~amd64~~10.0.1.1” requires Servicing Stack v10.0.18362.772 but current Servicing Stack is v10.0.18362.651. [HRESULT = 0x800f0823 – CBS_E_NEW_SERVICING_STACK_REQUIRED]

NOTE: Doesn’t seem to be a KB4535680

See attached.

Enough for tonight 🙂 Thanks.

Reply | Quote

rebop2020 wrote:

What do you think before I run scannow?

I think you need to start over and do the first instruction right.
See my instructions in #2343233.

If you think you know better, there is no sense me helping you.

Reply | Quote

Well, I am careful. And I do make mistakes. I did not follow on the Disk Cleanup and learned something. That has been done now. So based on that, do you want me to ruin DISM again?

Anything with newly presented updates?

Move on to SFC?

 

Let me know. I have some time this afternoon to do more.

Reply | Quote

Ran DISM as I figured could not hurt. No corruption. So now at

Reboot?

Update anything?

SFC?

 

Reply | Quote

Well, it looks like you are getting updates in the queue now. That’s good.
It means you DO NOT need to reset Windows Update (the last part of the original instructions) right now.

Go ahead and run sfc /scannow. It should clean up any other system file problems.
Come back and tell me the results and we’ll talk about where to go next.

 

Reply | Quote

Super, thanks. Good to know I can avoid that. And will run SFC in a bit after errands.

 

I just want to revisit DiskCleanup for a moment and clarify. Particularly because I was surprised at your reply.

I KNEW there are at least 3 ways to get to DiskCleanup. What I did not know is they bring up different screens depending on the method chosen. You did not say I must go to DiskCleanup this exact way, so I did not think twice about opening in my most familiar way.

I did select ALL but the BUT’s, but that was only half of the available items on that screen. More were hidden by the ADVANCED or System button. I do not recall its title. But when I went your way, all were on a single screen.

And finding some things that seemed appropriate to clean on that second screen, I posted. Thought I was doing a good thing by asking from that second screen.

So now I know that the different methods of opening DiskCleanup can have different results. And if you did not, now you know as well. And potential other readers.

Reply | Quote

Make a backup, run sfc /scannow, sip G&T while is does its thing.

cheers, Paul

Reply | Quote

🙂

Reply | Quote

[rebop2020]

Seem to be missing a post?

Wanted to note that in doing everything up to SFC, Three things have changed and all fixed:

1. The Windows Login Error above
2. .log files changed the default app to Notepad. I had it set otherwise
3. My mapped NAS lost the password to connect and needed to be reentered.

Might be more, but these were the only changes I have come across. If it has any interest.

• This reply was modified 4 years ago by rebop2020.

Reply | Quote

SFC ran easily. The only think it corrected was a link to the Snipping Tool. It mentioned the aforementioned directory owners, but neither said it repaired or not. Ended with all repaired successfully.

About to reboot:

NO issues. At least nothing obvious.

So PK, what would you like me to do next?

Reply | Quote

Here’s the current situation:

The original monthly CU for 1909, KB4601315 was pulled by MS and replaced by KB5001028 (which is what is showing in your WU queue). The updates will sit in the queue until you click the “Download.” They are not going anywhere.

There may be a problem with the Feb .NET CU. Testings are still pending.

MS still has a problem with Conexant drivers. There is a workaround. Look and see if you have any Conexant Audio drivers (or any other than Audio Conexant drivers, for that matter). If not, that’s good.

We are currently on DEFCON-2 for Feb patches – for a reason. There are several possibilities from here.
1. You can wait till DEFCON-4 to try to install the Feb updates in your screenshot, by clicking “Download”.
2. You can go ahead and install the Feb patches with the hope that MS will not issue another hotfix 🙂 and there are no other problems with the current CU 🙂 . I would hold up on the .NET if this is your choice.
3. You can download the Jan updates from the Catalog and try to install them manually SSU KB4598479 and CU KB4598229, which should bring you up to date. (except for .NET, MSRP, Flash, etc). Then wait for DEFCON-4 to install Feb updates.

In any case, whenever you attempt to do an update, if it should fail, then, you should go back and repeat the process in #2324661 and include “Reset Windows Update” at the end.

So it’s up to you.

Reply | Quote

So:

1. Hide the .net update?
2. Run the others including the 1909 update?

OR:

1. Set to install 2004?
2. Set to install 20H2?

I will have to do that at some time. Better after the other updates?

What is you recommendation?

Reply | Quote

If you hide the .NET update for now (until more is known), you are still early for the Feb updates (IMO), but the other three patches are legit. If you want to risk it.

I would do the 1909 update first. Make an image before you try. You don’t know if updates through WU will be successful or not. Best to try on a version you know is working

If you are determined to upgrade, given a choice between upgrading to 2004 or 20H2, I’d choose 2004. But I’d wait another week (at lease) to do that. Listen to what Susan and the others are finding. That part will be easy. You just run Susan’s reg file or edit the registry to set TRV for the version you want, and it will be offered the next time WU scans on it’s own.

Reply | Quote

Thanks. Will hide .net. Will do the others tomorrow.

I thought Susan had blessed 2004 if not soH2? Did I misread?

Will post on the updates.

Reply | Quote

Susan blessed 2004, but she has not blessed the Feb updates for 2004. And that’s what you will get if you upgrade – the latest 2004 Build 19041.804.

1 user thanked author for this post.

rebop2020

Reply | Quote

Ahhhh. Of course! Thanks.

Reply | Quote

About to reboot

You wrote that earlier today in post 2343372. Have you rebooted since posting that? If so, what were the results?

Reply | Quote

Bob99 wrote:

About to reboot

You wrote that earlier today in post 2343372. Have you rebooted since posting that? If so, what were the results?

I answered in that post though maybe not obviously. No issues unless something that was not immediately obvious. Seems like I am getting offered updates again. Hopefully get on track with the blessed updates here.

Still a few things I have not seen – such as the “Optional Updates” on the update page. Mine are never optional. Maybe next update will change that. But all seems working.

Reply | Quote

I answered in that post though maybe not obviously.

My sincere and humble apologies for the question. 🙂

As I now see after rereading the post of yours that was the subject of my question, things seem as if they went well.

Still a few things I have not seen – such as the “Optional Updates” on the update page.

They might still be around, but the focus for now should be on the advice provided by PKCano on just what to do with what WU is showing you for regular (or non-optional) updates. At the time of writing this post, PK is off the site but should be back around the site starting tomorrow morning for a while.

Reply | Quote

Sorry, that was my bad for not being more clear, not yours 🙂

 

Reply | Quote

Depending on deferral settings you may not see optional updates.  That’s actually a good thing.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

The settings you have should keep you from getting optional updates – no Previews, no drivers, no upgrades you don’t want.
In fact, I never see the optional section of WU on my machines with those settings at all.

Reply | Quote

Interesting. thanks. I have never even seen the section blank. SO perhaps that is why. But for example, even with drivers set to be blocked., you can see a new Lenovo Power Manager was offered in yesterdays update offerings. I would think that would be blocked. I have that now as well as NVIDIA and Intel blocked in wushowhide.

 

Waiting on Susan’s updates to updates for the next step.

Reply | Quote

Susan, since I do not have conexant, is 5001028 safe and recommended to install?

 

Thanks.

Reply | Quote

kb5001028 is a February 2021 patch. We have an MS-DEFCON level indicator at the top of the page. Although if you wish to try it after getting your system working properly with the help of PKCano, there’s nothing stopping you. My advice, stick with the MS-DEFCON, it’s safer 😉

If debian is good enough for NASA...

Reply | Quote

Thanks. Reason I asked is it says:
Versions 1909
5001028
2/13/2021
Defer

Cumulative update
Conexant audio still a blocking issues to 2004

So if the issues was JUST conexant, then that would not affect me. But I will wait.

Reply | Quote

That cut and paste did not work very well 🙁

Reply | Quote

Use the “Text” tab when copy/paste instead of the “Visual” tab 🙂 .

Reply | Quote

I might have been mistaken about this. Will have to see. But it is possible that Windows Updates is not showing my drivers, but wushowhide is and I confused the two. Will know more next time that happens.

Reply | Quote

@PKCano, let me ask:

I know my goal is to move to 2004, perhaps pause a bit then go to 20H2. With that in mind, is there a benefit to first install the 1909 CU or should I set TRV to 2004 and wait for an all clear on the FEB patch for 2004 from Susan?

Either way is fine, just trying to understand what is best and why. Right now on hold either way

 

PS: I assume if I set TRV to 2004 in the registry, I will still have the opportunity to hide unwanted updates, yes? This would be my first use of TRV so I’m unsure if that triggers the installs or works as it does now presenting updates and allowing me to choose which to hide.

Reply | Quote

Your original problem was Windows Update didn’t work. You were stuck on Build 18363.657 which is Feb 2020 updates. See your original post above.
You still don’t know if Windows Update works or not. You see the updates in the queue now, but you haven’t attempted to update yet. If you try and the update were to fail, you still have some work to do to get it going.

To me, it seems to be the wrong choice to UPGRADE under those conditions. My recommendation is to do one update cycle with a system you know functions. Then, if that works, you can upgrade to 2004 at any time. It is simply a matter of changing the Registry value to 2004.

Course, I don’t know squat 🙂 🙂

Reply | Quote

@PKCano, maybe the OP should try downloading and installing KB4023057 ?

“This update includes files and resources that address issues that affect the update processes in Windows 10 that may prevent important Windows updates from being installed. These improvements help make sure that updates are installed seamlessly on your device, and they help improve the reliability and security of devices that are running Windows 10.”

Reply | Quote

Thanks for the thought! I have read horror stories on this patch. Deleting needed files to free up drive space that is not needed for just one. I have had this hidden forever and I believe that is the recommendation here as well. But thanks for thought.

I think the issue is fixed. Will know for sure fairly soon. I was getting all updates except those for 1909. Getting at least one now.

Reply | Quote

HAH!

So that’s what I shall do. Makes sense. Will wait on the 1909 CU blessing.

Reply | Quote

rebop2020 wrote:

I have read horror stories on this patch.

I have installed this update with ill effect.

Reply | Quote

NO ill effect?

Reply | Quote

[Bob99]

@Alex5723 –

It’s great that you and others here have had no ill effects from its installation. However, there is a group of folks who have installed it and it has subsequently produced unwanted side effects for them.

My guess is that @rebop2020 doesn’t want to be in the group of folks who install it and it then proceeds to produce unwanted side effects on their machine.

KB4023057 has the potential to alter some of the settings in Group Policy that PK and @rebop2020 have gotten established in order to help him avoid unwanted installations of unwanted updates at unwanted times.

 

• This reply was modified 4 years ago by Bob99.

Reply | Quote

Thanks bob99. Well said.

There are articles that speak to this like the following:

https://www.ghacks.net/2020/08/29/microsoft-pushes-out-kb4023057-again-to-enforce-windows-10-upgrades/

The main issue from that point of view is that the update may change the system’s settings in regards to the installation of automatic updates. In other words, if you have configured Windows 10 to block the automatic installation of updates, this update will undo the changes and you end up getting all updates pushed to the system and installed.

https://hothardware.com/news/microsoft-kb4023057-blowing-away-windows-10-update-settings

https://www.diskinternals.com/uneraser/kb4023057-update/

Many other articles. Just google issues with KB4023057

 

Reply | Quote

b wrote:

NO ill effect?

Thanks 🙂

Reply | Quote

[Alex5723]

Bob99 wrote:

KB4023057 has the potential

The update hasn’t altered any GP settings on my Windows 10 (I think the OS was running 1909 at that time). Maybe I am lucky.

This is one of the reasons to make an image backup before monthly updates.

• This reply was modified 4 years ago by Alex5723.

Reply | Quote

rebop2020 wrote:

Many other articles. Just google issues with KB4023057

As Alex has said, make an image backup first, then you can easily revert.
Being stuck at the Feb 2020 update is not a place you want to be.

cheers, Paul

 

Reply | Quote

Not quite sure what that reply has to do with KB4023057, but I always make a fresh image before and update and have daily incrementals, weekly differentials and monthly fulls.

 

On another note. I have not been offered the Servicing Stack update. From what I read it is not in the CU’s until 2004. Not worried about it. just noting its absence to the available updates.

Reply | Quote

The Servicing Stack never shows up in the Windows Update queue, but it is bundled with the CU, installs with the CU, and will soon be a part of it.
The place to look for the SSU, from the View Windows History page (in the upper left corner) click on  the”uninstall updates” link (or Control Panel\Windows Update\View installed Updates) and it will take you to the list of installed updates.

Reply | Quote

PKCano wrote:

Your original problem was Windows Update didn’t work. You were stuck on Build 18363.657 which is Feb 2020 updates. See your original post above. You still don’t know if Windows Update works or not.

cheers, Paul

Reply | Quote

Cool. Learned something. I had thought it was a separate update until 2004 when built-in then to the CU.

Waiting on Susan for 5001028 blessings. Being patient.

Reply | Quote

OK. looks like the 1909 updates I have been awaiting are now approved. So off to do an image and restore point and install them today. Will report, of course, and look for guidance of next steps if this is successful..

 

BTW, the Feb Master Patch List  shows an update of Feb 26th!! Today is the 22nd 🙂

Reply | Quote

I believe we are still on DEFCON-2. See top of page.

Reply | Quote

I fought with one of my laptops for almost a year to get Windows updates to run on a 3 year old MSI system, it would reboot, hang, then rollback.

Tried a reinstall, refresh from USB, all failed.

 

Turned out to be safeboot in the BIOS – turned it off, updated fine then turned it back on! I don’t know why a windows update that changes the boot would not work with the bios..

Reply | Quote

See this PK.

Reply | Quote

And note the date?????

Reply | Quote

OK @PKCano. Sitting tight waiting to hear which is correct.

Reply | Quote

Both are correct.
BUT
The Master Patch List pertains to businesses with IT Dept.s
The DEFCON sustem applies to consumers/individuals.

Read the last line that shows on the Main Blog page under “The latest vulnerabilities in the network stack”

Reply | Quote

Hmmm. I do not see anything on the Master Patch List posts nor the html that says for IT Pros Only. How would we know that is the intent?

“Read the last line that shows on the Main Blog page under “The latest vulnerabilities in the network stack””

I think that is pretty easy to miss.

Back to wait mode.

 

Reply | Quote

I upgraded from v1909 (on 2/18/21) to 20H2 and have received numerous BSoDs and mouse/kb lockups – not all the time, but enough which makes me reconsider going back to v1909.

Dan

Reply | Quote

I think it would be helpful if this topic said “For IT Professionals Only” or some such.

https://www.askwoody.com/patch-list-master/

Note it still says Feb 26th although appears to have been updated again today to mention 20H2 recommended.

And so, if the Master Patch List does not apply to me, what topic should I be watching to check when safe to update my 1909 and then hopefully move on the get current – at least for a while.

Thanks.

 

Reply | Quote

The great big MS-DEFCON number at the top of the Blog.
When it’s 3 or larger, it’s time to update.

Reply | Quote

Of course. Not blind here, but no explanation behind the change in number?

I like to be more informed than a number change when I can. Which is why I was following the other topic which it seems is not designed for me or others with home networks who are not in IT.

It confuses me why this is not made more clear. And why posts are post dated. Maybe its just me….

Back in wait mode….

 

Thanks.

Reply | Quote

perhaps this would help
https://www.askwoody.com/ms-defcon-system/
MS-DEFCON System (grey header panel) explains in detail

If debian is good enough for NASA...

Reply | Quote

Thanks. Have read that. I just *thought* that when the number changes there might be a topic that has the back story on why it changed each time it does. Similar to what Susan does for IT pros. Perhaps there is not.

Reply | Quote

rebop2020 wrote:

I just *thought* that when the number changes there might be a topic that has the back story on why it changed each time it does.

https://www.askwoody.com/forums/topic/ms-defcon-4-make-sure-january-updates-are-installed/

https://www.askwoody.com/forums/topic/ms-defcon-4-reminder-for-december-updates/

https://www.askwoody.com/forums/topic/ms-defcon-4-all-clear-to-install-updates/

There’s been at least one each month on the Main Blog.

Reply | Quote

Cool. Now I know what to keep an eye out for.

Reply | Quote

rebop2020 wrote:

Of course. Not blind here, but no explanation behind the change in number?

The change in MS-DEFCON is always accompanied by a blog post by Susan on Computerworld.

example : https://www.computerworld.com/article/3605357/is-it-time-to-install-microsofts-january-updates-yes.html

Reply | Quote

OK, at Defcon 4 🙂 and getting ready to try the updates. I did a wushowhide and found two I had not seen before:

Intel software component 2.11.100.3 and Intel system 2.10.100.2

I am *assuming* these should be hidden, yes?

AND, I thought I would do the 1909 update and then the .net separately later unless you think it is best to do both in the same update. Will wait to be sure on both.

Thanks.

Reply | Quote

Yes to the .NET update separately. Let’s see if updating works now.

Reply | Quote

Wow. AW having issues this morning!

You did not address the two Intel offerings PK. Yes to hide before I start this? And I may wait until AW more steady in case I need to jump back with an issue. But I am hoping/expecting these to go smoothly.

 

Thanks.

Reply | Quote

Yes, only deal with the CU – not Intel, not .NET.

Yes, it’s OK to wait till AW is back to normal.

Reply | Quote

Temporarily putting the site in maintenance mode @ AskWoody

Still a bit bumpy.  Apologies.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

No apologies needed! I fully understand.

Reply | Quote

Running dialog:

Started the 1909 CU update. Downloaded in less than a minute. Then went to installing and 100% in less than another minute. Then went back to installing again. After two minutes or so, 20%. Another two minutes to 44%. Two more to 73%. Hanging at 74% for quite some time now – almost 5 minutes. Now ticking off, 78, 79, 80….pausing at 90%. Done pending restart.

Restarting….Working on Updates. Taking its time. Its OK. Restarting. Macrium screen. Now Getting Windows Ready message…Desktop.

WinVer 1909 18.363.1379

New icon – Meet now. Everything else looks fine. All drives and mapped. 5 GB taken up somewhere. Will look a little. Not in temps. Not in system restore.

I’m going to call this successful. You?

So I will assume (and wait for you to confirm PK) that next is to unhide the .NET update and run that. Yes?

Thanks.

(Back in 20-30 minutes)

Reply | Quote

Bob-

That little icon labeled “Meet Now” is part of MS’s effort to get folks to use Skype in an easier way, with (if I recall correctly) no sign-in needed.

If you don’t use Skype or if you don’t intend to use it, you can just right-click on the icon and have it disappear from the system tray/taskbar. That’s what I did when it showed up several months ago. When you right-click on it, one of the choices says something about disabling it, and that’s what you want if you’re not going to use it.

Reply | Quote

BAck.

 

Got an email from you saying “Probably windows.old but that is from Feature only, no? And not there. About 500MB for the cab for that 1909 Update. All I could find.

 

So, next? .NET? Anything special or just unhide?

Thx.

Reply | Quote

Leave the .NET hidden. You can install the next .NET update in March. There was some difficulty with the Feb one. I have hidden it on my Win10 and it’s not critical.

Well, that’s a winner. Look through the hidden updates. If you have hidden the Flash removal or any Defender updates, unhide and install them.

I would let 1909 alone till March updates. After that, you can choose to upgrade to 2004 or 20H2 whenever you want. But I think it would be a good idea to see how this works for a while. Go through your settings, turn on System Restore so you have Restore Points.

Make a full disk image and a data backup SOON. You don’t want to lose this one.

Oh, and I would not run Disk Cleanup at least for the next 10 days. After that, you can get rid of the old stuff which will remove some of those GBs you acquired.

Reply | Quote

OK. One reason I was anxious to try the .NET is that I still cannot get Dolby working (you might recall that) and thought that had a chance. I shall wait.

Restore was on.

Brief look at Control Panel has a Windows 2 Go I don’t recall. Will look at all settings.

Image no worries, but what “data backup” are you referring to?

And I assume that my TRV at 1909 stays for a while? AHHH it is now in GPEDIT and not configured. How should I make that change from Registry to GP? Just configure GP or need to delete Reg keys first or…?

New Update to hide: Security Update for Windows 10 KB4535680. Will look for that while I await your opinion.And BTW, I have never been offered Edge Chrome.

 

Reply | Quote

Just configure TRV in GP. Leave the Reg setting alone, the GP setting should override it.

The .NET CU is cumulative – you can wait.

Reply | Quote

Cool. And just wait until Edge is offered to me as well?

Reply | Quote

You will eventually get it by default, I think in April.

Reply | Quote

AHHHH, that’s the Secure Boot Susan advises against! Hidden….

Reply | Quote

OK, found one other tiny change: I have a custom column for “Backup Method” in my Macrium folders in Windows Explorer. It got deleted. Easy to rest and not uncommon for a Win 10 update to say to itself “that doesn’t look right – I’ll remove it”. But that, Meet Me, Windows 2 Go and TRV in GPEDIT. I think that’s about it.

See ya in a couple of weeks when we likely do 20H2. Guaranteed more changes then.

Thanks.

~Bob

Reply | Quote

Brief look at Control Panel has a Windows 2 Go I don’t recall.

Hi Bob!

Just a quick note to let you know that Windows 2 Go is disappearing from editions of Windows 10 starting with 2004, so you don’t need to worry about it! There’s a formal announcement about it disappearing in the light blue box at the very top of the following web page from Microsoft which describes Windows 2 Go:

https://docs.microsoft.com/en-us/windows/deployment/planning/windows-to-go-overview

Based upon what you’ve said in post just above, this sounds like some good news for you.

Reply | Quote

Thanks Bob. One less thing to worry about 🙂

Reply | Quote

@PKCano, question. Reading the newsletter again and Susan’s recommendations, is there any reason I should not do the .NET and 20H2 updates now rather than wait 3 weeks or more for the March updates to hit DEFCON? I can wait if I must but curious the reasoning to wait.

 

Thanks.

Reply | Quote

Waiting for other to find the pitfalls is always good.
But, if you have a backup and time to update / roll back (2 – 4 hours), go for it.

cheers, Paul

Reply | Quote

But doesn’t DEFCON 4 mean that others have discovered the pitfalls? What am I missing?

Not trying to be contentious and have a true appreciation of the help I am getting here, but some things just don’t make sense. If DEFCON 4 says all patches (or at least the ones listed) are good, why wait another month for new patches to be validated?

Now PKCano has a point its good to wait a few days or so after a CU to be sure all is working as expected before doing a Feature Update. And I have done a pretty thorough check. But OK, I’ll give it a few more days. Just hate to wait another month for things approved now. Make sense?

 

 

Reply | Quote

I think I answered the question and gave the reasons in #2346864.

Reply | Quote

OK, reading more and going to wait for the March updates and approval. But….

Lenovo Vantage is offering me Intel Management Engine software “2044.15.0.1951” and says it fixes an issue with BSOD in Updating Windows.

I WILL be updating from 190-9 to 20H2 and updating .NET as well this month. Should I be installing this Intel patch and perhaps the Intel firmware patch as well? Are they safe? Recommended?

Thanks.

Reply | Quote

If you had made a backup and let Windows Update do it’s thing, you would now have been relaxing in the knowledge of a job well done.

Make the backup and install everything, except the previews.
Let us know how it went.

cheers, Paul

Reply | Quote

Not understanding in the least, Paul.

First, I have backups made very night and a fresh complete backup every first of the month. So?

Second, what does “let Windows Update do it’s thing” mean? Part of the reason I am here is to know WHAT to let Windows do. Makes no sense to me what you are saying.

And quite a bit of ambiguity here. OK to install, wait a month, etc. Hard to interpret as it seems there is not a cohesive opinion. Some say disregard MPL unless IT Tech, Susan says, no, same as DEFCON.

And my last question you replied to was LENOVO VANTAGE updates, not Windows. Looking for opinions on their safety. Especially firmware updates but MB device software as well.

So perhaps you could be less cryptic on backups and Windows “doin’ its thing”.

And while I am thinking about it, are there BIO’s of the people from this site and/or those that reply as MVP’s? Would be nice to know who you are, what your background is and more data to install trust in replies. Did I miss those?

Reply | Quote

[Alex5723]

rebop2020 wrote:

Should I be installing this Intel patch and perhaps the Intel firmware patch as well? Are they safe? Recommended?

Trust Lenovo Vantage drivers, Firmware.. Don’t trust Microsoft’s Intel.. drivers.. updates. Hide them.

Lenovo Y530.

Microsoft is sending a driver update that bricks Lenovo laptops (I got it too) Lenovo – System – 15.11.29.61.
Lenovo ACPI-Compliant Virtual Power Controller” under “System devices”. Block/hide the update

https://forums.lenovo.com/t5/Lenovo-IdeaPad-1xx-3xx-5xx-7xx-Edge-LaVie-Z-Flex-Notebooks/LAPTOP-BEEPING-UPDATE-WONT-TURN-ON/m-p/5068125

• This reply was modified 4 years ago by Alex5723.
• This reply was modified 4 years ago by Alex5723.

Reply | Quote

I found this interesting, Alex. Got me reconsidering that Vantage update again:

https://www.zdnet.com/article/microsoft-warns-this-windows-10-workaround-to-cure-lenovo-thinkpad-bsods-hits-security/

From what I read the fix is risky and the issue might not affect me and my specific computer.

Reply | Quote

Thanks Alex. I learned my lesson (before finding AskWoody) on Microsoft offered Lenovo updates. I did the Realtek Audio from M’soft and  Dolby has never worked since. Waiting for a Lenovo update to the driver. Cannot find a way to unwind and not mission critical.

I have had issues with Vantage drivers as well, but Lenovo actually fixed them after dozens of posts on their forums 🙂 My rule of thumb is if its working, don’t update. The reason I am possibly bending that rule now is the IME update claims to fix a BSOD from using Windows Update and since I will be doing Feature update soon, want to see how important and trustworthy that particular update is.

 

 

Reply | Quote

I went ahead and did the .NET update for three reasons:

1. I have never unhid something and installed so wanted to observe that process
2. I was hoping it might fix my Dolby issue that crashes in .net. It  did not.
3. I wanted to be sure my decision NOT to update the Lenovo Intel Management Driver was a good decision. It appears top be.

So no hitches or issues. All seems fine. Except Dolby still broken.

Will be waiting on the next approval of the March 20H2.

Reply | Quote

rebop2020 wrote:

Lenovo Intel Management Driver

Intel Management Engine 12.0 Firmware

(Fix) Enhancement to address CVE-2020-8752/8753/8745/8750/8757/8756/8760/8744/8751/8754/8761/8747/8755/8746/8749/8705/12303/12304/12297

That is for my Lenovo Y530.

Haven’t installed yet but I did update my BIOS a couple of minutes ago.

Reply | Quote

 

I think that might be a different version of IME than I was offered. I want to say mine was 15, but unsure.. All seems working fine without it. DO let me know what you find when you install.

Reply | Quote

I’m going to put this in this thread in case it is related to either the 1909 update or .NET. I have just started to google for answers, but if you know the answer would save some time perhaps.

Last night while I was asleep and nothing scheduled to run I got about 50 of the following critical errors. all the same except for the containerID’s:

Description:
Metadata staging failed, result=0x80070490 for container ‘{00000000-0000-0000-FFFF-FFFFFFFFFFFF}’
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”&gt;
<System>
<Provider Name=”Microsoft-Windows-DeviceSetupManager” Guid=”{fcbb06bb-6a2a-46e3-abaa-246cb4e508b2}” />
<EventID>131</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x4000000000000000</Keywords>
<TimeCreated SystemTime=”2021-03-05T06:56:27.586830400Z” />
<EventRecordID>6173</EventRecordID>
<Correlation />
<Execution ProcessID=”14536″ ThreadID=”12060″ />
<Channel>Microsoft-Windows-DeviceSetupManager/Admin</Channel>
<Computer>W———-S</Computer>
<Security UserID=”S——–” />
</System>
<EventData>
<Data Name=”Prop_ContainerId”>{00000000-0000-0000-FFFF-FFFFFFFFFFFF}</Data>
<Data Name=”HRESULT”>2147943568</Data>
</EventData>
</Event>

Ideas while I look? If I find it first will report the solution. Have never seen this error before. All happened within a minute.

Thanks.

~Bob

Reply | Quote

Update, they are ERRORS, not “critical” errors.

Reply | Quote

Ok, came across this:
<p style=”text-align: left;”>”In regards to the event id 131 for Windows 10, I went to control panel, devices and printers, right click your pc icon, click device installation settings, click no let me choose what to do, uncheck box automatically get the device app and info provided by your device manufacturer. After that I did not get any more 131 errors.”</p>
Now, I have it set not to download drivers in GP and when I go to

Device Installation settings I get different options:

“Do you want to automatically download manufacturer’s apps and custom icons available for your devices?

YES, recommended (was checked

NO, (your device might not work as expected)

I changed to NO. Can you tell me how yours are set? Did yoi make the change?

 

Thanks.

 

Reply | Quote

From another site on this error:

You may receive event id 131 stating that metadata staging failed and devices did not update but if you read your event log in full, a few seconds later the devices do actually update.  This really is a timing issue.

Event Log:

Select Applications and Services

Select Microsoft

Select Windows

Select Device Set up Manager

Now you should see the red errors with event id 131 and underneath that you will the successful update of devices a few seconds later.

This is ‘a timing issue on the server’ not hardware or software related.

Makes sense as I see those as mentioned and also have not seen these errors before. I will be keeping an eye open.

PS. Failed to post going to a warning page about my IP being blocked?? Using a different browser and session to post now.

 

Reply | Quote

@PKCano – was offered 8 or so updates today. 6 or so for Microsoft Office 2010 and some for apps like Visio I do not have installed if I recall. I hit pause for 7 days quickly. There was a 1909 update as well. So I am taking this as good news.

I shall wait on Defcon and then your advice whether to install these with another 1909 update or change TRV to 20H2 and wait for updates to repopulate and move to 20H2.

Reply | Quote

I would think if the 1909 updates install successfully, Windows Update is working like it should.
After that indication, I think it would be safe to upgrade to 2004/20H2 at your leisure.

With all the mess going on with the initial release of the March patches, I think I would wait a few days at the very least, though, before doing anything..

Reply | Quote

Sitting tight, for sure. So even though last month’s installed successfully and this month’s offered successfully, you would still install March 1909 before update to 20H2?

Reply | Quote

That is correct.

Reply | Quote

Still sitting tight and waiting, but my 7 day pause expeired today and I saw maybe 10 or so updates offered. Paused for another 7 but two questions:

 

1. I am being offered a Visio update and I do not have Visio on my computer. Why?
2. I am being offered KB4589211 Intel Microcode update. I do not see this on the lists. What is the thinking of installing this or not?

Thanks

Reply | Quote

Hi Bob!

To help PK out, please post the KB number of the Visio update that you’re currently being offered. That way it can be determined if you need to worry about it or not.

Sometimes, there are components of a larger program installed within a suite’s installation that help it run, and this can make it look as if you need an update for the entire program that you only have a small piece of.

In other words, there may be a small component of Visio installed in your Office 2010 installation, and it may be making MS think you have a full copy of Visio installed when, in fact, you don’t.

By the way, per your post above (#2349482) you have been offered Visio updates before, so the same advice you got before about the Visio update may very well apply this time. 🙂

Reply | Quote

Thanks Bob. Unfortunately I did not write down the KB for Visio before I paused for another 7 days. And this is the only Visio ever offered so if I mentioned before, I did not recall the recommendation for what to do if Visio not installed. And there are a bunch of Office updates, as expected and still for Office 2010.

 

I’ll catch the KB in 7 days.

 

Reply | Quote

[PKCano]

Glad you are sitting tight.
If you had updated/upgraded when you were pushing to do so, you would have landed in the middle of the printer BSOD mess that, even a week later, the OOB hotfix CUs have not fixed. Sometimes it pays to be patient.

Now, about the updates you are being offered:
+ Personally, I have not installed any of the Intel Microcode patches on my machines. That is a personal preference. Some people here have installed them. That has to be your choice.
+ You may not have Visio installed on your computer, as such. But there may be some component of it in your Office installation, or in one of the other programs you/Microsoft have installed. Windows Update evidently sees some indication it is needed. I would go ahead and install the Visio update(s). It won’t hurt anything, and it may fix something of which you are unaware.

I am usually testing the updates on my VMs immediately after Patch Tues. But this month, I have only updated one v20H2 so far, and that was by installing the OOB hotfix CU manually instead of the Patch Tues CU. Most of my printers are Type 3, only one HP Officejet is Type 4.

If you are using Group Policy, with the setting of “2” (notify download/install), you should NOT be using Pause AT ALL. PERIOD!
If you use Pause, not only do you negate the “2” setting, but you have no idea what is pending or what you will get at the end of the Pause.
Hide the updates you don’t want with wushowhide and leave the rest sitting in the queue so you know/see what you are dealing with. With “2” set, they won’t download unless you click the “Download” button (or Pause runs out when you least expect 🙂 ).

EDIT: And another round of Win10 OOB CUs for printer BSODs last night (3/18). Latest feedback for 2004/20H2 says “Do NOT install” – See Main Blog discussion.

• This reply was modified 3 years, 11 months ago by PKCano.

Reply | Quote

Thanks PK.

OK, understand and agree on the Visio. Was a surprise as I have received MANY Office updates in the last three years but this is a first for Visio. And after support for Office 2010. But I agree, likely extremely low risk and will do on the all clear.

