• Where we stand with this month’s Windows and Office security patches

    Home » Forums » Newsletter and Homepage topics » Where we stand with this month’s Windows and Office security patches

    Author
    Topic
    #129489

    August has seen a relatively normal number of bugs in Windows and Office patches, some acknowledged by Microsoft, some not Post coming in Computerworl
    [See the full post at: Where we stand with this month’s Windows and Office security patches]

    Viewing 12 reply threads
    Author
    Replies
    • #129504

      In case you missed it, there was a strange very out-of-band patch released on Monday night for Outlook 2016, KB 4011043.

      1 user thanked author for this post.
    • #129517

      In case you missed it, there was a strange very out-of-band patch released on Monday night for Outlook 2016, KB 4011043.

      Woody,

      It does NOT show up in Microsoft Catalog.

      Dave

      1 user thanked author for this post.
    • #129523

      thanx Woody!

      always disable wsearch when installing windows along with all the other c*** they foist upon the unsuspecting…

      per: http://www.blackviper.com

    • #129540

      For what it’s worth I’ve had Windows Search disabled forever on all my systems.

      Everything still works (quite possibly even more reliably). I have SSD storage and it’s even still fast.

      -Noel

      3 users thanked author for this post.
      • #129549

        I second that Noel, we even had Windows Search switched off in W7 since 2009 on a SSD until recently retired. No adverse effects were ever felt and it probably done the SSD a world of good (as well as indexing off). Our W8.1 also has Windows Search off and indexing, there’s a place for everything with everything in it’s place..who needs search?

        Windows - commercial by definition and now function...
    • #129544

      Would disabling the Windows Search service work too? Or are the regedits necessary to stop this?

      • #129572

        See the next post, reference to BleepingComputer…

        1 user thanked author for this post.
        • #129579

          I read all of that, I’m just wondering what disabling the Windows Search service does in comparison to the regedits. Even though the instructions make perfect sense (for once) I’d much rather, if possible, take care of the whole thing in one step.

      • #129581

        Would disabling the Windows Search service work too? Or are the regedits necessary to stop this?

        You don’t need to edit the registry to stop nor to disable the Windows Search service. Simply go into the “Services” tool of the “Administrative Tools” choice from the Control Panel (Win7). To see the Administrative Tools choice, however, you need to be in an administrator-level account or, if you choose to, run “services.msc” from the “Run” dialog box on the Start menu and simply select to run it as an Administrator.

        Once you’re in the services snap-in, scroll all the way down to the listing for “Windows Search”. Double clicking on it will bring up its Properties dialog box, showing the page  where you can change the startup type to “Disabled”, as well as stop the service from currently running (click the “Stop” button below the startup type drop-down box) all at once. Just make sure to click OK when you’re done making changes. Now, reboot the computer to make them effective immediately.

        A word of warning if you do use the search service or have an application that uses the search service routinely: The steps above completely disable the service and will render the program(s) that use the service either somewhat or completely useless until you apply this month’s patch that fixes the vulnerability. Also, you will have to remember to re-enable the service once the patch is applied, probably, so take note of the startup type before disabling the service so you know what to set it back to after patching.

        I hope this helps!

        2 users thanked author for this post.
    • #129548

      BleepingComputer also have a detailed discussion on, with a link to a work-around for, CVE-2017-8620: https://www.bleepingcomputer.com/news/microsoft/microsoft-just-fixed-a-wormable-bug-in-windows-search-affecting-all-os-versions/ .

      1 user thanked author for this post.
      • #129566
      • #129623

        BleepingComputer also have a detailed discussion on, with a link to a work-around for, CVE-2017-8620: https://www.bleepingcomputer.com/news/microsoft/microsoft-just-fixed-a-wormable-bug-in-windows-search-affecting-all-os-versions/ .

        From the above:

        Microsoft recommends they disable the WSearch service as a workaround, but this will also disable any search functions on those machines.

        What functions are disabled?

        I’m running Win 8.1 and can search for files / folder names just fine via Explorer’s little search box in the upper-right without WSearch enabled. It does the search right then, with no indexing, which is what I prefer anyway.

        I use Classic Shell to add a Start menu to Win 8.1 and I use it to replace the Windows start menu on Windows 7 and 10 systems, and its search box works just fine without WSearch enabled to locate things to start.

        When I want to do rigorous content searches, not just for things Microsoft deems worthy of indexing, I have downloaded/installed a quite powerful free 3rd party search tool called grepWin that does a faster, more thorough content search than Microsoft’s search ever could. It even goes so far as to tell you when a file can’t be opened for searching, so you can’t accidentally miss things without knowing it.

        Not terribly long ago Microsoft introduced a bug with one of its updates that manifested as an inability to search in Outlook if you had indexing enabled. I never had any problem with that patch because I had WSearch with indexing disabled already.

        Here are my specific recommendations for disabling indexing in a way that leaves Windows functional (written in context for Win 8.1 with Classic Shell installed, but the steps do work for 7 and 10 as well)…

        Note: These steps are reversible, but if you don’t have a good feeling that you can change deep settings on your computer confidently and know why things work or don’t work, please be careful and/or consider not making this change.

        ScreenGrab_NoelC4_2017_08_16_054651

        ScreenGrab_NoelC4_2017_08_16_054654

        ScreenGrab_NoelC4_2017_08_16_054657

        -Noel

        8 users thanked author for this post.
        • #129635

          I don’t believe I’ve ever used Windows Search for very long either.  I used the Windows XP search back in the day, but for XP, Windows Search was an optional download that I never used.  As much as people denigrated the XP search, it “just worked” for me… if I needed it to look for text within a file, it did it; if I needed to find a file with a certain string in its name, it did that too.

          When I upgraded to 7, I did use the Windows Search from the start menu briefly, but I very quickly ended up with Classic Shell, which worked even better.  The Windows Search was frustratingly inconsistent; sometimes it would find things, sometimes not, and I never knew the why or the when.  Its habit of pretending it doesn’t know what I am asking for when I type “reg” in the search box is insulting too… it knows very well that there are a couple of programs that match exactly what I have typed, but until I get the full “regedit” in there, it twiddles its thumbs and whistles and looks at the clouds.  It’s done that for other “dangerous” programs too, if I recall, but regedit is one I use the most.  Don’t try to out-think me, Microsoft.  Your job is to help me to do what I want with my PC, not protect me from myself.

          For file system searches, I use Everything.  Any filename (or bit of a filename) I type in is found in under a second.  Windows search was never that fast, indexing enabled or not, and the Classic Shell search doesn’t find some of them.

          That’s not to say Classic Shell search is bad.  It does what I want to use it for perfectly, which is to search installed programs and system features so I don’t have to wade through layers of clicky menus (though sometimes I want to do it that way, at the possible risk of losing my “Power User” card; I think spatially, and the cascading Classic start menu works very well with the way I think.  I can often “see” [not really accurate, but there’s no better term] where an option is in the start menu in my head faster than I can come up with a program name.  Once I look in the right place, more or less, I see what I am looking for within a line or two, and only then does the name of the thing I want enter my consciousness).

          For filesystem searches, it’s Everything all the way.  I have it on my Quick Launch bar.  I’m going to have to send a contribution to that dev when I can (I did already with Classic Shell).  I don’t have a great deal of money, but I do want to support them where I can.  Some things would be worth paying for even though they’re free.

           

          Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
          XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
          Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

          5 users thanked author for this post.
        • #129697

          I decided to experiment by disabling Windows Search in Windows 10 and the computer is a bit more responsive for many tasks. When you disabled it for your Windows 10 (1607) installation was the boot time also shorter than default Windows 10?

          • #129792

            It’s possible that has contributed to a better boot time. For my virtual machine it’s only about 20 seconds total from just after POST (i.e., when the blue Windows logo shows) to the logon prompt (and I have disabled all “fast boot” mechanics; I only want real shutdowns / bootups). It takes another 7 seconds to log in, when I have it set to automatically do so.

            It makes sense… The system in general will be more responsive when you’re not competing with an indexing process that’s using the disk.

            -Noel

            • #129805

              Thank for replying, Yes I have fast startup and other start on boot/logon programs disabled, the computer acts like a new machine.

