Spectre Patch

[pixellip]

Hi

Has anyone patched their servers yet with spectre and noticed any degredation?

Thanks

[MrCoffee]

I came here wondering the exact same thing. I did hear horror stories of patches causing BSOD's for machines where the AV's hadn't been properly updated.

 

Also performance hits of upto 30%... some of our stuff is creaking a little already. I'm a bit wary - anyone else patched yet?

[arh1a]

Updated all our Server 2016 servers and touch wood everything seems to be running fine.

[ChrisMiles]

Updated all our Server 2016 servers and touch wood everything seems to be running fine.

 

Did you add the registry settings to enable the fixes? The Windows Server patch doesn't do anything unless you specifically enable it. Theres a thread on here somewhere to the microsoft page about it, looking for it...

[ChrisMiles]

Here:

https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution

[arh1a]

Wasn't aware of that, makes sense why I didnt noticed any difference.

[Priscilla110]

Spectre Patch Causes 'Significant Slowdown' On Older OS, Chips Have you guys seen this? I'm waiting to see how bad the hit is.

[Koldov]

OK, so sense check this for me please...

 

1) Your antivirus solution (if vendor has an updated solution) makes a reg change (Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" Value="cadca5fe-87d3-4b96-b7fb-a231484277cc" Type="REG_DWORD”

Data="0x00000000”.)

 

2) This enables WU to install an update (or if not, download and install manually - as my WU is not showing this as available for any of my servers yet) For Server 2012R2 - KB4056898

 

3) Then manually enable the protections with the following reg entries:

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

 

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

 

If this is a Hyper-V host and the firmware updates have been applied: fully shutdown all Virtual Machines (to enable the firmware related mitigation for VMs you have to have the firmware update applied on the host before the VM starts).

 

Restart the server for changes to take effect.

 

4) Install with PS script:

 

PS> Install-Module SpeculationControl

 

5) Check with PS script:

 

PS> # Save the current execution policy so it can be reset

 

PS> $SaveExecutionPolicy = Get-ExecutionPolicy

 

PS> Set-ExecutionPolicy RemoteSigned -Scope Currentuser

 

PS> Import-Module SpeculationControl

 

PS> Get-SpeculationControlSettings

 

PS> # Reset the execution policy to the original state

 

PS> Set-ExecutionPolicy $SaveExecutionPolicy -Scope Currentuser

 

6) Apply an applicable firmware update from the OEM device manufacturer....

Edited January 10, 2018 by Koldov

[ChrisMiles]

Looks right to me, step 3 isn't needed on clients, but the rest is.

[DJ-1701]

OK, so sense check this for me please...

 

1) Your antivirus solution (if vendor has an updated solution) makes a reg change (Key="HKEY_LOCAL_MACHINE" Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat" Value="cadca5fe-87d3-4b96-b7fb-a231484277cc" Type="REG_DWORD”

Data="0x00000000”.)

 

2) This enables WU to install an update (or if not, download and install manually - as my WU is not showing this as available for any of my servers yet) For Server 2012R2 - KB4056898

 

3) Then manually enable the protections with the following reg entries:

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

 

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

 

If this is a Hyper-V host and the firmware updates have been applied: fully shutdown all Virtual Machines (to enable the firmware related mitigation for VMs you have to have the firmware update applied on the host before the VM starts).

 

Restart the server for changes to take effect.

 

4) Install with PS script:

 

PS> Install-Module SpeculationControl

 

5) Check with PS script:

 

PS> # Save the current execution policy so it can be reset

 

PS> $SaveExecutionPolicy = Get-ExecutionPolicy

 

PS> Set-ExecutionPolicy RemoteSigned -Scope Currentuser

 

PS> Import-Module SpeculationControl

 

PS> Get-SpeculationControlSettings

 

PS> # Reset the execution policy to the original state

 

PS> Set-ExecutionPolicy $SaveExecutionPolicy -Scope Currentuser

 

6) Apply an applicable firmware update from the OEM device manufacturer....

 

Looks right to me, step 3 isn't needed on clients, but the rest is.

 

If I am reading that correctly... 4 and 5 are just for testing are they not?

[ChrisMiles]

If I am reading that correctly... 4 and 5 are just for testing are they not?

 

Thats correct, it will show you how protected you are and whether you need additional firmware updates.

[jmak]

 

6) Apply an applicable firmware update from the OEM device manufacturer....

 

How are people who don't have SCCM updating the firmware? I've been reading and it looks like there is a support way to deploy with GPO for Dell machines using their proprietary system - Dell Client Configuration Toolkit (CCTK). I've never used it before - I usually update manually adhoc when I have the machines for something else or when I re-image. Any advice or better alternatives?

 

I have a set of around 60 Acer Travelmates as pupil machines spread around the classrooms and can't see any supported way of deploying BIOS updates. Suggestions welcome (as long as they don't include throwing the machines away!)

 

Thanks

[MYK-IT]

In relation to Hyper-V, as well as patching the physical Hyper-V hosts (as described by @Koldov) do you need to apply (again) the same to each and every individual Virtual Machines?

 

Thanks.

[atcoates]

How are people who don't have SCCM updating the firmware? I've been reading and it looks like there is a support way to deploy with GPO for Dell machines using their proprietary system - Dell Client Configuration Toolkit (CCTK). I've never used it before - I usually update manually adhoc when I have the machines for something else or when I re-image. Any advice or better alternatives?

 

I have a set of around 60 Acer Travelmates as pupil machines spread around the classrooms and can't see any supported way of deploying BIOS updates. Suggestions welcome (as long as they don't include throwing the machines away!)

 

Thanks

Are there any silent switches that can be used with the acer bios package so you can deploy it? We deploy the dell bios using RM CC4 and just add the silent switches that dell specify.

[Ashfold]

I guess I only have to follow step 6) Apply an applicable firmware update from the OEM device manufacturer.... on the hyperV hosts the VMs wont need it?

[DavR]

3) Then manually enable the protections with the following reg entries:

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f

 

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

 

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

 

If this is a Hyper-V host and the firmware updates have been applied: fully shutdown all Virtual Machines (to enable the firmware related mitigation for VMs you have to have the firmware update applied on the host before the VM starts).

 

Restart the server for changes to take effect.

 

Thanks for spelling that bit out @Koldov, I hadn't realised I needed to do that bit on my servers.

 

I've stuck the reg keys into a policy to deploy, they'll get a full reboot when I do the BIOS updates on the servers.

 

Luckily I'm not running anything very intensive on any of my servers, so I'm not too worried about the performance hit, fingers crossed. The only server I am a little concerned about is my SCCM / WSUS server, but only I'll notice that.