On the microcode – got a good place to read up so I can decide if its something I care to do? Likely will not, but as you have seen by now I like to be informed

Now this is a surprise:

 

“If you are using Group Policy, with the setting of “2” (notify download/install), you should NOT be using Pause AT ALL. PERIOD!”

I thought that after setting TRV and GP for 2 (which it always has been) that folks here were using PAUSE for 7 days until Defcon was all clear. I can tell you that the offerings before the first 7 day pause and after were slightly different adding the Microcode, for example. All those now paused 7 days to be seen again next Thursday or Friday.

So, based on that, what would you recommend? I would think if Defcon clears, no issues – install ’em. But if not? Pause again or leave in the queue? None for now to hide except MAYBE the microcode which I shall read more on.

PS on Microcode. What if my CPU is not on the listed list for that Microcode update and I install? What happens?

Thanks.

 

Reply | Quote

rebop2020 wrote:

I thought that after setting TRV and GP for 2 (which it always has been) that folks here were using PAUSE for 7 days until Defcon was all clear.

You didn’t read the section in AKB2000016 that said DO NOT use Pause. When Pause is set, WU doesn’t see any updates. When Pause is terminated, WU ignores the “2” setting and downloads/installs anything you didn’t see. You defeat the purpose of “2” when you set Pause.

To get your self out of the problem, disconnect from the network, Resume pause (it will fail with a “Retry” b/c there is no connection). Restart the computer and WAIT for WU to check again for updates on its own. They will sit in the queue and not download. Hide the ones you don’t want (Intel Microcode, etc) with wushowhide and leave the rest in the queue so you can see what’s pending. Wait for WU to rescan and remove the ones you hid from the queue.

If you use the “2” setting in GP, DO NOT USE PAUSE.

Reply | Quote

My processor is listed in the KB article for Microcode. Still researching.

Reply | Quote

Quoting Susan from Computerworld:
<h2>Should you install?</h2>
But the question everyone always asks me is… should I install these microcode updates? I’m not convinced. I have in the past uninstalled some of these patches from machines after seeing them slow down after the update. In this instance, the attackers would have to “monitor power consumption and deduce what instructions were being performed by a CPU, allowing them to steal sensitive data from memory.” That sounds like “nation state” attackers looking for key industrial or government secrets. These days, the most sensitive information on my computer is my weekly order to Instacart and my Amazon purchases. Unless your computer keeps nuclear codes, or is an ATM machine, I’d skip those updates —  especially if they impact performance.

<aside id=”” class=”nativo-promo nativo-promo-1 tablet desktop”></aside>I do recommend bios updates, especially on Windows 10 machines.

Seems to be the most common opinion that these may not have value for home users, but larger network users in corporate might be more interested. And seems there have been side effects slowing performance as mentioned by some users on pother sites. I likely will hide this update.

Reply | Quote

OK, I did enough reading to decide I do NOT want to install the Microcode.

So I went to wushowhide to hide that update. There were NO updates to hide! A first.

I am hoping that since I am on PAUSE that when the pause lifts I will be able to hide that update. Correct me if that is wrong and what you recommend to do to avoid that update but install all others AFTER DEFCON goes green?

Thanks.

 

Reply | Quote

rebop2020 wrote:

I am hoping that since I am on PAUSE

If you are on pause wushowhide won’t find updates.
You have GP=2 so un-pause.
Set GP to block drivers download.
Run wushowhide (I wouldn’t use it. Use WUmgr instead) and hide Intel Microcode.

1 user thanked author for this post.

rebop2020

Reply | Quote

Alex5723 wrote:

You have GP=2 so un-pause.

What you are suggesting will cause everything that is available to download/install. Because if you terminate Pause while connected to the Internet, WU will ignore the “2” and automatically download/install anything pending (that you can’t see because of Pause).

Reply | Quote

I will not terminate pause. I will let it expire. Perhaps by then DEFCON will change. But if expiration caused all to install, it would have done that yesterday before I hit pause again. And agree – I expect wushowhide to see these again after pause expires. And if not, worst is I will get the microcode along with the others.

Now, was going to post this first:

Thanks for the replies.

You say:

“You didn’t read the section in AKB2000016 that said DO NOT use Pause. When Pause is set, WU doesn’t see any updates. When Pause is terminated, WU ignores the “2” setting and downloads/installs anything you didn’t see. You defeat the purpose of “2” when you set Pause.”

You are right, I missed that. BUT, 7 day pause expired yesterday and Windows did NOT download or install anything! It showed me the list again, with one or two added since I did the 7 day pause and allowed me to do another 7 day pause. So perhaps the way it functions has changed. And perhaps letting pause expire does not cause any issues. I can see where RESUME would.

I shall wait until late next week. I truly believe that will achieve the same goal without having to RESUME and Fail.

Just reread AKB2000016 and searched for every instance of “pause”. If anything, it is cryptic about using “2” and pause together. I am not seeing a warning in that article. And again, I’m feeling like my explanation above will be fine. We shall see.

And no, I am not saying I know better than you PK, just that there was no warning that stood out and I am not seeing anything auto install by using pause. Time shall shortly tell.

 

 

Reply | Quote

Hi @PKCano.

Read Susan’s updates on DEFCON this morning. I do use an old HP 5P laserjet. Very old drivers with no updates. It IS my goto black and white printer. My other printers are Canon and Brother label printer so should not be affected. Thoughts on the updates and this printer?

Now, I was not yet offered up Updates coming off the 7 day pause, but went to wushowhide and now offered up the expected updates to hide. Assuming you agree, I would want all including the March 1909 CU and all office updates. I now hid KB4589211 microcode. So I feel I am, as expected, exactly where I wish to be and will be able to install these, hide just the CU or….? when offered updates again tomorrow. I’d hate to wait another month on 1909 CU’s before I go 2004 or 20h2, but I will if best.

 

Will appreciate your thoughts.

Reply | Quote

See #2353027, or Susan’s Blog Post on the Alert issued this morning.

Reply | Quote

rebop2020 wrote:

Hi @PKCano. Read Susan’s updates on DEFCON this morning.

🙂

First thing I said and was looking for your thoughts. Especially with one HP printer.

I guess I will see what is offered tomorrow. Worst comes to worst can uninstall the CU.

Reply | Quote

As I suspected, when I stopped “pausing” for 7 days, I was then offered updates again and could hide as desired. With all the controversy on the 1909 March CU, I decided to hide it and the microcode and install all the office patches for 2010. As much as I would like to finally get back up to speed with 20H2 (or 2004 at the least though it seems if I do that I might as well go to 20H2) I am going to wait for a clear DEFCON on 1909 April CU.

But I cannot find any reason NOT  to use pause with GP set to “2” at all.All works as expected.

To be continued…

Reply | Quote

OK, I have an unexpected.

I had hidden the March 1909 CU in wushowhide. It still shows hidden there. I had been waiting for Updates to alert me in notifications to install the others.