              Apparently Windows Search was the narrow bottleneck using much more resources than required to index files, perhaps it is also incompatible with antivirus programs.

        • #129801

          Noel, I am not particularly impressed by disabling Windows Search as it has side effects created on purpose by design, but your article certainly deserves careful reading and assessment before providing an authorised opinion in this matter.
          Thanks. 🙂

          • #129821

            A very reasonable thought process.

            Either I don’t know what I’m missing, or I am not simply doing the things that would invoke the side effects you mention, or I have a system that makes the side effects bearable.

            I’d honestly love to hear about specific things that you or others do that depend on Windows Search (indexing). Then I could say what it is I do that’s the equivalent or similar and measure comparative performance.

            When I want to search for a filename in the Explorer box, it works. When I want to search in the Classic Shell start menu, it works. When I want to search for message content in Outlook, it works.

            I’m sorry, but when I search files for something, whatever it is – say the non-text term “&#@” – I want to find it, no matter whether some programmer decided indexing will deal with it. When I want a rigorous search for content inside files I wouldn’t choose Windows Search whether or not it was fast. It’s not reliable! That’s why I like grepWin. It gets the job done, and quite quickly (given that I have a high performance I/O subsystem).

            And also note that I *never* want to search online using the search box in any of those places. Online searches are what Google’s site is for.

            Finally, Windows is simply more reliable if you don’t try to use the more “modern” features. No one would talk about “a corrupted index”, nor would Microsoft provide a way to reset the index, if it didn’t happen.

            Am I missing something important here?

            -Noel

            1 user thanked author for this post.
          • #129826

            Late to the party ™ but I’ve had indexing and search disabled from… always! Back from xp days to current, old win7 install. Disabled as one of the (many) first things after install…

            Never experienced any negative side-effects. Only positive ones!

            Not missing anything to my knowledge, so interested in learning more as well…

            2 users thanked author for this post.
            • #129846

              Same here, I switched off Search years ago as it just seems to consume resource for little if any benefit.

              If I had to do constant and extensive file searches on a regular basis it might prove to have some virtue (I don’t know) but for me it seems to be one of those solutions that’s looking for a problem

              1 user thanked author for this post.
        • #130022

          For those Windows 7 users who are trying to make all the changes Noel listed in the screenshots above for disabling the Search and Indexing services, please remember that File Explorer in Windows 7 is actually called “Windows Explorer”. THAT’S where you’ll find the entry about turning off the Library Features.

          In other words, for Windows 7, the place to look is User Configuration/Administrative Templates/Windows Components/Windows Explorer. Just click once on the Windows Explorer title and you’ll see the settings show up in the right hand pane. You’ll probably find the “Turn off Windows Libraries features…” setting listed about halfway down the list in the right hand pane without having to scroll down at all.

          1 user thanked author for this post.
    • #129642

      So for a Windows 7 machine with a single monitor setup, does the risk of the bug outweigh the benefit of the patch?

      My employer pushed out the August roll-up two days after patch Tuesday, and I’ve been running  it on my work Windows 7 system without incident for almost a week.  So I wonder if there’s still a benefit to waiting when it comes to my home Windows 7 system.

      I’m also wondering if the “one size fits all” nature of the MS-DEFCON system is a problem.  For example, this month the bugs appear more severe in Windows 10 than in Windows 7.  Should users of both operating systems be subjected to the same waiting period?

      • #129780

        Fair question. I don’t have a complete answer.

        If I start breaking out MS-DEFCON scores for different versions of Windows (7, 8.1, 1607 and 1703, at least), should I also break them out for Office, .NET, and so on.

        I’d rather stick with one overall red light/green light system. As long as we don’t get caught up in any security risks associated with just-patched security holes, it’s a reasonably good approach.

        Or, to put it another way, when your company applied the August 2017 patches to your Win7 machine, did you see any benefit? 🙂

        1 user thanked author for this post.
        • #130016

          If I start breaking out MS-DEFCON scores for different versions of Windows (7, 8.1, 1607 and 1703, at least), should I also break them out for Office, .NET, and so on.

