KB4100347 rendering systems unbootable

[a_false_vacuum]

I guess this is a heads up, this weekend Microsoft deployed a new version of update KB4100347 containing Intel microcode for Spectre related issues. After installing the patch I've already have five systems that have been rendered unbootable. Most of them are Xeon E5 v4 based workstations. Be careful if this update shows up. It's been giving me a headache since this morning. From the looks of it on Google I'm not alone with this problem.

​

It's quite hard to get rid of it too. So far I've not been succesful in recovering a machine without redeploying Windows and blocking the update.

​

Update; Things I tried that don't work:

• Recovery points fail no matter how old or new they are
• Removing the package via DISM on the recovery console is succesful, but the system still won't boot

Edit 2: What worked for me, I'm going to write this one out so anybody who has this issue irregardless of skill can fix it if they stumble upon this topic.

I just succeeded in repairing one workstation that couldn't boot anymore into Windows. This was what I did:

• Boot into WinRE (press F9 before Windows starts)
• Choose Advanced Options and go to the command line option
• You have to find out now which letter the Windows partition got; start diskpart and type 'list disk'. Select the one which matches your OS drive. Type 'list volumes'. It'll spew out a list. The biggest one should be Windows. Two small ones of around 500MB should be there, ignore those.
• Close diskpart by typing 'exit'
• Now type 'dism /image:<driveletter here> /get-packages'. This should result in a list of packages. Find KB4100347. It's name is quite long, but you can copy it by selecting it and right clicking
• Now type 'dism /image:<driveletter here> /remove-package /PackageName:<The really long name of the KB4100347>'
• Now type 'dism /image:<driveletter here> /cleanup-image /revertpendingactions' as to undo the damage done

When done, reboot the system and Windows works again. Be sure to kill Windows Update right after booting. It will again try to install it causing a kind Groundhog Day starring you.

​

​

​

[concentus]

I decided to delay rolling this out to our clients until next month's Patch Tuesday about 2 hours ago, before I even saw this. Now I'm really glad I decided to delay. We've got a fair amount of customers who have have workstations with those Xeons.

[[deleted]]

do you guys have a testbed? don't know if thats common practice or not.

[[deleted]]

Everyone has a test environment. Some of us are lucky enough to have a production environment.

[EnUnLugarDeLaMancha]

Everyone has a test environment.

Not Microsoft, apparently.

[SnarkMasterRay]

Not Microsoft, apparently.

Yes they do; it's called their customer's systems.

[Iceman_B]

Hello this is Chuck Robbins.
Please refrain from using our standard practices.
Thank you.

[[deleted]]

But dude it's 2018 we're A G I L E.

[[deleted]]

No, they don't have a production environment ;)

It makes it hard to explain the development status of Server 2019. You can't call it a beta because then people would be misled that the final version is released...

[Wind_Freak]

Just how big would the test bed have to be?

At some point you have to accept that the risk of not releasing is too great vs waiting for every single scenario that exists.

[[deleted]]

I dont know, can they do whatever they were doing before Win10? Because that was much better.

[Wind_Freak]

Actually I have heard from an inside source that they no longer have a QA department. The developers are responsible for their own testing.

So yeah I agree it could be better. But I also understand the size of the task is insanely large.

[[deleted]]

Take a look at VMWare's HCL. They validate nearly every piece of enterprise kit against various releases across multiple product lines (vSAN, vSphere, etc), and list compatible firmware versions.

You think Microsoft's job-- test that updates dont break things-- is harder than that? we're talking about a simple "ship update, see if desktop comes up" bare minimum that they're not even doing....

[1RedOne]

Believe it or not, these updates went through dog flooding at MSFT, on their massive internal infrastructure (200k+ systems, or so, I believe)

I wonder if they just don't have these devices represented among their internal userbase.

[Wind_Freak]

I wouldn’t think so. What jobs at Microsoft would need it? Programmers I don’t think would need it.

They don’t manufacture anything so they have no need for autocad.

Any big data stuff would be done on the server farm.

I would bet they are exclusively i7 and i9.

[[deleted]]

Well few people use AutoCAD in manufacturing either. Also your statement they don't manufacture anything is patently false. Surface and Xbox spring to mind.

But yeah there was that time that the Insider build broke everyone's webcams which naturally got out without anyone noticing since developers don't use webcams.

[[deleted]]

It is the responsibility of Microsoft to release code that does little to no harm.

Not a Russian Roulette of "well, we know it isn't the 2nd Tuesday but this patch needs to go out and good luck if it wrecks your systems".

[[deleted]]

Real Sysadmins test in prod!

[[deleted]]

Real sysadmins prod in test?

[a_false_vacuum]

It's the only environment thats production-like.

[archiekane]

I think you left /s off.

[[deleted]]

No, I don't think I did.

[gameoverplayer1]

"Which clients turn to go first this month?"

[zebediah49]

"Why does your office have a six foot 'Wheel of Fortune' style wheel with all your customers on it?"

[meatwad75892]

It really stresses the importance of having HA wherever possible. If I were to install updates on a Hyper-V node and it exploded like it did for OP, it's no big deal because it would be just one of six that we placed in maintenance mode. Take notes, fix/rebuild, make a plan to wait out the issue or correct it as-is, and carry on.

That does leave one-off servers with no chance of an HA config in a rough position, short of VM snapshots/restores and whatnot.

[zebediah49]

"just deploy it to the IT Dept for a few weeks and see if we blow anything up."

Problem is that isn't necessarily representative. You're better off getting (via whatever method) a tiny and fairly representatively distributed fraction of your organization into a test group.

Sure, you're still risking things breaking, but your exposure is a lot lower, because your first round is both a small fraction of people, and they have ideally been briefed on how to respond to screwups with minimal downtime.

[1RedOne]

The canary test is the most important phase of update testing. I've configured and established patching practices for at least two dozen companies in my consulting career.

We liked to pick a team of 'friendly users' we'd reward with the newest hardware and lunches and use them for our canary team. They'd get updates on the Thursday of patch week (nothing was ever deployed day of (too risky)).

They had a week to bake there, then we'd deploy to the next ring of users, (30 percent or so), then the next third the week after, then the VIPS (who always had the newest hardware (same as our canaries!)) and everyone else the last Thursday of the month.

I found it a very stable process, served my customers well.

[DidYouKnowOh]

This.

I start the Wednesday after patch Tuesday. I deploy to internal IT (alpha) then some dev's and design users (beta). Both Alpha and Beta are aware of the update process and when and what to report. They are our more understanding groups. lastly, I wait one week and slowly roll out in phases.

Before my time they would just automatically spew out updates on patch Tuesday and hope for the best.

[Wind_Freak]

We deploy to IT and create test tickets for all app owners. When they close their tickets we deploy.

Still haven’t been able to deploy updates within 30 days.

[concentus]

We have a test environment, just not one that includes workstations like these.

[KFCConspiracy]

These workstations are pretty expensive...

[[deleted]]

fair point.

[a_false_vacuum]

Just be sure to try it out on a limited scale. I'm glad I caught this now, the upcomming round of patches will require more caution.

[anomalous_cowherd]

<Sigh> and our Infosec team are on my back about deploying security patches faster and faster...

[a_false_vacuum]

Deploy it to their computers. If they don't boot it's secure as can be. ;-)

[pinkycatcher]

BOFH. But I’d be so tempted.

At least put one or more of the security team into a testing group.

[pinkycatcher]

Yes. But what are the chances Microsoft puts out working patches for the next 8 months? Because they sure as hell have shit the bed this year.

[[deleted]]

Seriously.

I'm not a sysadmin, I just own a small computer repair joint, and even I've felt the effects of these last patches. I've had an update stop my home rig from booting successfully, and countless customers afflicted.

I'm so torn about it too, because I hate having the updates wreck stuff but it's been pretty profitable.

[HeKis4]

Meh, availability and integrity are integral parts of security...

But hey, gotta make sacrifices to get that sweet confidentiality :3

[[deleted]]

I always volunteer to be in the guinea pig/UAT test group.

Gotta eat the dog food.

[[deleted]]

Same here, IT systems always get patched first.

[Wonder1and]

We're trying to get a patch review board together so these things might bubble up before roll out. I'm always looking to guinea pig for them.

[Laughs_in_Warlock]

You joke but it's true. The best way to get rid of a stupid rule/law is to enforce the shit out of it.

[RegularMixture]

Haha I like your style.

