Solved KB4480970 breaking Local Network access?

[ShadowMario3]

I have a Windows 7 laptop that is shared on my local network (Workgroup) that is easily accessed through any computer in the house (most of them being Windows 10 or through Android) through the regular network file sharing and Remote Desktop. For Remote Desktop, I made sure to click the setting: "Allows connections only from computers running Remote Desktop with Network Level Authentication (more secure)".


However, yesterday, upon installing KB4480970, none of the computers can access the Windows 7 computer through the regular network file sharing or Remote Desktop. For Network sharing, the error on Windows 10 computers is "The handle is invalid", and for Remote Desktop, it said "The local security authority cannot be contacted. This might be due to an expired password." with an error code of 0x207 (for Android Remote Desktop). Even when I changed the password, or reinstalled the Ethernet driver, the same errors occurred, but upon uninstalling KB4480970, things went back to normal. Anyone know what this update changes to make it so local network connections to a Windows 7 computer no longer works?

 

[ShadowMario3]

Looks like it's a known issue:


Patch Tuesday updates for Win7, KB 4480970 and KB 4480960 knock out networking | Computerworld


Hopefully Microsoft will be able to fix it soon.

 

[HRM]

This happened to me also...Unknown handle error etc. Luckily there was one reference to the issue I found and uninstalling KB4480970 solved it for me.
only one of three machines auto updates so I knew were the problem must be.

 

[yabuddypj]

#metoo #toosoon?

I can confirm I noticed the RDP portion of the issue today when connecting to a clean 2008R2 SP1 server via RDP. The exact same error message. I tested from multiple different RDP clients (other 2008 servers and multiple patched windows 10 clients) and got the same error.

Disabling NLA authentication also makes the issue go away.

Perhaps that's the underlying mechanism at fault for all of this?

I'll uninstall the patch if need be. Having NLA broken really defeats its purpose and I don't want to leave it disabled.

PJ

 

[HRM]

for me it was a win 7 machine I keep in the basement for security cameras and file sharing. No secpol installed so uninstall was easiest. I may install it and go that route, but I am just very happy to have figured it out in only a couple hours.

 

[NetworkMonkey]

Yup, this worked for me!

We had a client who was accessing software through a shared drive who could no longer do so after tuesdays updates.
Removing the KB4480970 update made everything work again, thanks!

 

[Paul Black]

Hi NetworkMonkey,

Welcome to SevenForums!

Removing the KB4480970 update made everything work again.

Out of interest, did you uninstall the KB4480970 update the conventional way, through Uninstall a program, or did you use wusa run from an elevated command prompt?

 

[NetworkMonkey]

Hi NetworkMonkey,

Welcome to SevenForums!



Out of interest, did you uninstall the KB4480970 update the conventional way, through Uninstall a program, or did you use wusa run from an elevated command prompt?

I uninstalled it through the programs/ features > view installed updates. Did a restart once it was finished and bam- everything was back to normal

 

[Paul Black]

Hi NetworkMonkey,

I uninstalled it through the programs/ features > view installed updates. Did a restart once it was finished and bam- everything was back to normal.

Thanks for sharing the solution, it will help other people visiting this thread that have the same problem/question.

 

[jvunguyen]

Root Cause and Solution for the error

Access Denied

Cause:
Microsoft Hotfix KB4480970 is the problem.

Solutions:
I did validate myself these solutions when I had the problem this morning. And they worked. I like to share with you.

1. Create another user and give the access/permission to the share. I can access the share no problem without that error.

2. On the Win 7 share workstation, start Command Prompt window (elevated to Administrator right), enter this command
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Reboot the machine and you can continue to use the user who belongs to Administrator group as before. I like to use this solution so I can use my favorite ID as before

3. Uninstall the hotfixes and patches. I do not recommend this.

 

[Gadgets]

So what if the user that you use to access the share is not an administrator, since this is a huge security risk.

For example, HostComputer has a user called Admin, which is an administrator and a user called Share, which is a standard user. Only the "Share" user has permissions to access the share. Does this fix still work?

 

[ShadowMario3]

Solutions:

2. On the Win 7 share workstation, start Command Prompt window (elevated to Administrator right), enter this command
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\system /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Someone said this in response to that fix:



"Careful with this, it stops UAC from stripping admin groups from your token when connecting to remote shares and is a potential security issue."

If that is true, I would not recommend this as a fix. Might be best to just wait for Microsoft to release another patch fixing this issue.

 

[ShadowMario3]

Looks like there was an update released on Friday that fixes this issue:


Access Denied


Resinstalled KB4480970, then install this update afterward, and things are back to normal.

 

[Paul Black]

Hi ShadowMario3,

Looks like there was an update released on Friday that fixes this issue:

Access Denied

Resinstalled KB4480970, then install this update afterward, and things are back to normal.

Don't quite follow you!

Do you mean you download and re-installed the KB4480970 .msu file?

 

[ShadowMario3]

Hi ShadowMario3,



Don't quite follow you!

Do you mean you download and re-installed the KB4480970 .msu file?

No, I reinstalled KB4480970 through Windows Update. The link I posted takes you to KB4487345, which is the actual fix. To download KB4487345, go here to the Microsoft Update Catalog:


Microsoft Update Catalog

 

[Paul Black]

Hi ShadowMario3,

No, I reinstalled KB4480970 through Windows Update. The link I posted takes you to KB4487345, which is the actual fix. To download KB4487345, go here to the Microsoft Update Catalog:

Microsoft Update Catalog

Thanks for clarifying that.

 

[HRM]

Thank you, that worked for me, back up to date.