List of Available Hotfixes for Windows 7

This Article ID: 2820833 is more of an enforcement of NTFS file permissions over removable devices and other removable media.

This article ID provide Step-by-Step solutions and "Microsoft Fix-it" solutions for those wanted disallow read and write access to removable devices.

-Article ID: 2820833 - Last Review: May 17, 2013 - Revision: 2.0
NTFS disk access permissions for removable or external media could be bypassed.

Introduction:
We are aware of detailed information and tools that can be used to access files on removable devices. These tools can bypass NTFS file permissions on non-server distributions of Microsoft Windows. We are aware that this issue may affect internal disks, fixed disks that are marked as removable, and also external media such as USB, Firewire, E-SATA, SD, and other removable media. We are aware of situations in which disks on certain storage controllers may be marked as "removable" regardless of physical position inside or outside the computer case or the kind of connection that is used by the disk.

This issue does not affect the primary system volume (that is, the device from which Windows is currently running).

Systems that are affected in a default configuration are primarily at risk. For example, this includes systems multiple disks that are running Windows Vista, Windows 7 and Windows 8.

More Infos:
How to tell if your environment is affected
NTFS disk access permissions for removable or external media could be bypassed

You'll find here a list of re-released article IDs due to an issue in which the digital signature by Microsoft will expire prematurely.

NOTE:
Some of the Article IDs posted above are already re-released ones as they are tagged v2 or v3 when you do requesting them, thus it will make you be able to recognize more easily the version!

-Article ID: 2771149 - Last Review: March 15, 2013 - Revision: 6.0
List of Windows hotfixes that are affected by signed Microsoft binaries.

Summary:
This article lists the Windows hotfixes that were re-released to address an issue in which the digital signature on files produced and signed by Microsoft will expire prematurely, as described in Microsoft Security Advisory (2749655)

Applies to:
Windows 7, Windows Server 2008 R2, Windows Vista, Windows Server 2008

More information about the hotfixes re-released:
List of Windows hotfixes that are affected by signed Microsoft binaries

Note: Some of the article IDs mentioned in that list do not appeared posted along this thread by me.

-Article ID: 2808693 - Last Review: February 10, 2014 - Revision: 8.0
Hotfix is available that disables the function that lets users change the format of a physical smart card PIN or a VSC PIN in Windows 7, Windows 8, Windows Server 2008 R2, or Windows Server 2012.

Introduction:
This article describes a hotfix that disables the function that lets users change the format of a Virtual Smart Card (VSC) personal identification number (PIN) by using the CTRL+ALT+DEL sequence. After you apply this hotfix, you can enable and disable this function.

By design, a VSC PIN must have a minimum of 8 digits and can contain any combination of numbers and characters. For example, Pin1234! and 12345678 are valid VSC PINs. Physical smart cards may not have this limitation.

For VSCs, you cannot use a mechanism that is built into Windows to apply a policy that enforces a specific PIN format (such as a 10 digit PIN that contains only numbers). However, for both VSCs and physical smart cards, you can enforce a PIN format by using other methods. For example, you can use a custom PIN tool to enforce the PIN format. To make sure that users do not change a specified PIN format, disable the function that lets users change the PIN format.
Prerequisites:

To apply this hotfix, you must be running running one of the following operating systems:

• Windows 7 Service Pack 1 (SP1)
• Windows Server 2008 R2 Service Pack 1 (SP1)
• Windows 8
• Windows Server 2012

Registry information:
How to back up and restore the registry in Windows 322756


After you apply this hotfix, follow these steps to enable or disable the function that lets users change the smart card PIN:

1. Start Registry Editor. To do this, press the Windows logo key+R, type regedit, and then click OK.
2. Locate and then click the following registry key:
   HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\
3. On the Edit menu, point to New, and then click Key.
4. Type SmartCardCredentialProvider, and then press Enter.
5. On the Edit menu, point to New, and then click DWORD Value.
6. Perform one of the following actions, based on the kind of smart card on which you want to restrict functionality:
   
   • For VSCs, type AllowVirtualSmartCardPinChangeAndUnlock, and then click Modify.
   • For physical smart cards, type AllowSmartCardPinChangeAndUnlock, and then click Modify.
7. Type 1 in the value data box, and then click OK.
   
