3

So we have an environment with machines running Server 2008r2, 2012r2, and 2016 (the majority are running 2012r2). All the server updates are managed by a WSUS server running 2012r2 (it patches itself, too). Yesterday, I manually synchronized the WSUS server and approved the updates related to Meltdown and Spectre. I then verified that everything downloaded properly by updating the WSUS Server itself with the patches-- everything worked as expected.

Now, this morning, after everything should have scanned for the updates (and they did scan), only a few computers are showing as needing the updates-- in fact, the vast majority are showing as installed/not applicable.

They are all either running Symantec Endpoint Protection or Windows Defender/Forefront and have the proper compatibility registry key set. If you download the update from the update catalog and install it, it installs successfully, but I don't want to have to patch all the servers manually. Other updates are installing just fine from the WSUS server.

This hasn't just happened in this one environment. In another environment that I work on sometimes, it is having the same issue (only they are using Avast! business security, but again, the registry key is set).

Does anyone have any insight into this?

Thanks!

~Allen

Improve this question
10
  • Is there even a spectre patch available yet???
    – Chopper3
    Commented Jan 5, 2018 at 19:03
  • 1
    @Chopper3, yes- Microsoft release Out of Band patches Wednesday night. support.microsoft.com/en-us/help/4072698/…
    – Allen Howard
    Commented Jan 5, 2018 at 19:05
  • Note that in addition to the Windows and A/V updates, we will need to install BIOS/firmware/microcode updates, according to Microsoft.
    – Todd Wilcox
    Commented Jan 5, 2018 at 19:58
  • @ToddWilcox Yeah, I can confirm that based on Windows clients. But Windows should still install the update without the firmware update as not all the patches require it (only one of them does).
    – Allen Howard
    Commented Jan 5, 2018 at 20:08
  • @AllenHoward - This looks strange. I was able to update Server 2016 after making the required changes in the Registry. Are you sure you have made the proper Compatibility settings in the Registry (if you're having non-Microsoft Antivirus)?
    – Am_I_Helpful
    Commented Jan 8, 2018 at 13:46

2 Answers 2

Reset to default
0

So today I logged onto the WSUS console, and now all the machines are reporting that the update is needed and can be installed. It seems Microsoft has revised these updates for Windows Server 2012r2 and Windows 8.1, as well. This seems to have caused the servers to detect.

The clients seem to detect now as well, I'm wondering if Microsoft put in a validity date starting today?

Improve this answer
-2

As per me if possible wait for sometime as current patches may impact performance of server. This patch should be applied on hardware in form of firmware first and then on hypervisor n last on guest OS .

For now these patches are like mitigation creating a layer between hardware and OS to avoid this issue.

So wait if possible and follow sequence or update patches and prepared for performance issues.

Improve this answer
4
  • 1
    This advice is highly situational. Many environments require security as a first priority and in those environments, waiting is not an option.
    – Todd Wilcox
    Commented Jan 9, 2018 at 19:54
  • Agree on your points but presently we all mostly on VM and cloud instances it's not easy to bypass all layers . But yes depends on each m every condition and situation .
    – user451361
    Commented Jan 10, 2018 at 2:19
  • @user451361 - The order of applying the patches are exactly in the reverse order to what experts like Microsoft, etc. have suggested in the advisory; hence, a downvote.
    – Am_I_Helpful
    Commented Jan 10, 2018 at 18:57
  • @Am_I_Helpful - Thanks for your feedback :) - But me too have some feedback from different vendors and read many articles like below: ibm.com/blogs/bluemix/2018/01/… ---- Drivers or firmware never can patched in reverse order as per my experience. they always comes from hardware to host os and then host os to guest os. might be you have some better understanding then me. Thanks anyways
    – user451361
    Commented Jan 11, 2018 at 2:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .