[German]Marketing firm AdDuplex has released its latest Windows 10 distribution figures for June 2018. Looking at this figures brought me to the decision, that the whole thing is useless – nothing more than bullshit.

The data from the new AdDuplex report of June 2018 says that Windows 10 April Update has been rolled out to 3/4 of all Windows 10 systems.

(Windows 10: Distribution June 2018, Source: AdDuplex)

The figure shown above says, that 78,1 % of all Windows 10 Machines are on April Update (V1803). Windows 10 Fall Creators Update (FCU) is at 15,7%, and the other Windows 10 versions are at 2,4% and below 1%.

Sorry, another bullshit bingo

Sorry, that’s not trustable! Going back one month, in May 2018 AdDuplex has posted the diagram below.

(Windows 10: Distribution May 2018, Source: AdDuplex)

AdDuplex claimed, that Windows 10 V1803 has been installed on 50% of all Windows 10 machines. Within my article Windows and OS market share in May 2018 I shed a bit light on absolute figures. When Terry Myerson announced his departure from Microsoft, the number of 700 million Windows 10 systems was already mentioned. So 50% of 700 Million are 350 Million.

Within the article AI powers Windows 10 April 2018 Update rollout dated June 14, 2018, Microsoft published a 2nd figure. They wrote ‘With over 250 million machines on the Windows 10 April Update, we are seeing ….’. Hell, this 250 million Windows 10 V1803 machines, confirmed by Microsoft on June 2018 are far below of the 350 million AdDuplex is claiming End of May 2018. And now they are going to say 3/4 of all Windows 10 machines are already on Version 1803. What these guys are smoking?

Overall they use telemetry data from apps to estimate the amount of a Windows 10 version installed in the wild. This means, the figures they are receiving and reporting monthly are useless – just bullshit. There is no value looking at this figures – so I decided, not to publish additional blog posts about Windows 10 figures released by AdDuplex.  

[German]Companies using BitLocker should be careful when upgrading to Windows 10 V1803. BitLocker recovery information cannot be backed up to Active Directory (AD). Here a short hint to save you a longer troubleshooting.

Some discussion within my German blog

The topic has already been discussed within my German blog in connection with the article Windows 10 V1803 als ‘Semi-annual’ deklariert und mehr (Windows 10 V1803 is declared ‘Semi-annual’ and business ready). German blog reader Markus K. commented there:

I haven’t heard yet that the Bitlocker AD-Backup problem is fixed. Without bitlockers, nothing is “ready for business” for us.

Microsoft really doesn’t want you to configure anything and use it exactly as you get it.

German blog reader Ingo mentioned within a comment: Bitlocker hasn’t backed up keys to the AD for ages. This is probably also intended, people should use MDOP MBAM.

For those not fluent with MDOP and MBAM, Microsoft documented it here. The Microsoft Desktop Optimization Pack (MDOP) is a portfolio of technologies available as a subscription for Software Assurance customers. MDOP helps to improve compatibility and management, reduce support costs, improve asset management and improve policy control, according to Microsoft. Microsoft BitLocker Administration and Monitoring (MBAM) provides an administrative interface for enterprise-wide encryption of BitLocker drives.

Since I’m not active in this environment, I can’t say or judge anything about it.

Microsoft Japan has published some advice

Blog reader Markus pointed me a few days ago to a Technet article published from Microsoft Japan. The translated title is BitLocker recovery information can not be saved in AD DS in Windows 10 1803 (I’ve linked the Google Translate page). This article confirms the above issue with the BitLocker Drive Encryption feature for Windows 10 version 1803. The technology support team writes::

It is reported that BitLocker recovery information cannot be stored in Active Directory in Windows 10 version 1803. If this problem occurs, the following error message appears.

The technical team confirms, there is no problem with the configuration of the Active Directory domain service schema, when this error message occurs while running Windows 10 version 1803. So you could stop troubleshooting this issue.

Occurrence condition

This problem occurs when the following two conditions are satisfied, and it does not occur when BitLocker is activated using the domain account credentials.

• We configured BitLocker recovery information to be stored in Active Directory by Group Policy. ( see the note below)
• You have activated BitLocker using local account credentials.

According to the post, this error does not occur when BitLocker is activated using the domain account credentials

How to check Group Policy

If you enable “Save BitLocker recovery information from xxxx to AD DS” in the following three group policies, BitLocker recovery information is stored in Active Directory when BitLocker encryption is started.

– Group Policy Name

[Select the recovery method for the BitLocker-protected operating system drive].
[Select the recovery method for the BitLocker-protected fixed data drive].
]Select how BitLocker-protected removable drives are to be recovered].

How to work around the problem

This problem occurs when you use local account credentials and there is no workaround for storing BitLocker recovery information in Active Directory with a local account. This can be remedied by enabling BitLocker in one of the following ways.

• Activate BitLocker with the domain administrator account.
• If the domain administrator account is unavailable, temporarily place the domain account in the local Administrators group and enable BitLocker.

The original article in Japanese is available at Technet Japan. Perhaps this will help some administrators affected to spare them additional troubleshooting.

Are you responsible in a business environment for Windows 10 rollout? Are you ready for a good joke? Well, here we come: Microsoft says Windows 10 V1803 is business ready.

I’ve addressed this topic early June 2018 within my German blog post Windows 10: CB, CBB, SAC-T – Babylon im Microsoft-Kosmos. The excerpt in brief: Microsoft decided to change many things for Windows as a service (WaaS). So the names Current Branch (CB) and Current Branch for Business (CBB) introduced with Windows 10 are now obsolete. Microsoft now uses Semi Annual Channel (SAC) and Semi Annual Channel (Targeted) SAC-T as abbreviations for new Windows 10 versions.

(Source: Microsoft)

Also waiting and testing Windows 10 feature upgrades before deployment was quotes as ‘old school’ from Microsoft. John Wilcox from Microsoft has published an article Moving from project to process: digital transformation with Windows as a service end of March 2018, explaining some changes. This article attempts to prepare the basis for some changes in the process of how Microsoft Windows 10 would like to roll out function updates in companies. Microsoft is trying to switch from a project-based to a process based approach to function updates. At the end of May 2018 Wilcox then added the blog article Windows 10 and the “disappearing” SAC-T.

Companies are able to delay deployment of feature updates. But Microsoft believes that organizations should adopt the same approach as end users, starting with targeted implementations to validate applications, devices and infrastructures within the enterprise. The goal for companies is, to begin a broad deployment of a new Windows 10 build once validation was complete.

Windows 10 V1803 is SAC – and business ready …

And I’ve had the article Windows 10 V1803 is ‘Semi-annual’ ready – seriously? in mid of June 2018 within my blog, addressing some of this questions.

Crysta T. Lacey‏ @PhantomofMobile has brought this back to my attention recently with a tweet – and I recognized, I haven’t blogged about that in English. So I like to point out, what’s going on.

“We recommend organizations broadly deploy the latest version of Windows 10 when they are ready, and not wait until the “Targeted” designation has been removed.”

In other words, go on Enterprises and savue users, ‘Live on the WILD Beta Side’.
And you were wondering about 1803?

— Crysta T. Lacey (@PhantomofMobile) 1. Juli 2018

According to the following Table published on Microsoft’s web site Windows 10 release information, Windows 10 V1803, Build 17134.137 (latest revision date 6/26/2018) has reached Semi-Annual Channel (Targeted). This means (thanks Crysta T. Lacey for this hint): This build is only ready for targeted machines – not for all machines …

(Source : Microsoft; Click to Zoom)

But Microsoft wrote in foot note (1): Windows 10, version 1803 designation has been updated to reflect the servicing option available in the operating system and to reflect existing deferral policies. We recommend organizations broadly deploy the latest version of Windows 10 when they are ready, and not wait until the “Targeted” designation has been removed. This means: Microsoft says this build is ready for broad deployment in enterprises.

Really? I’ve published recently the article Windows 10 April Update: Bugs and Issues. The German pendant received up today 138 comments from my readers. Most of them are reporting small and bigger or serious issues. Some earlier issues has been fixed by cumulative updates. But there are still a lot of issues in Windows 10 V1803. Do you thing, Windows 10 V1803 is business ready? Will you follow Microsoft’s advise and deploy Windows 10 V1803 within your enterprise environment?

Similar articles:
Windows 10 V1803 is ‘Semi-annual’ ready – seriously?
Windows 10 April Update available (April 30, 2018)
Windows 10 V1803: Removed features, planned replacements
Patchday: Windows 10 updates June 12, 2018
Windows 10 V1803: Update KB4315567
Windows 10 V1803: Update KB4284848 (June 26, 2018)
PSA: Windows 10 V1803: Update KB4284848 brings SMBv1 fix
Windows 10 V1803: Install issues with update KB4284835
Windows 10 V1803 update creates a new OEM Partition
Windows 10 V1803: mstscax.dll and error 0x80071779
Windows 10 April Update: Bugs and Issues
Windows 10 V1803: Hotfix for Easy Document Creator Scan’
Surface Studio: Trouble with Windows 10 V1803
Windows 10 V1803: Remote Assistance connect
Windows 10 V1803: Update KB4100403 (with SSD fix)
Windows 10 V1803: No BitLocker recovery backup in AD

On June 14, Microsoft released Windows 10 Insider Preview Build 17692[Redstone 5] in the Fast Ring. Microsoft has announced now in Windows Blog that build 17692.1004 has been available in the Slow Ring since July 2, 2018. Details can be found within the Windows Blog.

[German]Does anyone use Windows Defender on Windows 10 in an enterprise environment? Then assure that Windows Defender can connect to various cloud services. Otherwise ‘Defender cloud protection’ is not ensured.

Recently I published the article Windows 7 Defender won’t receive updates (June 2018), addressing issues with Windows 7 Defender, which doesn’t receive updates anymore. Either module updates have killed the Defender or there is a server-side problem at Microsoft. This question is unanswered, although this is currently not a big problem under Windows 7 – no one will just rely on Windows Defender, but use a separate antivirus solution.

Under Windows 10, however, Microsoft positions Windows Defender as a complete antivirus solution. And especially in the enterprise environment, Microsoft offers very good protection with Windows Defender Advanced Thread Protection (ATP) and cloud services – provided everything is set up correctly.

Does the Firewall blocks Windows Defender Cloud access?

In corporate networks, outgoing connections are often limited via a firewall. This may prevent Windows Defender from accessing the cloud to detect threats or the servers to download new signatures. Recently I became aware of this topic via Twitter.

Is your Windows Defender/SCEP missing detections?
Are you behind a corporate firewall?

Your network team may have broken Defender cloud protection connections as part of an overbroad Windows Update block. This happens! You should test. https://t.co/MDQaT0x23S

— SwiftOnSecurity (@SwiftOnSecurity) 30. Juni 2018

Microsoft has published End of April 2018 the article Configure and validate network connections for Windows Defender Antivirus. This article discusses how to set up the enterprise firewall so that the ‘Windows Defender Antivirus Cloud-delivered Protection’, also known as Microsoft Advanced Protection Service (MAPS), works.

In my opinion, the URLs of websites that Windows Defender needs to be able to contact in order for Microsoft Advanced Protection Service (MAPS) to work are of particular interest. 

Whether the function is available and how to activate it can be found on the Windows Active Defense website under ‘Cloud-delivered protection’. 

Similar article:
Windows Defender reports Trojans as false positives
Windows Defender extension for Google Chrome
Windows 7/8.1 receiving Windows Defender ATP support
Windows 10 V 1703: How to disable Windows Defender in Security Center

Microsoft has released a public preview of Windows Defender ATP for Windows 7 SP1 and Windows 8.1 in mid of June 2018. Here are a few details in case you missed it.

In February 2018 I have published the article Windows 7/8.1 receiving Windows Defender ATP support. Microsoft has plans, to bring Windows Defender ATP support, which is currently only available in Windows 10, also to Windows 7 and Windows 8.1.

I didn’t follow this topic, so I wasn’t aware, that Microsoft has launched a public preview of Windows Defender ATP on June 18, 2018. Some Tweets and this comment below my blog post Windows 7 Defender won’t receive updates (June 2018)  brought my attention back to this topic.

Windows Defender ATP EDR capability for Windows 7 SP1 and Windows 8.1 is now in public preview! https://t.co/Y80maQzoae #wdatp #cybersecurity #infosec

— Windows Defender ATP (@WindowsATP) 18. Juni 2018

Here it is, the latest, but there are others older: “Onboard previous versions of Windows”https://t.co/gGfe7WWcYO

— Crysta T. Lacey (@PhantomofMobile) 30. Juni 2018

NEW WINDOWS DEFENDER IS SUPPOSED TO BE OUT THIS SUMMER FOR OS’s W7SP1 & W8.1.

ICYMI: @SBSDiva @AdminKirsty @woodyleonhard @thurrott @maryjofoley @bdsams @mehedih_ @ruthm @MPECSInc @etguenni @SwiftOnSecurity @pcper @SGgrc @MalwareJake @GossiTheDog @ryanshrout @JobCacka https://t.co/UQmNqSsyjn

— Crysta T. Lacey (@PhantomofMobile) 19. Juni 2018

Microsoft has published an article Onboard previous versions of Windows on 06/18/2018, informing users about Windows Defender Advanced Threat Protection (Windows Defender ATP) for:

• Windows 7 SP1 Enterprise
• Windows 7 SP1 Pro
• Windows 8.1 Pro
• Windows 8.1 Enterprise

Windows Defender ATP extends support to include down-level operating systems, providing advanced attack detection and investigation capabilities on supported Windows versions.

To onboard down-level Windows client endpoints to Windows Defender ATP, you’ll need to:

• Configure and update System Center Endpoint Protection clients.
• Install and configure Microsoft Monitoring Agent (MMA) to report sensor data to Windows Defender ATP as instructed below.

If you want to experience Windows Defender ATP, you can sign up for a free trial.

[German]Users of Windows 10 may experience a nasty surprise when switching to version 1803. Drivers are no longer be loaded and return the error code 39 in the device manager – although all worked before installing the feature update. This is due to Core Isolation (HCVI), which was implemented in all versions of Windows 10 since version 1803 – and can cause the driver error on compatible machines.

The error

The error, that users are facing in Windows 10 V1803 is always the same. The driver suddenly cannot be loaded. Here is the message

Windows cannot load the device driver for this hardware. The driver may be corrupt or missing. (Code 39)

{Invalid image}

%hs is either not intended to run under Windows or contains an error. Reinstall the program using the original installation media or contact your system administrator or software vendor for assistance. Error status 0x

Within this German MS Answers forum post it has drastic consequences. After installing the feature update lifting the machine to Windows 10 V1803, the Intel(R) HD Graphics 3000 and its drivers no longer works. The Microsoft Basic Display Driver takes over the screen output, but only supports a resolution of 1024 x 768 pixels.

The root cause: Core isolation

Error code 39 indicates an incompatible or damaged driver. But with Windows 10 April Update there is an additional problem, which my German colleague Ingo Böttcher described in his German blog post here. Microsoft has also introduced the so-called core isolation (HVCI) in the home versions of Windows 10 V1803 (previously this was limited to the Device Guard of the Enterprise Edition, see).

HVCI isolates the kernel via the built-in hypervisor (virtualization) to protect it. However, hardware support is needed. As Ingo writes, apart from Virtualbox issues also various drivers have problems with the new HVCI featrue. However, you can control and turn off core isolation on supported machines in the Windows Defender Security Center. Within this article is a screenshot and an explanation how to turn it on – this feature isn#t supported on my test system’s hardware.

A bug prevents disabling HVCI in GUI

In Windows 10 version 1803, however, there is a bug that to my knowledge was not fixed until June 2018. Once an HVCI function has been activated, it can no longer be switched off via the Windows Defender Security Center (see this post). The workaround is to invoke the registry editor via Run as administrator and then navigate to the key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard\
Scenarios\HypervisorEnforcedCodeIntegrity

Then set the DWORD value Enabled to 0 (see also this Microsoft article) and reboot Windows 10. After that HVCI should be disabled and the old drivers (or Virtualbox) should work again.

[German]Mark Russinovich has updated the two tools Sysmon and Autoruns from the Sysinternals Tools on July 5, 2018 (see this Technet article).

Sysmon V8.0

System Monitor (Sysmon) is a Windows system service and device driver. Once installed on a system, it remains resident across system reboots. The task is to monitor system activity and log it in the Windows event log. The tool provides detailed information about process creation, network connections and file creation time changes.

By collecting and then analyzing the events generated by Windows Event Collection or SIEM agents, you can identify malicious or anomalous activity and understand how intruders and malware work on your network.

Sysmon V8.0 adds rule tagging, which results in tags appearing in event log entries they generate. It also greatly expands the command-line length logged, fixes a GUID printing bug for parent process GUIDs, and prints friendly registry path names for rename operations.

Details & Download: Sysmon v8.0

Autoruns v13.90

This utility shows which programs are called or configured to run during system startup or logon and when various built-in Windows applications such as Internet Explorer, Explorer, and Media Player are started. These programs and drivers are located in the user’s start folder, in the Run and RunOnce registry keys, and other registry keys. Autoruns displays Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, autostart services and much more.

Autoruns V13.90 now includes Runonce\*\\\\Depend key and GPO logon and logoff positions. The new version corrects an error when parsing WMI paths

Details &Download: Autoruns 13.90

Thanks to @PhantomofMobile for the Tweet.

A few minutes ago Microsoft released the Windows 10 Insider Preview Build 17711 (Redstone 5) in the Fast Ring (and Skip Ahead Ring). The announcement was made as usual in the Windows-Blog. There are new features in the Edge, the Fluent Design, the display, the Registry Editor. Details can be found in the linked Microsoft blog post.

A short tip for administrators of Windows systems who perform forensic analyses with regard to logon processes. Windows events with event ID 4624 have a numeric code that indicates the type of logon (or logon attempt). 

Microsoft employee Jessica Payne is a member of the Defender security team. On Twitter she explains the meaning of various codes in short tweets.

Logon type 10: this is a typical RDP alert meaning that terminal services was engaged for the logon. 3rd party software like virtualization consoles and screen share can also generate it. Means credentials were in memory (lsass) and also hit cached credentials.

— Jessica Payne (@jepayneMSFT) 29. Juni 2018

Just click on the tweet, then the whole thread should be displayed. Perhaps this is useful for some of you.

[German]Microsoft seems to allow links in mails that are displayed via mail app to be opened in any browser. This is a fundamental change, because Microsoft announced earlier this year, that such links will be opened in Edge browser only.

Microsoft has announced Windows 10 Insider Preview Build 17623 in Windows Blog, that the Windows Mail app will open links only in Microsoft Edge:

For Windows Insiders in the Skip Ahead ring, we will begin testing a change where links clicked on within the Windows Mail app will open in Microsoft Edge, which provides the best, most secure and consistent experience on Windows 10 and across your devices. With built-in features for reading, note-taking, Cortana integration, and easy access to services such as SharePoint and OneDrive, Microsoft Edge enables you to be more productive, organized and creative without sacrificing your battery life or security. As always, we look forward to feedback from our WIP community.

Now it seems, that the feedback wasn’t too overwhelming. Now italien web site postet a screenshot of an early Mail app update, that showns an option to change that association (see also here).

(Options in Mail app)

The screenshot shows an option within the mail app settings that can be used to specify whether or not mail links should be opened in Microsoft Edge. With Edge option disabled, links in Windows Mail app should reopen in the default browser of the operating system.

[German]Google and Mozilla have banned the Stylish browser extension (AddOn) from the stores. Here is some background information about this add-on.

Browser Add-On Stylish

The quite popular browser add-on Stylish was available for browsers like Google Chrome, Firefox, Opera and Safari. The add-on is available in the Google Chrome App Store, for example, and has over 1.5 million users there.

According to advertising, the Stylish add-on was a user style manager that can be used to redesign the web. Stylish makes it easy to define themes and skins for many websites. The browser extension became a hit because it allows users to place their own overlays on websites and hide features they don’t want to see.

My warning from January 2017

The AddOn was sold to a new owner (Justin Hindma) in October 2016. Already in January 2017 I had the article Browser Add-On Stylish – der neue Datensammler? within my German blog. There I warned against this add-on, because it extracts the user’s data. My advice was to stay away from this add-on.

Google and Mozilla finally banned that add-on

Now I read at ZDnet.com that Google and Mozilla finally removed tha add-on from the Mozilla repository and Chrome App Store. Background to the ban is, that the popular Stylish extension collects data about website visits in a way that could be used to identify users.

The provider writes in his Stylish Privacy Policy that the data collected does not allow any conclusions to be drawn about the user. But this seems to be not true, as software engineer Robert Heaton’s research has shown. Robert Heaton described the demise of the add-on from a useful tool that he had used for several years to today’s data collector with threat to privacy. Within the article it is mentioned, that the Chrome version of this add-on has been tracking since January 2017 (matches my blog entry above). The Firefox add-on has integrated the tracker since March 2018. Robert Heaton describes in great detail what the add-on transmits. Not only are URLs logged, but each data record is assigned a user-specific ID. The user can be identified by this ID and the information collected.

Mozilla has removed Stylish from its Firefox add-ons catalog. “We have decided to block for violating the data practices described in the review policy,” wrote Mozilla software developer Andreas Wagner. The Stylish page in the Chrome Web Store now displays a 404 error page. If someone is using this add-on, I recommend to uninstall it immediately.

Microsoft will offer a core version of Windows Server 2019, which comes without a desktop and is managed via PowerShell and Admin Center. But there is also a desktop version available.

Already in March 2018 Microsoft had announced the upcoming Windows Server 2019 version in the blog entry Windows Server 2019. In a new blog post Server Core and Server with Desktop: Which one is best for you, dated from July 5, 2018, the Windows Server team presents its plans for the future. And they’re quite a surprise. Ned Pyle pointed out the new features via Twitter:

Windows Server 2019 in Core mode benefits from Windows Admin Center & the Server Core App Compatibility feature. For many workloads & environments, you can ditch the desktop. Give it a go. https://t.co/gxHIMmGaKX

— Ned Pyle (@NerdPyle) 6. Juli 2018

Windows Server Core

According to Microsoft, for most server scenarios, the Server Core installation option is the best (and recommended) choice. A server core installation comes without a desktop and is suitable for large data centers and clouds, both physical and virtual. According to Microsoft, the smaller footprint of Server Core provides a smaller attack surface and is therefore less vulnerable than the Desktop Server option.

Microsoft writes, that in the past users have had problems running apps that require local GUI interaction on Server Core. Either the apps fail to install or, worse, they fail later or just don’t run right. Microsoft adding a new Server Core-based application compatibility feature to address these problems. Admins can install it or uninstall it on demand.

For Windows Server Insiders, it’s possible to get the Server Core App Compatibility feature-on-demand (FOD) now, if some of the apps don’t run (well) on server core.Microsoft hopes, that most of this pass run well with the App Compatibility FOD. New server management apps should be designed to work remotely, ideally as extensions to Windows Admin Center. According to Microsoft, you can overtime use Server Core everywhere without the App Compatibility FOD at all. On  Twitter @SwiftOnSecurity expressed the whole thing with this tweet:

Breaking: Microsoft confirms Server 2019 is dropping Desktop Experience, will only support PowerShell and Hololens.

— SwiftOnSecurity (@SwiftOnSecurity) 6. Juli 2018

Of course there is also an installation variant of Windows Server 2019, called Desktop, which comes with the usual desktop from Windows 10 including start menu. Further details may be read at Server Core and Server with Desktop: Which one is best for you,

Microsoft has begun to ship its previously blocked Windows 10 April Update (V1803) to Dell Alienware PCs and Notebooks. The devices are automatically updated to the new Windows 10 build.

Microsoft announced in early May that it had blocked the Alienware notebook models 13 R3, 15 R3, 15 R4, 17 R4 and 17 R5 from upgrading to Windows 10 April Update (V1803). Background was that the installation of Windows 10 V1803 could cause a problem with the black screen after the battery saving mode was resumed..

Microsoft update 1803 is now ready for Alienware computer. This one should run automatically already, if no feel free to run it. It works now.

— Alienware Support (@AlienwareTech) 5. Juli 2018

Now ZDNet reported that Alienware Support confirmed last week that Windows 10 April Update (V1803) is now ready to install on the above models. The installation should be automatic, the problem with the black screen should no longer occur. Question: Any of you concerned and can confirm that the upgrade to V1803 is working?

Policy Analyzer is a utility in the Security Compliance Toolkit for analyzing and comparing sets of Group Policy Objects (GPOs), which has been received a minor update End of June 2018.

Crysta T. Lacey informed me via a Tweet, that this helpful tool received a minor update End of June 2018:

Policy Analyzer – minor update
June 29, 2018

Aaron Margosis

ICYMI: @SBSDiva @AdminKirsty @woodyleonhard @thurrott @maryjofoley @bdsams @mehedih_ @ruthm @MPECSInc @etguenni @SwiftOnSecurity @pcper @SGgrc @MalwareJake @GossiTheDog @ryanshrout @JobCackahttps://t.co/8EBZ9PANgv

— Crysta T. Lacey (@PhantomofMobile) 30. Juni 2018

According to this Microsoft post, a minor update that resolves a localization bug reading some non-English advanced auditing settings files (audit.csv), and another bug that would cause Policy Analyzer to crash when reading an invalid GPO backup XML file has been fixed.

Policy Analyzer should be (hopefully) completely bug free now. The download package also adds PolicyRules files for the four Windows and Office baselines we have published since Policy Analyzer was last updated.

A short tip for administrators working with InTune. The WindowsAutoPilotIntune 2.1 script has been released in the PowerShell Gallery. This is an example module for managing AutoPilot devices via the Intune Graph API. Michael Niehaus pointed this out here.

[German]The rumors of the last days has been true. Microsoft has introduced the Surface Go Tablet, which is entering the education market with a price starting at 399 US $ and a 10-inch display. From today, July 10, 2018, pre-orders are possible.

Small, light, portable, affordable

Within this blog post Microsoft’s beschreibt Chief Product Officer, Panos Panay, describes the design goals in the development of the Microsoft Surface Go. Many people travel throughout the day in different situations, on their way to work, school or home. If you want to use a surface there, it must provide a balance between performance and versatility, form and function. 

(Surface Go, Source: Microsoft)

The idea behind the Surface Go design was to provide the smallest, lightest and cheapest Microsoft Surface Tablet to date.

10 Inch with 1800 x 1200 pixel resolution

Das Surface Go is something like a smaller version of a Surface Pro, because it has only a 10 inch display (3:2). It is a PixelSense display with 1,800 x 1,200 pixel resolution, which supports a surface pen with 4096 pressure levels. In portrait mode, the display is designed to display US textbooks. In landscape format, they display electronic books in a double-page format – the tablet is optimized for the educational sector. The device should be available in the following combinations:

• 4 GB RAM / 64 GB eMMC memory,
• 8 RAM / 128 GB eMMC memory,
• 8 RAM / 128 GB eMMC memory, LTE
• 8 RAM / 256 GB eMMC memory, LTE

The eMMC memory is slower and cheaper than SSDs. The processor is an Intel Pentium 4415Y (Kaby Lake, 7th generation), which is clocked at 1.5 GHz and should be more powerful than the Atom CPUs. In its lightest version, the Surface Go weighs only 562 grams and is 8.3 mm thick. A built-in stand (kickstand) with full friction hinge allows a folding angle of up to 165 degrees. This allows you to switch from tray mode to studio mode. 

The Surface Go has a USB-C port, a microSD card reader and two cameras (5 megapixel front, 8 megapixel back). The Windows Hello front camera enables a login with face recognition. A Surface Connect connection is available for docking and charging. The battery life is indicated as’9 hours’. Windows 10 S is delivered as operating system, a change to Windows 10 Home is possible free of charge.

Price in the USA

The Surface Go is offered in the USA at a price starting at 399 dollars against the iPad from Apple and the Chromebooks from Google. The 4GB RAM/64GB eMMC WiFi model can be pre-ordered today, July 10, 2018 (in the US, Canada, UK, Ireland, France, Germany, Austria, Belgium, Luxembourg, Netherlands, Switzerland, Denmark, Finland, Norway, Sweden, Poland, Italy, Portugal and Spain). The device will be available in stores from August 2, 2018. The LTE models will be available later this year. Microsoft will offer an optional Type Cover and a Surface Pen.

(Source: YouTube)

The video has been published by Microsoft, Brad Sams has published the following hands-on video.

(Source: YouTube)

[German]Microsoft released several cumulative updates for the supported Windows 10 builds on July 10, 2018. Here are some details about the updates.

A list of updates can be found on this Microsoft website. I have pulled out the details below. Some of these updates for Windows 10 versions 1607 to 1709 are also available as delta updates  for the WSUS.

Updates for Windows 10 Version 1803

The following updates are available for Windows 10 April Update (version 1803).

Update KB4338819 for Windows 10 Version 1803

Cumulative update KB4338819 contains quality improvements but no new operating system functions and raises the OS build to 17134.165. Here is a list of addressed issues:

• Improves the ability of the Universal CRT Ctype family of functions to correctly handle EOF as valid input.
• Enables debugging of WebView content in UWP apps using the Microsoft Edge DevTools Preview app that’s available in the Microsoft Store.
• Addresses an issue that may cause the Mitigation Options Group Policy client-side extension to fail during GPO processing. The error message is “Windows failed to apply the MitigationOptions settings. MitigationOptions settings might have its own log file” or “ProcessGPOList: Extension MitigationOptions returned 0xea.” This issue occurs when Mitigation Options has been defined either manually or by Group Policy on a machine using Windows Defender Security Center or the PowerShell Set-ProcessMitigation cmdlet.
• Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows.
• Security updates to Internet Explorer, Windows apps, Windows graphics, Windows datacenter networking, Windows wireless networking, Windows virtualization, Windows kernel, and Windows Server.

The update is distributed via Windows Update, but should also be available via WSUS or the Microsoft Update Catalog. Microsoft is not aware of any problems with the update.

Important: The Servicing Stack Update (SSU) KB4343669must be installed before installing the package from the Microsoft Update Catalog.

Servicing Stack Update KB4343669 for Windows 10 Version 1803

Update KB4343669 (Servicing stack update for Windows 10, version 1803: July 10, 2018) improves the stability of the servicing stack. The update is available via WSUS or in the Microsoft Update Catalog.

Compatibily Update KB4339277 for Windows 10 Version 1803

Compatibily update KB4339277 is a dynamic update, used during install or factory reset to improve the upgrade experience to Windows 10, version 1803.

Updates for Windows 10 Version 1709

The following updates are available for Windows 10 Fall Creators Update (version 1709).

Update KB4338825 for Windows 10 Version 1709

Cumulative updateKB4338825 for Windows 10 Version 1709 (Fall Creators Update) raises the OS build to 16299.547 and includes quality improvements and the following fixes:

• Addresses an issue that, in some cases, causes the wrong IME mode to be chosen on an IME-active element.
• Addresses an issue with form submission in Internet Explorer.
• Addresses an issue where DNS requests disregard proxy configurations in Internet Explorer and Microsoft Edge.
• Addresses additional issues with updated time zone information.
• Addresses an issue that causes the latest versions of Google Chrome (67.0.3396.79+) to stop working on Cobalt devices.
• Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows.
• Security updates to Internet Explorer, Microsoft Edge, Microsoft scripting engine, Windows apps, Windows graphics, Windows datacenter networking, Windows virtualization, Windows kernel, and Windows Server.

The update is distributed via Windows Update, but can also be downloaded via Microsoft Update Catalog.

Important: The Servicing Stack Update (SSU) KB4339420 must be installed before installing the package from the Microsoft Update Catalog.

This cumulative update has the same known issues as the previous month’s patch. Some non-English platforms can display the following string in English instead of the localized language: “Reading scheduled jobs from file is not supported in this language mode.” This error is displayed when Device Guard is enabled and you are trying to read the scheduled jobs you have created. In addition, there are other known bugs with Device Guard activated (e.g. no & or . operator etc., see) Microsoft is working on solving the problems.

Servicing Stack Update KB4339420 for Windows 10 Version 1709

Update KB4339420 (Servicing stack update for Windows 10, version 1709: July 10, 2018) improves the stability of the servicing stack. This SSD update is available via WSUS or in the Microsoft Update Catalog.

Compatibily Update KB4338852 for Windows 10 Version 1709

Compatibily update KB4338852 is a dynamic update, used during install or factory reset to improve the upgrade experience to Windows 10, version 1709.

Updates for Windows 10 Version 1703

The following updates are available for Windows 10 Creators Update (version 1703).

Update KB4338826 for Windows 10 Version 1703

Cumulative update KB4338826 for Windows 10 Version 1703 (Creators Update) raises the OS build to 15063.1206 and includes quality improvements and the following fixes:

• Addresses an issue with form submission in Internet Explorer.
• Updates Internet Explorer’s Inspect Element feature to conform to the policy that disables the launch of Developer Tools.
• Addresses an issue that, in some cases, causes the wrong IME mode to be chosen on an IME-active element.
• Addresses an issue in which DNS requests disregard proxy configurations in Internet Explorer and Microsoft Edge.
• Addresses additional issues with updated time zone information.
• Evaluates the Windows ecosystem to help ensure application and device compatibility for all updates to Windows.
• Security updates to Internet Explorer, Microsoft Edge, Windows apps, Windows graphics, Windows virtualization, Windows kernel, and Windows Server.

The update is distributed via Windows Update, but is also available in the Microsoft Update Catalog. No known issues.

Windows Update Improvements

Microsoft has released an update directly to the Windows Update client to improve reliability. Any device running Windows 10 configured to receive updates automatically from Windows Update, including Enterprise and Pro editions, will be offered the latest Windows 10 Feature Update based on device compatibility and Windows Update for Business deferral policy. This does not apply to long-term servicing editions.

Updates for Windows 10 Version 1507 and 1603

Various updates are available for Windows 10 RTM to Windows 10 Creators Update (version 1703). Here is a short overview.

• Windows 10 Version 1607: Update KB4338814 is only available for Enterprise and Education and Windows Server 2016. This update fixes the OS build to 14393.2363. Details, also about the known problems can be found in the KB article.
• Windows 10 Version 1507: Update KB4338829 is available for the RTM version (LTSC). The update removes the OS build to 10240.17914. Details, also about the known problems can be found in the KB article.

For Windows 10 V1511 there was no update that this version has fallen on the support. Details on the above updates can be found in the respective Microsoft KB articles in case of doubt.

Similar articles:
Adobe Flash Player Version 30.0.0.134
Microsoft Office Patchday (July 3, 2018)
Patchday: Windows 10-Updates July 10, 2018
Patchday: Updates for Windows 7/8.1/Server July 10, 2018

[German]On July 10, 2018 Microsoft released several (security) updates (KB4338818, KB4338823) for Windows 7 SP1 and other updates (KB4338815, KB4338824) for Windows 8.1 and the corresponding server versions. Here is an overview of these updates.

Updates for Windows 7/Windows Server 2008 R2

For Windows 7 SP1 and Windows Server 2008 R2 SP1, a rollup and a security-only update have been released. The update history for Windows 7 can be found on this Microsoft page.

KB4338818 (Monthly Rollup) for Windows 7/Windows Server 2008 R2

Update KB44338818 (July 10, 2018, Monthly Quality Rollup for Windows 7 SP1 and Windows Server 2008 R2 SP1) contains improvements and bug fixes that were already included in the previous month’s update. The update addresses the following:

• Provides protections for an additional vulnerability involving side-channel speculative execution known as Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
• Updates Internet Explorer’s Inspect Element feature to conform to the policy that disables the launch of Developer Tools.
• Addresses an issue where DNS requests disregard proxy configurations in Internet Explorer and Microsoft Edge.
• Security updates to Internet Explorer, Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows wireless networking, and Windows virtualization.

The update is automatically downloaded and installed by Windows Update. It can also be downloaded from the Microsoft Update Catalog. This update has the known issues since months that the NIC (network interface controller) no longer works due to a missing third-party .inf file. The remedy is to reinstall the NIC via the device manager.

KB4338823 (Security Only) for Windows 7/Windows Server 2008 R2

Update KB4338823 (Security-only update) is available for Windows 7 SP1 and Windows Server 2008 R2 SP1 and addresses the following items:

• Provides protections for an additional vulnerability involving side-channel speculative execution known as Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
• Security updates to Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows wireless networking, and Windows virtualization.

This update is available via WSUS or in Microsoft Update Catalog. There are no known issues. When installing the Security Only Update you must also install KB4339093 for IE.

Addendum: Compatibility update KB2952664 for Windows 7

I am also offered the compatibility update KB2952664 for Windows 7 on my machine. Microsoft writes about this:

This update performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program. The diagnostics evaluate the compatibility status of the Windows ecosystem, and help Microsoft to ensure application and device compatibility for all updates to Windows. There is no GWX or upgrade functionality contained in this update.

The update is distributed via Windows Update and is classified as important. It can also be downloaded from the Microsoft Update Catalog. Due to previous experiences described in the blog post Windows 7/8.1: Updates KB2952664 & KB2976978 (02/08/2018), I would hide this update.

Updates for Windows 8.1/Windows Server 2012 R2

For Windows 8.1 and Windows Server 2012 R2 a rollup and a security-only update have been released. The update history for Windows 8.1 can be found on this Microsoft page.

KB4338815 (Monthly Rollup) for Windows 8.1/Server 2012 R2

Update KB4338815 (Monthly Rollup for Windows 8.1 and Windows Server 2012 R2) contains improvements and fixes that were included in the rollup for the previous month. It also addresses the following items.

• Provides protections from an additional subclass of speculative execution side-channel vulnerability known as Speculative Store Bypass (CVE-2018-3639). These protections aren’t enabled by default. For Windows client (IT pro) guidance, follow the instructions in KB4073119. For Windows Server guidance, follow the instructions in KB4072698. Use this guidance document to enable mitigations for Speculative Store Bypass (CVE-2018-3639) in addition to the mitigations that have already been released for Spectre Variant 2 (CVE-2017-5715) and Meltdown (CVE-2017-5754).
• Provides support to control usage of Indirect Branch Prediction Barrier (IBPB) on some AMD processors (CPUs) for mitigating CVE-2017-5715, Spectre Variant 2 when switching from user context to kernel context. (See AMD Architecture Guidelines for Indirect Branch Control and AMD Security Updates for more details). For Windows client (IT pro) guidance, follow the instructions in KB4073119. Use this guidance document to enable IBPB on some AMD processors (CPUs) for mitigating Spectre Variant 2 when switching from user context to kernel context.
• Provides protections for an additional vulnerability involving side-channel speculative execution known as Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
• Updates Internet Explorer’s Inspect Element feature to conform to the policy that disables the launch of Developer Tools.
• Addresses an issue where DNS requests disregard proxy configurations in Internet Explorer and Microsoft Edge.
• Addresses an issue that causes the mouse to stop working after a user switches between local and remote sessions.
• Security updates to Internet Explorer, Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows virtualization, and Windows kernel.

This update is automatically downloaded and installed from Windows Update, but is also available in the Microsoft Update Catalog. There are no known problems with the update.

KB4338824 (Security-only update) for Windows 8.1/Server 2012 R2

Update KB4338824 (Security Only Quality Update for Windows 8.1 and Windows Server 2012 R2) addresses the following items.

• Provides protections from an additional subclass of speculative execution side-channel vulnerability known as Speculative Store Bypass (CVE-2018-3639). These protections aren’t enabled by default. For Windows client (IT pro) guidance, follow the instructions in KB4073119. For Windows Server guidance, follow the instructions in KB4072698. Use this guidance document to enable mitigations for Speculative Store Bypass (CVE-2018-3639) in addition to the mitigations that have already been released for Spectre Variant 2 (CVE-2017-5715) and Meltdown (CVE-2017-5754).
• Provides support to control usage of Indirect Branch Prediction Barrier (IBPB) on some AMD processors (CPUs) for mitigating CVE-2017-5715, Spectre Variant 2 when switching from user context to kernel context. (See AMD Architecture Guidelines for Indirect Branch Control and AMD Security Updates for more details). For Windows client (IT pro) guidance, follow the instructions in KB4073119. Use this guidance document to enable IBPB on some AMD processors (CPUs) for mitigating Spectre Variant 2 when switching from user context to kernel context.
• Provides protections for an additional vulnerability involving side-channel speculative execution known as Lazy Floating Point (FP) State Restore (CVE-2018-3665) for 64-Bit (x64) versions of Windows.
• Security updates to Windows apps, Windows graphics, Windows Shell, Windows datacenter networking, Windows virtualization, and Windows kernel.

The update is available via WSUS or in the Microsoft Update Catalog. Microsoft is currently not aware of any errors. When installing the Security Only Update you must also install KB4339093 for IE.

Similar articles:
Adobe Flash Player Version 30.0.0.134
Microsoft Office Patchday (July 3, 2018)
Patchday: Windows 10-Updates July 10, 2018
Patchday: Updates for Windows 7/8.1/Server July 10, 2018

[German]Last night Microsoft released the .NET Framework update KB4340558 for Windows. As it looks, this update is buggy and cannot be installed. The installation ends (on some systems) 0x80092004.

.Net Framework update KB4340558

.Net Framework update KB4340558 (Security and Quality Rollup updates for .NET Framework 3.5 SP1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, and 4.7.1 for Windows 8.1, RT 8.1, and Server 2012 R2) is available for the above framework versions. The security update is intended to fix the following vulnerabilities.

• A “remote code execution” vulnerability exists when .NET Framework does not validate input correctly. An attacker who successfully exploits this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts that have full user rights. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who have administrative user rights. To exploit the vulnerability, an attacker would have to pass specific input to an application through susceptible .NET Framework methods. This security update addresses the vulnerability by correcting how .NET Framework validates input. To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8284.
• An “elevation of privilege” vulnerability exists in .NET Framework that could allow an attacker to elevate their user rights level. To exploit the vulnerability, an attacker would first have to access the local computer, and then run a malicious program. This update addresses the vulnerability by correcting how .NET Framework enables COM objects. To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8202.
• A “security feature bypass” vulnerability exists when .NET Framework components do not correctly validate certificates. An attacker could present expired certificates when challenged. This security update addresses the vulnerability by making sure that .NET Framework components correctly validate certificates. To learn more about this vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2018-8356.

The specified security fixes therefore suggest that you install this security update quickly.

Installation Fails with Error 0x80092004

German blog reader Markus B. contacted me today via e-mail (thanks) and described his observation.

KB4340558 is running on error. 60 PCs cannot install it. Find also already the first forum posts to it. Don’t seem like the only one.

“2018-07 Security and Quality Rollup for.NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 under Windows 8.1 and Server 2012 R2 for x64 (KB4340558)”. It has error code 80092004.”

A 2nd blog reader from Greece reported the same to me via e-mail. Currently ther is only a German forum post, describing the same error. Also downloading the package from Microsoft Update Catalog and install ist manually, ends with the error dialog shown below.

However, Markus B. wrote, that he received an install error code 0x80092004 (not shown above), which should be found in the event logs. Error code 0x80092004 stands for CRYPT_E_NOT_FOUND, ‘The object or property was not found’. This indicates that something was not found within the package. I assume that Microsoft broke something within the package and have to re-release a new version.

Further details

Below user Valter left a comment, shedding a bit light into that issue. I mentioned the CRYPT_E_NOT_FOUND meaning for error code 0x80092004. Blog reader Valter found the following entry within his event log:

“Couldn’t find the hash of component: NetFx4-PenIMC”

So it seems that one part of the update is missing a has value, so the update installer refuse the package. PenIMC stands obviously for a pen component (Pen Input Mode Component?).

For curiosity I went to Microsoft Update Catalog and tried to download KB4340558. The goal was to analyze the package.

Microsoft Update Catalog offered me three .msu packes. Blog reader Valter wrote below in a comment, that he wasn’t able to install the .msu files. There is a Russian Technet forum thread, where KB4338424, KB4338415 and KB4338419 are mentioned also. While KB4338424 and KB4338415 installs for this user, KB4338419 creates the install error.

I read also some forum posts (see here at spiceworks), where users are claiming, that the update installs on Windows Server 2012 R2 without a flaw. Due to the fact, that we have a cumulative update, it’s explainable, that not all Windows 8.1 and Windows Server 2012 R2 systems will fail. Some are probably patched, while on others updating NetFx4-PenIMC fails due to the missing hash value.

Addendum: At askwoody.com there is this forum post, where a user wrote, that entering the command below in an administrative command prompt windows helped.

Dism /Online /NoRestart /Cleanup-Image /StartComponentCleanup

Just try it and reboot Windows. If it works, it’s fine, but I’m skeptical.

Sum it up and final recommendations

Before I wrote the blog post, I’ve 3 different cases, where this update fails during installation on Windows 8.1 clients or Windows Server 2012 R2. After publishing the German and English article, I received another 8 confirmations of this error so far. There are also posts at Microsoft answers, at askwoody and spicework community.

All approaches as using sfc /scannow and dism, to repair Windows system files and component store, or delete the update store, won’t help. Also an attempt to install the package from a download via the .msu file will fail. Currently my recommendation is to hide the update, and wait until Microsoft releases a revised patch or recommendations to fix the install issue. I’ve escalated the issue within this Microsoft answers forum thread, and I created this Technet forum thread – let’s hope that help. If you are affected, you can leave a comment. If a solution is known, also.