   Note If you set either the AllowVirtualSmartCardPinChangeAndUnlock or AllowSmartCardPinChangeAndUnlock value to 1, users can change the format of the PIN. If you set the value to 0, users cannot change the format of the PIN.
8. On the Edit menu, point to New, and then click REG_SZ or REG_EXPAND_SZ Value.
9. Perform one of the following actions, based on the kind of smart card on which you want to restrict functionality:
   
   • For VSCs, type VirtualSmartCardPinChangeAndUnlockString, and then click Modify.
   • For physical smart cards, type SmartCardPinChangeAndUnlockString, and then click Modify.
10. You can use the VirtualSmartCardPinChangeAndUnlockString and SmartCardPinChangeAndUnlockString registry values to display information on the user's computer. Type any information that you want to provide to the user, and then click OK.
11. Exit Registry Editor.

You can set the VirtualSmartCardPinChangeAndUnlockString or SmartCardPinChangeAndUnblockString registry entry value to REG_SZorREG_EXPAND_SZ. If you want the text on the Secure Desktop screen to contain carriage returns, follow these steps to change the binary data of the registry entry:

1. Set the VirtualSmartCardPinChangeAndUnlockString or SmartCardPinChangeAndUnblockString registry entry value to REG_EXPAND_SZ, and then input the text that you want to display to users.
2. Right-click the registry entry that you set in step 1, and then click Modify binary data....
3. Add "0D 00 0A 00" in each location that you want a line break to appear.

Note You can use Group Policy to set the registry entry to REG_EXPAND_SZ for a string that does not contain line breaks in the binary data. However, if you want the string to contain line breaks, edit the string, export the "0D 00 0A 00" values as an .REG file, and then deploy the .REG file. To do this, use Group Policy to run a startup, shutdown, logon, and logoff script.

Review & request hotfix:
http://support.microsoft.com/kb/2808693/en-us

-----------------------------------------------------------------------------------------------------------

-Article ID: 2923388 - Last Review: February 12, 2014 - Revision: 1.0
Plain text displayed when XSLT style sheet used to transform an XML document into HTML in Windows 7 or Windows Server 2008 R2.

Symptoms:

Consider the following scenario:

• You have a computer that runs Windows 7 or Windows Server 2008 R2.
• You use an XSLT style sheet to transform an XML document into HTML.
• Your browser, such as Internet Explorer, uses xmllite.dll to transform XML documents.

In this scenario, the XML document transformation fails intermittently and plain text is displayed within the browser.

Review & request hotfix:
http://support.microsoft.com/kb/2923388/en-us

Here we can find three Hotfixes that all sharing to the same files and same "DTS Time Changeover & Software Products " problems and have to be installed one by one by order given or picked-up to suit the needs of the Operating System. The files will be recorded in the C:\Windows\winsxs and will let appear the last hotfix updates given.

I recon it's a little tricky to have three hotfixes sharing the same files in two days time!!

1) -Article ID: 2800213 - Last Review: February 11, 2014 - Revision: 3.0
High CPU usage during DST changeover in Windows Server 2008, Windows 7, or Windows Server 2008 R2.

Symptoms:
Consider the following scenarios:


Scenario 1

• You have a computer that is running Windows Server 2008, Windows 7, or Windows Server 2008 R2.
• You configure the complementary metal-oxide semiconductor (CMOS) clock according to Coordinated Universal Time (UTC).
• You configure a DWORD type registry key named RealTimeIsUniversal in the following path, and set the value to 1:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation
• The CMOS clock does not match the Windows clock.
• The computer starts the daylight saving time (DST) changeover.

In this scenario, the computer uses 100 percent of CPU resources. The CPU usage remains at 100 percent until both the CMOS clock and the Windows clock pass the DST changeover time.


Scenario 2

• You deploy a Hyper-V virtual machine that is running Windows Server 2008, Windows 7, or Windows Server 2008 R2.
• The clock on the host server that runs the virtual machine is set to the UTC time zone.
• You change the time zone of the Windows clock on the virtual machine to a local time zone.
• After you restart the virtual machine, the Windows clock on the virtual machine does not reflect the local time zone, and is instead set to the UTC time zone.
• You configure a DWORD type registry key named RealTimeIsUniversal in the following path on the virtual machine, and set the value to 1:HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation
• The CMOS clock does not match the Windows clock.
• The virtual machine and the host server start the DST changeover.

In this scenario, the virtual machine uses 100 percent of CPU resources. The CPU usage remains at 100 percent until both the clock on the host computer and the Windows clock on the virtual machine pass the DST changeover time.

