Convenience rollup for Win 7 SP1 and 2008 R2 SP1 (KB3125574)

[javanse]

Korrektur: weder KB3068708 noch KB3080149 sind im Update integriert, beide werden mir nach einer frischen Win7 SP1 + KB3125574 Installation noch angeboten.



KB3075249 (This update adds telemetry points to the User Account Control (UAC) feature to collect information on elevations that come from low integrity levels.) dagegen scheint integriert zu sein, die Versionsnummern der betroffenen Dateien (Authui.dll, Appinfo.dll, Consent.exe) enden auf .23403 und sind damit höher als im KB-Artikel zu 3075249 angegeben.

[jamesaepp]

Thanks for updating the software to include this KB. If I run UpdateGenerator, will I then be able to install this KB using the client updater, or must I wait for the next release of wsusoffline?

[boco]

Who told you it would be? No decision has been made at that point.

I dearly hope it will not be included as prerequisite, as WOU would become useless for me. Worse, it would become malware that infects every Win7 system with Win10 and Telemetry sh*t. Convenience my ass.
Note: Should that really happen it would end all of my activities here. I know I could modify the lists, but I don't have any time to do that.

[jamesaepp]

Why wouldn't wsusoffline include this KB? Is it not faster to install all Windows updates using this huge rollup, then when that's done, remove all the GWX and Telemetry stuff you want? Forgive my ignorance on most of the telemetary and gwx drama, I don't get to keep up with these things. But with my limited knowledge, that would seem to me a much faster way to update Windows 7.

[boco]

That update doesn't consist of multiple patches, it's one big package. For that reason, you cannot remove that spy and winx stuff afterwards. The system is permanently infected.

[jamesaepp]

I don't understand how MSU's work a whole lot, but why can't we:

1. Install the huge MSU
# This will install all of the packages it wants
# However it will not update the Windows Update history , queries with 'dism /get-package' will not show individual packages that the convenience pack includes
2. Install one of the telemetry updates
# This will install the package
# It will also update Windows update history, show up with 'dism /get-package'
# I'm flaky on this step -- it may very well just already know that the package is installed by the convenience pack and skip it
3. Uninstall the telemetry update
# This will then remove the package, registry entries, raw data on the volume


I know it's a round-about way, but if we can work around the telemetry just by doing that, shouldn't we time the software to see if it's faster to let it do all updates first, then uninstall packages as wanted?

[boco]

That doesn't work. Upon installation of any package in Windows, only files that are newer are "replaced"*. Nothing is actually installed when you install the same or older file versions again.

But, what truly crushes your theory is that upon uninstallation of a package the previous versions of the files will be restored. Which are already infected by the 'Convenience' pack. The pre-pack versions will be activated again if you uninstall the pack itself (if you are lucky).


*Usually the old version is not removed, but stays in the WinSxS repository. The appropriate version of the file is then hardlinked into the Windows (sub-)directory.

[rbronca]

Whilst the discussion on whether to include the convenience update continues, may I suggest including a test as to whether it is already installed or not and act accordingly.
That way, you can keep it excluded by default, which it appears that a lot of individual users are wanting and for everyone else, slip streaming the one patch isn't the end of the world to do beforehand.

In short:
kb3125574 Installed - leave installed and patch appropriately.
kb3125574 not installed - ignore the kb3125574 patch and patch appropriately.

Maybe you could add a check box / switch to allow the user to articulate that choice in the application for Windows 7 / Server 2008 R2.

Hope this helps to chart a path through the alternatives here.

Keep up the good work

regards

[aker]

My suggestion is pretty simple:
KB3125574 is not security relevant for systems with aepic.dll version = 6.1.x.x; just for ones with aepic.dll version = 10.0.x.x.
So most likely (I didn't test it) WUA will detect it as relevant, if aepic.dll has a 10.0.x.x-version.
wsusou should treat it as a normal security update (if included in wsusscn2.cab), if it's detected as relevant by WUA.

[WSUSUpdateAdmin]

Moin!

Ich nehme an, dass Microsoft mit dem "Convenience rollup update" zum einen das Problem mit den langen Update-Suchzeiten lösen, zum anderen aber möglicherweise auch die von vielen ungeliebten Telemetrie- und W10-Gedächtnis-Updates unterbringen möchte.

Daher bin ich vorsichtig und werde es bis auf weiteres nicht integrieren.

Über eine geänderte StaticUpdateIds-wupre-w61.txt könnte man es installieren lassen, wenn man denn möchte - vielleicht sollte es davon auch eine "custom"-Fassung geben (können)?

Gruß
Torsten Wittrock