Windows Update 3159398 Issue

[Boredguy]

WSUS downloaded update 3159398 (and a few others) last night and on 2 stations that had it installed today had an issue where the GPO's are not being applied correctly on stations.

Issues apparent are no mapped drives, printers and reverting the desktop to the Windows 2000 style.

 

Removing the update from the station put it back to normal.

You may want to check the update on one computer before authorising it out

[timbo343]

Funny you should say that, a member of my family rang me last night and said things had reverted bavk to what looked like win7 from win10. When they restarted everything was fine. I then remembered it was patch tuesday yesterday.

[RLR]

https://social.technet.microsoft.com/Forums/en-US/e2ebead9-b30d-4789-a151-5c7783dbbe34/patch-tuesday-kb3159398?forum=winserverGP

[saintoctopus]

Yep - we've just experienced this too! Sadly...everything has now installed said update...

 

Need to find a way to uninstall it across the network now...

[saintoctopus]

Yep - we've just experienced this too! Sadly...everything has now installed said update...

 

Need to find a way to uninstall it across the network now...

 

This as a batch file should do it (if anyone wants it)

@echo off

wusa /uninstall /kb:3159398 /quiet /forcerestart

[DJ-1701]

You can also Remove the update from workstations via WSUS.

 

[ajs]

If you give Authenticated Users the Read permission on the Delegation tab the GPOs should start working again without the need to uninstall the update.

[box_l]

As above ^^

 

https://support.microsoft.com/en-us/kb/3163622

 

Resolution

To resolve this issue, use the Group Policy Management Console (GPMC.MSC) and follow one of the following steps:

•Add the Authenticated Users group with Read Permissions on the Group Policy Object (GPO).

•If you are using security filtering, add the Domain Computers group with read permission.

[Boredguy]

Blasted Microsoft.

 

Well thankfully it was only affecting our staff and students GPO's which are security filtered to specific groups (so can't use the authenticated users read option)

Setting domain computers to read access for the staff policy on a station that had not yet had the update removed fixed it *yippy*... only spent the last hour making sure the updates were removed

[ajs]

Giving Authenticated Users Read permissions on the Delegation tab won't affect the security filtering, it'll only allow the GPO to be queried (at which point the Security Filtering will kick in and do its job)

[Arthur]

MS16-072 – Known Issue – Use PowerShell to Check GPOs

 

Import-Module GroupPolicy

# Get all GPOs in current domain
$GPOs = Get-GPO -All

# Check we have GPOs
if ($GPOs) {

   foreach ($GPO in $GPOs) {

       $AuthUser = $null

       # See if we have an Auth Users perm
       $AuthUser = Get-GPPermission -Guid $GPO.Id -TargetName "Authenticated Users" -TargetType Group -ErrorAction SilentlyContinue

       # Alert if we don’t have an 'Authenticated Users' permission
       if (-not $AuthUser) {

           Write-Warning "MISSING – $($GPO.DisplayName) – ($($GPO.Id)) – does not have an 'Authenticated Users' permission – please investigate"

       } else {

           # Alert on a custom permission
           if ($AuthUser.Permission -eq "GpoCustom") {

           Write-Warning "CUSTOM – $($GPO.DisplayName) – ($($GPO.Id)) – has a custom 'Authenticated Users' permission – please investigate"

           }

       }
   }
}

[mortstar]

It seems that Microsoft really need to change the way they communicate. Confidence in the update process has been blown to pieces (especially with the way they are abusing it to push out Win 10), so as soon as there is an issue with a Patch Tuesday admins are immediately looking for the offending KB and uninstalling it (checking the threads and comments on Spiceworks/El Reg etc.). With this particular problem this is unnecessary and negates the security issue that Microsoft are mitigating. From the fact that the simple fix is documented in MS16-072, Microsoft were well aware of the issue this would raise but they made zero attempt to communicate this actively. Surely they should go back to pre-announcing Patch Tuesday where they could flag-up these known, pre-update changes in advance. Instead they leave us scrambling for answers and others actively reducing the security on their systems. Edited June 16, 2016 by mortstar

[Ertech]

I have already installed the latest updates on my Windows server 2012r2 but not on my workstations Win7 - would that cause any problems? Should I remove the update from the server 2012r2??

[Boredguy]

Server side should not have an issue. Just go through your GPO policies and check your delegation permissions as per the tech article and you'll be fine

[mortstar]

I have already installed the latest updates on my Windows server 2012r2 but not on my workstations Win7 - would that cause any problems? Should I remove the update from the server 2012r2??

 

You should install the update, but you should change any of your Security Filtered GPOs so that they contain read permission for either Authenticated Users or Domain Computers as per https://support.microsoft.com/en-us/kb/3163622

[Steve21]

Is there any downside to just adding both "fixes" Domain Comps and auth users to all of the GPOs delegation? It won't apply if it's not targeted at them and not like any harm can be done from reading them right?

 

Steve

[dobsonl]

As above ^^

 

https://support.microsoft.com/en-us/kb/3163622

 

Resolution

To resolve this issue, use the Group Policy Management Console (GPMC.MSC) and follow one of the following steps:

•Add the Authenticated Users group with Read Permissions on the Group Policy Object (GPO).

•If you are using security filtering, add the Domain Computers group with read permission.

 

Hi All,

 

We have also had this issue and can confirm adding the above for the respective GPOs does fix the issue, we added domain computers for those that had security filtering and ensured authenticated users was on the others.

 

Luke

[internetuser]

this power shell scrip will fix it

set-gppermissions -TargetName "Authenticated Users" -TargetType group -PermissionLevel GpoRead -all

[saintoctopus]

MS16-072 – Known Issue – Use PowerShell to Check GPOs

 

Import-Module GroupPolicy

# Get all GPOs in current domain
$GPOs = Get-GPO -All

# Check we have GPOs
if ($GPOs) {

   foreach ($GPO in $GPOs) {

       $AuthUser = $null

       # See if we have an Auth Users perm
       $AuthUser = Get-GPPermission -Guid $GPO.Id -TargetName "Authenticated Users" -TargetType Group -ErrorAction SilentlyContinue

       # Alert if we don’t have an 'Authenticated Users' permission
       if (-not $AuthUser) {

           Write-Warning "MISSING – $($GPO.DisplayName) – ($($GPO.Id)) – does not have an 'Authenticated Users' permission – please investigate"

       } else {

           # Alert on a custom permission
           if ($AuthUser.Permission -eq "GpoCustom") {

           Write-Warning "CUSTOM – $($GPO.DisplayName) – ($($GPO.Id)) – has a custom 'Authenticated Users' permission – please investigate"

           }

       }
   }
}

 

Great!! Thank you - all sorted now

[box_l]

this power shell scrip will fix it

set-gppermissions -TargetName "Authenticated Users" -TargetType group -PermissionLevel GpoRead -all

 

Top Man!

That saved me a lot of time.

 

BoX

[mikes]

Top Man!

That saved me a lot of time.

 

BoX

 

Thanks - do you recommend running this again with Domain Computers on all GPO's - or just doing it manually on the ones I use security filtering on?

It is obvious the quality of development at Microsoft is getting worse...

[robyholmes]

Just done this before I approve WSUS update later today. Thanks for the information.

[Ertech]

I was wondering if my settings looked right - please see attached img

[robyholmes]

I was wondering if my settings looked right - please see attached img[ATTACH=CONFIG]37373[/ATTACH]

 

With that GPO your fine, its if you have removed Authenicated Users from the security filter and put something else in its place. This is when you have a problem and need to add either Domain Computers or Authenicated Users to the security tab. If you run the script Arthur posted:

https://blogs.technet.microsoft.com/poshchap/2016/06/16/ms16-072-known-issue-use-powershell-to-check-gpos/

It will show you any with a problem in red.

[Arthur]

Modifying Default GPO Permissions at Creation Time

 

... a quick blog post about how you can ensure that all GPOs that get created going forward in your environment, get the proper read permissions on them. A long time ago, I blogged about how you could add additional groups to the default GPO ACL by modifying the defaultSecurityDescriptor attribute on the group-policy-container AD schema class. This method is well documented by Microsoft and indeed will allow you to add Domain Computers with read access to every new GPO that gets created to address future problems with MS16-072. The process is relatively simple (or as simple as a schema change in AD can be).

 

The usual caveats apply.