          I’d rather stick with one overall red light/green light system. As long as we don’t get caught up in any security risks associated with just-patched security holes, it’s a reasonably good approach.

          >Or, to put it another way, when your company applied the August 2017 patches to your Win7 machine, did you see any benefit?

          I’d have to say there was no tangible benefit. The benefits would be: 1.) piece of mind and 2.) no more nagging from the system tray.

      • #129794

        Lower risk of infection is certainly a difficult thing to directly observe as a benefit.

        On the other hand, it’s entirely possible that just using a good browser, a decent anti-malware subsystem, and not opening attachments in eMail will protect you more than enough from malware to weather the few weeks of DEFCON-2 delay.

        Add ad/tracking blocking, disabling of execution of ActiveX and restricting things from running in iFrames and you take it up another few notches.

        To gauge your risk, ask yourself this: How many actual infections or reports of blocked infections from my anti-malware software am I typically seeing when I use my computer or device as I do normally? If you haven’t seen one in months or longer, you can use that to estimate the chances you’ll be hit by the next discovered vulnerability any time soon.

        -Noel

        2 users thanked author for this post.
        • #130019

          To gauge your risk, ask yourself this: How many actual infections or reports of blocked infections from my anti-malware software am I typically seeing when I use my computer or device as I do normally? If you haven’t seen one in months or longer, you can use that to estimate the chances you’ll be hit by the next discovered vulnerability any time soon.

          The problem is that web sites can get compromised and previously safe behavior can suddenly put you at risk.

          For example, the current wallpaper in my desktop background slideshow is an image I downloaded years ago. I’m reminded that I recently tried to open it from an old bookmark, so I could post a link to it in another forum. Seamonkey warned me that the website was now unsafe and blocked me from going there. If that site was hosting a vulnerability that was patched in the August updates, I could have been in a world of hurt.

    • #129658

      I use Windows Search many, many times a day. I have so many files, even with a nice clean hierarchy of folders, it is much faster to bring up the folders by typing their name or the name of a file I want to work on or often the content I am looking for by using Windows Search. I don’t want to open a box, click, type, press ok or anything. I need very quick access to files just by pressing the Windows key and then start typing. Windows Search has been for me the biggest productivity boon going from XP up to any version of Windows later. If I could shift-click the results to do an automatic “open file location” instead of opening the file, I would be even happier.

      For all its flaws, Windows Search on Windows 7 has been what I used because it did the job for me 99% of the time. I need to search file content regularly through the day. Although I find you guys arguments convincing, I don’t have the same needs and I don’t need to search the content of log files or reg files, or almost never. I want fast results so I can get my work done and although Windows Search is probably not fast, it finds things quickly for me. I limited its indexing to only specific locations, maybe that helps even if  I have a few hundred thousand of files.

      What I don’t like is if I have many files or folder with the same name, I don’t see any other information about it and right-clicking results then properties then search again to do it for other files when Windows might reorder them defeats the idea of fast search. Fortunately, it is not a frequent issue for me. Still, that’s bad.

      Windows Search on Windows 10 has destroyed my workflow. It is absolutely horrible because it requires me to click on a filter to find anything. If you move your data to a second partition (I use ReFS on a data disk in mirror mode), Windows Search don’t find anything you type right away. It is there, but not in the first screen (which is some kind of best matches, I guess). So, to find a folder, I need to press the Windows key, type the name, then click on filters, then click on filter by folders. Awful! It drives me crazy. I have one computer with Classic Shell now which doesn’t suffer from this issue and one computer where I kept Windows Search to see if the bug will be fixed, but I can say it drives me completely crazy when I have to use it.

      Thanks for sharing the grepWin tool, Noel. I might give it a try to see if it will fit my workflow, because I don’t have high hopes that MS will fix this anytime soon. Plus, it would have the bonus of stopping this service and who knows what they do with those requests you put in there in this new age of share everything with us for diagnostics purposes.

      I would have liked an integrated solution that is as fast as Windows Search in terms of clicks and that looks for content easily, all integrated seamlessly with Windows. That is why third party solutions didn’t meet my expectations before. Classic Shell with the indexer turned on seems to find content. For now, it is a perfectly workable solution for me on Windows 10.

