Windows 10: Windows Server Guidance against speculative execution vulnerabilities

Additional information

Q1: I wasn’t offered the Windows security updates that were released on January 3, 2018. What should I do?
A1: To help avoid adversely affecting customer devices, the Windows security updates that were released on January 3, 2018, have not been offered to all customers. For details, see Microsoft Knowledge Base Article 4073225.

Q2: How can I tell if I have the right version of the CPU microcode?
A2: The microcode is delivered through a firmware update. Consult with your OEM about the firmware version that has the appropriate update for your CPU.

Q3: Why aren't Windows Server 2008 and Windows Server 2012 platforms getting an update? When can customers expect the fix?
A3: Addressing a hardware vulnerability through a software update presents significant challenges, and mitigations for older operating systems require extensive architectural changes. Microsoft continues to work with affected chip manufacturers to investigate the best way to provide mitigations.

Q4: What is the performance impact for the mitigations?
A4: There are multiple variables that affect the performance of these mitigations, ranging from the CPU version to the running workloads. In some systems, the performance impact will be negligible, and in others it will be considerable.

Microsoft recommends that customers assess the performance impact for their systems and make adjustments if necessary.

Q5: I am running Windows Server in a third-party hosted environment or cloud. What should I do?
A5: In addition to the guidance above to address virtual machines, you need to contact your service provider to make sure that the hosts that are running your virtual machines are adequately protected.

For Windows Server virtual machines running in Azure, see Microsoft Knowledge Base Article 4073235.

Q6: Are there any Windows Server container-specific guidelines?
A6: The January update for Windows Server container images for Windows Server 2016 and Windows Server 10, version 1709 include the mitigations for this set of vulnerabilities, and no additional configuration is required.

Note that you still need to make sure that the host where these containers are running is configured with the appropriate mitigations.

Q7: Do the software and hardware updates have to be installed in a particular order?
A7: No, the installation order doesn't matter.

Q8: Do I need to reboot after the microcode but before the OS update?
A8: Yes, you must reboot between the microcode and OS updates.

[/quote]
Source: https://support.microsoft.com/en-us/...tive-execution

:)

 

Windows 10 we cannot connect to the update service

PLEASE READ :

Microsoft Security Advisory:
MSRC ADV180002

Intel:
Security Advisory

ARM:
Security Advisory

AMD:
Security Advisory

NVIDIA:
Security Advisory

Microsoft Secure blog:
Understanding the Performance Impact of Spectre and Meltdown Mitigations on Windows Systems

Windows for Business blog:
Windows Analytics now helps assess Meltdown and Spectre protections

Consumer Guidance:
Protecting your device against chip-related security vulnerabilities

Antivirus Guidance:
Windows security updates released January 3, 2018, and antivirus software

Guidance for AMD Windows OS security update block:
KB4073707: Windows operating system security update block for some AMD based devices

Update to Disable Mitigation against Spectre, Variant 2:
KB4078130: Intel has identified reboot issues with microcode on some older processors

Surface Guidance:
Surface Guidance to protect against speculative execution side-channel vulnerabilities

IT Pro Guidance:
Windows Client Guidance for IT Pros to protect against speculative execution side-channel vulnerabilities

Edge Developer Blog:
Mitigating speculative execution side-channel attacks in Microsoft Edge and Internet Explorer

Server Guidance:
Windows Server guidance to protect against speculative execution side-channel vulnerabilities

Server Hyper-V Guidance

• Virtual Machine Resource Controls
• Hyper-V Host CPU Resource Management

Azure Blog:
Securing Azure customers from CPU vulnerability

Azure KB:
KB4073235: Microsoft Cloud Protections Against Speculative Execution Side-Channel Vulnerabilities

Azure Stack guidance:
KB4073418: Azure stack guidance to protect against the speculative execution side-channel vulnerabilities

SQL Server guidance:
KB4073225: SQL Server Guidance to protect against speculative execution side-channel vulnerabilities

SCCM guidance:
Additional guidance to mitigate speculative execution side-channel vulnerabilities

 

Regarding KB4078130

Note Users who
do not have the affected Intel microcode do not have to download this update.

We are also offering a new option – available for
advanced users on affected devices – to manually disable and enable the mitigation against Spectre Variant 2 (CVE 2017-5715) independently through registry setting changes. The instructions for the registry key settings
can be found in the following Knowledge Base articles:

• KB4073119: IT Pro Guidance
• KB4072698:
  Server Guidance