SSU Fixes Security Update Issue

Microsoft has released a Secure Boot security update and is recommending this SSU be prioritized as it resolves an issue in the Secure Boot.

CVE-2020-0689 is a vulnerability that could allow attackers to bypass Secure Boot and install untrusted software. The new SSU fixes the issue by making sure prerequisite updates are installed in the proper order for the CVE-2020-0689 security update to install without errors.

Customers using Syxsense Manage and Syxsense Secure can find KB5001205 available now for immediate deployment.

What are Servicing Stack Updates?

Servicing stack updates provide fixes to the Windows servicing stack, the fundamental component that installs Windows updates.

It also contains the “component-based servicing stack” (CBS), which is a key underlying component for several elements of Windows deployment, such as DISM, SFC, changing Windows features or roles, and repairing components.

Servicing stack updates improve the reliability of the update process to mitigate potential issues while installing the latest quality updates and feature updates. If you don’t install the latest servicing stack update, there’s a risk that your device can’t be updated with the latest Microsoft security fixes.

Microsoft recently released Windows 10’s May 2020 Update. Codenamed 20H1, the spring release is referred to as “version 2004,” and includes a number of new features for security and performance.

Contrary to the 1909 (Fall 2019) Update that was more of a service pack or cumulative update with little changes, this update includes many changes across various areas of the operating system. For organizations planning to deploy the latest release, it’s strongly recommended to peruse the list of new features (as well as features deprecated) and, as always, test it first.

New Features in Windows 10 2004

New Cortana Experience

The new app has taken a significant shift, so if you’re used to using the digital assistant, be prepared.

The new version is mainly focused on increasing productivity—it has removed features for music, smart home, and third-party options. Additionally, Microsoft has removed Cortana on Android and iOS as well as unsupported Windows 10 versions. There are still improvements including interface enhancements and better integration with email, calendars, and other Windows apps.

Windows Subsystem for Linux 2

The Linux subsystem, which has been in Windows 10 for some time, has been majorly changed. It now runs entirely in a lightweight virtual machine managed by Windows. The full Linux kernel now enables full system call compatibility, offers great performance improvements, and can be easily updated through Windows Update. You can learn much more about the new WSL 2 by clicking here.

Windows Sandbox Improvements

The Windows Sandbox was introduced last year with the spring release of Windows 10 1903 and allows users to launch virtual devices for safe testing with a minimal version of Windows 10. Microsoft recently rolled-out new features to further automation including support for configuration files, audio input enhancements, and better use of administrative hotkeys.

Cloud Recovery Option

In previous versions of Windows 10, there’s a recovery option to ‘Reset this PC’ to perform a local reinstall, in the event that corruption occurs. Introduced in Windows 10 2004, this option now allows for not just local recovery, but also with ‘Cloud download’ where the files can instead be delivered from Microsoft’s servers directly (as long as the device has an adequate internet connection). Mac users have enjoyed this for quite some time and now Microsoft has finally stepped-up.

Security Options

Windows Hello has been used for some time to allow users to log in with biometrics or passwordless methods, like fingerprint, face scan, or PIN code. With Windows 2004, these options are now supported even if the device is booted-up in Safe Mode. This is most likely added because now Windows Hello passwordless authentication can used entirely without passwords (while logging-in with a Microsoft account). Another security improvement with 2004, Microsoft has expanded its FIDO2 security key support to “include hybrid Azure Active Directory (Azure AD)-joined devices, enabling even more customers to take an important step in their journey towards passwordless environments.”

Anyone running certain models of AMD processers will also be happy to know that 2004 includes its new Secured-core technology. Lastly, there’s a new setting that allows apps to start back up when a user signs in/out. It supports registered desktop apps, but they will start in a suspended state minimized to the taskbar to save resources. This is located in Sign-in options and is disabled by default.

The Rest of the Features

Notepad has been with Windows since nearly the beginning and finally it has received some new features. This includes line numbers when using word-wrap, new Find experience when using word-wrap, notification when making unsaved changes, text zoom, and new shortcuts.

Since Windows 10 started with Feature Updates, areas of the operating system ported over from Windows 7 have slowly been phased out. This is apparent with every new release increasing the amount of features in Settings, and deprecating the old items. This version finally allows the Network Status page to be more comparable to Control Panel. The new Wifi 6 and WPA3 are now supported in 2004, preventing such attacks as DragonBlood and KRACK.

Just like Windows has handled it with Microsoft Office apps for years, there’s the new ability to automatically restore open UWP (Universal Windows Platform) apps, such as Calendar and Mail, after a reboot. There’s also an improved tablet experience for convertible PCs.

And for years, gamers and administrators alike have begged for the Task Manager Performance tab to support graphics card performance options. Windows now includes GPU performance metrics, just like other major components. It should be noted that although GPU performance is now monitored, thermal metrics are still not included.

Some Driver Issues

It should also be noted that the initial release of Windows 10 2004 didn’t come without a few hiccups and this isn’t anything new (Windows 10 1809, anybody?). There have been reports of bugs in various drivers including peripherals, accessories like Bluetooth, audio as well as graphics and display issues. Fortunately for many, Microsoft already caught a number of these with Windows Insiders testing and has enabled a number of blocks for devices that may have these unsupported drivers.

For example, certain audio drivers were highlighted early: “To safeguard your update experience, we have applied a compatibility hold on Windows 10 devices with affected Conexant or Synaptics audio drivers installed from being offered Windows 10, version 2004 or Windows Server, version 2004 until the driver has been updated,” Microsoft stated. There are also outstanding issues with Realtek Bluetooth drivers, Intel integrated GPUs, Thunderbolt, and older Nvidia display adapters. For administrators, it’s always recommended to test the Feature Update first in an environment that’s representative of the production environment to catch any potential issues.

Organizations, as well as consumers, that run Windows 10 version 2004 will have full update support for 18 months (support until December 14, 2021).

How Syxsense Can Help

Overall, trusting Windows Server Update Services (WSUS) or other third-party patching solutions may not bring these devices to a supported version successfully. Leveraging a cloud-based solution to bring older Windows 10 devices up-to-date ensures success and standardization, whether devices are inside or outside the network.

Syxsense Manage includes the ability to migrate managed devices to any desired version of Windows 10 through the use of a Feature Update task. Simply prepare end-user installation delay and reboot options, choose the devices to target, and select a time for the upgrade that works best for these target devices. A phased deployment approach is also recommended by the industry and is always easily done with Syxsense Manage.