Cause:
This issue occurs because the hardware abstraction layer (HAL) uses the CMOS clock time incorrectly, and this causes a conflict. This behavior occurs when the RealTimeIsUniversal registry key is configured.

Review the Resolution:
High CPU usage during DST changeover in Windows Server 2008, Windows 7, or Windows Server 2008 R2


2) -Article ID: 2922223 - Last Review: February 11, 2014 - Revision: 2.0
You cannot change system time if RealTimeIsUniversal registry entry is enabled in Windows.

Symptoms:

Consider the following scenario:

• You have a computer that is running Windows 7 Service Pack 1 (SP1), Windows Server 2008 R2 SP1, or Windows Embedded Standard 7 SP1.
• You configure the complementary metal-oxide semiconductor (CMOS) clock.
• You apply a DWORD type registry key that is named RealTimeIsUniversal in the following path and set the value to 1: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TimeZoneInformation
  
• You try to change the system time through Control Panel in Windows.

In this scenario, the time cannot be changed. Additionally, the time is changed back to the CMOS clock.

Note You can change the CMOS clock through the BIOS.

See section "Applies to" for your proper operating system.

Resolution: The following files are available for download from the Microsoft Download Center:

You cannot change system time if RealTimeIsUniversal registry entry is enabled in Windows


3) -Article ID: 2922790 - Last Review: February 12, 2014 - Revision: 1.0
Some software products function incorrectly in Windows 7 and Windows Server 2008 R2.

Symptoms:
When you have more than seven software products installed that use the PsSetLoadImageNotifyRoutine API in Windows 7 and Windows Server 2008 R2, some products cannot register for notifications and do not function correctly.

Cause:
This issue occurs because the operating system has a limit of 8 registrations. One is used by the operating system, leaving 7 for other software products.

Resolution:
This hotfix increases the limit to 64 registrations.

Workaround:
To work around this issue, you can uninstall some third-party software products.

Review & request hotfix:
http://support.microsoft.com/kb/2922790/en-us

This is another exemple of two Hotfixes sharing same drivers files, posted the same day.
So, according to their descriptions adapt to your needs the one suits you the best as they might superseded by drivers version and date.

1) -Article ID: 2907020 - Last Review: February 12, 2014 - Revision: 1.0
"Location is not available" error when you access a mapped network drive after Windows standby or resume.

Symptoms:
Consider the following scenario:

• You have a Windows 7 or Windows Server 2008 R2 computer that supports the sleep and resume functionality and joined to a domain.
• You access a mapped network drive from Explorer on a Windows 7 or Windows Server 2008 R2 computer.
• You put the computer to sleep and wake the computer again after some time.

In this situation, you cannot access the mapped network drive for a short time. Additionally, you receive the following error message:

Location is not available.

Can't Access x:\

The specified network name is no longer available.

Cause:
This issue occurs because the Server Message Block (SMB) session is deleted on the server-side.

Review & request hotfix:
"Location is not available" error when you access a mapped network drive after Windows standby or resume


2) -Article ID: 2923398 - Last Review: February 12, 2014 - Revision: 1.0
A Remote Desktop session may stop responding when you access a remote shared folder by using SMB version 2.

Symptoms:
Consider the following scenario:

• You have a server that is running Windows Server 2008 R2 Service Pack 1.
• You start a Remote Desktop session from a client computer to the server.
• Then, you access a remote shared folder by using the Server Message Block (SMB) version 2 protocol from the Remote Desktop session.

In this scenario, if the network between the server and the remote share is not stable, the Remote Desktop session may randomly stop responding.

Note This problem may also randomly occur when you access a file share by using SMB version 2 over a high latency network.

Cause:
This problem occurs because the SMB version 2 disconnect is handled incorrectly.

Applies to

• Windows 7 Service Pack 1
• Windows Server 2008 R2 Service Pack 1

Review & request hotfix:
A Remote Desktop session may stop responding when you access a remote shared folder by using SMB version 2

-Article ID: 2921916 - Last Review: February 11, 2014 - Revision: 1.0
The "Untrusted publisher" dialog box appears when you install a driver in Windows 7 or Windows Server 2008 R2.

Symptoms:
Consider the following scenario:

• You have a computer that is running Windows 7 or Windows Server 2008 R2.
• You install a driver that is signed by an SHA256, SHA384, or SHA512 certificate, and the "Untrusted publisher" dialog box appears.
• You click to select the Always trust check box and then click OK.
• You uninstall the driver.
• You install the same driver again.

In this scenario, the "Untrusted publisher" dialog box appears even though you already set the Always trust option to always trust the publisher.

Review & request hotfix:
The "Untrusted publisher" dialog box appears when you install a driver in Windows 7 or Windows Server 2008 R2

---------------------------------------------------------------------------------------------------------------

-Article ID: 2920289 - Last Review: February 12, 2014 - Revision: 2.0
A Stop Error occurs on a computer that has IPSec configured in Windows 7 Service Pack 1 or Windows Server 2008 R2 Service Pack 1.

Symptoms:
You configure Internet Protocol Security (Ipsec) on a computer that is running Windows 7 Service Pack 1 or Windows Server 2008 R2 Service Pack 1. When you start the computer, you experience a Stop error when IpSec rules are applied for the first time.

Cause:
This problem occurs because of a race condition in the TCP/IP driver.

Review & request hotfix:
A Stop Error occurs on a computer that has IPSec configured in Windows 7 Service Pack 1 or Windows Server 2008 R2 Service Pack 1

--------------------------------------------------------------------------------------------------------------

-Article ID: 2924171 - Last Review: February 12, 2014 - Revision: 1.0
Resource Monitor (Perfmon /res) crashes in Windows 7 and in Windows Server 2008 R2.

Symptoms:
If you use Windows Task Manager or the Perfmon /res command to start Resource Monitor on a computer that is running Windows 7 or Windows Server 2008 R2, the Perfmon.exe process crashes. Additionally, you receive an error message that resembles the following:

Code:

Faulting application name: perfmon.exe, version: 6.1.7601.17514, time stamp: 0x4ce7972c
Faulting module name: wdc.dll, version: 6.1.7601.21854, time stamp: 0x4eb38833 
Exception code: 0xc0000005 
Fault offset: 0x0000000000061a1c 
Faulting process id: 0x548 
Faulting application start time: 0x01ceb90f1d977b61 
Faulting application path: C:\Windows\System32\perfmon.exe 
Faulting module path: C:\Windows\System32\wdc.dll 
Report Id: 63bef6f4-2502-11e3-bfa7-d89d671f169f

Cause:
This problem occurs because of a race condition in the WDC.dll module.

Review & request hotfix:
Resource Monitor (Perfmon /res) crashes in Windows 7 and in Windows Server 2008 R2

--------------------------------------------------------------------------------------------------------------

-Article ID: 2922059 - Last Review: February 13, 2014 - Revision: 2.0
A Windows 7-based tablet that uses the Intel Atom processor may stop responding for two minutes

Symptoms:
You have a tablet that uses the fourth-generation Intel Atom processor, that is running Windows 7, and that has an HDMI monitor connected to a dock. If you undock the tablet while it is in the sleep state and then resume the tablet from sleep, the tablet may not respond to Plug & Play or power requests for up to two minutes. For example, there may be a delay before Windows detects USB devices that are plugged in or a delay in putting the tablet back into the sleep state.

Cause:
This problem occurs because of an issue between Windows Power Manager and an audio device.

Review & request hotfix:
A Windows 7-based tablet that uses the Intel Atom processor may stop responding for two minutes

For those that have installed kb2592687: "Description of the Remote Desktop Protocol 8.0 update for Windows 7 SP1 and Windows Server 2008 R2 SP1".

Please, refer to this post: #170


-Article ID: 2908518 - Last Review: February 13, 2014 - Revision: 1.0
Svchost.exe crashes after you install the RDP 8.0 update in Windows 7.


Symptoms:

Issue 1
Assume that you install the Remote Desktop Protocol (RDP) 8.0 update on a computer that is running Windows 7 Service Pack 1 (SP1). You enable the RDP 8.0 Host by using the Local Group Policy Editor. In this situation, the Svchost.exe process crashes intermittently on the computer.

Issue 2
Consider the following scenario:

• You install the RDP 8.0 update on a computer that is running Windows 7 SP1.
• The computer is configured to allow remote desktop connections.
• You run an application that uses Windows Terminal Server virtual channel APIs (such as the WtsVirtualChannelOpen and WtsVirtualChannelClose APIs) to create and use virtual channels in a Remote Desktop Protocol (RDP) session.

