You still have time to get a copy of Win10 1709

Per a tweet from Paul Thurrott, the Download Windows 10 site is still offering version 1709. I just checked and it’s still there.

If you think you may need a copy of 1709 in the future, hop over there and download an official ISO.

Whatever you do, don’t burn it on a CD and then sell the CD as if it were a “genuine” 1709 CD.

Update: as mentioned in the comments, the page is now offering version 1803. Sic transit gloria.

Win10 1803 megathread

I’m just joking.

The real megathread is on Reddit. But it’s definitely not for the faint of heart.

Here’s what I’m seeing on the latest build (bare metal machine):

Kinda gives you a warm and fuzzy feeling about build quality, amirite?

Keep me posted on your problems.

A remarkably unbiased review of Win10 April 2018 Update

I just finished reading Preston Gralla’s review of the new Win10 version 1803.

You’re going to see lots of pie-in-the-sky reviews of Win10 1803 in the next few days. Microsoft has publisheda  massive list of improvements, complete with slick video explainers.

For a more down-to-earth (and, in my opinion, far more accurate) take, read Gralla’s review.

Bottom line, IMHO: There’s not much there, there.

Patch Lady – Get back to a schedule

Lately I’ve noticed that Windows patches have stopped being consistent.  No I’m not talking about bugs, I’m talking about timing.  Once upon a time updates came out any day, any time and if you were an admin at a firm you had to rush around and determine if you needed to apply the update.

Then came the era of the “Second Tuesday”.  Microsoft made the commitment of releasing security updates on the Second Tuesday.  If updates came out any other day, we all knew that the update was an “out of band” or “out of cycle” update that meant it was a needed security patch that needed to be installed immediately.  Then we had the fourth Tuesday where non security Office updates were released or any other update that didn’t kick a reboot.  Any update that kicked a reboot was released on Second Tuesday to minimize the amount of rebooting.

And now we have the new era of updating.

Here’s what it’s supposed to be:

First Tuesday of the month is reserved for non security Office updates.

Second Tuesday of the month is supposed to be security updates and any update that kicks a reboot.

Third Tuesday of the month is supposed to be preview updates for the following month’s Windows 7 and 8.1 releases

Fourth Tuesday of the month is supposed to be for “clean up” updates for Windows 10 especially for Semi annual targeted (the old CB) to fix issues during the early release.

Here’s our reality:

https://support.microsoft.com/en-us/help/4093105 Windows 10 1709 released on fourth Monday.

https://support.microsoft.com/en-us/help/4093112 Windows 10 1709 (main security update released on Second Tuesday)

https://support.microsoft.com/en-us/help/4089848 Windows 10 1709 – released on fourth Thursday

https://support.microsoft.com/en-us/help/4088776 Windows 10 1709 (main security update released on Second Tuesday)

https://support.microsoft.com/en-us/help/4090913/march5-2018kb4090913osbuild16299-251 Windows 10 1709 released on first Monday

https://support.microsoft.com/en-us/help/4074588 Windows 10 1709 (main security update released on Second Tuesday)

https://support.microsoft.com/en-us/help/4058258 Windows 10 1709 released on fourth Wednesday

https://support.microsoft.com/en-us/help/4073291/windows-10-update-kb4073291 Windows 10 1709 released on third Thursday

https://support.microsoft.com/en-us/help/4056892 Windows 10 1709 released on first Wednesday

It’s to the point where I see consultants disabling Windows 10 update services by setting up a task that runs daily to shut off the windows update service.  It’s to the point that I see consultants talk about “there was an out of band update yesterday” and I cringe because we’re becoming so numb to release cadence that we can’t tell when an update is an out of band for security purposes versus out of band because Microsoft released another fix.

I applaud Microsoft for fixing bugs, but….. given this release cadence we are causing people to take drastic steps to control updating.

Recently on twitter an image was posted about how Microsoft got feedback and made sure that everyone on campus understood customer pain.  But that image doesn’t fully encompass the true pain of Windows updating.

1. People don’t trust that their machine will recover from updating.  Look at the drastic measures we are doing to ensure we can control updates.
2. People don’t trust that their machine will get good solid notifications when a major update will occur.
3. People don’t trust that updates do exactly what they say they do and nothing else.
4. People don’t trust in the telemetry collection process.  [This is one that I respectfully disagree that telemetry is a bad thing.  I WANT Microsoft to get all the data points of how updates are good or bad.  Unfortunately telemetry is too much aligned with the forced updating problem and thus is getting a bad rap.]

So Microsoft, with all the new emphasis on privacy and data collection in 1803, with all the push on GDPR,  please start by rebuilding the trust of Windows Updates.  Start with going back to consistent days.  Start by going back to specific days of release.

We still have a long way to go.

How to really, truly block the pushed upgrade to the next version of Windows 10, version 1803

Here’s how to fend off Win10 version 1803, when it starts rolling out on Monday. The “official” deferral method was breached three times for version 1709, so a little extra protection may, uh, be in order.

Computerworld How-To.

MS-DEFCON 3: Apply April patches but if you have Win7 or Server 2008 R2, read the fine print!

If you waited until now to install this month’s patches, getting them should be easy. But if you jumped the gun and installed some or all of the Win7/Server 2008 R2 patches when they became available, a minefield of patching problems awaits.

Computerworld woody on Windows

Announcing “Windows 10 April 2018 Update”

The official announcement appeared, like clockwork, at 6 am Redmond time.

With Windows 10, we’ve focused on delivering the most modern and most secure operating system. Since its initial launch, we delivered two updates with features designed to enable the creator in each of us. With our latest major release – the Windows 10 April 2018 Update – we want to give you back some of your greatest currency, your time. Our hope is that you’ll have more time to do what matters most to you – create, play, work or simply do what you love…

The April 2018 Update will be available as a free download beginning Monday, April 30.

Which is an odd way of wiggling around the abysmal “Creators Update” marketing/naming scheme.

Interesting. The official announcement doesn’t include the word “version” anywhere. I’m going to assume it’ll call itself version 1803 — at least until I hear otherwise.

Anyway, I’m glad to see that the new name makes some sense — and it isn’t North America-centric.

Microsoft offers more Spectre v2 microcode updates, KB 4090007, KB 4091663, KB 4091664

Yesterday, I posted a note about two new Spectre v2 patches, KB 4078407 and KB 4091666.

The first is a Win10-only fix that has to be combined with a microcode change from your hardware manufacturer in order to accomplish anything. As @abbodi86 notes:

KB4078407 is not a patch, it’s just an executable that enables the Spectre mitigation protection by changing two registry entries

The second is a microcode-only, Intel-only, Win10 1507-only patch that changes the microcode for a large number of Intel processors.

This morning, Günter Born notes on Borncity that there are now four of these microcode patches:

• KB4090007 for Win10 1709/”Server 2016 version 1709″
• KB4091663 for Win10 1703
• KB4091664 for Win10 1607/Server 2016

In addition to the one I described yesterday, KB4091666 for Win10 1507.

None of them are available through Windows Update. You have to manually dig into the Update Catalog to get them.

As noted (voluminously) there are no known exploits as yet for Meltdown, Spectre v1 or Spectre v2. You might want to tuck these away in case we ever see a reason to use them.