Microsoft Patch Alert: April 2020, another ‘wacky’ month

The patching pace this month returned to normal: We had the Patch Tuesday patches on April 14, followed by the “optional, non-security, C/D Week” patches one week later (Monthly Rollup Preview for you Win8.1 afficionados). With a bit of luck, that’s the last round of confusing “optional” Win10 patches: Microsoft promises we won’t see any more of them.

We also had an out-of-band patch for Office 2016 Click-to-Run, Office 2019 (which is only available as Click-to-Run) and Microsoft 365 Apps for Enterprise (previously known as Office 365 ProPlus). The big concern with those patches falls into the “it’s not a bug, it’s a feature” column.

More big, scary zero-day vulnerabilities

For the Chicken Little crowd, we had three zero-day patches – ones identified by Microsoft as being “Exploited” when issued – and, as best I can tell, none of those have found their way into mainstream attacks. Same old story.

As a perplexing sidenote, many reports included a fourth zero-day patch, CVE-2020-0968, which was issued with an indication of “Exploited: Yes” but is now listed as “Exploited: No.” Long story, but the divergent reports on the web have largely been updated. (Thx, @campuscodi, @dangoodin001)

I’m not aware of any widespread attacks based on any of the three (or four) “Exploited” patches. As usual, the exploits at this point are limited to extremely targeted attacks.

VBA libraries get blocked with the Office Click-to-Run patches

If you use one of the recent Click-to-Run versions of Office and you start getting “Compile error: / Can’t find project or library” error messages (see screenshot), there’s a reason why. You’re running a VBA command – whether you realize it or not – that’s trying to open something out on the wild, wild web.

 

Microsoft

Patch Lady Susan Bradley explains in her Patch Watch column (paywall, donation required):

“Microsoft is doing you a favor; it’s pointing out that an application you’re using is breaking security by pulling links or references directly from the Web rather than from your computer…. Microsoft recommends that you move your VBA object libraries to an intranet (i.e., local network) location. You can then use a Group Policy object setting to remove the blocking.”

The old ‘missing’ data new profile bug is still there

I’ve been talking about this bug for months, and it doesn’t seem to be getting any better.

It’s not clear to me why or how, but in some cases, the Win10 Cumulative Update installer hits a “race condition” on reboot, with the user coming back up to a temporary profile. In plain English, the user runs the update, reboots, and returns to a clean desktop, without their desktop customizations, while files in their customary folders (such as Documents) have disappeared.

I don’t know what causes the race conditions, but I do know lots of people have complained about deleted data files when, in all likelihood, they’re sitting at the bottom of an obscure backup profile. I’ve even heard from someone who upgraded from Win10 1903 to version 1909 and hit the same problem.

The right people at Microsoft know all about the problem, but nobody has acknowledged it or confirmed it. The best solution is to re-boot all the way through log in four or five times and, if that doesn’t work, try to retrieve your wayward profile using an enormously complex series of steps outlined by Shawn Brink on Tenforums.

Installation problems and blue screens

Every month we see Win10 cumulative update installation problems – the installer runs for a while, hiccups, then rolls back the cumulative update. This month there have been more than the usual number of reports, at least in my experience.

We also frequently see one-off bluescreens after installing the latest cumulative update. It’s hard to tell whether the bluescreen is actually caused by the patch, or if it’s just serendipity in reverse.

Usually, sooner or later, a pattern emerges – a specific hardware combination, or driver, or other software conflict – and it becomes clear who should avoid trying to install the cumulative update. This month, though, I’ll be hanged if I can see a pattern.

Microsoft really wants to know about the bugs you hit

Surprisingly, uniquely, and much to its credit, Microsoft issued a call for help with the latest outstanding bugs:

“We have seen social media reports related to KB4549951 [the April Win10 version 1903 and 1909 cumulative update] that mention Bluetooth, stop error with blue screen and other related issues… To date, we have not seen these issues reflected in telemetry, support data or customer feedback channels. We continuously investigate all customer feedback and are closely monitoring this situation. Note If you experience any issues we’d like to know. Please provide feedback using the keyboard shortcut Windows + F or go to the Start menu and select Feedback Hub so that we can investigate.”

Of course, reports of the problems have peppered the Microsoft Answers Forum, the Windows Feedback Hub, the official Windows 10 cumulative update thread on Reddit, and in dozens (or more) online articles and blogs.

Still, it’s nice of them to ask.

 

Microsoft

I was recently informed that, if you want to report a cumulative update bug in the Feedback Hub, you should NOT necessarily put it in the Install and Update category (screenshot).

The Install and Update category is reserved for problems with the update installer itself. For example, install failures would go in the Install and Update category – but “missing” data and bogus temporary profiles would, presumably, go under Desktop Environment, even if the problem’s clearly linked to a specific update. Likewise, presumably, cumulative update-induced reboot bluescreens would go in… some other category. You get to choose which one.

Sporadic problems connecting to v4 printers

Susan Bradley is following a handful of complaints about the latest Win10 version 1903 and 1909 cumulative update breaking access to shared printers. It appears that the cumulative update knocks out some shared printers using the v4 Printer Driver.

We still don’t know whether the problem lies with the cumulative update, the driver, Group Policy settings, or the phase of the moon. Two official Microsoft support cases have yielded zero useful results.

Not looking forward to May

I’m dreading May. Microsoft seems hell-bent on releasing Win10 version 2004 in May. Computerworld’s Gregg Keizer and I have both strongly recommended that it hold off until we aren’t in the middle of coping with a massive shift to Work-from-Home.

I’m seeing more and more reports of problems with the version of Win10 2004 that’s currently available to Windows Insiders. Gene Morgan, for example, wrote to tell me:

“I’m an Insider and installed the Pre-Release offering which is usually equal to what will soon be unleashed into the wild and previous such updates worked with no issues. After the installation and the numerous reboots involved, the desktop appeared and all seemed well until I went to open Outlook 365. Click on It and nothing happens. Try to open Word 365, frame comes up but nothing you can work with. Try to open Adobe Acrobat DC, won’t open. Try to open the new Edge Browser, ditto. Open Google Chrome, the frame and tabs come up but after 45 minutes, there was nothing in any of the tabs. Hard Drive light is on continuously – not even flashing, solid on.

I rebooted, thinking something may not have loaded properly. Nothing resolved. Hard Drive light on continuously as before. Thinking “well maybe there’s just a lot of cleanup that needs to be done after the install” I left the machine to its own devices overnight. Next morning, no programs will open as before. Annoyed, restored my PC to v. 1903 and everything works like lightning.”

For every botched upgrade I’m sure there will be dozens of clean ones. But why kick the dog? The list of new features in Win10 version 2004 seems even less compelling than any Windows version upgrade, ever. That’s quite an accomplishment. Microsoft should re-examine its motives, in light of the current state of computing.

Credit: Woody Leonhard, Computerworld