Opinion: The first Patch Tuesday of '21; time to delay updates

[Gandalf_The_Grey]

It’s Patch Tuesday time — that exciting second Tuesday of each month when we turn towards Redmond, WA, hoping for quality updates — and my advice is to not install updates tomorrow. To be fair, the vast majority of Microsoft users should be fine with whatever patches and fixes arrive. But, personally, I push off updates and delay installations on the systems I care about; you should do the same.

With that piece of advice out of the way, I have some suggestions for 2021 for a healthy patching year.

Susan’s first recommendation of ‘21: Use Windows 10 Pro, not Home.

I recommend several things when dealing with updates: First and foremost, make sure you are on Windows 10 professional, not Windows 10 Home.

By design, Windows 10 Home doesn’t expose as many settings to defer and push off updates. If you are running either Windows 10 Home or Windows 10 Home S, I recommend upgrading to Pro. To do this, click on Start>Settings, then on System and scroll down to About. If it says Home under “Edition,” whip out your credit card and click on “change product key or upgrade your edition of Windows.” The upgrade process to purchase Windows 10 Professional takes a few minutes. You will be prompted to reboot and your machine will then be running the Pro version.

If you purchase a machine with Windows 10 S mode, this specific platform only allows installations of software from the Microsoft store. I have had the fun job of having to upgrade a Windows 10 Home S mode Surface device to Windows 10 Pro. I was surprised to find it’s a two-step process. First, I followed the same process outlined above: You go into the About screen and purchase a product key online to move the machine to Pro. I thought that would be enough to flip the machine out of S mode. It was not. I had to enter the Microsoft Store and search for a link to do so. Once I did, the Surface was finally on Windows 10 Professional.

In truth, I think S mode is ultimately where enterprises might end up: It’s a locked-down version of Windows 10 that only allows Microsoft store apps to be installed. Similar to an iPhone, where you can only install updates from the Apple store, it keeps the system better protected from ransomware and other malware. But if you are an everyday Windows user like me, you need to be able to download and install software from sources other than the Microsoft store.

While you are in the About section, see what feature release version you’re running. For consumers and small businesses (anyone without an Enterprise or Education license) you need to at LEAST be on version 1909, 2004 or 20H2. If you are not on any of these versions, you’ll not get security updates this month.

Susan’s second recommendation of ‘21: Set updates to install later in the month (and set targetedreleaseversion to 2004 or 20H2).

On Windows 10 Pro, there are a couple of settings I always check. First, I always go into Start>Settings, Update & Security, Windows Update; click on Advanced options, scroll down and choose “Pause until …”and select a date later in the month. I prefer setting a specific date as I feel this process works better than using pause. Then I set the targetedreleaseversion for the feature release version I’m comfortable with. (I don’t install feature releases right away; this setting lets me push it off and only install the release I want. I’m now comfortable recommending the 2004 feature release if you haven’t already moved to it. Microsoft finally fixed one of the lagging bugs in 2004 and 20H2, a crash issue that was triggering reboots on Jan. 7 among users renaming the Administrator account.

For business users, I’m comfortable with (and personally run) 2004 in my business. Don’t worry if you are already on 20H2; I’m running that version at home and have not seen major issues. I prefer to stay one version behind and recommend that you set the targetedreleaseversion at 20H2; doing so means that once the NEXT feature release comes out, you won’t be first in line.

If you are unlucky to have a computer with a Conexant audio driver, you may still be blocked from upgrading to 2004 or 20H2. Many users report that they’ve worked around the issue by manually uninstalling the Conexant driver in the driver settings to revert to a generic Microsoft audio driver. They then trigger the installation of 2004. Once it’s installed, the driver will automatically get updated to the Conexant driver. You can scroll down to “DaleHuhtala’s” Dec. 2 post in the answers forum for details on the process. I’m still hoping Microsoft will provide a better update process for these machines.

Prepare to say goodbye to Flash

Last but not least, we can start saying goodbye to Adobe flash. Microsoft will be releasing a Windows update, KB4577586, to remove Flash, but you can take action now. You can check whether Flash is installed by going to the Adobe Flash web page and clicking on check now. You will need to check each browser you have on your computer to test whether it’s still enabled. You can manually download KB4577586 from the catalog site, by matching up the version you have. Remember X86 means a 32-bit operating system, and X64 means 64-bit operating system. I’ve provided a step by step video on the AskWoody Youtube page for more details.

As always, if you have any questions please let us know on Askwoody.com.

The first Patch Tuesday of ’21; time to delay updates

Though most users should be ok with the latest round of patches from Microsoft, it's still prudent to delay installing them for a bit to make sure there are no problems.

www.computerworld.com

 

[Jan Willy]

Can we expect issues?

 

[Gandalf_The_Grey]

Can we expect issues?

You never know beforehand.
I install the patches when they arrive and never had serious issues.
My work laptop normally gets the Januari patches at the end of Januari like it should be for a work-related machine.
They have been tested and most bugs have been noticed and hopefully resolved by then.
In the past it took months before a consumer Windows 10 release was declared ready for business by Microsoft.

 

[amirr]

You never know beforehand.
I install the patches when they arrive and never had serious issues.
My work laptop normally gets the Januari patches at the end of Januari like it should be for a work-related machine.
They have been tested and most bugs have been noticed and hopefully resolved by then.
In the past it took months before a consumer Windows 10 release was declared ready for business by Microsoft.

I agree with you.
I remember my friend telling me this:
Regarding the optional, or even recommended updates in general: It’s not because I don’t have problems that you won’t, or vice versa. It depends on what hardware, drivers, and software you have on your machine, so it’s really not predictable.

If you do use standard and recent components, recent windows install, and up-to-date drivers, most probably you’ll be OK, but it’s not a given.

 

[mkoundo]

Can we expect issues?

Expect there to be issues and proceed to macrium reflect and create a system image today.

 

[WhiteMouse]

Expect there to be issues and proceed to macrium reflect and create a system image today.

When I get new NMV.E SDD, I will create incremental backup everyday.

 

[HarborFront]

I just checked but there's nothing for today

Will Flash be removed today by MS since it’s already announced by Adobe that Flash is dead today?

 

[Gandalf_The_Grey]

The updates are live:

Microsoft releases Windows 10 builds 19042.746, 18363.1316 - here's what's new

Today is the second Tuesday of the month, and that means that all supported versions of Windows 10 are getting mandatory cumulative updates today. For consumers, that's version 1909 and up.

www.neowin.net

Microsoft patches Defender antivirus zero-day exploited in the wild

Microsoft has addressed a zero-day vulnerability in the Microsoft Defender antivirus, exploited in the wild by threat actors before the patch was released.

www.bleepingcomputer.com

Windows 10 Cumulative Updates KB4598229 & KB4598242 released

Today is first Patch Tuesday of 2021 and Microsoft is rolling out a new cumulative update for all supported version of Windows. The cumulative update with security fixes is rolling out to PCs with October 2020 Update, May 2020 Update, November 2019 Update, and May 2019 Update.

www.bleepingcomputer.com

Microsoft January 2021 Patch Tuesday fixes 83 flaws, 1 zero-day

With the January 2021 Patch Tuesday security updates release, Microsoft has released fixes for 83 vulnerabilities, with ten classified as Critical and 73 as Important. There is also one zero-day and one previously disclosed vulnerabilities fixed as part of the January 2021 updates.

www.bleepingcomputer.com

 

[mkoundo]

Microsoft Windows Security Updates January 2021 overview - gHacks Tech News

Today is the first patch day of the year 2021. Microsoft released security updates and non-security updates for the company's Windows operating system and other company products such as Microsoft Office. ADVERTISEMENT […]

www.ghacks.net

 

[Digmor Crusher]

Updated, zero issues as usual.

 

[Gandalf_The_Grey]

Interesting blogpost from Zero Day Initiative:

CVE	Title	Severity	Public	Exploited	Type
CVE-2021-1647	Microsoft Defender Remote Code Execution Vulnerability	Critical	No	Yes	RCE
CVE-2021-1648	Microsoft splwow64 Elevation of Privilege Vulnerability	Important	Yes	No	EoP

Zero Day Initiative — The January 2021 Security Update Review

Welcome to the new year, and welcome to the first Patch Tuesday of 2021. Take a break from your regularly scheduled activities and join us as we review the details for the latest security offerings from Microsoft and Adobe. Adobe Patches for January 2021 This month, Adobe released seve

www.zerodayinitiative.com

 

[ForgottenSeer 85179]

After required PC reboot, it ends with Bluescreen for me which i doesn't get for years.

Then i manual shutdown and Windows start repairing including revert latest Update.

Edit: bluescreen code is "BAD_POOL_CALLER"
Need to check that

 

[FireHammer]

Hi Folks!, Updated, Zero troubles as usual.

 

[Cortex]

I laugh in the face of MS Update issues, maybe a small problem but nothing of significance?

 

[HarborFront]

Just updated mine. So far running without issue

 

[amirr]

Hi Folks!, Updated, Zero troubles as usual.

Me too, no issues as always. God bless Microsoft.

 

[Kongo]

No problems for me either.

 

[Viking]

No problems here also.

 

[Ink]

No problems here, not using Windows.

Jokes aside, I'll check later in the week. These updates are not a high priority, when the computer disconnected from a power source.

 

[Gandalf_The_Grey]

The first Patch Tuesday security bulletin for 2021 from Microsoft includes fixes for one bug under active attack, possibly linked to the massive SolarWinds hacks.
Microsoft addressed 10 critical bugs, one under active exploit and another publicly known, in its January Patch Tuesday roundup of fixes. In total it patched 83 vulnerabilities.
The most serious bug is a flaw in Microsoft’s Defender anti-malware software that allows remote attackers to infect targeted systems with executable code. Security experts are warning that Windows users who have not connected to internet recently and received an auto-update, should patch now.
“This bug in the Microsoft Malware Protection Engine may already be patched on your system as the engine auto-updates as needed. However, if your systems are not connected to the internet, you’ll need to manually apply the patch,” wrote Dustin Childs, Trend Micro’s Zero Day Initiative (ZDI) security manager.

Critical Microsoft Defender Bug Actively Exploited; Patch Tuesday Offers 83 Fixes

The first Patch Tuesday security bulletin for 2021 from Microsoft includes fixes for one bug under active attack, possibly linked to the massive SolarWinds hacks.

threatpost.com