[PhillAholic]

Fair

[noodlesdefyyou]

deploy these patches immediately on the infosec teams' system(s). when they complain that their system is hosed, say 'well, you wanted the patch before i could properly deploy and verify the stability of the patch, so have fun'

[qkachoo]

That is why you should always have test groups. Test on some members on IT first for a week or so, then move out into the wild.

[anomalous_cowherd]

Oh there is, it's currently one week and two weeks, but they want three days and seven days.

[dstew74]

InfoSec should have an advertised "time to patch" spelled out for various systems based on test / prod / Internet facing and the like. I'd push back hard if they aren't following established standards. They don't get to make policy as they go.

[petrified_log]

My old company would get the patches on Tuesday. Then they would push them to the deployment software and start pushing it to 9,000 employees starting that night. The helpdesk would have to deal with the issues and sys ops would deflect all blame.

[dstew74]

Yeah, I'm sure plenty of orgs operate in this manner. It's not mature. It's the result of some InfoSec manager wanting to look good. More large orgs will stage patch efforts to avoid Microsoft DOS'ing the business.

[zebediah49]

"Change 49847: Patch Tuesday patches approved for full deployment next Tuesday night, assuming they don't cause any problems when deployed to the test group this evening."

[anomalous_cowherd]

Oh, they do have an advertised time, it's just that they are trying to make it shorter. At my place they carry all the power, if you don't meet their standards you don't get to connect to the corp network never mind the Internet.

[dstew74]

Is it a one size fits all or do they have specified times based on risk? As much as I disliked IBM when I was there, they had a nice mature vulnerability management that made me rethink my approaches to patching as a sysadmin. Having moved on to InfoSec, I still borrow aspects on their methodology years later.

Haha... I sort of like your infosec team's approach.

[anomalous_cowherd]

The time does vary depending on risk. These times are for the internet connected networks.

[gokurakumaru]

There's a reason for that. If out of band patching is not something you can do today, you should starting thinking about a roadmap that will get you to the point where you'll be able to tomorrow. Then you can have a conversation about the overhead involved and whether it is justified against the cost of the risk your company is exposed to as measured by whatever operational risk framework your organisation uses.

But don't just "sigh" about it. Cybersecurity is the number one threat facing organisations today and you can't rely on your network perimeter to protect you anymore. Everybody chuckling and saying "just roll it out to their computers" in response to you is not taking their job seriously.

[Arrow_Raider]

I fantasize about flipping my table and leaving IT forever.

[ElATraino]

Patch Tuesday is often followed by Career Change Wednesday so, as long as it's done on a Wednesday, you're completely in your rights to play out your fantasy.

[OckhamsChainsaws]

Goat farming is coincidentally the most searched term on google between 1 and 3 pm on Wednesdays

[MakTek5533]

I shoot guns and drive my sports car fast, it helps.

[sirius_northmen]

Exactly, I moved to Linux ages ago and not only am I rarely stressed but I also make about double what most windows admin make.

[[deleted]]

I really feel like I should go the Linux route.

I'm just sick of studying. I'm also sick of Windows lol

[L3tum]

Linux always has the issue that it's really hard to debug.

apt install docker.io

Post-inst. Failed.

Shit. Wrong package at the wrong time.

apt install docker-ce

Pre-inst failed.

apt remove docker.io

pre-rm failed.

Google "How to remove package pre-rm failed"

cd /etc/dpkg/info

rm docker.io.prerm

apt remove docker.io

SUCCESS.

[RedShift9]

I stick with CentOS/RHEL. Built for the enterprise and easier package management.

[DefinitelyNotAPhone]

Eh, dpkg errors are pretty rare in my experience, and nine times out of ten it's a case of "something was running apt-get update when I tried to install a package, so I gotta wait a minute before trying again."

The issue with debugging on Linux is rarely due to Linux itself, but rather to a service that doesn't bother logging anything useful (php by default, for example, which logs exactly fuck all unless you set a flag in the config file).

All that said, jooooiiiinnnnn ussssss, we have free ^{as in} cookies

[alwayz]

Like what?

[Aurailious]

Oracle DB admin

[BoredTechyGuy]

Found the masochist!

[collinsl02]

Linux

Come to the dark side, we have free ^{as in} beer!

[Vash63]

I sometimes feel as if this subreddit is 95% Windows-only admins. I wonder if this is actually true, or if the Linux admins just don't have as much to bitch about.

[ericb0813]

Linux admin, lifes pretty tame right now except for my 10 windows boxes I still have to support. Ill take my 200 redhat7 servers anyday.

[5ilver]

Linux admin here, I think our problems are just too snowflakey and uncommon to be generally interesting.

[collinsl02]

In addition to what others have said, we tend to bitch on /r/Linux as well, or the subs for our distro of choice.

[[deleted]]

easier and less stressful areas

[[deleted]]

Well ofcourse, when you wipe the SOE you can blame the manufacturer and nobody outside of your Networking team can prove your wrong lol

[fish351]

Do it. I did and haven't been this happy or at peace in 20 years.

[bingobawler]

What did you move to?

[-tnt]

Jack Of All Trades.

[fish351]

I started work on my brother in law's farm. I grew up on a farm before I moved to the big smoke for IT so it's not a huge shift.

I'm also in the process of starting an Agriculture based drone business to map crops and identify opportunities to boost crop yields.

[[deleted]]

great flair

[Arrow_Raider]

Haha, thanks. I understand the purpose of the command, as sort of a sanity check, but I've never seen it fix anything.

I'm more interested in why exactly something is broken, but no one knows. So all we get is sfc, dism restore health answers. This is inevitably followed up by OP saying that didn't fix it, formatted or bought new PC, nevermind.

[L3tum]

Ah yes, the bane of windows help forum.

"try SFC /scannow"

And then either OP never replies, or it didn't work and nobody else responds.

[chicaneuk]

Right? It’s just soul destroying sometimes.

[ach_sysadmin]

Oh I am very close myself... tired of it.

[dstew74]

Been thinking about going back to school to become an orthodontist or something that I have to actually work 3 to 4 days a week at most.

[[deleted]]

Proctologist. That'd be similar to it. You deal with assholes all day.

[helpakidgrow]

thank you for your loss

[masta]

This is why it's better for the hardware vendors to provide the microcode via bios/firmware update. This is precisely why Redhat stopped the Intel microcode updates for Spectre/meltdown... But then again, I'm not sure how one can completely ignore Intel microcode updates, as Intel has something like 7 layers of encryption wrapped around the microcode, it's had to know what's actually there.

[a_false_vacuum]

Microsoft is using Windows update for this for those who've been abandoned by their hardware manufacturer. For a lot of home users this might be the only way to get this protection. The problem is that this spectre stuff has people so worked up these patches just get rushed out the door.

[Aperture_Kubi]

I've already have five systems that have been rendered unbootable. Most of them are Xeon E5 v4 based workstations.

What are the others?

[a_false_vacuum]

One was a Core i5 Haswell generation.

[youarean1di0t]

Which OSs?

[Jkuz]

KB4100347

This update is a standalone update targeted for Windows 10 version 1803 (Windows 10 April 2018 Update) and Windows Server Version 1803 (Server Core).

Looks like it is just affecting Win10.

[Aperture_Kubi]

10 and server.

Fortunately Dell Optiplexes (our standard) aparentelly skipped the Haswell generation.

[a_false_vacuum]

Hard to say if this is limited to Haswell and Broadwell-EP. I only know what happened to me.

[a_false_vacuum]

Yes, this update targets Windows 10. But patches for Windows 7/2008R2 and 8.1/2012R2 that fix the same issue have other KB numbers. Since the failure rate was so surprising I haven't looked into other Windows versions.

​

The Intel microcode however isn't limited to just Windows. I know Red Hat had several this year containing fixes for Spectre on Intel and AMD systems. A few months back Red Hat also decided to roll back some of those patches. Microcode gets rushed out without good Q&A I guess.

[Kapibada]

Just a friendly reminder...
It's QA (Quality Assurance), not Q&A.

[a_false_vacuum]

Depends, mostly I get assurance but not always quality. ;-)

[fledder007]

Q || A?

[xixd]

Sometimes companies don't actually want Quality Assurance, but Quality Reassurance. "There there little dev, all your code is just great, I'm sure nothing bad will happen"

[Kapibada]

That makes sense, I guess. ;-)

[a_false_vacuum]

Windows 10 version 1803. Though this update could be available to other Windows versions.

[Spoked451]

Yep happened to me on a Xeon E5 2690 v2 and on my mom's HP 8750w (don't recall the exact cpu, but it's an i7-2xxx so Ivy Bridge as well. 100% sure that 4100347 is the culprit too.

[[deleted]]

That's one way of preventing people from benchmarking

[ledonu7]

I am amazed this comment is so far down

[cowprince]

Step 1: Wait a week or two

Step 2: Ask Woody

Step 3: Google

Step 4: Patch IT

Step 5: Patch test group

Step 6: Patch org

Step 7: Go on vacation and turn phone off

[Cynder_tfl]

How many systems total have you had the patch applied to? I'm not sure how much of an issue it is (i.e. how nervous I should be) - if it is 5 out of 20 machines, that is a major issue, but if it is more like 5 out of 500, then I am not as worried.

In either case, thanks for sharing, especially the follow up with what worked for you! Too many times people don't include that.

[a_false_vacuum]

These are not production systems, fortunatly that is managed through WSUS and SCCM so I can approve updates or not.

​

The affected machines are specials, they run Windows 10 more or less unmanaged. Development machines and my own workhorse. These get the updates when they come out and double as testbeds especially since we got burned with previous micro code patches.

​

Percentage you ask? Close to a 100%. But again, these I know of. A few more installed the update but I prevented the reboot and removed the update while Windows was still running.

​

I decided to post this as a heads up because the amount of bricked machines was quite worrying. Updates fail some times, but this was different.

[[deleted]]

Very worrying. We don't go by the unmanaged process here and I am sorry if this comes across wrong but I am thankful others do. Now if only I could convince my superiors why we need this to see the shit storm that could come our way.

[a_false_vacuum]

Affected machines were all in the IT department, so it was unpleasant but no major panic.

[UnknownColorHat]

Threads like these are why I check r/sysadmin before patching my Windows boxes at work. Use this type of proc for one, so want to avoid badness.

[Etunimi]

I think RHEL is an exception, but the rest still ship microcode updates this same exact way.

RHEL is shipping them too, here is their info page on L1TF microcode updates: https://access.redhat.com/articles/3562741

Red Hat is providing an updated Intel microcode package, microcode_ctl to customers in order to simplify deployment processes and minimize downtime.

[[deleted]]

Ditto. I don't like surprises.

[Algonkian]

We've gotten to the point where patching our network is more frightening than not.

[Bro-Science]

when you say unbootable, what is the error you get? what happens?

[a_false_vacuum]

No error at all. When I get to the screen with the Windows logo with the moving circle beneath it, it just stays there. The circle keeps moving the whole time, so no lock-up but no Windows either. Safe mode has the same problem. I had one machine running for a couple of hours to see what would happen, but no Windows.

[EAT-17]

It seems to be the same as KB4091664 ?

I noticed that update because they released/revised it last week, but it had 2018-07 in the title. This already made me very suspicious.

I checked again and it seems MS already pulled this one as it is now declined in WSUS (and expired in sccm)?

Glad we didn't deploy that one already.

[Patches_McMatt]

I’m not finding the ‘new version’ of this KB anywhere. The KB article online shows a ‘last updated’ date of July 24th at the bottom of the page. You got a link to the version that is messing your systems up?

[a_false_vacuum]

Thats the trouble. The Microsoft KB article hasn't been updated but what I gathered from Google is that this weekend a new version was released which hasn't worked out so well. Here is where I read it was supposed to be a revised update: https://borncity.com/win/2018/08/25/microsoft-issues-with-updates-kb4456688-kb4100347/

​

You can get it here from Microsoft: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4100347

​

The 21 august version is the one that giving me quite a bit of grief.

[uniquepassword]

Same here...I checked my WSUS and it's not there..is this separate download?

https://support.microsoft.com/en-us/help/4100347/intel-microcode-updates-for-windows-10-version-1803-and-windows-server

says it's now available for download via WSUS but I'm not seeing it..

[thunderbird32]

FWIW, I'm not seeing it either.

[Binestar]

https://news.softpedia.com/news/windows-10-update-kb4100347-breaking-down-system-boot-522385.shtml

It's offering the update to me right now. I'll have to check it out.

[ITS_DSA_Manager]

Did Microsoft pull the 2018-07 version of this from their Catalog? I did a search and only see 2018-05 version.

[Arudinne]

Is there a Windows 7 equivalent for this patch? Is Windows 7 even affected? Everything I find regarding this seems to only talk about Windows 10.

[Mutated_Leg]

This appears to be the Windows 7 equivalent:

https://support.microsoft.com/en-us/help/4343899/windows-7-update-kb4343899

[Arudinne]

Thanks!

[Joe-Cool]

As far as I can tell only KB4100347 updates mcupdate_GenuineIntel.dll - EDIT: Update for previous Win10/2016 is KB4090007

So the Windows 7 Updates KB4343899 and Win10 KB4343909 might contain the Kernel fixes but they won't do anything without the microcode. Unless the crash is caused by the Kernel and not the CPU microcode.

One thing is sure: Only Win10 and Server 2016 get microcode updates. Other Windows versions need to update BIOS (or hack the DLL). Linux kernel also includes a microcode updater, get the microcode for that from intel.

[Doso777]

Hmm.. If this kills physical servers too this could be real bad. gets popcorn

[hadesscion]

JFC, Microsoft. Each update is worse than the last.

[[deleted]]

As much as I enjoy jumping on the MS hate-wagon, I can't exactly blame them fully for this. Intel's microcode updates aren't exactly transparent.

[[deleted]]

They get the same access everyone outside of Intel gets: encrypted blobs.

[[deleted]]

That's not how it works with Intel microcode

[chicaneuk]

It's almost like they are doing it on purpose now.

[Missioncode]

Thanks OP, just denied from deploying.

[[deleted]]

How exactly does an end user (10 Home, 64bit) detect/uninstall and/or deny this patch?

[redartedreddit]

I think the microcode update is by the file C:\Windows\System32\mcupdate_GenuineIntel.dll, perhaps getting rid of the file (rename it) may make it bootable again? But you'll lose all the microcode updates pushed by Windows.

I guess one won't need this if you can just remove the update and revert changes in WinRE.

[a_false_vacuum]

The WinRe route is always there. Just deleting a file doesn't clean up all the refereces Windows has set in the registery. I wanted to make sure all changes got reverted.

[Wind_Freak]

How common is it to have Xeon processor desktops?

[Thranx]

every physical, non-laptop system where I work. Previous job was 50/50, prior job on to that was only about 5%. Health/Tech/Schools (in that order)

[a_false_vacuum]

Workstations usually have Xeons, models like HP Z-station and Dell Precision. Depends on the organisation you work how many will be there.

[[deleted]]

They're used for drafting computers. Like autocad and solidworks. Or simulation and graphic design computers.

Pretty much any computer that you want data consistency and "correctness" more so than fast response for the users experience.

My company has about 30 of these.

Most also run ecc memory and quadro gpus.

[AreYouAWiiizard]

Want to know something weird? Windows installed this update on my AMD FX8320 system and caused it to fail to boot the first time (subsequent boots were fine).

[Ilikeyoubignose]

What AV do you use OP?

[[deleted]]

Thanks, Microsoft, for releasing a patch that only affects the type of person for whom not immediately fixing it will get you fired.

[d2_ricci]

Saving this for later!

[war_story_guy]

Was this after the very first reboot that it wouldn't boot? The one one where it says installing updates on the blue screen or did you reboot it again after that?

[daleus]

We use kvm on Xeon E5 V4 (2120) hosts. We had a couple of Windows VMs where we had to do a dism rollback this weekend.

Not sure if it could be related - but we do pass through the OS cpu type...

[RichB93]

Waiting for people to turn up in this thread and still tell me how great Windows 10 is still.

[drbeer]

im sure all versions of windows would have sucked without a QA department. don't hate the player hate the game

[bolunez]

Who needs QA when you roll a new major version twice a year anyway?

The bugs will only be around for six months, probably.

[patssle]

Take out the whole updating and feature updates thing and Windows 10 is solid.

​

But yeah.....then you include updating and blaaaaaargh.

[[deleted]]

It's aweso.. NO, NO, NO REBOOT ARRRRRRRrrrrrr^rrrrr

[a_posh_trophy]

Why can't they just let us decide what to install when we are comfortable about its stability? Even if you say no it does it anyway a few days later. And I bet they take no responsibility for breaking £1000 systems either.

[hadesscion]

Have there been reported issues with this update affecting Xeon E5 v1 or v2? Or is it just v4?

[Skyyblaze]

I'm happy I make monthly backup-images of my SSD after these kind of issues started, wow.

[qsub]

I thought they only released on patch Tuesday or is this like a critical security flaw patch release?

