Windows patch KB 3139929: When a security update is not a security update | Hacker News Reader

Windows patch KB 3139929: When a security update is not a security update

infoworld.com

78 pointsbased235 comments

There's been a huge shitstorm on Reddit about Windows 7 / 8 forcing an automatic upgrade to Windows 10 [1] [2] [3] [4], with many accounts of people going away to do something and coming back to find their PCs had updated to Windows 10 without their permission. However I've not been able to find any stories on this from reliable sources. All I've found so far is a forum post on CNET and a submission on Slashdot [5] [6].

Does anyone know what's actually going on with this?

[1] https://www.reddit.com/r/pcgaming/comments/4a5edx/psa_window...

[2] https://www.reddit.com/r/pcgaming/comments/4a7bkp/psa_micros...

[3] https://np.reddit.com/r/technology/comments/4a0asv/warning_w...

[4] https://www.reddit.com/r/pcmasterrace/comments/4a59p4/psa_wi...

[5] http://www.cnet.com/forums/discussions/forced-to-upgrade-fro...

[6] https://news.slashdot.org/story/16/03/12/1634229/windows-10-...

Whatever is going on, you can stop it from happening. Please get the word out about GWX Control Panel!

http://ultimateoutsider.com/downloads/

You can turn off all updates, delete the pre-downloaded update cache, kill the tray notifications, etc. - works wonderfully on several machines I tested!

Source code?

Not my project, but it works. No idea if source is available.

There's no need to install any 3rd party software. Microsoft themselves provide the switch to disable upgrades to Windows 10:

https://support.microsoft.com/en-us/kb/3080351

(and you can also simply not install/uninstall KB3035583 aka GWX)

With all due respect to this official microsoft solution, it's a huge pain in the complicated ass for casual users to follow. GWX Control panel is just click, click, done - something you can tell your grandma to do.

Unfortunately, it looks like that same tool could make it a bit too easy to disable Windows Updates altogether, which is not a good idea.

I'd rather endure some pain with going through the registry route, but apply a fix that addresses only one particular behavior.

MS isn't respecting the update settings I choose allready. I no longer trust any of the so called "solutions" they are offering.

Edit: in my particular case I tracked it down to a third party install that was forcing a windows update, so it wasn't directly an issue with MS in this case.

There is also a registry fix that I came across recently.. even simpler.

Share please!

You can also turn all outgoing connections off by default in the windows firewall, then whitelist the couple of programs that actually need to access the internet.

I had windows 7 set to ask permission before installing updates. This morning it downloaded an update and without warning it shut down all my software and tried to restart to install it. I was able to cancel the restart but now I have a nag window that only lets me put off the restart for 4 hours.

This is a work machine and I am absolutely livid. I can't use windows 10 to do the work I need to do, and any time I spend on this is time I am not able to earn my living. As far as I'm concerned Microsoft is trying to steal my legally purchased copy of windows 7 from me.

Quick fix: open a command prompt as admin (Ctrl+Shift+Enter) and type:

net stop "windows update"

That will stop it until you reboot....

After that, uninstall KB3035583 (choose to reboot later when prompted), then run the Disk Clean up tool and select the Clean up system files after the initial scan. Select the Temporary installation files for deletion. Longer version: http://winsupersite.com/windows-10/prevent-windows-10-upgrad...

If you are up to editing the registry via regedit, the key is:

HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DWORD value: DisableOSUpgrade = 1

See: How to manage Windows 10 notification and upgrade options https://support.microsoft.com/en-us/kb/3080351

OK, Ed Bott of ZDNet has posted a couple of reg files, DisableOSUpgrade.reg and DisableGWX.reg. Download them, double-click them, and they will change the registry for you.

See: How to block Windows 10 upgrades on your business network (and at home, too) http://www.zdnet.com/article/how-to-block-windows-10-upgrade...

The two small text files are at https://onedrive.live.com/?authkey=!APe8Z7RJNVNc0uM&id=FEA7E...

Which is odd, because it doesn't install without permission.

Even if you can't see how to avoid installing it (ie you can't read or miss the small type that says "Click here to change upgrade schedule or cancel scheduled upgrade") then you can simply decline the EULA.

However, the level of technical expertise on reddit is noticeably lower than reddit users think, so it may be a much more common problem: PEBCAK ;-)

It appears that this patch was bumped from recommended to important and ended up getting automatically installed. Even SME networks running WSUS were affected if they are configured to allow important patches by default.

