Patch Tuesday was a week and a half ago, but it"s becoming more and more common for Microsoft to push multiple cumulative updates in a month. This week, the firm released new updates for PCs running the Windows 10 Anniversary Update (version 1607) and the Creators Update (version 1703).
If you"re on version 1703, you"ll see KB4077528, or build 15063.936. You can manually download it here, and it contains the following fixes:
Addresses issue where an application cannot read or write attributes of windows that belong to another process using Get/SetWindowWord, Get/SetWindowLong, or Get/SetWindowLongPtr.
Addresses issue where Internet Explorer stops responding, which delays the desktop appearing, makes the Start menu unresponsive, and causes some system tray icons to disappear.
Addresses issue where members of the Performance Log Users group receive the error “Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))”. The error appears while trying to schedule logging of performance counters, enable trace providers, or collect trace information.
Addresses issue where authentication to Microsoft Outlook fails when using conditional access.
Addresses reliability issue where certain Device Guard rules may cause the system to stop working.
Addresses issue where a 0x06d9 failure occurs when a user attempts an OS upgrade or an LCU update. The system automatically reverts to a previous version of the upgrade or update.
Addresses issue where a server error occurs occasionally during file transfer. The error is “Stop D1 in tcpip!TcpSegmentTcbSend”.
Addresses issue where a print server name containing a wildcard character (*, ?) prevents the Point and Print Restrictions Group Policy from taking effect.
Addresses issue where the Remote Authentication Dial-In User Service (RADIUS) server name isn"t authenticated while connecting to a wireless network.
Addresses issue where iSCSI target redirection during login might lead to stop error 9f.
Addresses issue that causes server-side performance regression and poor transfer rates for high-latency scenarios.
Addresses issue where the Internet connection service (ICS) connections don"t persist across OS restarts or ICS service restarts. You can also activate this solution using an optional EnableRebootPersistConnection registry key described in KB4055559.
Addresses issue with the Auto-register Inbox templates feature for UEV where the Scheduled Task didn"t have the proper trigger.
Addresses issue where the App-V client didn"t read the policy for SyncOnBatteriesEnabled when the policy was set using a Group Policy Object (GPO).
Addresses issue where the Supported On field for the Enable App-V Client policy is blank in the Group Policy editor.
Addresses issue where the user’s hive data in the registry is not maintained correctly when some App-V packages belong to the connection group.
Provides additional logging for administrators to take action, such as picking a proper configuration for their App-V package, when there are multiple configuration files for a single package.
Addresses issue with App-V packages that aren"t compatible with registry virtualization using kernel containers. To address the issue, we changed the registry virtualization to use the earlier (non-container) method by default. Customers who would like to use the new (kernel container) method for registry virtualization can still switch to it by setting the following registry value to 1:
Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AppV\Client\Compatibility
Setting: ContainerRegistryEnabled
DataType: DWORD
It also contains one known issue to be aware of:
| Symptom | Workaround |
|---|---|
| Because of an issue that affects some versions of antivirus software, this fix applies only to computers on which the antivirus ISV updated the ALLOW REGKEY. | Contact your antivirus manufacturer to verify that their software is compatible and that they have set the following REGKEY on the computer: Key="HKEY_LOCAL_MACHINE"Subkey= "SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" Value Name="cadca5fe-87d3-4b96-b7fb-a231484277cc" |
Those on Windows 10 version 1607 will see KB4077525, which brings the build number to 14393.2097, and can be manually downloaded here. Here"s what"s fixed:
Addresses issue where users of Citrix XenApp are unable to change passwords by pressing Ctrl+F1.
Addresses issue where members of the Performance Log Users group receive the error “Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))”. The error appears while trying to schedule logging of performance counters, enable trace providers, or collect trace information.
Addresses issue where the WinRM event query returns the error "0x6c6 (RPC_S_INVALID_BOUND)" from the target server. The error appears when servers are configured to push their security event logs to a central server for analysis using a subscription.
Addresses issue where authentication to Microsoft Outlook fails when using conditional access.
Addresses issue where smart card logons fail with the error "Signing in with a smart card isn’t supported for your account...." after the authenticating DC has been restarted. Authenticating DCs log KDC Event 19 and Kerberos Distribution Event 29 in the System event log. The log states that a suitable certificate cannot be found for smart card logons.
Addresses issue where the certutil.exe -MergePfx command could not produce a merged EPF file for multiple V1 certificates.
Addresses issue where the SM3 cryptographic hash algorithm was not supported on TPM devices. Customers experiencing this issue noticed that their TPM failed to initialize.
Addresses issue where a 0x06d9 failure occurs when a user attempts an OS upgrade or an LCU update. The system automatically reverts to a previous version of the upgrade or update.
Addresses issue where a server error occurs occasionally during file transfer. The error is “Stop D1 in tcpip!TcpSegmentTcbSend”.
Addresses issue where the Remote Authentication Dial-In User Service (RADIUS) server name is not authenticated while connecting to a wireless network.
Addresses issue where iSCSI target redirection during login may lead to stop error 9f.
Addresses issue in MPIO where pass-through SCSI requests may lead to a stop error if the disk is pending removal.
Updates MPIO path selection algorithm to match the documentation when all paths are Active or Unoptimized.
Addresses issue where a delay function in StorNVMe may cause a small CPU usage increase when launching applications.
Improves ReFS performance by more thoroughly unmapping multiple views of a file. See KB4090104 for additional tunable registry parameters to address large ReFS metadata streams.
Improves ReFS performance by removing idle containers from its hash table.
Addresses issue where booting with Unified Write Filter and a connected USB hub may lead to stop error E1.
Addresses issue where the Internet connection service (ICS) connections don"t persist across OS restarts or ICS service restarts. You can also activate this solution using an optional EnableRebootPersistConnection registry key described in KB4055559.
Cleans the public IP with the correct information for the SDN Network Manager.
Adds ADCS support for Certificate Transparency (CT) that"s compatible with the updated Google Chrome requirements. CT is a technology used by certificate authorities to log and publish certificate metadata for improved security.
Adds ADCS support for Certificate Transparency for publicly trusted SSL/TLS certificates.
Addresses issue where there is missing information in the Value field of audit event 5136 for Directory Service Changes. This occurs when you modify an attribute of an object on Windows Server 2016 Domain Controllers. This problem may occur if you use PowerShell commands (Add-ADGroupMember or Set-ADGroup) to add someone to a group using the user’s SID instead of the Distinguished Name.
Addresses issue where an HTTP 500 error occurs when an ADFS farm has at least two servers using Windows Internal Database (WID). In this scenario, HTTP basic pre-authentication on the Web Application Proxy (WAP) server fails to authenticate some users. When the error occurs, you might also see the Microsoft Windows Web Application Proxy warning Event ID 13039 in the WAP event log. The description reads, “Web Application Proxy failed to authenticate the user. Pre-authentication is "ADFS For Rich Clients". The given user is not authorized to access the given relying party. The authorization rules of either the target relying party or the WAP relying party are needed to be modified.”
Addresses issue in which AD FS can no longer ignore prompt=login during authentication. A Disabled option was added to support scenarios in which password authentication is not used. For more information, see AD FS ignores the "prompt=login" parameter during an authentication in Windows Server 2016 RTM.
Addresses issue in AD FS where Authorized Customers (and relying parties) who select Certificate as an authentication option will fail to connect. The failure occurs when using prompt=login if Windows Integrated Authentication (WIA) is enabled and the request can do WIA.
Addresses issue where AD FS incorrectly displays the Home Realm Discovery (HRD) page when an identity provider (IDP) is associated with a relying party (RP) in an OAuth Group. Unless multiple IDPs are associated with the RP in the OAuth Group, the user will not be shown the HRD page. Instead, the user will go directly to the associated IDP for authentication.
Addresses issue where some Remote Desktop Protocol (RDP) clients that used an absolute URI (instead of a relative URI) were blocked by the Web Application Proxy (WAP) server from connecting to the Remote Desktop Gateway. This affected RDP clients on iOS, Mac, Android, and the Windows modern RDP client app. The error is "We couldn"t connect to the gateway because of an error. If this keeps happening, ask your admin or tech support for help. Error code: 0x03000008."
Addresses issue where GPMS reports are not showing content when you select links in the report with one of these errors:
Error: "XMLSerializer" is undefined.
‘DOMParser’ is undefined.
Server execution failed.
Addresses issue where Dedup may cause data corruption to a file when you:
Create a file smaller than 2.2 TB.
Optimize the file.
Add data to the file that increases it to more than 2.2 TB.
Addresses issue where a file is always marked as corrupted—even though it isn"t—when running a full Dedup scrub on a file larger than 2.2 TB.
Addresses issue where, after installing .NET 4.7, creating a new DFS-Replication group or adding a member to an existing replication group in the DFS Management snap-in leads to an error. The error is “The value does not fall within the expected range”.
Addresses issue where, after installing .NET 4.7, the Create Cluster wizard in the Failover Cluster Management UI may unexpectedly close upon selecting Browse on the Select Servers page.
Addresses issue where the Japanese keyboard layout didn"t work properly during a Remote Assistance session.
Addresses issue where logons to a Remote Desktop VDI collection start to fail after a period of server uptime. The Performance Counter Remote Desktop Connection Broker Redirector Counterset/RPC Contexts will show incremental growth during logon hours. When the value reaches 40, new connections to the farm fail or time out.
KB4077525 contains the same known issue as the update listed above, as well as one more:
| Symptom | Workaround |
|---|---|
| After installing this update, servers where Credential Guard is enabled may restart unexpectedly. The error is "The system process lsass.exe terminated unexpectedly with status code -1073740791. The system will now shut down and restart." Event ID 1000 in the application log shows: "C:\windows\system32\lsass.exe" terminated unexpectedly with status code -1073740791 Faulting application: lsass.exe, Version: 10.0.14393.1770, Time Stamp: 0x59bf2fb2 Faulting module: ntdll.dll, Version: 10.0.14393.1715, Time Stamp: 0x59b0d03e Exception: 0xc0000409 | See Disable Windows Defender Credential Guard. Microsoft is working on a resolution and will provide an update in an upcoming release. |
To install either of these updates, you can either grab them manually from the links provided, or you can just head over to Settings -> Update & security -> Windows Update -> Check for updates.