3

This scenario is a bit different than the one described here. I'm running the latest feature update of windows, Windows 10 1709. In December, I had to manually install the Fall Creators Update in-place.

Starting in January 2018, the device falsely reported it was up to date several days after a security KB was rolled out. I had to resort to manually installing and downloading the January 2018 security update.

Now the February 2018 security update is out, and this machine again claims it is up to date but is not.

I've tried everything here (save clean install) to no avail. I've run Get-WindowsUpdateLog in powershell, and for some reason the update service really is not seeing any relevant security updates. (I've grabbed the ID of the relevant February 2018 update, KB4074588 with ID 29A306E7-C732-4FF8-A939-B1CD9FEEF0D6.1, and that update is nowhere to be found in the log.)

Any thoughts or suggestions before I just proceed with a new windows install?

0

1 Answer 1

4

One of the main issues with the January updates are that they require an updated anti-virus to update a specific registry value. Once that is done, then Windows will start seeing updates again.

If you do not have an anti-virus that will do this, or you have Windows Defender disabled, you can manually add the registry value.

Microsoft has released this advisory.

You can check if this is the case pretty easily.

  1. Click on start
  2. Type in regedit and hit enter Browse to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat
  3. If cadca5fe-87d3-4b96-b7fb-a231484277cc exists and is set to 0x00000000 you should be getting the updates.

If not, you can create the entry if you wish.

Registry Entry

4
  • 1
    Wow. You are exactly right. Set the registry key and updates immediately showed up. Thank you so much. Feb 15, 2018 at 20:58
  • Also, FYI, I had windows defender disabled due to performance reasons. That Microsoft decided the right answer for incompatible antivirus is to never give you updates again but tell you that you are fully up to date makes my head hurt... Feb 15, 2018 at 21:09
  • 2
    @aggieNick02 The reason Microsoft did this was that updates for Meltdown and Spectre would cause machines to blue screen if their anti-virus wasn't up to date as it changed the way Anti-Virus and other programs could interface deeply into the machine. So Microsoft wanted vendors to put in this reg value to show that they complied with this change. Feb 15, 2018 at 21:43
  • 1
    Yeah, I totally get the reason, and even remember reading about it. My head hurts because the behavior when the key is not set is to tell you everything is fine and up to date. An error code, or an update that does nothing more than tell you "hey, no updates until you update your AV" would be so much better. I wonder how many people who disabled windows defender are currently unprotected from all the non-Spectre/Meltdown vulns patched in the last two months and have no idea. Feb 15, 2018 at 22:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .