Flexis September 2024 Patch Recommendation
Patches Microsoft released in September 2024:
- KB5042881: 2024-09 Cumulative Update for Microsoft server operating system version 21H2 for x64-based Systems
- KB5043050: 2024-09 Cumulative Update for Windows Server 2019 for x64-based Systems
- KB5043124: 2024-09 Servicing Stack Update for Windows Server 2016 for x64-based Systems
- KB5043051: 2024-09 Cumulative Update for Windows Server 2016 for x64-based Systems
Impacted Products:
Microsoft Windows
Microsoft Edge
(HTML-based)
Microsoft Edge
(Chromium-based)
Internet Explorer
Microsoft Office and Microsoft Office Services and Web Apps
Windows Defender
Visual Studio
ASP.NET Core
Chakra Core
Microsoft Dynamics
.NET Framework
.NET Core
Please note the following information regarding the security updates:
Windows 10, version 1607 Mobile and Mobile Enterprise editions reached the end of support (EOS) on October 9, 2018. These editions will no longer be offered servicing stack updates.
Windows 10, version 1607 IoT Core edition reached the end of support on April 10, 2018. This edition will no longer be offered servicing stack updates.
Windows 10, version 1607 IoT Core Enterprise edition reached the end of support on April 9, 2019. This edition will no longer be offered servicing stack updates.
Windows 10, version 1607 Enterprise, Education, Pro, Home, and Pro for Workstation reached end of support on January 10, 2023. These editions will no longer be offered servicing stack updates.
Windows 10 Enterprise N 2016 LTSB and Windows 10 IoT Enterprise 2016 LTSB will reach the end of support on October 13, 2026.
To continue receiving these updates, we recommend updating to the latest update of Windows. For more information, see Get the latest Windows update.
Windows Server 2016 Datacenter edition, Nano Server installation, and Standard edition, Nano Server installation options reached the end of support on October 9, 2018.
Windows Server 2016 Essentials, Datacenter, Standard, Multipoint Premium Server, and Hyper-V Server will reach the end of support on January 12, 2027.
KB5042881: Windows Server 2022
Improvements
This security update includes quality improvements. Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.
- [Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates that the process requires full administrator access. To turn off the UAC prompt, set the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair registry value to 1. The changes in this update might affect automatic Windows Installer repairs; see Application Resiliency: Unlock the Hidden Features of Windows Installer.
- [IE mode] Pop-up windows open in the background instead of in the foreground.
- [AppContainer] Printers do not work as you expect when you use them in a restricted setting, like AppContainer.
- [BitLocker] You might not be able to decrypt a BitLocker data drive. This occurs when you move that drive from a newer version of Windows to an older version.
Known issues in this update
Symptom
After installing this update, you might be unable to change your user account profile picture.
When attempting to change a profile picture by selecting the button Start> Settings > Account > Your info and, under Create your picture, clicking on Browse for one, you might receive an error message with error code 0x80070520.
After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device. Resulting from this issue, your device might fail to boot Linux and show the error message “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.”
The August 2024 Windows security update applies a Secure Boot Advanced Targeting (SBAT) setting to devices that run Windows to block old, vulnerable boot managers. This SBAT update will not be applied to devices where dual booting is detected. On some devices, the dual-boot detection did not detect some customized methods of dual-booting and applied the SBAT value when it should not have been applied.
After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization. This issue might occur if legacy protocol (Remote Procedure Call over HTTP) is used in Remote Desktop Gateway. Resulting from this, remote desktop connections might be interrupted.
This issue might occur intermittently, such as repeating every 30 minutes. At this interval, logon sessions are lost and users will need to reconnect to the server. IT administrators can track this as a termination of the TSGateway service which becomes unresponsive with exception code 0xc0000005.
Workaround
To work around this issue, use one of the following options:
Option 1: Disallow connections over pipe, and port \pipe\RpcProxy\3388 through the RD Gateway.
This process will require the use of connection applications, such as firewall software. Consult the documentation for your connection and firewall software for guidance on disallowing and porting connections.
Option 2: Edit the registry of client devices and set the value of RDGClientTransport to 0x00000000 (0)
In Windows Registry Editor, navigate to the following registry location:
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client
Find RDGClientTransport and set its value to 0 (zero). This changes the value of RDGClientTransport to 0x00000000 (0).
Microsoft is working on a resolution and will provide an update in an upcoming release.
KB5043050: Win 10 Ent LTSC 2019 Win 10 IoT Ent LTSC 2019 Windows 10 IoT Core LTSC Windows Server 2019
Improvements
This security update includes quality improvements. Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.
[Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates that the process requires full administrator access. To turn off the UAC prompt, set the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair registry value to 1. The changes in this update might affect automatic Windows Installer repairs; see Application Resiliency: Unlock the Hidden Features of Windows Installer.
Known issues
Symptom
After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device. Resulting from this issue, your device might fail to boot Linux and show the error message “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.”
The August 2024 Windows security update applies a Secure Boot Advanced Targeting (SBAT) setting to devices that run Windows to block old, vulnerable boot managers. This SBAT update will not be applied to devices where dual booting is detected. On some devices, the dual-boot detection did not detect some customized methods of dual-booting and applied the SBAT value when it should not have been applied.
Please refer to the workaround mentioned in Windows release health site for this issue.
After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization. This issue might occur if legacy protocol (Remote Procedure Call over HTTP) is used in Remote Desktop Gateway. As a result of this, remote desktop connections might be interrupted.
This issue might occur intermittently, such as repeating every 30 minutes. At this interval, logon sessions are lost and users will need to reconnect to the server. IT administrators can track this as a termination of the TS Gateway service which becomes unresponsive with exception code 0xc0000005
Workaround
To work around this issue, use one of the following options:
Option 1: Disallow connections over pipe, and port \pipe\RpcProxy\3388 through the RD Gateway.
This process will require the use of connection applications, such as firewall software. Consult the documentation for your connection and firewall software for guidance on disallowing and porting connections.
Option 2: Edit the registry of client devices and set the value of RDGClientTransport to 0x00000000 (0)
In Windows Registry Editor, navigate to the following registry location:
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client
Find RDGClientTransport and set its value to 0 (zero). This changes the value of RDGClientTransport to 0x00000000 (0).
Next step: We are working on a resolution and will provide an update in an upcoming release.
Microsoft is working on a resolution and will provide an update in an upcoming release.
KB5043124: Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016 Windows Server 2016
Install this update to resolve issues in Windows. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article for more information. After you install this item, you may have to restart your computer.
KB5043051: Win 10 Ent LTSB 2016 Win 10 IoT Ent LTSB 2016 Windows Server 2016
Improvements
This security update includes quality improvements. Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.
[Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates that the process requires full administrator access. To turn off the UAC prompt, set the HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair registry value to 1. The changes in this update might affect automatic Windows Installer repairs; see Application Resiliency: Unlock the Hidden Features of Windows Installer.
Known issues in this update
Symptom
After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device. Resulting from this issue, your device might fail to boot Linux and show the error message “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security Policy Violation.”
The August 2024 Windows security update applies a Secure Boot Advanced Targeting (SBAT) setting to devices that run Windows to block old, vulnerable boot managers. This SBAT update will not be applied to devices where dual booting is detected. On some devices, the dual-boot detection did not detect some customized methods of dual-booting and applied the SBAT value when it should not have been applied.
Please refer to the workaround mentioned in Windows release health site for this issue.
After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization. This issue might occur if legacy protocol (Remote Procedure Call over HTTP) is used in Remote Desktop Gateway. Resulting from this, remote desktop connections might be interrupted.
This issue might occur intermittently, such as repeating every 30 minutes. At this interval, logon sessions are lost and users will need to reconnect to the server. IT administrators can track this as a termination of the TSGateway service which becomes unresponsive with exception code 0xc0000005.
Workaround
To work around this issue, use one of the following options:
Option 1: Disallow connections over pipe, and port \pipe\RpcProxy\3388 through the RD Gateway.
This process will require the use of connection applications, such as firewall software. Consult the documentation for your connection and firewall software for guidance on disallowing and porting connections.
Option 2: Edit the registry of client devices and set the value of RDGClientTransport to 0x00000000 (0)
In Windows Registry Editor, navigate to the following registry location:
HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client
Find RDGClientTransport and set its value to 0 (zero). This changes the value of RDGClientTransport to 0x00000000 (0).
Next step: Microsoft is working on a resolution and will provide an update in an upcoming release.