Windows 10: KB5012170 update for windows server 2022

Hoong Jhang Chin · Jul 10, 2023

Hi, Referring to https://support.microsoft.com/en-us/topic/kb5012170-security-update-for-secure-boot-dbx-72ff5eed-25b4-47c7-be28-c42bd211bb15#articleFooterSupportBridge=communityBridge, I'm looking for the update for Windows Server 2022 in update catalog https://www.catalog.update.microsoft.com/Search.aspx?q=KB5012170 but I can't find the installer for Windows Server 2022. Please advise. Thank you.

:)

Brink · Jul 10, 2023

KB5012170: Security update for Secure Boot DBX: August 9, 2022

KB5012170: Security update for Secure Boot DBX: August 9, 2022

Applies to

This security update applies only to the following Windows versions:

Windows Server 2012

Windows 8.1 and Windows Server 2012 R2

Windows 10, version 1507

Windows 10, version 1607 and Windows Server 2016

Windows 10, version 1809 and Windows Server 2019

Windows 10, version 20H2

Windows 10, version 21H1

Windows 10, version 21H2

Windows Server 2022

Windows 11, version 21H2 (original release)

Azure Stack HCI, version 1809

Azure Stack Data Box, version 1809 (ASDB)

Summary

This security update makes improvements to Secure Boot DBX for the supported Windows versions listed in the "Applies to" section. Key changes include the following:

Windows devices that has Unified Extensible Firmware Interface (UEFI) based firmware can run with Secure Boot enabled. The Secure Boot Forbidden Signature Database (DBX) prevents UEFI modules from loading. This update adds modules to the DBX.

A security feature bypass vulnerability exists in secure boot. An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software.

This security update addresses the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX.

To learn more about this security vulnerability, see the following advisory:

ADV200011 | Microsoft Guidance for Addressing Security Feature Bypass in GRUB

For additional information about this security vulnerability, see the following resources:

CVE-2022-34301 | Eurosoft Boot Loader Bypass

CVE-2022-34302 | New Horizon Data Systems Inc Boot Loader Bypass

CVE-2022-34303 | Crypto Pro Boot Loader Bypass

Known issues

[table][tr][td]Issue[/td] [td]Next step[/td] [/tr] [tr][td]Some original equipment manufacturer (OEM) firmware might not allow for the installation of this update.[/td] [td]To resolve this issue, contact your firmware OEM.[/td] [/tr] [tr][td]If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the update failing to install. To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions.[/td] [td]To workaround this issue, do one of the following before you deploy this update:

On a device that does not have Credential Gard enabled, run following command from an Administrator command prompt to suspend BitLocker for 1 restart cycle: Manage-bde –Protectors –Disable C: -RebootCount 1 Then, deploy the update and restart the device to resume the BitLocker protection.

On a device that has Credential Guard enabled, run the following command from an Administrator command prompt to suspend BitLocker for 2 restart cycles: Manage-bde –Protectors –Disable C: -RebootCount 3 Then, deploy the update and restart the device to resume the BitLocker protection.

[/td] [/tr] [tr][td]When attempting to install this update, it might fail to install, and you might receive Error 0x800f0922. Note This issue only affects this security update for Secure Boot DBX (KB5012170) and does not affect the latest cumulative security updates, monthly rollups, or security-only updates released on August 9, 2022.[/td] [td]This issue can be mitigated on some devices by updating the UEFI bios to the latest version before attempting to install this update. We are presently investigating and will provide an update in an upcoming release.[/td] [/tr] [tr][td]Some devices might enter BitLocker Recovery on the first or second restart after attempting to install this update on Windows 11.[/td] [td]If your device is prompting for a BitLocker Recovery key, you will need to supply it to start Windows. For more information, see Finding your BitLocker recovery key in Windows. If you have not installed this update and have BitLocker enabled on your device, follow the instructions below to temporarily suspend BitLocker before installing. If you have installed this update and have not yet restarted your device or have only restarted your device once, temporarily suspend BitLocker by using the instructions below. IMPORTANT: If you have restarted your device two times or more after installing this update, your device is not affected by this issue. To temporarily suspend BitLocker, or to avoid a BitLocker recovery when deploying this update, follow these steps:

Run the following command from an Administrator command prompt: Manage-bde -protectors -disable %systemdrive% -rebootcount 2

Install this update, if not already installed.

