KB4474419 SHA-2 Code Signing Support Update for Windows 7 - Aug. 13

[Brink]

SHA-2 code signing support update for Windows Server 2008 R2, Windows 7, and Windows Server 2008: August 13, 2019

Applies to: Windows Server 2008 R2, Windows 7, Windows Server 2008

Notice

• This security update was released March 12, 2019 for Windows 7 SP1 and Windows Server 2008 R2 SP1.
• This security update was updated May 14, 2019 to add support for Windows Server 2008 SP2.
• This security update was updated June 11, 2019 for Windows Server 2008 SP2 to correct an issue with the SHA-2 support for MSI files.
• This security update was updated August 13, 2019 to include the bootmgfw.efi file to avoid startup failures on IA64 versions Windows 7 SP1 and Windows Server 2008 R2 SP1.

Summary

This update introduces SHA-2 code sign support for Windows 7 SP1, Windows Server 2008 R2 SP1, and Windows Server 2008 SP2.

For more information, see the following articles:2019 SHA-2 Code Signing Support requirement for Windows and WSUS

ADV190009

How to get this update

Method 1: Windows Update

This update will be downloaded and installed automatically.

Note This update is also available through Windows Server Update Services (WSUS).

Method 2: Microsoft Update Catalog

To get the standalone package for this update, see the Microsoft Update Catalog website.

More information

Prerequisites

There are no prerequisites for installing this update.

Restart information

You have to restart the computer after you apply this update.

Update replacement information

This update doesn't replace a previously released update.

Improvements

This update also includes the following improvements:

• Further hardening of infrastructure files that are used by the Windows Update and Microsoft Update client.
• A more secure communication channel between the service and the Windows Update and Microsoft Update client has been added.

Source: https://support.microsoft.com/en-us/help/4474419/sha-2-code-signing-support-update


Direct download links for KB4474419 MSU file from Microsoft Update Catalog:

:ar: Download KB4474419 MSU for Windows 7 32-bit (x86) - 34.1 MB

:ar: Download KB4474419 MSU for Windows 7 64-bit (x64) - 52.9 MB

 

[Anak]

Shawn, does this support requirement relate to this article I saw?

Still Using Windows 7? Microsoft's Next Update Is Critical

If you want to continue receiving Windows updates, then the next Windows 7 and Windows Server 2008 update is critical as it adds support for SHA-2 encryption. Without it, future updates can't be downloaded.

Support for Windows 7 is set to end on Jan 14. 2020, but access to Windows updates may end in March if you don't allow your Windows 7 machines to download and install Microsoft's next patch.

Source: PCMag

 

[Brink]

Hello Anak,

Correct, it's related to that article.

 

[file3456]

Can someone post the exact KB for this when it comes out?

 

[Anak]

Hello Anak,

Correct, it's related to that article.

Thanks Shawn,

Your News posting does say it in its own way:

Customers running legacy OS versions (Windows 7 SP1, Windows Server 2008 R2 SP1 and Windows Server 2008 SP2) will be required to have SHA-2 code signing support installed on their devices by July 2019. Any devices without SHA-2 support will not be offered Windows updates after July 2019.

Do you know if 'stand alone updates' are delivered through Windows Updates or will we have to 'go get it' say, in the update catalog?

 

[torchwood]

Hi

According to the MS blog, its due to be released this Tuesday.


Roy

 

[Brds7t7]

Do you know if 'stand alone updates' are delivered through Windows Updates or will we have to 'go get it' say, in the update catalog?

I'm guessing it will be pushed through Windows Update. Usually when MS pushes an update which affects future WU functionality, they get pushed through WU. They did that recently with the v2 Oct 2018 Servicing Stack update which stated if it wasn't installed then future rollups wouldn't install properly. They made it a mandatory update through WU, so I'm guessing this will be the same.

 

[Anak]

Thanks TW and Brds

 

[Brink]

Update:

 

[Anak]

Thanks Shawn,

I see this was started way back in 2015:
Microsoft security advisory: Availability of SHA-2 code signing support for Windows 7 and Windows Server 2008 R2: March 10, 2015

Microsoft Security Advisory 3033929

3033929 has been on my win 7 box since 03 / 10 / 2015. I haven't seen any updates for today on the microsoft update catalog but there are the ones for 3033929.

   Information

My mention of KB3033929 does not mean to imply that what we are all waiting for will have that same number. And, the ones linked to above are not the ones we need, I only linked to them for reference.

 

[erpster4]

It looks like they're out now - KB4474419

 

[Anak]

Thanks erpster4!

I checked before I came on and I haven't seen mine yet.

 

[Brds7t7]

Just appeared in my Windows Update list. Haven't installed it yet, as I like to wait for at least a week before installing any MS updates these days.

 

[Anak]

You have till when? July's patch Tuesday?

 

[Anak]

Mine finally came in, little strange though, I had three showing in installed:


And five in history.


Understandable though as one of the histories were for a scan and the other a definition.

 

[BlueGuy]

Just appeared in my Windows Update list. Haven't installed it yet, as I like to wait for at least a week before installing any MS updates these days.

Let us know how it went, please.

Have I been asleep? What is WSUS 3.0 SP2? and do I need it?

 

[Anak]

So far so good, on my machine, but then I imagine I'll have to wait until Windows Update sends me a new update with sha-2 requirements. Could be any day now.

Do you need WSUS 3.0 SP2? Maybe; If you're running a server or a server in a corporate environment.
Description of Windows Server Update Services 3.0 Service Pack 2 If you do need it there is a D/L link at the link I provided.


Related:
WSUS 3.0 (google search)

 

[redfolder]

do not install!!

With extended support ending at the beginning of 2020 I was already planning on replacing my very stable Windows 7 PC which has served me very well for the last 10 years.

Installed the Windows security monthly roll up with no problems.

However after installing KB4474419 when I hit the desktop the page displayed differently than normal and gave this error

"Failed to connect to a windows server. Windows could not connect to the System Event Notification Service service. This problem prevents standard users from logging on to the system. As an administrative user, you can review the System Event Log for details about why the service didn't respond."

tried switching to a standard user, couldn't log-in

I don't have time for this, so thankfully managed to do a successful system restore.

Now moving forward my plans to buy a new PC before the mid-July 2019 update cut-off.

 

[BlueGuy]

So far so good, on my machine, but then I imagine I'll have to wait until Windows Update sends me a new update with sha-2 requirements. Could be any day now.

Do you need WSUS 3.0 SP2? Maybe; If you're running a server or a server in a corporate environment.
Description of Windows Server Update Services 3.0 Service Pack 2 If you do need it there is a D/L link at the link I provided.


Related:
WSUS 3.0 (google search)

Thanks, looks like I don't need it. Didn't get the memo. :sarc:

 

[Anak]

With extended support ending at the beginning of 2020 I was already planning on replacing my very stable Windows 7 PC which has served me very well for the last 10 years.

Installed the Windows security monthly roll up with no problems.

However after installing KB4474419 when I hit the desktop the page displayed differently than normal and gave this error

"Failed to connect to a windows server. Windows could not connect to the System Event Notification Service service. This problem prevents standard users from logging on to the system. As an administrative user, you can review the System Event Log for details about why the service didn't respond."

tried switching to a standard user, couldn't log-in

I don't have time for this, so thankfully managed to do a successful system restore.

Now moving forward my plans to buy a new PC before the mid-July 2019 update cut-off.

Hi redfolder, welcome to 7F!

Sounds like you have bigger security problems that was hiding in the wings than what this update has caused. You should look into it.

Thanks, looks like I don't need it. Didn't get the memo. :sarc:

You're welcome, Not a problem BlueGuy.