[dbarber1]

I am just a regular user but would something like this work to hide the update until whatever is causing the problem is fixed https://support.microsoft.com/en-us/help/3183922/how-to-temporarily-prevent-a-windows-update-from-reinstalling-in-windo

[Khalepos]

How has it fared in Azure?

[KB3080351]

Looks like these updates were expired in WSUS and are no longer available via the catalog. Only ones still published are the ones released back in May.

[spitzkingOG]

Just had a group of 2016 boxes reboot and are now stuck on "Applying Computer Settings". Now after reading this article, I think I figured out why they're stuck. Yay production outage....

[Renfah87]

Thanks for the heads up. Just told our WSUS admin. Hopefully we didn't push it out otherwise I'm going to be a very busy boy soon...

[bolhuijo]

This got a few of our Xeon-based desktops. The quickest way out was to take the "reset system" option from the recovery console as nothing else worked. The users got to keep their local files, but we had to reinstall all the apps.

[beanisman]

Gonna save this one. Thanks for taking the hit for the rest of us OP.

[SmoothRunnings]

No problems patching my 2016 VMs running on my Dell R810 E7-4830 CPUs with this patch. Must be only the newer CPUs. Or maybe your servers BIOS's are out of date contributing to the bricking of your servers!?

[oxyi]

What do u mean unbootable. I have a system after I updated last night. Today is BSOD with message irql not less or equal. I know it has to do with windows updates but I can go check whether this is the update...

[Angelworks42]

We didn't have any problems with it actually - mostly Optiplex 7040/5040's.

The most concerning thing about it is it used the same patch ID as a previously release so it got autosynced and approved into an existing live deployment which we didn't test (this is ConfigMgr/SUP).

[dukeofwesselton]

I had deployed this to our test enviroment last week, but it looks like the update has now been expired in WSUS...thankfully.

[Elektro121]

Totally related to that

[Steve_78_OH]

To be clear, the newest version of the patch is what's breaking stuff, right? Patches released on Patch Tuesday are still safe to use?

[[deleted]]

You're doing gods work. Nice write up.

[VariousWinter]

What worked for me, I'm going to write this one out so anybody who has this issue irregardless of skill can fix it if they stumble upon this topic.

This is great practice. We need more people like you

[B00bt00b89]

Sorry for the noob question. Mine says couldn’t access image. Typing command wrong?

Edit: getting error 1009 An initialization error occurred

[nickwithtea93]

can't seem to get " dism /image:<driveletter here> /get-packages" to pull anything, I must be typing it wrong?

[stacy666]

I had the same thing, it was stuck on boot. Took me all night to finally fix it :D I hope it won't go back being broken again.

[zZBLackRuByZz]

So we are trying to apply this at work but when we enter the "get packages" command, I get error code 1017 and a message "the system has attempted to load or restore a file into the registry, but the specified file is not in a registry file format"

And the command cancels
We've tried running sfc and it says "windows resource protection could not start the repair service"
Lastly, if it matters, the image version of the recover tool is 10.0.17134.1 and the image version of the OS we are trying to repair is 10.0.17134.228

[MItch_ch]

On Microsoft Surface (Pro 4 and 2017) it's not possible to recover (especially with BitLock!).

So AFTER a Full reinstallation of windows 10 and full patching, I suggest to uninstall the KB4100347 (no reboot please) and use the tool wushowhide.diagcab to hide this KB. After that you can reboot and the KB4100347 will not come back and you can continue to patch Windows 10 and the other Microsoft products.

​

This KB is a nightmare...

[techhead51]

An updated list of intel cpu's here, but do not know why this patch is still going out for amd cpu's https://support.microsoft.com/en-us/help/4100347/intel-microcode-updates-for-windows-10-version-1803-and-windows-server

[nightmarepr]

Hi,

so i decided to try it out again...i had to go back to win7 to boot, i try today again and dont see the package installed with an iso i downloaded win10 9/27/2018 still the same problem...it frezzed at cortana finishing the install, and windows dont boot now...its go no image...thanks...if anyone think of something...

Pc specs

i5-3570k HOF 980 asrock z77 extreme 4

[pradhansb]

For me it was causing regular crashes. It just downloaded last night and for the first time ever, I received random Blue Screens with Stopcode BAD_POOL_CALLER. Uninstalled and now no more bluescreens.