Windows update KB5021130 - feedback please

[maxrebo]

We had a bulletin through this morning regarding this update, mentioning if our computers aren't configured to use Windows updates then users may no longer be able to login after 11 April.

 

Is this the case?

 

I've inherited a network where WU hadn't worked or been configured for the last 3 years so I'm on a massive catch up!

 

any need to panic?

[ITGuyNW]

You've not updated computers in three years?

 

Anyway, yeah in the November 2022 updates there was a change sent out that will be activated in the April 2022 updates.

 

You don't need WU to be configured perse, its that they need those updates.

 

KB5021130: How to manage the Netlogon protocol changes related to CVE-2022-38023 - Microsoft Support

[3s-gtech]

Hmm - if your PCs aren’t on LTSC they will most likely be on a Windows build that’s no longer supported, if they’ve been left that long.

[Olliedawg]

Know the feeling regarding the WSUS. When I started at my current school they were manually doing updates on every machine (what..). They did actually have a WSUS set up already on its own VM - although the tool crashed every time you opened it. Probably due to being neglected for a number of years. Did a fresh install and got it up and running again - saves a lot of time

[free780]

I'd just get Windows Update for Business Configured via GPO. As long as you have the bandwidth and/or WUDO configured correctly. WSUS can fail for all sorts of reasons.

[maxrebo]

You've not updated computers in three years?

 

Anyway, yeah in the November 2022 updates there was a change sent out that will be activated in the April 2022 updates.

 

You don't need WU to be configured perse, its that they need those updates.

 

KB5021130: How to manage the Netlogon protocol changes related to CVE-2022-38023 - Microsoft Support

Replace "you`ve" with "the school" - Only started in January and SCCM was broken (had been for a while) and it was just left...

[localzuk]

I'd just get Windows Update for Business Configured via GPO. As long as you have the bandwidth and/or WUDO configured correctly. WSUS can fail for all sorts of reasons.

Agree with this. We swapped from WSUS to WUfB recently, and it works SO much more reliably.

[maxrebo]

Agree with this. We swapped from WSUS to WUfB recently, and it works SO much more reliably.

can you manage all workstations\servers like you can in WSUS? any guides for setup?

[localzuk]

can you manage all workstations\servers like you can in WSUS? any guides for setup?

So, we only use it with clients. There's not a lot of management involved. You set up a policy saying what update cycle you want to follow etc, and that's it. Everything else is automatic.

 

You don't approve individual updates etc.

 

Microsoft's article on it is here - https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb

Edited March 8, 2023 by localzuk

[Olliedawg]

So, we only use it with clients. There's not a lot of management involved. You set up a policy saying what update cycle you want to follow etc, and that's it. Everything else is automatic.

 

You don't approve individual updates etc.

 

Microsoft's article on it is here - https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb

 

This looks interesting - I'm going to look at this to potentially replace out WSUS setup. I do agree that WSUS can be a pain sometimes (more often than not!)

[MS2011]

I'd just get Windows Update for Business Configured via GPO. As long as you have the bandwidth and/or WUDO configured correctly. WSUS can fail for all sorts of reasons.

 

Hi,

 

Are you using the GPO to push the update for the windows device and server ?

 

Or just windows device?

 

Thanks