|
Patch reliability is unclear, but widespread attacks make patching prudent. Go ahead and patch, but watch out for potential problems. |
Exploring Windows’ Administrative Tools: Part 5
Exploring Windows' Administrative Tools: Part 5
Windows’ Services tool gives you very fine control over how and when your system services run.
The Services tool is one of Windows’ Administrative Tools, a suite of professional-quality, system-management utilities used to adjust and control many of the operating system’s essential functions and features.
Starting with XP, these tools are either built into Windows or are offered as free add-ons. This guide to using the Services tool is the fifth installment in our Windows Administrative Tools series.
Part One of the series explains what the tools are and how to make them easily available from the Windows Start menu.
Part Two discusses Windows’ Performance Monitor, which reports in real time what’s happening within the OS as programs run — or fail to run!
Part Three describes how to use Windows’ Memory Diagnostic tool to thoroughly test your system’s random-access memory.
Part Four shows you how to use Windows’ Task Scheduler to run almost any program automatically, at the time and in the way you choose.
For this article on the Windows Services tool, I’ll focus mostly on the Win7 version because that’s the OS most Windows Secrets readers are running. But don’t worry — Windows XP’s, Vista’s, and Win8’s Services tools are very similar.
So what’s a Windows “service,” anyway?
Windows, like most operating systems, is a collection of hundreds of smaller programs. Windows Services are some of those smaller programs; they’re a special kind of software that runs in the background and provides specific, low-level functions to the operating system — and to other programs.
To put it another way, services are the software that lies beneath the veneer of the user interface. Services do the real work of running your PC — including networking, power management, hardware detection, cryptography, print spooling, security, and hundreds of other essential functions and features.
Right now, your Windows system is probably running about 150 services. (I’ll show you how to take a look at them in a moment.) The number of services fluctuates, depending on what you’re doing and what software you’re running.
Many services operate in daisy-chain fashion; they depend on other services for their input and deliver their output to still other services. This concept of dependency chains — services depending on others in order to function — is a key troubleshooting concept we’ll come back to later.
Many services start at boot-up and run continuously until shutdown. Others run on demand, triggered directly by a program or indirectly by a user action. The number of services your system is running at any time (and what those services are doing) has a huge impact on system performance.
For example: Long, slow boot-ups often result from too many services trying to load and run at the same time, during system start-up.
Which brings us to the Services tool: It lets you explore and control the services running on your system.
Getting started with the Services tool
In XP through Win7, fire up Services by simply typing services.msc in the Start menu’s text-entry box. In Win8, type services.msc in the Charms bar’s Search box.
In all versions of Windows, you also can access the Services tool via Control Panel’s (icon view) Administrative Tools applet. Or, if you’ve been following this series, you’ve probably set up Administrative Tools in the Windows Start menu. You’ll find Services there, too.
Figure 1 shows a typical opening window for Windows 7’s Services (other Windows versions have similar displays). At the moment I grabbed this screen shot, my Win7 system was running 179 services.
Figure 1. The Services tool (Win7's is shown) lists all the services currently running on your PC.
Note the two tabs — Extended and Standard — in the lower-left corner of the Services’ window. The Extended tab, open by default, provides an easy-to-read, full-text description of almost any service you select. If you want to save some room, select the Standard tab, which suppresses the separate full-text description.
In either view, you’ll find additional top-level information about the services in five columns: Name, Description, Status, Startup Type, and Log On As. (See Figure 2.) You can sort, or reverse-sort, each column by clicking its heading.
Figure 2. These five columns (shown in Standard view) display essential, top-level information about each service.
- Name is self-explanatory; it’s just the name of the service.
- Description is usually the same descriptive text that appears in the Extended tab and is presented in linear (rather than paragraph) format.
- Status shows whether the service has Started (i.e., is actually running and active).
- Startup Type tells you how the service gets launched. I’ll explain the options later, but for now, note that changing a service’s Startup Type can be extremely useful in reducing boot times.
- Log On As displays the type of account — local system accounts, network accounts, or specific users — that can access and control the service.
Exploring and editing individual services
Simply viewing your system’s services and their settings is 100 percent safe. But if you plan to make any changes to your services, ensure that your system backups are complete and current.
It’s easy to see more detail about any given service: Simply double-clicking its entry in the Services list opens its Properties window. (You can also right-click a given service and select Properties, in the traditional manner.)
Most systems will have a somewhat different list of services. So for this demonstration, let’s explore a service that’s installed by default in almost all Windows setups: Print Spooler — the service that queues documents for printing.
After exploring that nearly universal service, you can apply what you’ve learned to examining, performance-tuning, and/or troubleshooting other services running on your setup.
(BTW: If the Print Spooler service isn’t available on your system, no problem: just follow along using any general service. Pick one!)
To begin our exploration of Print Spooler, scroll down the Services list and double-click its entry (or the name of the alternative service of your choice). The Properties dialog will open with its General tab displayed.
Note the General tab’s Service status, highlighted in Figure 3. It tells you what the selected service is doing, and it offers buttons that let you control the service.
Figure 3. The Service status area (circled) lets you directly start, stop, and — in some cases — pause a service.
On most systems, Print Spooler starts during Windows’ launch, so its status should be Started. Clicking Stop terminates the service; clicking Start initiates it.
Some services allow finer control — you can click Pause or Resume, as needed. As in the case of Print Spooler, if a service doesn’t allow pausing, the buttons will be grayed out (see Figure 3).
These Service status options can be useful when troubleshooting a Windows problem. If, for example, you suspect a given service is causing trouble, you can stop or pause it and observe the effect.
Before doing either, however, click the Dependencies tab, shown in Figure 4. This will let you see what other services might be affected by pausing or stopping a service.
Figure 4. The Dependencies tab shows other services the current service depends on — and which depend on it.
In my example, you can see that Print Spooler depends on the HTTP and RPC services. This is vital troubleshooting information: If you were having a problem with Print Spooler, you’d now know that the problem could be upstream, rooted in the HTTP or RPC services. Checking dependencies can help focus your troubleshooting on the most likely sources of trouble.
In Figure 4, you can also see that Fax services depend on Print Spooler. Identifying those services dependent on the current service helps avoid unintended downstream consequences. In this case, for example, if you stop Print Spooler, Fax services will fail.
An MS TechNet article, “View service dependencies,” will give you more info.
Typically, Windows tries to recover from services failures automatically. The Recovery tab (shown in Figure 5) lets you modify the default service-recovery actions.
Figure 5. The Recovery tab lets you explore and change what Windows will do if a service fails.
Recovery options can be complex. The TechNet article, “Set up recovery actions to take place when a service fails,” contains complete information. Using Print Spooler as an example, here’s a quick overview:
- By default, Windows will try to Restart the Service the first and second time Print Spooler fails.
- Windows will Take No Action on third and subsequent Print Spooler failures.
- Windows will wait one minute between restart attempts and one day before it resets the fail count and starts over.
You can change each of those variables. Click the pull-down menu for the First, Second, or Subsequent failures, and you’ll get the following options:
- Take No Action
- Restart the Service
- Run a Program
- Restart the Computer
If you select Run a Program or Restart the Computer, the grayed-out options — Restart Computer Options and Run Program (in the lower half of the Recovery Tab) — become available.
You also can change the numeric values for Reset the fail count and Restart service after as you wish.
The Log On tab, shown in Figure 6, lets you control the accounts that can access and use the service — i.e., local system accounts, network accounts, or specific users. Generally, this setting should be left alone, but if you want to delve into it, see the TechNet article, “Services permissions.”
Figure 6. By default, the Print Spooler service is set to Local System account.
And that brings us back to the General tab.
Modifying a service to reduce startup times
One of the most common and productive uses of Services is to reduce the time a PC takes to be ready to use. Not all services need to load during Windows boots. Preventing or delaying their start can improve boot times.
All Windows versions support three service Startup types: Automatic, Manual, and Disabled.
Automatic means the service starts on its own, at boot-up. That’s often a good thing. For example, you need core operating system services to start right away, and you certainly want your firewall and other security services up and running as soon as possible.
But other services aren’t that important. Setting the Startup type to Manual removes those less critical services from the boot process. Instead, they start when triggered by a program that depends on them — or indirectly due to a user action. Unfortunately, manual startups sometimes don’t work reliably, so use this option with care. Check the service’s dependencies to ensure you’re not affecting some other, essential service.
Disabled means the service won’t start at all. Any software that depends on that service will most likely not operate properly — or at all. Use this option only if the service is one you know you’ll never use. (For example, the Tablet PC Input Service is typically never needed on nontablet PCs.) And as with the Manual option, use the Dependencies tab to ensure that no essential software depends on the service you’re disabling.
Vista, Windows 7, and Win8 offer a fourth option: Automatic (Delayed Start). This starts the service automatically, but only after the operating system is fully booted.