Restart the device.

Then, restart the device a second time.

BitLocker should automatically be enabled after two restarts. If you want to manually resume BitLocker to verify that it is enabled, use the following command: Manage-bde -protectors -Enable %systemdrive%

Status: We are working on a resolution and will provide an update in an upcoming release.[/td] [/tr] [/table]

How to get this update

[table][tr]Release Channel Available Next Step [/tr] [tr][td]Windows Update or Microsoft Update[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update.[/td] [/tr] [tr][td]Windows Update for Business[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies.[/td] [/tr] [tr][td]Microsoft Update Catalog[/td] [td]Yes[/td] [td]To get the standalone package for this update, go to the Microsoft Update Catalog website.[/td] [/tr] [tr][td]Windows Server Update Services (WSUS)[/td] [td]Yes[/td] [td]This update will automatically synchronize with WSUS if you configure Products and Classifications as follows: Product: Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, version 1903 and later, Windows 11, Azure Stack HCI, Azure Data Box Classification: Security Updates[/td] [/tr] [/table]

Prerequisites

Make sure you have the lastest servicing stack update (SSU) installed. For information about the latest SSU for your operating system, see ADV990001 | Latest Servicing Stack Updates.

Restart information
Your device does not have to restart when you apply this update. If you have Windows Defender Credential Guard (Virtual Secure Mode) enabled, your device might request a restart.

Update replacement information

This update replaces previously released update KB4535680.

File information

The English (United States) version of this security update installs files that have the attributes that are listed in the following tables.
Click to expand...

Read more: https://support.microsoft.com/en-us/...8-c42bd211bb15

scopio · Jul 10, 2023

Windows Update KB5012170 error 0x800f0922

Run the .bat file as instructed but did not solve the issue.

I will now try the Windows Installation Media and see if that helps.

- - - Updated - - -

Issue resolved by creating Windows 10 installation media

and installing Windows 10

Windows Update kb5012170 installed at the first attempt.

Brink · Jul 10, 2023

KB5012170 Security update for Secure Boot DBX

KB5012170: Security update for Secure Boot DBX

NOTE Improved diagnostics have been added to detect and report issue details through the event log. Please see KB5016061: Addressing vulnerable and revoked Boot Managers for more information.

Applies to

This security update applies only to the following Windows versions:

Windows Server 2012

Windows 8.1 and Windows Server 2012 R2

Windows 10, version 1507

Windows 10, version 1607 and Windows Server 2016

Windows 10, version 1809 and Windows Server 2019

Windows 10, version 20H2

Windows 10, version 21H1

Windows 10, version 21H2

Windows 10, version 22H2

Windows Server 2022

Windows 11, version 21H2

Windows 11, version 22H2

Azure Stack HCI, version 1809

Azure Stack Data Box, version 1809 (ASDB)

Summary

This security update makes improvements to Secure Boot DBX for the supported Windows versions listed in the "Applies to" section. Key changes include the following:

Windows devices that has Unified Extensible Firmware Interface (UEFI) based firmware can run with Secure Boot enabled. The Secure Boot Forbidden Signature Database (DBX) prevents UEFI modules from loading. This update adds modules to the DBX.

A security feature bypass vulnerability exists in secure boot. An attacker who successfully exploited the vulnerability might bypass secure boot and load untrusted software.

This security update addresses the vulnerability by adding the signatures of the known vulnerable UEFI modules to the DBX.

To learn more about this security vulnerability, see the following advisory:

ADV200011 | Microsoft Guidance for Addressing Security Feature Bypass in GRUB

For additional information about this security vulnerability, see the following resources:

CVE-2022-34301 | Eurosoft Boot Loader Bypass

CVE-2022-34302 | New Horizon Data Systems Inc Boot Loader Bypass

CVE-2022-34303 | Crypto Pro Boot Loader Bypass

Known issues

[table][tr][td]Issue[/td] [td]Next step[/td] [/tr] [tr][td]If BitLocker Group Policy Configure TPM platform validation profile for native UEFI firmware configurations is enabled and PCR7 is selected by policy, it may result in the update failing to install. To view the PCR7 binding status, run the Microsoft System Information (Msinfo32.exe) tool with administrative permissions.[/td] [td]To workaround this issue, do one of the following before you deploy this update:

On a device that does not have Credential Gard enabled, run following command from an Administrator command prompt to suspend BitLocker for 1 restart cycle: Manage-bde –Protectors –Disable C: -RebootCount 1 Then, deploy the update and restart the device to resume the BitLocker protection.