Yesterday I got the alert, but the CU was still in the list as pending there. That had happened before and I just ignored and the next day the next alert would not show what was hidden. But today, the second time I have been alerted to updates since “un-pausing”, it STILL shows the CU.

I ignored again to see what tomorrow brings.

I can try rebooting to see if that changes what Updates presents.

I can go ahead and install the CU as I likely will not have a printer issue. Even my HP, which is shared from another computer, is both Postscript and PCL 6, so likely not affected.

What do you think?

 

Reply | Quote

Hmmm. I have several emails on replies to this thread, but they are not here? What happened?

Reply | Quote

Just reading the emails:

Use WUmgr / WUmt / WUA.. instead.

I had issues with WUmgr though I do not recall specifics at the moment. But enough to want to avoid. Have not used the others. And interestingly enough, wushowhide hoid the microcode update perfectly as expected and doing the same steps with the CU did not. At least yet.

Worst comes to worst, will install the CU.

Will see what a reboot and the normal 3PM ish check for updates does today and post when I know more.

~Bob

Reply | Quote

OK, all good. Installed the Office updates and Malicious Software and all else hidden awaiting April Patches and/or 20H2. Hopefully both!

Reply | Quote

@sb, @pkcano – its the end of April and I am still on 1909. PKCANO wanted to see me update 1909 CU successfully one more time before updating to 2004 or 20H2. March CU’s were not recommended.

So where are we? Should I do the April CU? Should I just do 2004? 20H2? To be honest, everything looks and works as I would like right now and I’d prefer never to see an update that was not for security. But those ships have sailed, alas.

I still have old edge if that helps. Never been updated.

So especially with 2004 going to be forced on me next month, I am incredibly confused on what my best action is now.

Please advise .

Thanks.

Reply | Quote

Go ahead and update the 1909 to the April updates. Susan is probably about to change the DEFCON to 3 anyway, maybe this weekend (?). Let it sit on that update for a day or so.

If that goes without a hitch, then you can do the upgrade to 2004 or 20H2 whenever you want to. I would suggest going ahead with 20H2. Just change TRV to 20H2.
I have updated three of my Win10 to 20H2 without a problem.

Reply | Quote

About to change Defcon, so yes.  April has been way better behaved and they fixed the issues with gamer computers behind the scenes.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Thanks. I’ll wait a day or two in case Susan has comments on April of interest. And PKCANO, have you updated to 20H2 with the April updates?

 

Doing a full backup now to prepare.

 

Have not used wushowhide to see what is awaiting me but assume just Office updates and the 1909 April CU.

Reply | Quote

I updated from 1909 to 20H2 the other day and other than having to wait a long time for the update to install I had no issues.  Computer seems to be running fine, all my same apps still open firefox etc.  I can’t tell a difference.

1 user thanked author for this post.

LHiggins

Reply | Quote

Biiljoy wrote:

I updated from 1909 to 20H2 the other day and other than having to wait a long time for the update to install I had no issues.  Computer seems to be running fine, all my same apps still open firefox etc.  I can’t tell a difference.

Thanks. That’s encouraging!

1 user thanked author for this post.

Biiljoy

Reply | Quote

OK, just checked what was tyo be installed and needed to hide 3 I had not hidden. So my hidden list now contains:

kb535680 Secure Boot DBX
kb4589211 Microcoode
KB4023057
Microsoft Printer
Intel system
Intel software component
NVIDIA display
Intel-net
Lenovo-System
Lenovo-Monitor

I assume none of these will be there tomorrow when Windows check for updates again. Sometimes takes 2 days.

Open to comments, but seems like this is the prudent hide list.

 

Reply | Quote

Yes, that looks like ones you should hide.
As soon as they clear the update queue, go ahead and install the April CU.
If that is successful, you can upgrade to to 20H2 through WU.
If not, do the upgrade over the top from the Microsoft Win10 download page. (See today’s Plus Alert Newsletter)

Reply | Quote

Or just go ahead and do the upgrade over the top and save the time.

Reply | Quote

So you still haven’t been offered 20H2? Anytime I’ve had a computer that has gotten stuck on updating and throwing off odd errors upgrading using the “update now” button from this page as fixed up the updating issues. Given that they will soon be putting 21H1 up there soon, I’d do it sooner versus later.

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

This is the method I just used same thing was happening to me it wasn’t offering or failing so I went to the website got the update assistant and it worked.

Reply | Quote

Susan Bradley wrote:

So you still haven’t been offered 20H2? Anytime I’ve had a computer that has gotten stuck on updating and throwing off odd errors upgrading using the “update now” button from this page as fixed up the updating issues. Given that they will soon be putting 21H1 up there soon, I’d do it sooner versus later.

@SB @PKCANO I have 1909 in TRV. And PK has been guiding on updates to get me back to healthy and current.

 

I have KB4023057 hidden in wushowhide as of yesterday (again) but if I view windows update it still shows in the pending download list. I find it sometimes takes a few days to move off. If it were not there I would update right now.

Will it be ignored if I update since it is hidden? If not, can I force a way to show the updates without it?. I would like to get these done so I have a few days to see if all good before 20H2.

Reply | Quote

PKCano wrote:

Or just go ahead and do the upgrade over the top and save the time.

What happens in this case to updates that I wish to hide like KB4023057???

IF there is an easy way to update JUST the update desired to 20H2. Perhaps I will. But concerned about what happens to the hidden and as ytou can see, there are a few.

 

As I asked above, anyway to force the Update Page Pending Downloads to show only those NOT hidden?

Reply | Quote

If an update is showing in the Windows Update queue, it will download/install. You have to clear the queue of the ones you have hidden first.
Look at AKB2000013 and use @matador ‘s method for clearing the queue. Scroll down till you find it, and read through his whole scenario.

Reply | Quote

Thanks. will read. I “believe” i check for updates about 3PM daily from a task so will wait and see if it updates today before trying something else. I know what is hidden. And it is just that one showing in the queue. So will fix itself when update runs as a task again. And if not by early tomorrow, will do your suggestions.

 

Will report in.

Reply | Quote

PKCano wrote:

If an update is showing in the Windows Update queue, it will download/install. You have to clear the queue of the ones you have hidden first.
Look at AKB2000013 and use @matador ‘s method for clearing the queue. Scroll down till you find it, and read through his whole scenario.

That’s a long and a bit confusing thread pkcano. Did you mean as simple as this which appears worked for several users?

But, the upshot is: it worked. No metered connection, no reboot, just hide  in WUShowHide and a quick Pause On/Off. Only dared to do this as I have a fresh image backup.</p>
Does not sound like something you would recommend. But….

If not, would restarting the computer force an update to windows updates?

Thanks.

Reply | Quote

Sorry for the wonky formatting.

 

Reply | Quote

I didn’t think that would work at first either, but @matador convinced me.

If the April CU didn’t show up when it did the “check for updates” afterward (and you don’t have it hidden or already installed), then you need to go ahead with the upgrade over the top.
Don’t need to ask again – just do it 🙂

Reply | Quote

What if I ran windows update from task manager? Would that update the Update Settings page?

 

Asking, of course, before I cause trouble 🙂

 

Reply | Quote

@PKCANO

The April updates do show. Just still one I do not want to install. So….

I restarted. No new check for updates meaning no notification.

Now, can I trigger windows to check for updates in some way? Stopping and starting the service? Changing the time of the task?

If not, then let me just be 100% clear of the above:

What I do not want IS hidden in wushowhide.

1. I open the Update settings page.
2. Click Pause for 7 days (I am on Pro)
3. After a few seconds click Resume.
4. All EXCEPT the one shown in wushowhide will be installed.

If that is correct, and no way to force an update check, then that is what I will do.

Then Monday, if all good I will change TRV to 20H2 (case sensitive?) And let that happen organically.

 

Reply | Quote

If only the ones you want are in the queue, click the download button.
If what you want is in the queue, and there is nothing else in wushowhide but those you want, click the download button.
If nothing is in the queue, and what you want is in wushowhide, use the Pause/Resume to initiate the download/install.

If anything you DON”T want is in wushowhide, and you initiate the check for updates with Pause/Resume, you will get the one(s) showing in wushowhide you don’t want.

Reply | Quote

HAH! Understood. SO pause resume is not for me but another situation.

One I do not want is in the Queue. It is also in HIDE in wushowhide. All the others in the Queue I want. SO I need to wait.

But…

It seems in TASKS that the daily check for updates is about every 22 hours at 8:30 PM. Is it safe to change that time and if I set for (now) would it check immediately, or this time tomorrow?

Also in GPEDIT there is a setting to check more often than every 22 hours. And in fact that 22 hours can be 48 depending on what is done in wushowhide, etc. But if I change to every 4 hours, for example, will it check in four hours? And can I trust no adverse effects to these changes?

If not I am going to wait until windows decides to alert me I need updates….

 

PS. I did a restart and it did not check for updates. Would a shutdown startup be a different result? I am just trying to get to the point I can download sooner, of course.

Reply | Quote

OK, update complete, thoroughly checked, though not 100% and all good. Including printers.

Observations: 

1. There was no restore point automatically set before the installs. I set one yesterday to be sure.
2. The “New Edge” was installed. I will be looking for pointers here and elsewhere. Never had to sign into a browser before and as of yet, have not.
3. There is one task in tasks for windows update. It says it runs at 8:51PM daily. There was no notification of updates before I went to bed. And this morning says it ran then.

   Home on the settings panel says Windows Update ran at 2:50 yesterday afternoon. It did not.

   Would be nice to have a button to click to check for updates, refreshing what has been recently hidden in wushowhide and not starting an install automatically. As it is now, I have no idea when Update is actually checking in the background.

So, good for now. I will see if I can find anything odd today and tomorrow and Mon morning change TRV to 20H2. And check the registry to be sure the change is reflected there as well.

So thanks, a milestone of sorts and the next (bigger) adventure awaits with all the changes that will come with 20H2.

Reply | Quote

OK, so it would seem your Windows Update is fixed/working as it should.
Except you learned MS no longer cares about restore points.
Have fun with the upgrade.

Reply | Quote

PKCano wrote:

OK, so it would seem your Windows Update is fixed/working as it should.
Except you learned MS no longer cares about restore points.
Have fun with the upgrade.

 

Uh-huh 🙂

Reply | Quote

It’s still a good idea to always check that restore points (at least for your C: drive) are ENABLED after any version update of Win 10. Updates frequently turn it off.

Zig

Reply | Quote

As far as preferences go,
imaging a drive is far better over relying on ‘Restore points’.

If debian is good enough for NASA...

Reply | Quote

I do both. Full image before a CU or Feature and restore point before an update.

1 user thanked author for this post.

Alex5723

Reply | Quote

OK, thorough shakedown. Only downsides I found are a large number of the same repeating DCOM error 10010 on restarts. I believe this is caused by the new Edge.

 

I configured Edge NOT to run in the background or at StartUp. Wondering about the Tasks to check for Edge updates and so often. Are folks generally disabling those tasks or leaving them as is. I undertand it takes all control away form Edge updates and installs them whether you want or not. Thoughts?

Next week I will start a new topic on late to the 20H2 Party, no doubt. This one got me to that point and is getting a tad long in the tooth. But would like to know about thoughts on the Edge Update Tasks.

And thanks for all the help.

Reply | Quote

rebop2020 wrote:

Wondering about the Tasks to check for Edge updates and so often. Are folks generally disabling those tasks or leaving them as is. I undertand it takes all control away form Edge updates and installs them whether you want or not. Thoughts?

Leaving as is.

Susan Bradley confirms her long-standing advice in today’s newsletter:

By now, you know that I don’t recommend installing Windows updates right away, that you instead should hold off briefly. But you also know that I always recommend installation of browser updates right away. Chrome — and especially Edge — should be updated promptly because their security updates are critically important to your safety while on the Web.

(with an additional recommendation about The metered-connection “trick”)

1 user thanked author for this post.

rebop2020

Reply | Quote

Thanks. Seems odd it has to run every hour. I may think about changing that to once a day after I update to 20H2.

Reply | Quote

DCOM errors were a one time thing. Likely on reboot from installation. No worries there.

Reply | Quote

Is there any consensus on how to treat the Edge check for updates tasks? One runs every hour. The other every day. Are people disabling these or changing to once a week, month?

Reply | Quote

See #2356139. It stops the “check for updates.”
So far, it hasn’t returned. But Patch Teusday will be the real test.

Reply | Quote

I don’t want to stop Edge from checking for updates. Browsers are where are the zero day stuff is and patches for Edge come out all the time. (Clearly I need to make that clearer)

Susan Bradley Patch Lady/Prudent patcher

Reply | Quote

Thanks Susan. I have no problem with that and will likely use Edge VERY little. I just thought checking for updates every hour is excessive.

So, perhaps my last question in this topic:

I am about to change TRV to 20H2. There are 4 settings above that and I want to be sure they are set as should be:

1. Select when preview builds and feature updates are received
   Enabled and 0
2. Select when quality updates are received
   Enabled and 0
3. Disable Safeguards for feature updates
   Not Configured
4. Manage Preview Builds
   Not Configured.

If all good, will change to 20H2.

Thanks

 

Thanks.

 

Reply | Quote

In #1, you should set the top pulldown to “Semi-Annusal Channel” also.
Second screenshot in #2275043.

Reply | Quote

Thanks. I had not seen that before. So that is done and will change TRV. New topic to come if needed.

Reply | Quote

You can just add the “It worked” to this one!

Reply | Quote