The Automatic (Delayed Start) option can be extremely useful in reducing boot-up times for those services that allow the setting. Not all services do; in particular, Windows protects itself, and won’t let you set an essential service to Delayed Start, if that service needs to be in normal Automatic start mode.
Print Spooler is that kind of core service and usually should be left alone. But we can still use it to see where the Startup-type options are (see Figure 7).
Even though you can select Automatic (Delayed Start) in the Print Spooler properties, Windows won’t let you apply it.
Figure 7. Changing a service's Startup type can help reduce startup times, but it needs to be done with caution.
For more help on Startup types, the TechNet article, “Configure how a service is started,” has specifics.
Of course, if you make any change that doesn’t work out, you can always re-edit the service Properties to restore the original setting. A TechNet article lists the default settings for many Windows services.
Where to find additional information
What I’ve given you in this article just scratches the surface of Windows’ Services tool. Here are some good sources for additional information:
- TechNet article, “Services Snap-in,” provides overview concepts, best practices, how-tos, and troubleshooting for Vista, Win7, Win8, and Windows Server.
- Oddly, neither TechNet nor Microsoft.com offers much on XP’s Services tool. Check out the brief article, “Using the Microsoft Management Console” and the even-briefer page, “Using Services.”
- Surprisingly, you find more help in XP’s built-in Help system. Click Start/Help and Support, then enter the search string Administrative tool reference A-Z. Open the A-Z reference tool and scroll down to Services.
For a real-life example of how to use the Services tool, see “Windows’ Services editor disables runaway code,” the first item in the Nov. 8 LangaList Plus column (paid section).
Used with caution, Services can put you in control of your PC like never before!
The art of domino toppling: A natural for video
 |
By Kathleen Atkins Who hasn’t built a simple tower of sticks or blocks or cards and then — after an appreciative pause — knocked it over? You’re likely to have a hard time finding someone in the world who can’t be fascinated by things falling down. But consider the pastime of domino toppling, in which structures rise for the specific purpose of falling apart spectacularly. For some people, it’s a competitive activity — painstakingly building complex constructions, simply for the pleasure of watching something collapse in prolonged and intricate ways. Play the video |
Microsoft Accounts: The good, bad, and indifferent
For those venturing into Windows 8, one of the first surprises during the installation process is a request for your Microsoft account.
Providing your account name is optional, but doing so has numerous implications that extend beyond Windows 8.
What, exactly, is a Microsoft account?
Simply put, a Microsoft account is an e-mail address that’s been registered with Microsoft. Almost any address will do. But like everything with Microsoft, the real answer is more complex — there are, ah, nuances.
If you have an e-mail address created by Microsoft — @hotmail.com, @live.com, @outlook.com, @msn.com, etc. — you have a Microsoft account. For the past 15 years, Microsoft’s been issuing e-mail addresses under various names: Hotmail, Microsoft Passport, MSN, .NET Passport, Member Services Passport, Messenger ID, Windows Live ID, Xbox Live ID, Zune/Zune Pass ID, Windows Phone, and SkyDrive ID. I’m sure I’ve missed a few. All of those terms are now obsolete; they’re all just Microsoft accounts.
Many users are confused about the e-mail addresses used for MS accounts — they might assume that the address must contain one of the aforementioned Microsoft e-mail sites. But you can register any active e-mail address for a Microsoft account. Some users mistakenly believe they must give Microsoft the password for a registered e-mail address. Not true.
Another misconception is that you need a Microsoft account when setting up Windows 8. Again, not true. But here, Microsoft stacks the deck, encouraging you to either sign up for a new Microsoft-issued e-mail address or to register a current e-mail address as a Microsoft account. But you don’t need to do either. More about that later.
Here’s how to turn a normal e-mail address — say, WilliamGates385@yahoo.com — into a Microsoft account:
- Go to the Windows Live ID sign-up page. (Yes, I know that Microsoft calls it Microsoft account, but the page is still in the live.com domain.)
- As shown in Figure 1, fill out any convenient name and birth date. Use your real name and birth date, if you like. (If someone hijacks your Microsoft account, using your real name might help convince Microsoft that this really is your account. More about that below.) Or use a fictitious name — Microsoft doesn’t demand your real name.
Figure 1. You can turn any e-mail address into a Microsoft account.
- The Microsoft account name must be an e-mail address that you can access. (It doesn’t have to be tied to the personal name you gave for the account.) Microsoft will send an account confirmation e-mail to the address you give, and you need to reply to the message.
- The password you fill in applies only to the Microsoft account. It doesn’t have to be (indeed, shouldn’t be) the password for the e-mail address you provided. Don’t reuse passwords.
- If you feel comfortable giving Microsoft your phone number, by all means do so. As far as I know, Microsoft has never used this number to call someone. But should your Microsoft account get hijacked, having your phone number on file could help get your password reset. (Although the MS account form doesn’t say so, you don’t have to provide a phone number.)
I don’t give out my phone number. I prefer to click the Or choose a security question link below the phone-number box and provide an answer to one of Microsoft’s security questions.
The rest of the sign-up form is typical fare: you type in a CAPTCHA code and uncheck the Send me email with promotional offers box (unless, of course, you like receiving spam).
How Windows 8 uses a Microsoft Account
Undoubtedly, part of Microsoft Accounts is building a massive database of potential customers, tracking their clicks and travels on the Web, and selling them everything from aardvarks to Zunes. Tinfoil-hat theories might not be far off the mark when considering Microsoft’s motivations and actions.
That said, a Microsoft account does offer some worthwhile benefits that are possible only if you’re willing to let Microsoft tag along and watch you. Whether the benefits are worth any personal privacy erosion is a personal choice. What’s important is that you understand the alternatives so that you can make an informed decision.
In general, Microsoft accounts are used for all your interactions with Microsoft. Want to post a question on the Microsoft Answers forum (recently renamed the “Microsoft Community”)? Yep, you need a Windows Live ID, er, a Microsoft account. Buying music from the Xbox Music store? That requires a Microsoft account — and a credit card to back it up. Downloading a free Metro app from the Windows Store? You need a Microsoft account for that, too.
Windows 8 sign-in accounts (we used to call them “usernames” or “Windows logon IDs”) fall into two completely separate categories: they’re either Microsoft accounts, or they’re local accounts. If you sign in with the name on your Microsoft account, Windows checks your password against what’s stored on a Microsoft accounts database in the cloud. (If the computer is not connected to the Internet, there is a fail-safe mode, discussed in the next section.) Once again, the sign-in names used for all Microsoft accounts look like e-mail addresses — because they are e-mail addresses.
Local accounts, on the other hand, aren’t tied to any big database in the sky. Local accounts typically look like the usernames we’ve used for years: Woody, Dummy, GetMeOuttaHere, LtUaE42, or something similar. Windows 8 doesn’t make it easy to create a new local account — but it can be done if you watch what you’re clicking. (Click or tap Settings/Change PC Settings/Users/Add a user/. Look carefully for Sign in without a Microsoft account and then select the Local account box.)
Windows 8 has a handful of worthwhile features tied to a Microsoft account — though I suppose “worthwhile” is in the eyes of the beholder. I find some of them useful, some of the time.
For example, if you have two or more Windows 8 machines using the same Microsoft account, the OS will automatically sync some settings between the machines. These include user picture, Start screen tile layout, backgrounds, Internet Explorer history and favorites, icons on the desktop Taskbar, and some passwords. Windows even syncs Metro games scores and websites currently open in IE 10.
That automatic updating can be both useful and annoying. For instance, if you have a big-screen computer and a tablet both running on the same Microsoft account, the Start screen tile layout flip-flops all over the place. On the other hand, if you’re called away from a hot game of Solitaire and can resume it on another machine, you might be a happy camper.
Settings synching isn’t unique to IE 10. Google’s Chrome browser has a similar capability. Unlike Win8, Chrome lets you pick up your settings on any computer, anywhere — if you’re willing to sign in to Chrome with your Google ID. (Hey, Google collects privacy-bending data, too.) To migrate the IE 10 settings, you have to sign in to a Windows 8 machine that’s already using your Microsoft account.
If you use a Microsoft account on a Win8 machine, it will also automatically sign you in to other installed apps and services, such as the Windows Store and SkyDrive. (That’s either beneficial or scary, depending on how you look at it.) Signing in with your Microsoft account can also download new messages in Mail, sync images in Photos with Flickr, and connect People with Facebook — all automatically.
Sync settings can be customized; you can, for example, have Win8 sync your IE 10 history but not your Start-screen tiles. You change sync settings by bringing up the Charms bar and choosing Settings/Change PC Settings/Sync Your Settings. Adjust the On/Off sliders according to your wishes.
The hidden risks of Microsoft Accounts
By now, you must be asking yourself, “What happens if I use my Hotmail e-mail address to log on to Windows 8 and somebody hijacks my Hotmail account?” That’s a very good question.
Fortunately, Microsoft has thought of that, too, and has included some safeguards. First and foremost: if a hijacker changes your password, you won’t be locked out of Windows 8. There’s a mechanism (which I haven’t seen documented anywhere) that lets you sign in to Windows 8, using your old password, for at least several weeks.
When you use an old password, Windows warns you, “You’re signed in to this PC with your old password. Sign in again with your current password, or reset it.” If you go through the usual method in the Metro Change PC Settings dialog to reset your password, you can’t — the Reset option is grayed out. The only way to reset your password is to sign in to the live.com password reset site and follow the instructions there.
As long as you can remember your old password, Windows 8 will let you sign in — but to a reduced-functionality mode that’s similar to a local account. You then need to reset your account as soon as possible.
Microsoft doesn’t treat MS account information cavalierly. As stated in the Building Windows 8 blog:
- [Data] is sent to the cloud. All data and settings that leave your PC are transmitted using SSL/TLS. The most sensitive information, like your credential information, is encrypted once, based on your password, and then encrypted again as it is sent across the Internet.
“The data stored is not available to other Microsoft services or third parties. Last, before the sensitive information can be accessed on a second Windows 8 PC for the first time, you must establish “trust” for that PC by providing further proof of your identity. This further proof can be done by providing Windows with a code sent to your mobile phone number or by following the instructions sent to an alternate email address.
“Any of the data that is saved to the cloud via the roaming mechanism is only accessed by Windows for roaming. This is very important. So for example, Internet Explorer’s history is saved as a roaming state but is not used or accessed in any other context — it is no different than if you had manually created that same record of website history on another PC.”
On the other hand: clearly, Microsoft can and will collect information about how you use your Microsoft account — which Windows 8 PCs you use, when you sign in, even (in conjunction with IE 10) what websites you’ve visited (although InPrivate Browsing sites are understood to be verboten). If Microsoft has published a blanket declaration that it won’t retain personally identifiable information related to Windows 8 sign-ins, I haven’t seen it.
The choice depends on your security sensitivity
If you’re not ready to put some level of trust into Microsoft, obviously, you should avoid Microsoft accounts and use only local accounts, knowing all the while you’ll still have to sign up for a Microsoft account if you want to download any apps — even free ones — from the Windows Store.
I’ve been using Windows 8 for more than a year, and for most of that time I’ve set up throw-away Hotmail and Outlook.com accounts to use as Windows 8 Microsoft accounts. But I’m coming around to the idea of using a local account as my main account — that’s the account I use when I’m working, almost exclusively on the old-fashioned desktop — and signing in to Windows 8 with a little-used but still valid @hotmail.com account when I need to go into the Windows Store or otherwise use a Microsoft account. (I’m painfully aware of the fact that my credit-card information is tied to that Hotmail account, so I use that account as little as possible.
If you have a better approach, I’d sure like to hear about it! All of us who have taken up Windows 8 (don’t tell anybody, but I’m now running Windows 8 on my production machine) are facing similar trade-offs. Drop by the Windows Secrets Lounge and tell me how you’re coping.
Internet Explorer 10 on Windows 7 Preview out
Windows 7 users receive security patches for IE 9 plus a preview of IE 10.
Also, OpenDNS and Microsoft duke it out over an IPv6 update — with your computer acting as referee.
MS12-071 (2761451)
IE 9 users get a cumulative security update
It’s not a Patch Tuesday without some sort of Internet Explorer update. This time around, the fix is for three newly reported vulnerabilities in IE 9 that could allow an attacker to acquire the same rights as the current user. It’s a good reminder that one of the top security best practices is to do your browsing in a standard-user account (not an admin-level account).
IE 9 is the only version of Internet Explorer impacted by this critical update.
For Windows 7 users who like testing new software, Microsoft just released a preview version of IE 10, the browser included with Windows 8 and RT. (Some of you might have forgotten that a Win7 version of IE 10 has been in the works.) You can get the preview at an MS Downloads page or a TechSpot site that includes Microsoft’s promo material. I plan to test drive IE 10 on Windows 7 Preview soon; Microsoft claims it’s faster and more secure, plus does a better job of displaying webpages than its predecessors.
Keep in mind, however, that this is beta software. Use it for testing only, and don’t install it on production systems.
What to do: Install KB 2761451 (MS12-071) as soon as it’s offered.