On a device that has Credential Guard enabled, run the following command from an Administrator command prompt to suspend BitLocker for 2 restart cycles: Manage-bde –Protectors –Disable C: -RebootCount 3 Then, deploy the update and restart the device to resume the BitLocker protection.

[/td] [/tr] [tr][td]When attempting to install this update, it might fail to install, and you might receive Error 0x800f0922. Note This issue only affects this security update for Secure Boot DBX (KB5012170) and does not affect the latest cumulative security updates, monthly rollups, or security-only updates.[/td] [td]To resolve this issue, install the Servicing Stack Update (SSU) released March 14, 2023, or a later SSU update, for your supported Windows operating system:

Windows 11, version 22H2 SSU (SSU installed from cumulative update KB5023706)

Windows 11, version 21H2 SSU (SSU installed from cumulative update KB5023698)

Windows Server 2022 SSU (SSU installed from cumulative update KB5023705)

Windows 10, version 20H2, 21H2, and 22H2 SSU (SSU installed from cumulative update KB5023696)

Windows 10, version 1809/Windows Server 2019 (SSU installed from cumulative update KB5023702)

Windows Server 2016 SSU KB5023788

Windows 10 SSU KB5023787

Windows Server 2012 R2 SSU KB5023790

Windows Server 2012 SSU KB5023791

For information about the new error events added by these SSU updates and actions to take when an error occurs, see KB5016061.[/td] [/tr] [tr][td]Some devices might enter BitLocker Recovery on the first or second restart after attempting to install this update on Windows 11.[/td] [td]This issue is addressed in the servicing stack updates (SSU) and the latest cumulative updates (LCU) dated July 12, 2022 and later.[/td] [/tr] [/table]

How to get this update

[table][tr]Release Channel Available Next Step [/tr] [tr][td]Windows Update or Microsoft Update[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update.[/td] [/tr] [tr][td]Windows Update for Business[/td] [td]Yes[/td] [td]None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies.[/td] [/tr] [tr][td]Microsoft Update Catalog[/td] [td]Yes[/td] [td]To get the standalone package for this update, go to the Microsoft Update Catalog website.[/td] [/tr] [tr][td]Windows Server Update Services (WSUS)[/td] [td]Yes[/td] [td]This update will automatically synchronize with WSUS if you configure Products and Classifications as follows: Product: Windows Server 2012, Windows 8.1, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, Windows Server 2022, Windows 10, version 1903 and later, Windows 11, Azure Stack HCI, Azure Data Box Classification: Security Updates[/td] [/tr] [/table]

Prerequisites
Make sure you have the lastest servicing stack update (SSU) installed. For information about the latest SSU for your operating system, see ADV990001 | Latest Servicing Stack Updates.

Restart information
Your device does not have to restart when you apply this update. If you have Windows Defender Credential Guard (Virtual Secure Mode) enabled, your device might request a restart.

Update replacement information
This update replaces previously released update KB4535680.
Click to expand...

Source: https://support.microsoft.com/en-us/...8-c42bd211bb15

Windows 10: KB5012170 update for windows server 2022

KB5012170 update for windows server 2022

KB5012170 update for windows server 2022

KB5012170 update for windows server 2022

KB5012170 update for windows server 2022 - Similar Threads - KB5012170 update server

Windows Server 2022 : Unable to windows update

Windows Server 2022 : Unable to windows update

Windows server 2022 can not update patch from Windows server 2022 WSUS

Windows server 2022 can not update patch from Windows server 2022 WSUS

KB5012170 update for windows server 2022

windows server 2022

windows server 2022

windows server 2022

Windows Server 2022