In this scenario, RDP static virtual channels do not work. Additionally, virtual channel communication fails in the RDP session if you do not reestablish the connection.

Notes

• This issue does not affect other running RDP sessions.
• This issue can appear in different ways. For example, when you schedule several print jobs in a Remote Desktop Protocol session, the print jobs are deleted.

Issue 3
Consider the following scenario:

• You install the RDP 8.0 update on a computer that is running Windows 7 SP1.
• You run an application that uses Windows Terminal Server virtual channel APIs (such as the WtsVirtualChannelOpen and WtsVirtualChannelClose APIs) to create and use virtual channels in an RDP session.
• The application tries to open a static virtual channel by using a channel name that does not exist.

In this scenario, the operation that opens the static virtual channel stalls for 10 seconds when the system tries to open the nonexistent virtual channel again.

Review & request hotfix:
Svchost.exe crashes after you install the RDP 8.0 update in Windows 7

System Update Readiness Tool for Windows 7 x32bits & x64 bits (KB947821-v32) [February 2014]



Fix Windows Update corruption errors such as 0x80070002 and 0x80070057:
Windows Update corruption errors prevent Windows updates and service packs from installing. For example, an update might not install if a system file is damaged. If the error you see is in the following list, try the solution in this article.

0x80070002 | 0x8007000D | 0x800F081F | 0x80073712 | 0x800736CC | 0x800705B9 | 0x80070246 | 0x8007370D | 0x8007370B | 0x8007370A | 0x80070057 | 0x800B0100 | 0x80092003 | 0x800B0101 | 0x8007371B | 0x80070490

To resolve this problem, use the System Update Readiness tool. Then, install the Windows update or service pack again.
This tool is updated regularly, we recommend that you always download the latest version.

Article ID: 947821 (v32)
Last review: January 13, 2014
Applies to: Windows 8.1, Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows 8, Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows 7 Service Pack 1, Windows Server 2008 R2 Service Pack 1, Windows Vista Service Pack 2, Windows Server 2008 Service Pack 2.

Download the appropriate package for your OS Based System:
Fix Windows Update corruption errors such as 0x80070002 and 0x80070057

-Article ID: 2928800 - Last Review: March 11, 2014 - Revision: 1.0
Incorrect group name is displayed in folder permission list in Windows 7 or Windows Server 2008 R2.

Symptoms:
Assume that you rename a security group or a distribution group, and then grant permissions for the group to a folder by editing the Security tab of the folder properties. You log on a computer that is running Windows 7 Service Pack 1 (SP1) or Windows Server 2008 R2 SP1. In this situation, when you check the system access control list (SACL) in the Security tab of the folder properties, the group is displayed as Group Name (Domain Name\name), which is invalid. We expect that the group is Group Name (Domain Name\sAMAccountName).

Notes

• name is a placeholder for the name attribute in the group properties.
• sAMAccountName is a placeholder for the sAMAccountName attribute in the group properties.

Cause:
This issue occurs because incorrect name attribute is used instead of the sAMAccountName attribute in the SACL group display function.

Review & request hotfix:
Incorrect group name is displayed in folder permission list in Windows 7 or Windows Server 2008 R2

-Article ID: 2928562 - Last Review: March 11, 2014 - Revision: 1.0
Event 55 when you copy an encrypted folder to EFS shared folder in Windows.

Symptoms:
Assume that you enable Encryption File System (EFS) on a shared folder on a computer that is running Windows 8, Windows Server 2012, Windows 7 Service Pack 1 (SP1), or Windows Server 2008 R2 SP1. You copy an encrypted folder to the shared folder. In this situation, the copied folder in the shared folder is corrupted. Additionally, the following event is logged in the System log:
Event Type: Error
Event Source: NTFS
Event ID: 55
Description:
The file system structure on disk is corrupt and unusable. Please run the chkdsk utility on the volume "Drive_letter:"

Note When this issue occurs, you cannot access the shared folder until you run the chkdsk.exe process.

Cause:
This issue occurs because the NTFS.sys file incorrectly encrypts some content.

Review & request hotfix:
Event 55 when you copy an encrypted folder to EFS shared folder in Windows

Note: Might superseded the kb article ID: 2914680
-Article ID: 2914680 - Last Review: January 15, 2014 - Revision: 2.0
I/O delays in Windows 7 SP1 or Windows Server 2008 R2 SP1 => see post #189