MS12-075 (2761226)
Using malicious TrueType fonts to take control
This is one of those “click a link; get infected” threats. In this case, vulnerabilities in the Windows kernel-mode drivers could allow an attacker to download malicious TrueType fonts and take control of a PC. A computer cracker (the preferred label for black-hat hackers) would most likely exploit this vulnerability as part of a blended attack — i.e., combining two or more exploits to gain rights to a system.
KB 2761226 is rated critical and impacts all — and I do mean all — currently supported versions of Windows. (Yes, that means Windows RT, too.)
This is one of the first three security patches for Windows 8/RT.
What to do: Install KB 2761226 (MS12-075) immediately.
MS12-074
.NET Framework gets a WPAD upside the head
MS12-074 is a bundle of updates for every supported version of .NET Framework — from 1.0 to 4.5. The updates also apply to all supported versions of Windows, including Windows RT.
About half of these updates are rated critical. But because it’s .NET, I recommend delaying installing the patches for a week or two. Once I’ve had a look at these patches, I’ll give you my take in the Windows Secrets Lounge post for this article. (That will probably be during the U.S. Thanksgiving week.)
I feel comfortable delaying these updates. An attacker has to jump through numerous hoops to crack your system and set up a man-in-the-middle proxy server. As noted in a Nov. 13 MS Security Research & Defense blog, a malicious hacker “would need to act as the authoritative proxy auto-configuration file server for your network,” possibly by registering the hostname WPAD (Wikipedia definition).
This type of exploit is typically targeted at military systems — not the simple workstations most of us use. So, for now, the greater risk might be from installing the patch than from any potential attack.
What to do: Hold off on these updates for now. You can find the complete list of KBs at MS12-074.
MS12-072 (2727528)
Taking control of Windows through your Briefcase
Given our increasing use of cloud-synching software, I just had to investigate the exploit described in MS12-072. Almost all versions of Windows — XP through Win8, but not Windows RT — suffer from potential Briefcase attacks.
No, I’m not talking about surly business folk whacking you with their briefcases; rather it’s the mechanism in Windows that syncs file between Windows Explorer and a USB flash drive — a feature most Windows users have probably forgotten about. (Right-click in an Explorer folder window and select New; you should see the Briefcase [more info] option.)
In this exploit, malicious Briefcase files could be used by computer crackers to gain access to systems. This update ensures that doesn’t happen.
What to do: KB 2727528 (MS12-072) is rated critical; install it as soon as possible.
MS12-076 (2597126, 2687307, 2687311, 2687313, 2687481)
Malicious Excel files lead to attacks
Excel is nearly ubiquitous in business, so it should be no surprise that crackers are using malicious Excel files to target companies. The patches in MS12-076 fix four vulnerabilities in Excel, Versions 2003, 2007, 2010; Excel Viewer; Office Compatibility Pack (SP2 and SP3); Office 2008 for Mac; and Office for Mac 2011. The newly released Excel 2013 is immune.
As savvy Windows users, most Windows Secrets readers probably wouldn’t open unknown or unexpected Excel files in the first place.
What to do: Install the appropriate update listed in MS12-076 when offered.
MS12-073 (2716513, 2719033, )
Servers get a patch for IIS Version 7.0
Many years ago, Microsoft Internet Information Services (IIS) Version 4 (released on Windows 2000) prompted in a more secure era of coding. It (along with previous versions) was attacked often that Microsoft built IIS 5 to improve secure. Since Version 5, IIS has hardly ever needed patching. So for the first time in a long time, server admins running IIS — and who downloaded an optional FTP update — should review the update. In this case, the patches are included in MS12-073 and fix an information-disclosure issue.
This is just an FYI for admins; most Windows Secrets readers will never see nor have need for this update.
What to do: Rated moderate, the patches in MS12-073 apply only if you’ve installed FTP 7.0 or 7.5 on your webserver.
2750841
OpenDNS and Microsoft duke it out over IPv6
A Microsoft update that fixes issues with the Windows implementation of IPv6 is conflicting with OpenDNS’s implementation of the protocol.
I have a couple of my own issues with KB 2750841. First and foremost, it’s a nonsecurity update included with the Patch Tuesday security updates. As regular Patch Watch readers know, that alone puts an immediate hold on the patch.
Furthermore, the update’s conflict with OpenDNS means you might get an annoying popup, prompting you for additional sign-in information. It’s similar to the authentication alert you get when accessing a hotel’s wireless network.
As noted in the OpenDNS Forums, the popup appears because the system can’t resolve http://ipv6.msftncsi.com/ncsi.txt or any of the other checks that Microsoft’s Network Connectivity Status Indicator uses to detect a live Internet connection. That in turn redirects your browser to the OpenDNS Website Unavailable page. A Super User blog post gives an excellent discussion on why you might get an additional-authentication prompt.
What to do: Until this conflict between Microsoft and OpenDNS gets straightened out, skip KB 2750841.
Nonsecurity Driver Framework updates get a pass
While the Windows Secrets staff is taking a break for the Thanksgiving holiday, I’ll post any new information on several optional updates in the Windows Secret Lounge. Microsoft is releasing several updates to Kernel-Mode Driver Framework– (more info) and User-Mode Driver Framework– (more info) based drivers. Neither KB 2685811 (kernel-mode) nor KB 2685813 (user-mode) is a security update. So we can take some time to review them.
While you’re at it, hold off on KB 2761217 (adding Calibri fonts to Windows 7) and KB 2763523 (duplicate DUID in DHCPv6). Also wait on nonsecurity updates KB 2687277 for OneNote 2010, KB 2687623 for Outlook 2010, and KB 2687509 for Office 2010 (which fixes a conflict when Office 2013 is also installed). I’ll review all of these updates in the WS Lounge.
What to do: During the Thanksgiving Windows Secrets break, head over to the WS Lounge to revisit these updates.
Windows 8 and RT
Although the hot headlines in the tech world this week were about the abrupt departure of Windows 8 leader Steven Sinofsky, new Windows 8/RT users were more concerned about a series of updates. For example, MS Surface tablets using Windows RT received a firmware update. Windows 8 and Windows Server 2012 users received KB 2770917 — a cumulative update for November; KB 2769034 — fixing a problem in the Windows-recovery environment; KB 2769165 — a digital signatures fix; and, last but not least, KB 2772501 — a patch for an IE Favorites display problem.
My friends who purchased Windows RT Surface tablets love their device. But as early adopters, they also have to cope with the numerous early-days updates.
What to do: The pioneers of Windows 8 should expect more “finishing touches” updates in the weeks to come.
Regularly updated problem-patch chart
This table provides the status of problem patches reported in previous Patch Watch columns. Patches listed below as safe to install will be removed from the next updated table. For Microsoft’s list of recently released patches, go to the MS Safety & Security Center PC Security page.
| Patch | Released | Description | Status |
|---|---|---|---|
| 2686509 | 05-08 | Kernel Mode Driver; install issues on XP (updated status) | Skip |
| 2699779 | 06-12 | Office 15 installation fix (updated status) | Skip |
| 2709630 | 06-12 | Network domain sign-in delays (updated status) | Skip |
| 2592687 | 10-23 | Windows RDP 8.0 update for Win7 SP1 | Skip |
| 2574819 | 10-23 | Adds DTLS support to Win7 SP1 | Skip |
| 2750841 | 11-13 | MS/OpenDNS IPv6 conflict | Skip |
| 2553272 | 08-14 | Office 2010 stability/performance fixes | Wait |
| 2598289 | 08-14 | Office 2010 stability/performance fixes | Wait |
| 2661254 | 08-14 | Minimum certificate key length | Wait |
| 2735855 | 09-11 | Windows Filtering Platform: potential third-party firewall impact | Wait |
| 2553402 | 10-09 | MS FAST Search Server 2010 for SharePoint SP1 | Wait |
| 2731771 | 10-09 | Time-zone conversion | Wait |
| 2739159 | 10-09 | Windows 7 encryption | Wait |
| 2754849 | 10-09 | SQL Server; see MS12-070 for complete patch list | Wait |
| 2756822 | 10-09 | Cumulative time-zone update | Wait |
| 2745030 | 11-13 | .NET updates; see MS12-074 for complete patch list | Wait |
| 2732487 | 08-14 | Win7 sleep-mode hotfix | Optional |
| 2647753 | 10-09 | Printing core components — timestamp reissue | Optional |
| 2732487 | 10-09 | Segoe font — timestamp reissue | Optional |
| 2770816 | 10-23 | Install only if KB 2756872 fails; check MS Support site for details | Optional |
| 2687314 | 10-09 | Office Compatibility | Install |
| 2705219 | 10-09 | Networking components — timestamp reissue | Install |
| 2724197 | 10-09 | Windows Kernel | Install |
| 2731847 | 10-09 | Kernel update — timestamp reissue | Install |
| 2732500 | 10-09 | Win7 System Restore failures — timestamp reissue | Install |
| 2741517 | 10-09 | MS Office (HTML Sanitization Component); see MS12-066 for complete patch list | Install |
| 2742319 | 10-09 | MS Word; see MS12-064 for complete patch list | Install |
| 2743555 | 10-09 | Windows Kerberos server | Install |
| 2749655 | 10-09 | Certificate timestamp proactive fix | Install |
| 2754670 | 10-09 | MS Works 9 | Install |
| 2756485 | 10-09 | Exchange 2003 — timestamp reissue | Install |
| 2756496 | 10-09 | Exchange 2007 — timestamp reissue | Install |
| 2756497 | 10-09 | Exchange 2010 — timestamp reissue | Install |
| 2756872 | 10-09 | Windows 8 cumulative update | Install |
| 2720184 | 11-13 | Excel vulnerabilities; see MS12-076 for complete patch list | Install |
| 2727528 | 11-13 | Windows Briefcase | Install |
| 2761226 | 11-13 | TrueType kernel | Install |
| 2761451 | 11-13 | IE 9 cumulative update | Install |
Status recommendations: Skip — patch not needed; Hold — do not install until its problems are resolved; Wait — hold off temporarily while the patch is tested; Optional — not critical, use if wanted; Install — OK to apply.
