Replies

Thanks PK! I never install the optional updates myself. I might be mistaken, but the KB4535669 .NET update does not show up as optional on my system: apparently it has entirely replaced KB4535101.

Hey TJ, I installed KB4534273 on my 1809 Home machine a few days ago and didn’t run into any issue either during installation or after.

1 user thanked author for this post.

TJ

Windows 10 1809 Home here. Already installed the January 2020 CU (KB4534273) and MSRT update (KB890830) a few days ago, after testing “vulnerable” in the SANS test. These two patches installed without problems and the system is running fine as far as I can tell.

At this time, I have only a couple of Office 2013 patches to install and the January 2020 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8. Is there any pressing reason to install these or can I skip these for the time being? In particular, I’m wondering whether there is any substantial risk if I wait to install the .NET update: I was originally offered KB4535101 (released on January 14, 2020), but this patch has been superseded by KB4535669 (released on January 23, 2020) and I’d like to wait a bit more to install a patch released just two days ago and see if any bug report surfaces. Alternatively, would you advise manually installing KB4535101 from the MS Update Catalog?

Hey Woody,

Didn’t get stampeded to install the patch, but I note that in your post on January 17 you advised that “Unless your system, specifically, triggers a “You Are Vulnerable” warning in the SANS test, I recommend that you wait to patch” and after getting the You Are Vulnerable warning on my system (Windows 10 1809 patched up to December 2019, running Firefox 72.0.1) I sucked it up and installed the January 2020 cumulative patch and the Windows MSRT January update for good measure.

So far so good and I did not have any issue with these two updates (didn’t install the January .NET updates and Office patches though).

2 users thanked author for this post.

jburk07, woody

Windows 10 Home 1809 with December 2019 updates installed. I tested Firefox 72.0.1 (64 bit) and got the “You Are Vulnerable” message on the SANS test page.

I’m kinda perplexed: aren’t all Windows 10 versions without the January updates supposed vulnerable? Or does it also depend on the browser? Firefox is stated to be “not vulnerable”, but then why did I get the “You Are Vulnerable message” on the test page?

Given woody’s advice to install the January patches if getting the “You Are Vulnerable” message, I gritted my teeth and let those patches through. Accessing the SANS test page again after completing installation of the patches now gives me a “You Are Not Vulnerable” message.

1 user thanked author for this post.

PKCano

Win10 1809 here, reporting that after this week’s Patch Tuesday I have not been pushed onto 1909. The Feature Update to 1909 still shows up as an optional update when checking using Powershell while wushowhide only shows availability of the December CU for 1809.

When I was still on 1803 and MS announced they would start pushing 1803 users onto 1903, one month passed between the announcement and the actual pushing. Just a guess here, but maybe we are going to see in January next year the push to 1909.

1 user thanked author for this post.

abbodi86

Interesting… That mirrors my experience on 1803 Home back in July-September before I moved to 1809: no CUs offered, only 1903 and the other updates (.NET, etc) were showing up. I know that I’ll be annoyed if this happens also with 1809, but I’m curious to see whether this happens again just to see if it’s standard practice for MS to have only the feature update show up as a regular update on devices running a Win 10 version deemed close to EOL.

Ironically, for users hiding the feature update on that kind of devices it’s this practice that will actually prevent them from receiving the monthly updates rather than the obsolescence of the installed version.

1 user thanked author for this post.

abbodi86

Currently running 1809 Home and my plan is to stick to this version for a few more months at least. I know Woody recommended 1809 Home users move to 1903 to take advantage of the defer updates feature, but I actually prefer to keep using wushowhide to hide/unhide updates and install them when I want to (during the MSDEFCON 4+ days) rather than using defer updates and have MS force on me those updates if I hit the end of the maximum deferral period before the MSDEFCON drops to 4 or more. I realize that having to run regularly wushowhide is a bit more of a hassle than tapping the defer updates button a few times: it’s just than I appreciate the extra flexibility I have with wushowhide.

For the moment I’ve followed abbodi’s input and hidden the (currently optional) 1909 Feature Update in PowerShell. When MS starts to push 1909 on 1809 Home machines I suspect that this Feature Update will be visible also in wushowhide just like that for 1903 did a few months ago when I was still running 1803.

Speaking of which, back in July when I was on 1803 and MS started to force push 1903 I noticed that upon hiding the 1903 feature update (using wushowhide) I was no longer offered the monthly CU for 1803. Did this happen to anyone else? Anyway, when MS starts pushing 1909 I’m actually curious to see whether that was a random glitch (and the 1803 CUs should have actually been offered regardless that I hid the 1903 feature update) or whether this will happen all over again and I will not be offered the 1809 monthly CUs after hiding the 1909 feature update. If that happens, I’m just happy to install the monthly CUs (and SSUs) manually.

Thank you for doing that check on your 1809 machine. Either of the reasons you suggest for getting only one instance of 1909 makes perfect sense to me: mine is not a new installation (upgraded from 1803 using the 1809 ISO) or maybe it’s just another difference between Pro and Home versions.

BTW, it took a couple of days for this to happen after hiding the 1909 update with the above discussed commands, but now I’m no longer seeing the prompt to “download and install now” 1909 in the Windows Update screen.

That command to display the updates details in a different language is very handy, thanks.

And if you have the chance/time to check at your end which updates are visible on a 1809 machine, it’s going to be interesting to see which updates you are offered!

[Berserker79]

Awesome! Thanks so much for the updated commands to show more details and hide/unhide specific updates.

Herein below are the details for the three updates that were found:

Apologies that it is not in English, I’m running an Italian localized version of 1809 Home. The title of the first two updates translates to “Feature update to Windows 10 version 1903”, while the third translates to “Feature update to windows 10 version 1909”. Based on the KB numbers, the first two correspond to the September 10 and October 8 versions of 1903 and the third is ofc the current version of 1909. I can’t think of a reason why there are two versions of 1903 in the list, but I’m just going to hide both of them along with 1909.

And here is what I see after entering the hide command and then showing again the details:

After the next Patch Tuesday, I will run the commands again and let you know if a new version of 1903 and 1903 shows up to “replace” the hidden versions.

• This reply was modified 5 years, 5 months ago by Berserker79.
• This reply was modified 5 years, 5 months ago by Berserker79.
• This reply was modified 5 years, 5 months ago by Berserker79.

1 user thanked author for this post.

abbodi86

The output from the “show updates” command line only provides the name of the updates with no other data, so unfortunately I have no idea how o check what is the difference (if any) between the two instances of 1903 in the list.

I suspect that you are correct in that the feature updates will get renewed and thus show up again on each patch Tuesday: that’s what happened when I was using wushowhide on 1803 to hide 1903.

Anyway, I’d like to know how to reverse the operation and unhide the specific feature updates (i.e 1903 and 1909) only, since I plan to hide only those two. Thanks in advance!

[Berserker79]

Thank you abbodi86. This is much appreciated.

I’ve just got one more question: after running in powershell the lines of commands provided in your first link I got a list of updates including two instances of the 1903 feature update and one instance of the 1909 feature update (as I mentioned I’m on 1809 Home). Before I go ahead and enter the command to hide those feature updates, can you please let me know how I can unhide them if/when I change my mind and want the feature updates to install?

• This reply was modified 5 years, 5 months ago by Berserker79.

[Berserker79]

Thanks as always to woody for the helpful details. This was very interesting in order to figure out how to be prepared if I want to avoid an upgrade to 1909 of my 1809 Home machine until I feel ready for that.

I understand that 1909 is (currently?) offered as an OptionalInstall update and thus it will not show up in wushowhide. Assuming this does not change at a later time (i.e. at some point 1909 becomes non-optional and visible in wushowhide), can someone please expand on abbodi86 instructions regarding the use PowerShell to show OptionalInstall updates?

Specifically, it would be extremely helpful to have step by step instructions (but a link to a page with such instructions would also be fine of course) to guide me through the process of showing the 1909 optional update and hiding it. Thanks in advance!

• This reply was modified 5 years, 5 months ago by Berserker79.

So, for those on 1809 or higher, in essence this means that as long as we don’t use IE or fall for the old trick of opening suspicious links included in suspicious attachments of suspicious emails then there is no pressing need to install the out-of-band update, is that right? If so, it really sounds like my decision to ultimately move from 1803 to 1809 during the last DEFCON 3 period was well-timed and not at all invain!

BTW, for all those who don’t need IE at all, is there any clue whether disabling IE by using “Turn Windows features on or off” could also be an option to avoid falling victim to the exploit?