Windows Patch Tuesday update might send a user to the BitLocker recovery screen

Some Windows devices are presenting users with a BitLocker recovery screen upon reboot following the installation of July's Patch Tuesday update. Microsoft confirmed the issue overnight with an update to its Windows Release Health dashboard. The issue effects versions of Windows from Windows 10 21H2 to Windows 11 23H2 on the …

[navarac]

Spiral

What with this (again), and CrowdStike all within the same period, it seems to me that Microsoft Windows has become totally not to be trusted at all. It is all a downward spiral, and this, together with CrowdStrike, smells of Gross Negligence - something their EULAs cannot give protection from, whatever the lawyers say.

....and Microsoft wants to make BitLocker ON BY DEFAULT for all users? Crazy jerks.

[Pascal Monett]

I'm sorry to rain on your parade, but the EULA has been extremely efficient up to now at preserving Redmond from any fallout of its shoddy programming and lack of testing procedures.

I see no reason why this should change, and MSFT's stock price practically only ever goes up, so, that has to mean Redmond is right, right ?

[Doctor Syntax]

But how often has Microsoft been pushed on negligence?

I can envisage Crowdstrike being subject to class actions on this, not necessarily by customers but by members of the public who were frustrated airline passengers, bank customers & so on. They have no EULA with Croudstrike. What's not there can't be hidden behind but if they can establish that the company had a duty of care to them and that its release process fell short of what a reasonable person would expect then things could get interesting. Imagine Croudstrike going to court to argue that its customers shouldn't have used the product.

[Anonymous Coward]

OK, but let's then get to root causes. I'd like to hear from actual lawyers if negligence doesn't override any EULA terms because then it's Microsoft's turn on the block.

They have gotten away with increasingly shoddy programming which pretty much forced people to install extra products - Crowdstrike would not exist without that basic fact.

I understand Microsoft's enthusiasm to immediately seek to divert the attention, but the fundamentals of this problem lie with Microsoft, nobody else.

[Lennart Sorensen]

Crowdstrike runs in windows, linux and macos, and protects the applications from attacks, not just the OS. So you can't blame Microsoft for that. Apparently Microsoft wanted things like crowdstrike to run in user space and use an API to ask the OS for the things it needs, but since Defender doesn't do that, and the EU said they must provide 3rd party software the same access as their own, crowdstrike decided it wanted to use kernel mode too. And then they apparently don't write particularly safe code or do particularly good testing at crowdstrike.

[Anonymous Coward]

Of course I can blame Microsoft for that.

Or did you not hear it repeated for days on every news broadcast on the planet that Macs and Linux machines were not affected?

[Sceptic Tank]

Well then hire a lawyer.

[Ken Hagan]

Re: Spiral

You've learned the wrong lesson. The evil here is an update to *your* computer being applied by a third party at a time of *their* choosing, with no easy option for you to delay.

(In the case of CS, reports suggest that there was no option, period, which just makes it malware in my book.)

[Optimaximal]

Re: Spiral

I mean, I feel you're MASSIVELY overreacting here. Drive Encryption is a good thing, you know..?

[Roland6]

Re: Spiral

> Drive Encryption is a good thing, you know..?

It’s also a right pain in the a***.

Being able to pull a drive and mount it in another system can be really handy. How many people use encrypted USB sticks?

[Anonymous Coward]

Windows staggered updates rollouts

“Windows updates are perfect candidates for staggered rollouts and deployment rings, so the impact of the issue will be minimal for users who do not immediately take every update Microsoft offers.”

Can you explain how one is to disable forced updates?

[Mike 137]

Re: Windows staggered updates rollouts

"Can you explain how one is to disable forced updates?"

try wumgr

[James O'Shea]

Re: Windows staggered updates rollouts

Sigh.

1. Settings

2. Windows Update

3. Advanced Options

4. Pause updates.

Your updates will be paused for up to 35 days. At 35 days it's going to insist unless you do stuff MS won't like, such as

1. Windows R to get the Run box

2. Type “services.msc”, hit OK

3. Go to Windows Update in the list of services

4. Select the pull-down menu, select 'manual' hit OK if you just want to install updates when you want to, or select 'disable' and hit OK to Kill Updates With Fire! Use at your own risk. Works on Win10. I don't know, and don't care, about Win11. You could also try something simpler, such as buy a Mac or install Ubuntu.

Note that this is being typed on a Win10 box with updates set to manual. I'll probably get around to installing updates... later. Maybe.

Note that Apple puts a little red badge up on the system prefs icon advising you that there are updates and then usually leaves you alone and only makes a big deal if the update is really serious. I've never had a very serious update on Ubuntu, I have no idea what they do.

[Ken Hagan]

Re: Windows staggered updates rollouts

So you have to remember to do that every second Monday in the month. Maybe someone can suggest a way of automating that.

[James O'Shea]

Re: Windows staggered updates rollouts

If it's set to manual, updates runs when I want. At home that's usually that's a Saturday or a Sunday when I have nothing else planned. At the office, there are test machines and Group Policy and a script and a new guy available on Sunday mornings. By Monday the test systems have been updated, and the rest of the network will be updated next Sunday if everything works on the test machines for a week. New guys, Group Policy, and scripts exist to be abused, though the new guy gets overtime pay out of the deal.

[Roland6]

Re: Windows staggered updates rollouts

And the group policy setting, so that only selected systems get updated, so updates are staggered across the estate.

The way I had it configured for one customer was to have updates set to manual and in the third-party AV tool (Panda AD360) use its task scheduler to force systems in particular groups to update at different times. Obviously, I just had to remember to manually assign systems to a group. I’m sure it is possible with GPO, just that this way was obvious and straightforward.

Obviously, the fly-in-the-ointment with W10 is setting the target version level so W10 updates don’t get suspended due to MS wanting the system upgraded to W11.

[hoola]

Re: Windows staggered updates rollouts

Windows updates are not forced and can be installed at a time of the user'a or company's choosing. This has always been the .

Crowdstrike's update was completely different.

[Anonymous Coward]

Re: Windows staggered updates rollouts

> Windows updates are not forced and can be installed at a time of the user'a or company's choosing.

You can delay the update until ClippyAI nags you to death. Then there's the two days lost in trying to recover from a corrupt update file.

[hoola]

Re: Windows staggered updates rollouts

Just how many times has a Windows update duffed up a system to the point it is unusable?

In all the years I have had family devices I think once or twice and the recovery was straightforward.

At a corporate level where on the infrastructure team we managed around 1000 Windows servers, I cannot recall any being messed up.

We had over 10000 PCs, there was the occasional one and invariably it was something with esoteric hardware attached.

When people make all these claims about Windows updates perpetually breaking I just don't believe it or if it is happening perhaps the issue is closer to home in terms of the hardware or the user.

I gave seen users completely knob over all OSs with Linux being the more common on totally stuffed because they think they know what they are doing.

To put some context in we also had around 5000 Linux servers, highly managed, patched etc. Then Linux and Mac PCs. You know the one that caused the most grief?

Apple........

Downvote as much as you like but the most readers on ElReg hate Windows, hate Microsoft but have no understanding of the corporate world outside their sphere of "Only Linux and Open Source".

[Anonymous Coward]

Re: Windows staggered updates rollouts

> Downvote as much as you like but the most readers on ElReg hate Windows, hate Microsoft but have no understanding of the corporate world outside their sphere of "Only Linux and Open Source".

I contracted for a major international management consultancy. Who had totally standardized on the Microsoft product. Not much innovation going on there. They had two RJ45 on each desk. One that connected to the Internet and one that connected to a re-install Windows server. The machines borked so often that it was simpler to reinstall Windows. Their business records were stored in PPT with a special format in the file name. The files being stored on servers mapped to local drives G:, H: etc. You could access files in the Sydney office from the London office. Not much innovation going on there. They ran a FAX service that crashed over the weekend. Not a good look for a business consultancy. I've seen more innovation in the average tech college of over decade previously.

[Vincent van Gopher]

Jesus H

Fucking Christ! What next! Total Windows Armageddon? -->

TWA - I rather like that :)

TWA©

[Anonymous Coward]

Re: Jesus H

Total Windows Armageddon Tuesday.

[Anonymous Coward]

Re: Jesus H

The makings of a movie: I still know what you did on Total Windows Armageddon Friday.

[David 132]

Re: Jesus H

The horror version of Groundhog Day.

[heyrick]

The timing, however, could not be more unfortunate.

Unfortunate?

Try complete incompetence.

They watched the CrowdStrike fiasco, tried to blame the EU of all things, and then managed to push out their own broken update.

Granted, it wasn't as buggered as CrowdStrike, but you'd think right now would be exactly the time to measure a dozen times and cut once...

[Terry 6]

Testing

None of the big shareholder value chasing Tech monoliths seem to give a shit about users' machines. Not if they can keep shareholders happy by burying the cost of doing business. Not testing stuff properly is a handy corner to cut.

[Roland6]

Illegal memory reference handler?

I wonder when we might see MS ship an illegal memory reference handler, as CrowdStrike have clearly demonstrated it is a bug that Windows can’t gracefully handle these exceptions and resorts to the BSoD.

[Evilgoat76]

Re: Illegal memory reference handler?

Except it did...

You've thrown an exception in ring 0, all bets at this point are now off. The safest way to deal with this is to die gracefully. If kernal exceptions are being thrown around *anything* could happen and you can't count that the system is going to behave the way it should. The best thing is to just shut down as best you can and tell the user it's all gone sideways. If you are throwing critical exceptions, in a priviledged, protected area of program space as this was, you need to die cleanly before you really break something.

If an illegal access was thrown and something bad(tm) has happened in kernal ram, how do you know the reference you have for what threw the exception is good? The stack may well be a pile of broken bits or even now pointed at arbitrary memory locations. Hell your illegal access may have been legal till something else did something stupid before. SO maybe we handle it incorrectly, tel the user that all is good, but the kernal is still screwed. User goes on, hits save on on something important and it turns out the process we handled wasn't the cause and boom, there goes the file or even the whole filesystem. What if this is the first sign of bad RAM? Bad RAM can destroy the software on a machine pretty damn quickly, once filesystem caches start getting nerfed the fun really startes.

Every single modern OS does just the same thing. I beleive on a Linux update of Crowdstrike this exact thing DID happen.

The issue here was that MS put in a LOT of ground work to stop drivers buggering about with things, issued certification and along come Crowdstrike, totally sidestep this process, and have thaier "driver" load unsigned, un tested (and aparaently, with no QA) code into ring 0, something that's not supposed to be done. And on top of that aparently they do no sanity/bounds checking loading that unsigned code.

Much as I hate it, MS have done their best here and Crowdstrike just jumped the guard rails.

[Roland6]

Re: Illegal memory reference handler?

> "The safest way to deal with this is to die gracefully. "

This I suspect is at the heart of our differing viewpoints, as otherwise I agree with much of your post.

The question is is whether a BSoD is a satisfactory first choice "die gracefully" option, particularly as fundamentally we are talking about servers. It is my viewpoint it is not, especially with with respect to Windows as currently installed by default.

Taking on board your point about the uncertainty of what exactly has and hasn't failed, which makes fixing/repairing the currently running system to a stable configuration problematic, I suggest the typical Windows install has already allowed for this through UEFI, Safe Mode with/without networking boot mode and the Windows recovery partition/environment. Naturally for a server, it would seem the best option would be to do the BSoD fault logging and then automatically reboot into Safe Mode with Networking, potentially also with the option to call home (just like many network appliances). This giving the potential for a remote administrator/management system to regain access to the system to investigate and effect repairs. Yes, if the problem is more than software or has corrupted critical files this may not work, but then we have the Windows Recovery Partition... In general, I would suggest the root cause of the exception will be software and thus the assumptions MS made with respect to Safe Mode (and the Recovery partition) are valid most of the time. The trick is to link these together in a way that facilitates remote system recovery; and that is something MS can do and has been able to do for several years...

[Lost in Cyberspace]

Will somebody think of the (home) users

I know a few retailers that initially set up computers using new/generic Microsoft Accounts - all because MS make it very difficult to set up laptops with a local account.

Once in a while, these BitLocker screens appear and we have absolutely no way of finding out the MS account used, let alone the BitLocker key. OneDrive backups? In that same account. And, unsurprisingly, we get blank stares when asked about HDD backups.

[carl0s]

Re: Will somebody think of the (home) users

Yeah I've had a handful of Home edition Dell laptops that I have had to reformat. These used local accounts, not Microsoft accounts, and nobody chose to turn on bitlocker.

In fact the Inspiron 3520s that I was reselling did it enough times that I made a point of turning off Device Encryption (bitlocker with a home-user name) on them before handing them out, and I have also made my RMM sw pull the key from any machines I install the agent on.

I think it's the firmware updates being delivered via Windows Update that trigger the tamper thingies.

[carl0s]

Yeah I've had a handful of Home edition Dell laptops that I have had to reformat. These used local accounts, not Microsoft accounts, and nobody chose to turn on bitlocker.

In fact the Inspiron 3520s that I was reselling did it enough times that I made a point of turning off Device Encryption (bitlocker with a home-user name) on them before handing them out, and I have also made my RMM sw pull the key from any machines I install the agent on.

I think it's the firmware updates being delivered via Windows Update that trigger the tamper thingies.

[ecofeco]

I seen this movie before

I've had this happen with a few users machines over the years.

It was not a happy moment then and it isn't now.

[Ovalwingnut]

If it's Microsoft.. "we warned you"

quote: "Affected users will need their BitLocker recovery key to start their device" ??

Seriously? This is a joke, right?

Luckily I had my BitLocker code tattooed (in reverse) on my left cheek. No charge for that visual.

[anthonyhegedus]

Incompetent shitshow of a company

This isn't the first time this has happened. It's OK for our customers, who all have Microsoft 365 accounts and we can easily retrieve the keys. But what a fucking waste of time and resources.

IHow in the name of fuck does Apple manage to encrypt their computers with no sudden "enter your key" messages after an update, whereas this is a regular occurrence with Microsoft? It's same old, same old with MS - lack of quality control, strongarming their customers into a corner and moving the goalposts.

Everything in Microsoft is like a building site. Every other screen in 365 admin says "click here to use the new <whatever> experience" or "This feature has been replaced by <something> so don't use it unless you're doing so-and-so" or even "click here for a trial of the thing you expected to be able to do for free". How many different Teams apps, Onedrivel apps, Outlook apps are there these days? They never actually finalise and finish anything!

And when they do introduce a new feature without fully explaining it, like encrypting your drive, it goes wrong every 12-18 months.

IT'S NOT GOOD ENOUGH MICROSOFT, GET YOUR SHIT TOGETHER AND START BECOMING A SERIOUS OS!

[Optimaximal]

Re: Incompetent shitshow of a company

"IT'S NOT GOOD ENOUGH MICROSOFT, GET YOUR SHIT TOGETHER AND START BECOMING A SERIOUS OS!"

They literally are, hence why they're mandating drive encryption!

"IHow in the name of fuck does Apple manage to encrypt their computers with no sudden "enter your key" messages after an update, whereas this is a regular occurrence with Microsoft? It's same old, same old with MS - lack of quality control, strongarming their customers into a corner and moving the goalposts."

Apple employ hardware encryption because they control the full device spec, whereas Microsoft are obviously reliant on third parties implementing looser standards, although this was the hoohah behind Windows 11 requiring on-CPU TPM - its a guarenteed standard that prevents people shipping devices unable to support the security standard.

As for unlocking the device, Apple use an identical process to Microsoft - Primary key stored in the TPM/Enclave and a backup recovery key that needs to either be stored in a cloud account (365 or iCloud respectively) or written down/saved to an external drive. Your Apple devices security processor can fail/be cleared just like a Windows device TPM and your system drive won't unlock...

[cleminan]

Re: Incompetent shitshow of a company

> How in the name of fuck does Apple manage to encrypt their computers with no sudden "enter your key" messages after an update

I dunno. I've had my Mac lose the keychain more than once sweeping away some system & entire app settings. It's solid but it ain't bulletproof.

[bernmeister]

Dont panic.

Luckily Bitlocker is not implemented on Windows 10 Home.

[BenMyers]

Re: Dont panic.

What!!!! Yes, BitLocker works on Windows 10/11 Home. It is set up by default when one brings a computer home from the store, powers it up and creates a login. Managed to "repair" a dead Windows 10 Home laptop a couple of years ago by mouting the Bitlockered SSD in another computer, typing in the 48-bit BitLocker key and ridding the owner of BitLocker.

[BenMyers]

Another reason

One more reason not to use BitLocker.

[Anonymous Coward]

This July updated also borked the LDP service. Quite a few threads about this as well.

[FuzzyTheBear]

Spiral

It just goes in a spiral down the drain ..Open Source does not need to lift a finger .. Microsoft is doing a perfect job at destroying itself.

Trust MS ? Who can ?

[Sceptic Tank]

Stay away from the Windows

Is this bitlocker the thing that encrypts your data and then people demand money to have it decrypted? I always thought they demanded money only AFTER they encrypted your stuff; here with MS you have to pay up-front.

Anyway, amazing that they still have to push out bug fixes once a month for an OS that has been around since ca. 1994. How broken is the thing?

[simpletech]

and when the BitLocker password ISN'T stored in the user's Microsoft account...

you get to blank the disk and reinstall Windows again. If the user doesn't like/trust OneDrive, they lose all of their data too...

at least the customer I had this week that had this Windows Update bug happen to them DID trust OneDrive, so they didn't lose all of their stuff.

and to top it all off, most of my home/non-corporate users don't even know that FDE/BitLocker has been turned on in the first place, because Microsoft *didn't tell them*.