Publisher: AskWoody LLC (woody@askwoody.com); editor: Tracey Capen (editor@askwoody.com).
Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. AskWoody, Windows Secrets Newsletter, WindowsSecrets.com, WinFind, Windows Gizmos, Security Baseline, Perimeter Scan, Wacky Web Week, the Windows Secrets Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of AskWoody LLC. All other marks are the trademarks or service marks of their respective owners.
Your email subscription:
- Subscription help: customersupport@askwoody.com
Copyright © 2025 AskWoody LLC, All rights reserved.
Plus Membership
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
Get Plus!
Recent Topics
-
Excel Macro — ask for filename to be saved
by 47 minutes ago
-
Trying to backup Win 10 computer to iCloud
by 18 hours, 13 minutes ago
-
Windows 11 Insider Preview build 26200.5570 released to DEV
by 1 day, 7 hours ago
-
Windows 11 Insider Preview build 26120.3941 (24H2) released to BETA
by 1 day, 9 hours ago
-
Windows 11 Insider Preview Build 22635.5305 (23H2) released to BETA
by 1 day, 9 hours ago
-
No April cumulative update for Win 11 23H2?
by 9 minutes ago
-
AugLoop.All (TEST Augmentation Loop MSIT)
by 1 day, 10 hours ago
-
Boot Sequence for Dell Optiplex 7070 Tower
by 2 days, 1 hour ago
-
OTT Upgrade Windows 11 to 24H2 on Unsupported Hardware
by 2 days, 4 hours ago
-
Inetpub can be tricked
by 12 hours, 23 minutes ago
-
How merge Outlook 2016 .pst file w/into newly created Outlook 2024 install .pst?
by 22 hours, 51 minutes ago
-
FBI 2024 Internet Crime Report
by 2 days, 8 hours ago
-
Perplexity CEO says its browser will track everything users do online
by 1 day, 20 hours ago
-
Login issues with Windows Hello
by 2 days, 19 hours ago
-
How to get into a manual setup screen in 2024 Outlook classic?
by 2 days, 7 hours ago
-
Linux : ARMO rootkit “Curing”
by 3 days, 7 hours ago
-
Employee monitoring app leaks 21 million screenshots in real time
by 3 days, 7 hours ago
-
Google AI is now hallucinating idioms
by 3 days, 8 hours ago
-
april update
by 1 day, 12 hours ago
-
Windows 11 Insider Preview build 27842 released to Canary
by 3 days, 8 hours ago
-
Quick Fix for Slowing File Explorer
by 3 days, 9 hours ago
-
WuMgr not loading?
by 2 days, 4 hours ago
-
Word crashes when accessing Help
by 2 hours, 47 minutes ago
-
New Microsoft Nag — Danger! Danger! sign-in to your Microsoft Account
by 3 days, 8 hours ago
-
Blank Inetpub folder
by 3 days, 6 hours ago
-
Google : Extended Repair Program for Pixel 7a
by 3 days, 19 hours ago
-
Updates seem to have broken Microsoft Edge
by 3 days, 5 hours ago
-
Wait command?
by 3 days, 12 hours ago
-
Malwarebytes 5 Free version manual platform updates
by 4 days, 1 hour ago
-
inetpub : Microsoft’s patch for CVE-2025–21204 introduces vulnerability
by 4 days, 8 hours ago
Remembering Woody