      • #129795

        I use Windows Search many, many times a day. I have so many files, even with a nice clean hierarchy of folders, it is much faster to bring up the folders by typing their name or the name of a file I want to work on or often the content I am looking for by using Windows Search. I don’t want to open a box, click, type, press ok or anything. I need very quick access to files just by pressing the Windows key and then start typing. Windows Search has been for me the biggest productivity boon going from XP up to any version of Windows later.

        Do you realize that it does that even without the indexing service (Windows Search) running? I can’t speak to relative performance nor the use of the stock start menu, but with an SSD-equipped and relatively powerful system, I really don’t find myself waiting on anything. I suspect we work similarly to one another. If I type gpedit in the Classic Shell search box, it’s right there instantly.

        Name some specific things you do and I’ll do them (or something as similar as possible) and report back the exact timing.

        Classic Shell works awesomely well on Win 10 by the way, as it did on 8 and 7. I very much like that I still have hierarchy of menus and the same workflow as always, which feels more productive than any rendition of Microsoft’s start menu that has ever been released.

        -Noel

        1 user thanked author for this post.
        • #129824

          Can you try using classic shell with indexing disabled to find all Word documents that contain a certain word or expression?

          On the PC I installed classic shell, I didn’t disable indexing and it looked like it worked as well as Windows search. I thought it used the index but just presented the results correctly, contrary to Windows 10. However, if it is possible to disable indexing completely and get the same functionality, I am all for it.

          Usually, I don’t like having to add third-party software for basic OS functions. It adds more stuff to install and maintain for users, but this problem is so annoying and classic shell works so well, it is hard to pass on this one.

          Noel, did you see my recent long topic about tweaking standalone PCs in the Windows 10 section? I would have been curious to hear if you have things to say about it, if you experienced similar behavior, if you or ch100 maybe had a way to wipe the tatooed registry policies with a standard Windows command instead of the registry tweak.

          • #129836

            I have never used Classic Shell, so I cannot provide any information about the functionality in which you are interested. It may be a good piece of software, but it was just too much trouble for me to try it out. Maybe in the future 🙂

            1 user thanked author for this post.
            • #129858

              Thanks, I wasn’t putting your name for classic shell, but more for the local group policy topic I posted in the Windows 10 section and specifically if you knew how to wipe the specific local group policy directly pushed in the registry by tweakers with a standard command instead of having to delete the relevant registry sections.

              I suppose at least few people suffer from the incoherence between local group policy configuration and the actual state of the policy section of the registry if they randomly follow advice found on the Internet and mix that with Windows tweakers that directly address the registry and not the policy configuration files.

              See here:

              https://www.askwoody.com/forums/topic/tweaking-standalone-pcs-htfdlgpw-or-how-to-feel-da-local-group-policys-working/

               

    • #129755

      This bug which has been addressed in the latest (preview) CU for Windows 10 1607 and 2016 just released is of concern only to Enterprise users, and informative for anyone else. It affects Citrix XenApp running on Windows 2016, same build with Windows 10 1607. Users launching published desktops from XenApp on Windows 2016 would experience something similar with Windows 10 Enterprise 2016 LTSB. Similar, but obviously not identical. The issue is related to published applications and not to published desktops though, although the experience and the seamless windows design have very much the look of Windows 10.

      https://support.microsoft.com/en-au/help/4034661/windows-10-update-kb4034661

      Addressed issue where a black screen appears when launching an application on Citrix XenApp that was deployed from Windows Server 2016. For more details, read CTX225819.

      Binary Fix and Known Issues When Launching an Application Published from Windows Server 2016
      https://support.citrix.com/article/CTX225819

      Citrix and Microsoft have identified an issue when launching seamless applications from a Server VDA running Windows Server 2016. When a user launches an application published from this VDA, Citrix Receiver displays a black screen covering the work space of the monitor for several seconds before launching the application.

      1 user thanked author for this post.
    • #129756

      I need very quick access to files just by pressing the Windows key and then start typing.

      As you note later in your post, the Classic Shell search does this too.

      I’ve never even tried the Windows 8.x or Windows 10 search functions from the start menu/screen.  I put Classic Shell on 8.1 before I even tried to figure out how to use that bizarre UI (better just to vanquish it), and in the case of 10, I upgraded from 7 and it just carried over Classic Shell from the previous installation.

      As far as Everything, you can set it to have a hotkey too.  ALT-F is no harder to me than Shift-Win (which I use to bring up the start menu; I have the straight Win key disabled, as I inadvertently hit it WAY too often to have it pop up the start menu each time).

      Ultimately, if something works for you, then there’s no reason to look elsewhere, and when you used Windows 7, I would say if you were happy with it, then there’s no need for alternative.   It’s not surprising that 10 messed that up for you… it seems like that’s the norm rather than the exception (and that may well have been the case in 8.x, which I am not aware of even though I’m using 8.1 right now, heh).

      Dell XPS 13/9310, i5-1135G7/16GB, KDE Neon 6.2
      XPG Xenia 15, i7-9750H/32GB & GTX1660ti, Kubuntu 24.04
      Acer Swift Go 14, i5-1335U/16GB, Kubuntu 24.04 (and Win 11)

      3 users thanked author for this post.
      • #129776

        8.1 was fine and maybe even the early 10 before they forced Cortana as the only interface to Windows Search.

        1 user thanked author for this post.
    • #129833

      Either I don’t know what I’m missing, or I am not simply doing the things that would invoke the side effects you mention, or I have a system that makes the side effects bearable.

      I think what applies to you is mainly “I am not simply doing the things that would invoke the side effects you mention”.
      Just to mention one instance, few years ago Outlook 2013 msi installer was crashing when Windows Search was disabled or even worse, on servers running Terminal Server or Citrix, would crash too. I think this was patched since then, but I am not quite 100% certain. It is known that Windows Search is not even recommended to be installed on server versions due to performance issues, but it is available, mostly for the smallest file servers if required. The workaround was to install Windows Search, install Office 2013 and uninstall or disable Windows Search after the fact. This was on servers.
      Outlook Instant Search does not work with Windows Search disabled and the only correct procedure to avoid issues is to set certain Group Policies.
      As you see, my examples are mostly related to Outlook which many people may not use. There are complex interactions with Outlook and Exchange and Search depending if Outlook in in Online mode (currently supported only on Terminal Server but discouraged even there) and Offline mode.
      On the file servers mentioned earlier, if Documents or other System/User Profile folder is redirected and Windows Search is not installed, there is a warning and some obscure features are not available. However, it is not very common to install Windows Search in servers as mentioned before except for the very smallest implementations.

      1 user thanked author for this post.
      • #129857

        I think the fact “Windows search is not even recommended to be installed on server versions” probably means that except for rare occurences of issues with programs that are relying on it and forgot it might not be there on servers, the side effects should be minimal. Thanks for the info.

        1 user thanked author for this post.
    • #129973

      From Issues after Microsoft’s August Updates: “Microsoft has releases several updates on August 1, and August 8, 2017 for Windows and other products. Some users are reporting several issues caused by these updates. Here is an overview, what I’ve found so far.”

    • #129974

      The last 6 Windows 7 updates listed at Windows 7 SP1 and Windows Server 2008 R2 SP1 update history have a WordPad issue documented: “The WordPad application can sometimes crash on launch after installing KB[xxxxxxx].

      4 users thanked author for this post.
      • #129979

        One possible free work-around might be LibreOffice, for which a major update was recently released; I use it myself, and install on the Windows boxes under my care for those users who either don’t have or simply dislike MS Office (even for many who only use Outlook). In addition, I also always replace Notepad with EditPad Lite, which adds several useful features (free for personal use — https://www.editpadlite.com/ ).

      • #129985

        I wonder if we’ll ever see a fix?

        The free Word Online is a good alternative – as long as you’re online…

        For simple, not-Office-compatible stuff, I’m using Google Docs more and more.

    Viewing 12 reply threads
    Reply To: Where we stand with this month’s Windows and Office security patches

    You can use BBCodes to format your content.
    Your account can't use all available BBCodes, they will be stripped before saving.

    Your information: