Microsoft Defender for Endpoint laid low. Not by malware, but by another buggy Windows patch

A sad-faced Microsoft engineer has had to reset the "Days since we last shot ourselves in the foot" counter at the company's HQ after a security update broke Microsoft Defender for Endpoint on Windows Server Core. The issue started with patches emitted on 9 November, KB5007205 and KB5007206. The latter included the LTSC …

[ecofeco]

Microsoft...

...gonna Microsoft.

[Little Mouse]

Re: Microsoft...

So it seems. Only affecting Server Core is quite something.

Wasn't a big selling point of Core that it was a pared-back version of Server without all the unnecessary bolt-ons & bloat? i.e. Far fewer things could go wrong with it?

[MatthewSt]

Re: Microsoft...

My guess would be someone took a dependency on a component that doesn't ship with server core

[DJV]

"Days since we last shot ourselves in the foot"

A sad-faced Microsoft engineer has had to reset the "Days since we last shot ourselves in the foot" counter.

Do they party every time it threatens to reach double digits?

[Mine's a Large One]

Re: "Days since we last shot ourselves in the foot"

Nobody knows, they've never managed it.

[Anonymous Coward]

Re: "Days since we last shot ourselves in the foot"

Not true! When they released their first version of DOS, they just flat out didn't patch it for the longest time so it was "stable", for what little that is worth...

[EnviableOne]

Re: "Days since we last shot ourselves in the foot"

rumours are they didn't write it ...

[simpfeld]

Windows Server, a contradiction in terms

Having administered it for years, I still haven't changed that view!

[A random security guy]

Re: Windows Server, a contradiction in terms

You serve it.

[Anonymous Coward]

Wait a minute!

Microsoft cares about Kaspersky's products ? There's something definitely wrong here.

[A random security guy]

Re: Wait a minute!

Microsoft cares?

[Henry Wertz 1]

"Server Core"

I think the root problem here is "Server Core", the "Windows 10 IoT", etc., were intended to be real stripped down version of WIndows, but Windows itself was not intended to be stripped down this far. Not that they can't ultimately get it to work; but I've read about Microsoft running into all kinds of odd problems developing both of these; removing some services was easy, others were harder to remove; removing stuff like the GUI (for IoT versions) was apparently surprisingly difficult (there were some oddly non-GUI related things that the WIn32 API traditionally required having a window handle to do).

In contrast, the Linux kernel and components running on top of it are developed independently, and usually (other than maybe systemd...bleh) consciously avoid being dependent on anything else to the maximum extent possible. So the 'cloud' versions of various Linux distros are really just a matter of pulling out most server packages and all desktop-related packages from the server version of the distro (if it has one) and streamlining the startup script(s) since you're not mounting any disks, loading kernel modules or drivers, etc.. Of course a "IoT" variant (to run on Raspberry Pi etc.) you would want to mount disks, load modules, etc. so you remove excess packages but leave the startup more intact.