April Windows 7 updates - issues?

[enbiggen]

We've had quite a few machines stuck at the preparing for updates page. I've now declined KB4493448 and KB4493472 as a precaution - just posting here before I investigate further in case anyone else has the issue (or may be about to experience issues).

[Bedders]

There's some stuff citing KB4493472 on Reddit's usual Patch Tuesday Megathread https://www.reddit.com/r/sysadmin/comments/bb9dsi/patch_tuesday_megathread_20190409/.

[andy_b]

We have had problems with freezing - stuck on preparing updates. Seems to be a Sophos and kb4493472 problem

 

https://community.spiceworks.com/topic/2203711-update-kb4493472-issues

 

Update - Sophos say they have had a number of calls about this issue...

Edited April 10, 2019 by andy_b

[andy_b]

KB4493448 & KB4493435 also seem problematic.....

[Bedders]

Yep, confirmed also with this thread

- quote below for those who can't view Reddit, but further confirmation in comments.

we installed yesterdays (9th April 2019) windows update and a bunch of our PCs are stuck configurating.

 

The only workaround we have to this time is start in safe Mode and dissable all Sophos services.

Then you can boot the PC as normal, but if you reactivate the Sophos services, the PC is very very slow and if you reboot, it will get stuck again but now it says "Please Wait". And it is not in my interest to dissable my antivirus on our pc forever.

Sorry I can't help as I don't use Sophos here. Good luck getting it sorted!

[themightymrp]

Definitely got an issue here with 7 and Sophos. Anybody finding they can't boot to safe mode?

[andy_b]

https://community.sophos.com/kb/en-us/133945

[phreak]

Yes, we have this issue as well and have logged a call with Sophos.

 

Just as an FYI as it doesn't mention it in the article but the problem also seems to affect Server 2012 with these updates Security Monthly Quality update KB4493451, KB4493450.

 

But we saw that if you rebooted into safe mode windows rolled back the updates for us. Then rebooted and same message again before it then allowed us to boot normally.

@themightymrp I did notice one of the Win 7 machines hanging on the rollback screen on windows... and it never progressed from that. Had to cut the power to it but after that I was able to boot into safe mode normally.

[themightymrp]

Managed to get there in the end. Just a bit more patience was needed. Eventually it rolled back automatically and rebooted. I think I've sorted the few machines I had with the issue now so hopefully now I've declined the update we will be OK.

 

Yet further evidence I need to roll out Windows 10 site wide over Summer!

[DavR]

This took down my Windows 7 box at home, which is a useful canary in a way, as it tends to get the updates about 24hrs before they've made their way through my WSUS server. Completely borked the thing, sticks at configuring Windows Updates and has to be removed using Safe Mode!

 

Declined the updates in the Sophos article just now, before my servers attempt to update overnight - affecting Server 2008 R2, 2012 and 2012 R2. No clients involved for me, as they're all Windows 10.

[andy_b]

https://www.theregister.co.uk/2019/04/11/microsoft_sophos/

[Ertech]

Does this affect Intercept X as well?

[jtotheb]

Does this affect Intercept X as well?

 

In the KB posted above: https://community.sophos.com/kb/en-us/133945

 

Note: If you only have Sophos Intercept X installed you will not be affected by this issue.

[enbiggen]

Does this affect Intercept X as well?

From the email Sophos sent out yesterday evening: "Running any Sophos Windows endpoint or server product except Sophos Central Intercept X. (Note: this does impact Intercept X Advanced and Intercept X Advanced with EDR.)"

 

Ooops, someone got there just ahead of me :-)