Got four auto-updated PCs here at home that qualify for the upgrade and it hasn't happened to any of them.

And given Microsoft's reliance on people accepting its EULA, I'm pretty sure it would not deliberately bypass that....

Otherwise, Microsoft stated that it wouldn't upgrade PCs updated via WSUS, so I'd be interested to see concrete evidence, because that would clearly be a mistake. Not to mention wrong.

Folks over in /r/sysadmin has been complaining for about a week. My understanding if that the upgrade will actually go through unless GPO explicitly prevents the upgrade[0]. And the EULA dialogue will only appear AFTER the installation is complete[1].

[0]: https://www.reddit.com/r/sysadmin/comments/49nyhl/get_window...

[1]: https://np.reddit.com/r/technology/comments/4a0asv/warning_w...

> the EULA dialogue will only appear AFTER the installation is complete

This is true, and it's a waste of time, and it creates unnecessary risk. However, if you decline the EULA, it does roll back to your old OS. I've done this several times and it has worked perfectly so far.

It absolutely shouldn't be happening, but real sysadmins have the means to stop it from happening.

Came back to my win7 machine to a dialog saying that Windows 10 will automatically update for me in 3.5 hours. There was no actual cancel button, only try again later.

To be honest, when I first saw the win10 update dialog I thought it was malware. The tray icon and the dialogs are stored after windows 8 so they don't look right.

I spent about 3 hours this week doing tech support for my mom over the phone because of Windows 10's aggressive upgrading behaviour.

I told her to keep her the best way to keep safe security wise is to make sure the os/browser is up to date, and because Windows 10 keeps asking to upgrade, she went ahead and did so. After upgrading to Windows 10, all network access (wired and wifi) stopped working completely. The worst part of this is that if you can't get internet, you can't even download new drivers to try and debug the problem. We tried a few things, and eventually just did a system restore back to Windows 8, but unfortunately, the system restore didn't work completely and there was more mucking around to try and get the computer into a bootable state. Then, last night, she said the heard the fan making a lot of noise, and looked down to see that Windows had gone ahead and started installing Windows 10 again. Fortunately, wired network access works now, but wifi is still broken. Hopefully Windows will push an update that fixes the wifi access.

Microsoft seems to be working hard to keep the forces of the universe balanced. Whatever good will is generated by their foray into oss must be immediately offset by ill will produced by windows 10.

It's just the second law of thermodynamics at work.

I find this behavior really curious on Microsoft's part. When I originally read that Windows 10 would be the last version of windows I thought it metaphor, but I think Microsoft is really serious, they are no longer interested in producing a standalone operating system for machines. It feels to me like they are dragging their customers into a ChromeOS type world where everything is on the network.

Although force-upgrades are definitely too much, I wonder why such a strong opposition to upgrade t a much better OS in every way?

It certainly cannot be privacy, because you can turn off every piece of phone-home stuff. Also, almost every other OS has been doing the same thing for a long time now, so it seems a bit of an overreaction when Windows does it.

This sort of no-upgrades policy is what leads to IE6. And the entire world has to suffer because of a few obstinate sysadmins.

> It certainly cannot be privacy, because you can turn off every piece of phone-home stuff.

No, you can't.

I definitely can! I have options for everything including Cortana to the automatic malware reporting.

Unless you have Enterprise their are still telemetry options that cannot be turned off entirely, and there is diagnostics and usage data not covered by any of the user settings that still leaks from the OS back to Microsoft.

If you want to block them as well you need to do it with a firewall rules (like a third party software firewall on whitelist mode).

Is this the garbage in the system tray that keeps putting up notices about windows 10? or is this something else?

This one shows an ad in IE.

"I spent most of the night trying to replicate this behavior -- a blue banner on new tabs in IE11 with "Microsoft recommends upgrading to Windows 10" -- and couldn't get it to trigger. If you can, I'd appreciate your shooting an email with a screenshot to woody@askwoody.com."

weird, I just opened IE up and got it immediately:

https://imgur.com/o69rzTG

I get that same ad on a Windows 2012 R2 RDS server. It's interesting having a user in a remote desktop environment log a ticket about a required upgrade to Windows 10.

This is great. Nagging people might actually get them to upgrade to a supported, secure browser. I literally see nothing wrong with this.

But IE 11 is still supported and "secure" after latest updates.

Reply on news.ycombinator.com