Time to set up Microsoft’s mainstream September patches ...

It's a smelter-weight slapdown. 

in a single nook you've got the fowl Little contingent, which insists that September's IE zero-day patch need to be essential because Microsoft marked it as "Exploited: yes" and memorialized it with a very atypical patch on a Monday, adopted in Keystone Kops vogue with a stumbling path of comply with-ons. 

in the other corner you have got Dummies like me who say Microsoft surely didn't care that a whole lot concerning the protection gap since it didn't truly push out a repair. If Microsoft had been critical about the zero-day, the Dummies insist, it will've gotten its act collectively by way of now. Demonstrably, the act continues to be in development.

[ bought a spare hour? Take this online path and learn how to set up and configure home windows 10 with the alternatives you want. ]

And within the middle you have 1000000000 or two home windows shoppers who in fact don't care. They simply desire their computer systems to work and not all at once get whopped by means of a WannaCry wannabe.

Welcome to home windows as a service.

internet Explorer selections

With cyber web Explorer usage share hastily swirling down the drain, you could wonder why anybody would care a couple of patch for a zero-day worm in IE. The issue is that some security holes in IE can be exploited although you aren't using IE as a result of Microsoft spreads IE plumbing throughout windows. reasonable satisfactory. however Microsoft hasn't mentioned if the CVE-2019-1367 exploit may also be harnessed although you aren't the usage of IE. So the long and brief answer is we don't understand if you really need to install the IE patch(es).

That's genuine even with what you heard to your local evening information correct after the climate report — or examine in a single of a gazillion chicken Little articles rumbling within the home windows echo chamber.

[ connected: a way to offer protection to windows 10 PCs from ransomware ]

In what follows, I'll show you the way to install the professional, approved patches for all types of windows. That'll leave you unprotected from the CVE-2019-1367 ghoul. If the bird Little method appeals to you, if you happen to're accomplished with these steps, you have one of two decisions for windows 10:

Manually download and set up the Sept. 23 one-off patch on your version of home windows (1903 is here, 1809, 1803). in case you do that, understand that after you've put in the patch, you received't be able to deploy .web 3.5, which likely isn't a large deal until you're using the SAP ERP equipment. make certain you've got the newest Servicing Stack replace working before you install.

Use home windows update to set up the Sept. 24 or 26 "non-compulsory, non-security" patch (for 1903 that's KB 4517211, for 1809 it's KB 4516077, for 1803 it's 4516045). When offered the choice (see the screenshot at the conclusion of this text), click on down load and set up now. The "non-compulsory, non-security" patch which includes a safety patch will protect you from the IE zero-day, nonetheless it also may clobber your printer.

if you're using windows 7 or eight.1 (or Server versions) and also you observe the guidelines right here, you'll get all the counseled September patches, but you received't be included from the CVE-2019-1367 mess. if you're within the chicken Little birthday celebration, the easiest way to get included is to manually set up a single standalone patch, KB 4522007, that applies to IE in Win7, 8.1, Server 2012 and Server 2012 R2. It's a undeniable-vanilla IE patch (which ability it's a rollup), arriving at a weird time. It's now not a windows patch. 

extra telemetry for Win7 and eight.1

This month brought three cumulative updates for every version of Win10. The final cumulative update, marked "optional, non-safety" is really a safety patch. but you Win10 clients shouldn't suppose particular. Win7 and eight.1 this month have exactly the contrary difficulty — their "security most effective" patches encompass the whole suite of Microsoft snooping/telemetry updates, and setting up them sets up scheduled projects to use them.

It's the identical shenanigans we noticed in July.

happily, there are the right way to stay clear of the telemetry — or as a minimum lower it. details follow.

replace

here's the way to get your system updated the (tremendously) safe means.

Step 1. Make a full system image backup before you install the newest patches

There's a non-zero chance that the patches — even the newest, most effective patches of patches of patches — will hose your desktop. most effective to have a backup for you to reinstall although your computer refuses besides. This, besides the usual want for system restore elements.

There are a lot of full-photo backup items, together with as a minimum two decent free ones: Macrium mirror Free and EaseUS Todo Backup. For Win 7 users, if you aren't making backups always, take a glance at this thread started by way of Cybertooth for details. you have got respectable alternatives, both free and not-so-free.

Step 2. For Win7 and 8.1

Microsoft is blocking off updates to home windows 7 and 8.1 on contemporary computer systems. if you're operating home windows 7 or 8.1 on a pc that's 24 months old or more moderen, observe the guidelines in AKB 2000006 or @MrBrian's summary of @radosuaf's components to be certain which you can use windows update to get updates utilized.

in case you've been relying on the protection-most effective "group B" patching method to retain Microsoft's snooping utility off your notebook, you're stuck once more this month. which you can set up the August protection-best patch with out bringing in the snooping routines. but unless you install the telemetry-laden July and September protection-handiest patches, you're missing a couple of months of (no longer in fact all that vital) patches. suppose of it as a preview of your January Win7 end-of-aid conundrum.

for many home windows 7 and 8.1 clients, i like to recommend following AKB 2000004: the way to apply the Win7 and 8.1 monthly Rollups. remember to have one windows patch, dated Sept. 10 (the Patch Tuesday patch). in case you're very paranoid concerning the CVE-2019-1367 IE zero-day exposure, use the separately downloaded and manually put in IE replace, KB 4522007. 

know that some or the entire anticipated patches for September might also not exhibit up or, if they do reveal up, can also now not be checked. DON'T check any unchecked patches. except you're very sure of your self, DON'T go searching for additional patches. In specific, in case you install the September monthly Rollup, you won't need (and doubtless won't see) the concomitant patches for August. Don't mess with mother Microsoft.

in case you see KB 4493132, the "Get home windows 10" nag patch, be sure it's unchecked.

be careful for driver updates — you're far at an advantage getting them from a company's site.

After you've put in the latest month-to-month Rollup, in case you're intent on minimizing Microsoft's snooping, run through the steps in AKB 2000007: Turning off the worst Win7 and eight.1 snooping. in case you wish to thoroughly cut out the telemetry, see @abbodi86's exact instructions in AKB 2000012: the way to Neutralize Telemetry and maintain home windows 7 and 8.1 month-to-month Rollup model.

know that we don't know what tips Microsoft collects on Window 7 and 8.1 machines. however I'd be willing to bet that absolutely-up-to-date Win7 and 8.1 machines are leaking nearly as a good deal very own data as that pushed in Win10.

Step three. For windows 10 prior to edition 1903

if you wish to keep on with your present edition of Win10 professional — an inexpensive alternative — you can observe my suggestions from February and set "nice replace" (cumulative update) deferrals to 15 days, per the screenshot. in case you have nice updates set to 15 days, your machine already up to date itself on Sept. 25, and may replace once more on Oct. 16. Don't touch a thing and in selected don't click on assess for updates.Woody Leonhard/IDGFor the relaxation of you, together with those of you stuck with Win10 domestic, go during the steps in "8 steps to installation windows 10 patches like a pro." be certain that you just run Step 3, to cover any updates you don't want (such as the Win10 1903 upgrade or any driver updates for non-Microsoft hardware) earlier than proceeding.

if you see a observe that "You're at present running a version of windows that's nearing the end of guide. We advocate you replace to probably the most fresh version of windows 10 now to get the newest features and security improvements" you could safely kick back. Win10 1803 is decent through November. if you see a link to "down load and set up now," ignore it — for the same reason.

Step 4. For windows 10 edition 1903

windows replace in Win10 edition 1903 went via a important makeover final month. The outcomes, if it really works the way it's been described, will be a huge step ahead in home windows 10 patching.

There's a legacy fly within the ointment, although. if you've moved to Win10 pro version 1903, and also you set 15 day deferral on best updates (as proven within the preceding screenshot), you'll little question find that the settings proven within the screenshot aren't any longer purchasable to your laptop. Microsoft hasn't yet deigned to inform us what's occurring, however that you would be able to relaxation certain that your 15-day deferral turned into obeyed — and also you received the September patches on Sept. 25. Don't be anxious about changing the deferral settings. You're covered until Oct. sixteen.

long story brief, the setting proven in the screenshot might also not be seen for your laptop. no longer to be concerned. you've got a belt-and-suspenders variety of second option. in case you're on Win10 version 1903 (both domestic or seasoned), click the hyperlink on the home windows update web page that says "Pause updates for 7 days," then click on the newly published link, which says "Pause updates for 7 extra days," then click on it once again.

by means of clicking that hyperlink 3 times, you'll defer cumulative updates for 21 days from the day you all started clicking — if you do it today, you'll be blanketed until Oct. 23 — which is customarily lengthy sufficient for Microsoft to work out the worst bugs of their patches.

There are a couple of community policies and a handful of registry settings working within the historical past for those who make these adjustments. but when you're using pro and set the quality update deferral to 15 days, and punch the "Pause updates for 7 days" button 3 times (on both domestic or pro), remember to be in first rate shape. Woody Leonhard/IDGIf you see a suggestion of an optional replace (screenshot), don't click down load and set up now. much more bugs look forward to.

And, no, I don't know how to reliably keep Win10 1909 off your 1903 desktop. For now, the Pause updates button may still maintain you covered. At some element Microsoft will should clarify exactly how the function-upgrade-in-cumulative-replace-garb receives installed.

I believe.

reside tuned.

thanks to the dozens of volunteers on AskWoody who make contributions mightily, mainly @sb, @PKCano, @abbodi86 and many others.

We've moved to MS-DEFCON 3 on the AskWoody Lounge.