{"id":4555,"date":"2017-05-17T20:14:24","date_gmt":"2017-05-17T20:14:24","guid":{"rendered":"https:\/\/really.zonky.org\/?p=4555"},"modified":"2017-10-04T08:20:12","modified_gmt":"2017-10-04T08:20:12","slug":"when-windows-update-lies","status":"publish","type":"post","link":"https:\/\/really.zonky.org\/?p=4555","title":{"rendered":"When Windows Update Lies"},"content":{"rendered":"<p>It seems rather strange when you discover it, but Windows Update sometimes lies about what updates have been installed. I am not sure how often this happens, but it <em>does<\/em> happen from time to time. Which with <a href=\"https:\/\/en.wikipedia.org\/wiki\/WannaCry_ransomware_attack\">WannaCrypt<\/a>\u00a0rampaging around is somewhat unfortunate.<\/p>\n<p>What\u00a0<em>seems<\/em> to happen is that Windows Update gets confused about what patches it has installed &#8211; it&#8217;s internal database gets corrupt. One possible fix for this is to remove the database :-<\/p>\n<pre>net stop wuauserv\r\ncd %systemroot%\r\nren SoftwareDistribution SoftwareDistribution.old\r\nnet start wuauserv\r\nrd \/s\/q SoftwareDistribution.old<\/pre>\n<p>When using Windows 10, you may well have to start (<em>net start wuauserv<\/em>) Windows Update services before stopping them. Once you have removed the directory, the next time you run Windows Update in the gooey, it will spend some time rebuilding it&#8217;s database and hopefully will then pick up the missing updates. No promises but this worked on at least one server that had unacknowledged missing patches.<\/p>\n<p>Of course without a proper vulnerability scanner it may be tricky to determine when Windows is lying about being fully patched. The best bet is to assume it is lying whenever something like WannaCrypt comes along.<\/p>\n<p>The other possibility is to look into something like <a href=\"http:\/\/www.autopatcher.net\/forum\/\">Autopatcher<\/a> which is intended for offline updates &#8211; you can download the Microsoft updates and use the tool to patch Windows computers from the downloads.<\/p>\n<p><img data-recalc-dims=\"1\" loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-4560\" src=\"https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?resize=695%2C462&#038;ssl=1\" alt=\"\" width=\"695\" height=\"462\" srcset=\"https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?resize=1024%2C681&amp;ssl=1 1024w, https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?resize=300%2C200&amp;ssl=1 300w, https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?resize=768%2C511&amp;ssl=1 768w, https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?w=2048&amp;ssl=1 2048w, https:\/\/i0.wp.com\/really.zonky.org\/wp-content\/uploads\/ccolon.jpg?w=1390&amp;ssl=1 1390w\" sizes=\"auto, (max-width: 695px) 100vw, 695px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>It seems rather strange when you discover it, but Windows Update sometimes lies about what updates have been installed. I am not sure how often this happens, but it does happen from time to time. Which with WannaCrypt\u00a0rampaging around is somewhat unfortunate. What\u00a0seems to happen is that Windows Update gets confused about what patches it <a href='https:\/\/really.zonky.org\/?p=4555' class='excerpt-more'>[&#8230;]<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false,"_share_on_mastodon":"0"},"categories":[4,489],"tags":[1529,174,1528,1526,370,1527],"class_list":["post-4555","post","type-post","status-publish","format-standard","hentry","category-it","category-security","tag-autopatcher","tag-lies","tag-patches","tag-wannacrypt","tag-windows","tag-windows-update","category-4-id","category-489-id","post-seq-1","post-parity-odd","meta-position-corners","fix"],"share_on_mastodon":{"url":"","error":""},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p1f2KI-1bt","_links":{"self":[{"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/posts\/4555","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/really.zonky.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4555"}],"version-history":[{"count":6,"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/posts\/4555\/revisions"}],"predecessor-version":[{"id":5050,"href":"https:\/\/really.zonky.org\/index.php?rest_route=\/wp\/v2\/posts\/4555\/revisions\/5050"}],"wp:attachment":[{"href":"https:\/\/really.zonky.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4555"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/really.zonky.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4555"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/really.zonky.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4555"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}