*** WARNING ! Re: security Update !

This may be a co-incidence, but we have just had 2 Win 2K workstations Go
Down on the Test Network after applying the latest Security Update.

An SBS 2K Test Server is also having problems after the installation of the
Critical Updates, and we've had a call from a client re problems with their
server where they've updated.

** TEST BEFORE YOU INSTALL **

I think we may have been lulled into a false sense of security with the
success of recent MS Updates.

--
Henry Craven

clevere
Wed Oct 15 17:03:59 CDT 2003

Worked like a champ on my 3 machines. Two XP machines, and one SBS2k3.

"Henry Craven" <IUnknown@d.com> wrote in message
news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
> This may be a co-incidence, but we have just had 2 Win 2K workstations Go
> Down on the Test Network after applying the latest Security Update.
>
> An SBS 2K Test Server is also having problems after the installation of
the
> Critical Updates, and we've had a call from a client re problems with
their
> server where they've updated.
>
> ** TEST BEFORE YOU INSTALL **
>
> I think we may have been lulled into a false sense of security with the
> success of recent MS Updates.
>
> --
> Henry Craven
>
>
>
>
>

Henry
Wed Oct 15 17:19:29 CDT 2003

"clevere" <noway@noway.net> wrote in message
news:%23N9E9g2kDHA.3320@tk2msftngp13.phx.gbl...
> Worked like a champ on my 3 machines. Two XP machines, and one SBS2k3.
>

These are Win2K Workstations and SBS2K Servers that were Fully Patched and
SP'd to date.

The 2k W/Ss are falling over at <SystemDir>\AppPatch\drvmain.sdb.

... May be co-incidence as I say, but it may pay to test and take care.

2K W/Ss can't even be booted to safe mode.
( Haven't even thought about the Server yet )

Be careful out there.
--
Henry Craven

Andrew
Wed Oct 15 17:40:56 CDT 2003

I'd like to agree that "test before you install" is good advice, but
unless the test network exactly duplicates the conditions on the production
network, which is unlikely, the test probably isn't very useful-- and, more
to the point, the vulnerability still exists. So, even assuming that the
test fails, what can one do? For a critical update, with "run code of
attacker's choice" as the possible result, the only thing to do is to make
an image backup of the server or workstation, apply the thing, say a prayer,
and then call Microsoft if it fails, even if it requires a $245 incident. If
MS can't resolve it for you fast enough, then go back to the image backup
and insist on an updated patch as resolution of the incident.

"Test before you install" is advice that used to be mandatory common
sense, but the world has changed. I don't like it any more than anyone else,
but for better or for worse, that's the way it is.

"Henry Craven" <IUnknown@d.com> wrote in message
news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
> This may be a co-incidence, but we have just had 2 Win 2K workstations Go
> Down on the Test Network after applying the latest Security Update.
>
> An SBS 2K Test Server is also having problems after the installation of
the
> Critical Updates, and we've had a call from a client re problems with
their
> server where they've updated.
>
> ** TEST BEFORE YOU INSTALL **
>
> I think we may have been lulled into a false sense of security with the
> success of recent MS Updates.
>
> --
> Henry Craven
>
>
>
>
>

Henry
Wed Oct 15 17:49:49 CDT 2003

SBS 2K Servers and all services are up and running after a couple of
re-boots.
- Nothing showing in the event logs except one unexpected shutdown.
- nothing re the services that didn't start.
- Workstations still offline.

>
> Be careful out there.
> --
> Henry Craven

Susan
Wed Oct 15 19:21:53 CDT 2003

If it fails it's not a $245 call.

Any security patch that causes and issue... it's a free call.


Andrew M. Saucci, Jr. wrote:
> I'd like to agree that "test before you install" is good advice, but
> unless the test network exactly duplicates the conditions on the production
> network, which is unlikely, the test probably isn't very useful-- and, more
> to the point, the vulnerability still exists. So, even assuming that the
> test fails, what can one do? For a critical update, with "run code of
> attacker's choice" as the possible result, the only thing to do is to make
> an image backup of the server or workstation, apply the thing, say a prayer,
> and then call Microsoft if it fails, even if it requires a $245 incident. If
> MS can't resolve it for you fast enough, then go back to the image backup
> and insist on an updated patch as resolution of the incident.
>
> "Test before you install" is advice that used to be mandatory common
> sense, but the world has changed. I don't like it any more than anyone else,
> but for better or for worse, that's the way it is.
>
> "Henry Craven" <IUnknown@d.com> wrote in message
> news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
>
>>This may be a co-incidence, but we have just had 2 Win 2K workstations Go
>>Down on the Test Network after applying the latest Security Update.
>>
>>An SBS 2K Test Server is also having problems after the installation of
>
> the
>
>>Critical Updates, and we've had a call from a client re problems with
>
> their
>
>>server where they've updated.
>>
>>** TEST BEFORE YOU INSTALL **
>>
>>I think we may have been lulled into a false sense of security with the
>>success of recent MS Updates.
>>
>>--
>>Henry Craven
>>
>>
>>
>>
>>
>
>
>

--
"Don't lose sight of security. Security is a state of being,
not a state of budget. He with the most firewalls still does
not win. Put down that honeypot and keep up to date on your
patches. Demand better security from vendors and hold them
responsible. Use what you have, and make sure you know how
to use it properly and effectively."
~Rain Forest Puppy
http://www.wiretrip.net/rfp/txt/evolution.txt

Susan
Wed Oct 15 19:20:37 CDT 2003

If it fails it's not a $245 call.

Any security patch that causes and issue... it's a free call.


Andrew M. Saucci, Jr. wrote:
> I'd like to agree that "test before you install" is good advice, but
> unless the test network exactly duplicates the conditions on the production
> network, which is unlikely, the test probably isn't very useful-- and, more
> to the point, the vulnerability still exists. So, even assuming that the
> test fails, what can one do? For a critical update, with "run code of
> attacker's choice" as the possible result, the only thing to do is to make
> an image backup of the server or workstation, apply the thing, say a prayer,
> and then call Microsoft if it fails, even if it requires a $245 incident. If
> MS can't resolve it for you fast enough, then go back to the image backup
> and insist on an updated patch as resolution of the incident.
>
> "Test before you install" is advice that used to be mandatory common
> sense, but the world has changed. I don't like it any more than anyone else,
> but for better or for worse, that's the way it is.
>
> "Henry Craven" <IUnknown@d.com> wrote in message
> news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
>
>>This may be a co-incidence, but we have just had 2 Win 2K workstations Go
>>Down on the Test Network after applying the latest Security Update.
>>
>>An SBS 2K Test Server is also having problems after the installation of
>
> the
>
>>Critical Updates, and we've had a call from a client re problems with
>
> their
>
>>server where they've updated.
>>
>>** TEST BEFORE YOU INSTALL **
>>
>>I think we may have been lulled into a false sense of security with the
>>success of recent MS Updates.
>>
>>--
>>Henry Craven
>>
>>
>>
>>
>>
>
>
>

--
"Don't lose sight of security. Security is a state of being,
not a state of budget. He with the most firewalls still does
not win. Put down that honeypot and keep up to date on your
patches. Demand better security from vendors and hold them
responsible. Use what you have, and make sure you know how
to use it properly and effectively."
~Rain Forest Puppy
http://www.wiretrip.net/rfp/txt/evolution.txt

Andrew
Wed Oct 15 20:41:48 CDT 2003

I know you mentioned this before but I keep forgetting. All the more
reason just to apply the patch after making an image backup. Thanks-- I
suspect a lot of us will just assume that we'll get hit with the fee.

"Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP]" <sbradcpa@pacbell.net>
wrote in message news:3F8DE455.8050503@pacbell.net...
> If it fails it's not a $245 call.
>
> Any security patch that causes and issue... it's a free call.
>
>
> Andrew M. Saucci, Jr. wrote:
> > I'd like to agree that "test before you install" is good advice,
but
> > unless the test network exactly duplicates the conditions on the
production
> > network, which is unlikely, the test probably isn't very useful-- and,
more
> > to the point, the vulnerability still exists. So, even assuming that the
> > test fails, what can one do? For a critical update, with "run code of
> > attacker's choice" as the possible result, the only thing to do is to
make
> > an image backup of the server or workstation, apply the thing, say a
prayer,
> > and then call Microsoft if it fails, even if it requires a $245
incident. If
> > MS can't resolve it for you fast enough, then go back to the image
backup
> > and insist on an updated patch as resolution of the incident.
> >
> > "Test before you install" is advice that used to be mandatory
common
> > sense, but the world has changed. I don't like it any more than anyone
else,
> > but for better or for worse, that's the way it is.
> >
> > "Henry Craven" <IUnknown@d.com> wrote in message
> > news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
> >
> >>This may be a co-incidence, but we have just had 2 Win 2K workstations
Go
> >>Down on the Test Network after applying the latest Security Update.
> >>
> >>An SBS 2K Test Server is also having problems after the installation of
> >
> > the
> >
> >>Critical Updates, and we've had a call from a client re problems with
> >
> > their
> >
> >>server where they've updated.
> >>
> >>** TEST BEFORE YOU INSTALL **
> >>
> >>I think we may have been lulled into a false sense of security with the
> >>success of recent MS Updates.
> >>
> >>--
> >>Henry Craven
> >>
> >>
> >>
> >>
> >>
> >
> >
> >
>
> --
> "Don't lose sight of security. Security is a state of being,
> not a state of budget. He with the most firewalls still does
> not win. Put down that honeypot and keep up to date on your
> patches. Demand better security from vendors and hold them
> responsible. Use what you have, and make sure you know how
> to use it properly and effectively."
> ~Rain Forest Puppy
> http://www.wiretrip.net/rfp/txt/evolution.txt
>
>

Dave
Thu Oct 16 11:36:40 CDT 2003

Which update?

"Henry Craven" <IUnknown@d.com> wrote in message
news:ORjHvb2kDHA.2244@TK2MSFTNGP12.phx.gbl...
> This may be a co-incidence, but we have just had 2 Win 2K workstations Go
> Down on the Test Network after applying the latest Security Update.
>
> An SBS 2K Test Server is also having problems after the installation of
the
> Critical Updates, and we've had a call from a client re problems with
their
> server where they've updated.
>
> ** TEST BEFORE YOU INSTALL **
>
> I think we may have been lulled into a false sense of security with the
> success of recent MS Updates.
>
> --
> Henry Craven
>
>
>
>
>

Henry
Thu Oct 16 19:34:49 CDT 2003

"Dave Stoecker" <david_stoecker@hotCOFFEEmail.com> wrote in message
news:ulMmuOAlDHA.1764@tk2msftngp13.phx.gbl...
> Which update?

The Server Updates were installed as a Batch, so it's one of these:

824141
823182
826232
825119
828035

We don't have a record of the 2K Workstation Updates.
Sorry.

---
Henry Craven

Dave
Fri Oct 17 09:22:57 CDT 2003

OK, thanks : )

"Henry Craven" <IUnknown@d.com> wrote in message
news:uLMTvYElDHA.1884@TK2MSFTNGP09.phx.gbl...
> "Dave Stoecker" <david_stoecker@hotCOFFEEmail.com> wrote in message
> news:ulMmuOAlDHA.1764@tk2msftngp13.phx.gbl...
> > Which update?
>
> The Server Updates were installed as a Batch, so it's one of these:
>
> 824141
> 823182
> 826232
> 825119
> 828035
>
> We don't have a record of the 2K Workstation Updates.
> Sorry.
>
> ---
> Henry Craven
>
>

headchef
Fri Oct 17 11:42:36 CDT 2003

Henry, I loaded almost the same exact updates to my laptop this
morning. After that it took 3+ minutes to boot and continues to take
a long time. After removing each item individually and rebooting I
found 825119 was causing the problem. I re-installed the others with
no problems.

So if you can, uninstall 825119 and see what happens.

Good Luck.


"Henry Craven" <IUnknown@d.com> wrote in message news:<uLMTvYElDHA.1884@TK2MSFTNGP09.phx.gbl>...
> "Dave Stoecker" <david_stoecker@hotCOFFEEmail.com> wrote in message
> news:ulMmuOAlDHA.1764@tk2msftngp13.phx.gbl...
> > Which update?
>
> The Server Updates were installed as a Batch, so it's one of these:
>
> 824141
> 823182
> 826232
> 825119
> 828035
>
> We don't have a record of the 2K Workstation Updates.
> Sorry.
>
> ---
> Henry Craven

Henry
Fri Oct 17 20:44:37 CDT 2003

Thanks John.

The two Servers we loaded the patches to seem to have come good after
several reboots ( at least for now ) I'll be sure to watch out for 825119
when we do the rest.

--
Henry Craven

"Johnny F" <headchef@thebar-b-que.us> wrote in message
news:61dc0187.0310170842.4ab3df27@posting.google.com...
> Henry, I loaded almost the same exact updates to my laptop this
> morning. After that it took 3+ minutes to boot and continues to take
> a long time. After removing each item individually and rebooting I
> found 825119 was causing the problem. I re-installed the others with
> no problems.
>
> So if you can, uninstall 825119 and see what happens.
>
> Good Luck.

mealsormissles
Mon Oct 20 07:57:18 CDT 2003

I have an XP laptop that has failed at that point just after the security
updates.
It wont go past that line when booting to any of the safemode
configurations. If that wasn't bad enough, it's the unit with no-floppy and
a bum CD drive so I can't even use the recover disk.

j*


"Henry Craven" <IUnknown@d.com> wrote in message
news:OCG7fo2kDHA.2444@TK2MSFTNGP09.phx.gbl...
> "clevere" <noway@noway.net> wrote in message
> news:%23N9E9g2kDHA.3320@tk2msftngp13.phx.gbl...
> > Worked like a champ on my 3 machines. Two XP machines, and one SBS2k3.
> >
>
> These are Win2K Workstations and SBS2K Servers that were Fully Patched
and
> SP'd to date.
>
> The 2k W/Ss are falling over at <SystemDir>\AppPatch\drvmain.sdb.
>
> ... May be co-incidence as I say, but it may pay to test and take care.
>
> 2K W/Ss can't even be booted to safe mode.
> ( Haven't even thought about the Server yet )
>
> Be careful out there.
> --
> Henry Craven
>
>
>