Microsoft Says No More Windows Security Updates Unless AVs Set a Registry Key (bleepingcomputer.com)

Catalin Cimpanu, reporting for BleepingComputer: Microsoft has added a new and very important detail on the support page describing incompatibilities between antivirus (AV) products and the recent Windows Meltdown and Spectre patches. According to an update added this week, Microsoft says that Windows users will not receive the January 2018 Patch Tuesday security updates, or any subsequent Patch Tuesday security updates, unless the antivirus program they are using becomes compatible with the Windows Meltdown and Spectre patches. The way antivirus programs become compatible is by updating their product and then adding a special registry key to the Windows Registry. The presence of this registry key tells the Windows OS the AV product is compatible and will trigger the Windows Update that installs the Meltdown and Spectre patches that address critical flaws in the design of modern CPUs.

Comments

Windows Server

[DigiShaman]

Remember,

For Windows Server, you will need to also set the following three registry keys to enable post patch install. With Windows Home/pro, it's already enabled after installation.

For Windows Server.

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f

reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f

reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f

To Validate status, you can run the PowerShell command Get-SpeculationControlSettings.

If Windows 10 or Server 2016, you can skip the first step.

1. Set-ExecutionPolicy Bypass
2. Install-Module SpeculationControl
3. Get-SpeculationControlSettings
You will now see results.
4. Set-ExecutionPolicy Restricted (to protect the system via securing powershell again)

Good luck. Be sure to apply BIOS updates when and if applicable to stave off Spectre

Legitimate decision.

[Gravis Zero]

It pains me to side with Microsoft but their decision here is a good and legitimate one.

The key to it's legitimacy is this quote:

There is a problem where some anti-virus vendors are using techniques to bypass Kernel Patch Protection by injecting a hypervisor which they use to intercept syscalls and make assumptions about memory locations — memory locations which are now changing with the Meltdown fixes.

Re:Something wrong here

[StormReaver]

You do know that you can just disable the Windows Update service right?

Microsoft frequently ignores that setting.

Re:Now windows malware will mess with that key to

[bondsbw]

You have bigger problems than a registry key if the malware has root.

Re:No AV - No Updates?

[sinij]

So what happens if I don't install any AV-product and also don't use the Microsoft AV-Solution?

It is highly unreasonable to expect MS to be able to patch your Linux box. :P

Re:Now windows malware will mess with that key to

[Skuld-Chan]

If malware can set this reg key - your machine is already done (its only writable by system/admin).

Comment removed

[account_deleted]

Comment removed based on user account deletion