this is susan bradley the microsoft patch lady for computer world
in the united states we're coming up to a major holiday that of the eating holiday thanksgiving
and it's typically a time that i schedule maintenance jobs and especially at home
i look to see the the security and also the update progress on my home computers normally
i wait until the friday after thanksgiving in order to do any major projects even at home
i take that time to make sure my system is up to date and everything is set as i want it
at this time i'm ready to give the all clear to go ahead and install any updates if you haven't
already installed them now granted i'd probably wait and do it after your thanksgiving zoom get
together first and then install any updates i'd have i'd hate to see you see nothing but
the spinning wheel of the windows update process instead of your family and friends
2004 and 20h2 better known as 209 is still seeing some lingering installation bugs it's not so much
that you're seeing side effects from the the installation of patches but more lingering side
effects of the feature release itself one major pain point for business patchers that use was sus
sccm or other patching tools was when they updated from a previous feature release to either 2004 or
2000 h2 it lost certificates this is very painful especially in regards to vpn and other processes
now for home users that use windows update to go from the feature releases you won't see this issue
so again you may see this information in the news but it does not impact home or consumer patchers
that use the windows update process the good news is for business patchers this issue has been fixed
i'm still tracking an issue where a what's called an in-place upgrade where if you have a
windows 10 machine that's causing some issues you can use an in-place upgrade process to fix those
issues with windows 202 there's a bug where it won't let you do that they'll be fixing
that issue in the december release of windows 10 and update updating the isos at that time
now i recommend if you've been seeing any issues with slow downs or issues on your
windows 10 machine that you try to uninstall any third-party anti-virus and reinstall it
in particular for home and consumer users i find that windows defender is usually better suited to
keep up to handling these feature releases any other product might be a little bit behind the
eight ball remember if you're on version 1903 it goes out of service on december 8th 2020
so you'll want to make sure you're on version 1909 or later at that time
remember you can use a setting called the targeted release version
in order to ensure you stay on a specific feature release
you can use either group policy or a registry key in order to set that setting now i recommend
that you do not use the home version of windows 10 that you upgrade to windows 10 pro
because it's always my philosophy that you have a lot more ability
to control patching with the pro version versus the home
recently microsoft re-released kb4023057 this is the update that
makes sure that your system is ready to go for the next feature release
it checks on hard drive space checks on windows update components and in general
make sure your system is is clean and ready to go if you see this offered up to your machine
don't worry it's just making sure that you're set and ready for the next feature release
speaking of antivirus recently malwarebytes received released a new version because there
was an issue where users could not see local area network attached devices or
in the network neighborhood after upgrading to cu-19 if you use nas devices and you cannot see
that device and you use malwarebytes make sure you're up to date on your antivirus
now my final tip is just for business patchers that is those people that use a windows server
or domain controller in their environment it's a specific role and the domain controller
hands out authentication information for all the workstations in the environment
recently there was a patch that patched kerberos kdc security and as a result a side effect
was generated especially with federated federated authenticating recently there
was a side effect introduced with federated authentication service in a citrix environment
as a result several out-of-band patches were released to specifically fix this issue
these releases are not up on windows update
nor that are they add on with sus you have to manually go to the catalog in order to download
them and install them in your environment they're only needed to update on your domain controllers
again these are specifically for servers only for domain controllers
now at this time i'm still scratching my head and not quite understanding what i need to do to
be fully patched with this update in addition to the patch being installed there's also a registry
key that needs to be set and i'm honestly still a bit confused as to what i need in my environment
the information in the kb article says that by default
the registry key when it's not set will be the value of one that is the fix is enabled on the
domain controller but the domain controller does not require the tickets conformed to the fix
i'm still confused as to what i need in my environment to be safe and protected this only
impacts constrained delegation and i honestly do not have that setting in my environment so
i'm not sure if i need these registry keys bottom line i'll be looking more into this
and hope to get an answer for you back soon so that we all can be more secure until next
time i hope you have a wonderful wonderful holiday season and stay safe and stay patched