list of computers where Programs installed recently

SELECT 
CS.Name0, 
CS.UserName0, 
ISW.ProductName0, 
ISW.VersionMajor0, 
ISW.VersionMinor0, 
ISW.Publisher0, 
ISW.RegisteredUser0, 
ISW.InstallDate0, 
ISW.InstallSource0 
FROM 
dbo.v_GS_COMPUTER_SYSTEM CS, 
dbo.v_GS_INSTALLED_SOFTWARE ISW 
WHERE 
ISW.ResourceID = CS.ResourceID 
ORDER BY 
ISW.InstallDate0 DESC, 
CS.Name0, 
CS.UserName0, 
ISW.ProductName0

Out of band microsoft security update

Microsoft has released an out-of-band security update to address a critical vulnerability in Kerberos.

https://support.microsoft.com/kb/3011780

https://technet.microsoft.com/library/security/ms14-068 The vulnerability could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account.

A List of SCCM Log Files

The client logs are located in the %WINDIR%\System32\CCM\Logs folder or %WINDIR%\SysWOW64\CCM\Logs (for x64 OS).

The SCCM server log files are located in the <INSTALL_PATH>\Logs or SMS_CCM\Logs folder. IIS logs can be found in %WINDIR%\System32\logfiles\W3SVC1 folder.

Client Log Files

• CAS - Content Access Service. Maintains the local package cache.
• Ccmexec.log - Records activities of the client and the SMS Agent Host service.
• CertificateMaintenance.log - Maintains certificates for Active Directory directory service and management points.
• ClientIDManagerStartup.log - Creates and maintains the client GUID.
• ClientLocation.log - Site assignment tasks.
• ContentTransferManager.log - Schedules the Background Intelligent Transfer Service (BITS) or the Server Message Block (SMB) to download or to access SMS packages.
• DataTransferService.log - Records all BITS communication for policy or package access.
• Execmgr.log - Records advertisements that run.
• FileBITS.log - Records all SMB package access tasks.
• Fsinvprovider.log (renamed to FileSystemFile.log in all SMS 2003 Service Packs) - Windows Management Instrumentation (WMI) provider for software inventory and file collection.
• InventoryAgent.log - Creates discovery data records (DDRs) and hardware and software inventory records.
• LocationServices.log - Finds management points and distribution points.
• Mifprovider.log - The WMI provider for .MIF files.
• Mtrmgr.log - Monitors all software metering processes.
• PolicyAgent.log - Requests policies by using the Data Transfer service.
• PolicyAgentProvider.log - Records policy changes.
• PolicyEvaluator.log - Records new policy settings.
• Remctrl.log - Logs when the remote control component (WUSER32) starts.
• Scheduler.log - Records schedule tasks for all client operations.
• Smscliui.log - Records usage of the Systems Management tool in Control Panel.
• StatusAgent.log - Logs status messages that are created by the client components.
• SWMTRReportGen.log - Generates a usage data report that is collected by the metering agent. (This data is logged in Mtrmgr.log.)

Server Log Files

• Ccm.log - Client Configuration Manager tasks.
• Cidm.log - Records changes to the client settings by the Client Install Data Manager (CIDM).
• Colleval.log - Logs when collections are created, changed, and deleted by the Collection Evaluator.
• Compsumm.log - Records Component Status Summarizer tasks.
• Cscnfsvc.log - Records Courier Sender confirmation service tasks.
• Dataldr.log - Processes Management Information Format (MIF) files and hardware inventory in the Configuration Manager 2007 database.
• Ddm.log - Saves DDR information to the Configuration Manager 2007 database by the Discovery Data Manager.
• Despool.log - Records incoming site-to-site communication transfers.
• Distmgr.log - Records package creation, compression, delta replication, and information updates.
• Hman.log - Records site configuration changes, and publishes site information in Active Directory Domain Services.
• Inboxast.log - Records files that are moved from the management point to the corresponding SMS\INBOXES folder.
• Inboxmgr.log - Records file maintenance.
• Invproc.log - Records the processing of delta MIF files for the Dataloader component from client inventory files.
• Mpcontrol.log - Records the registration of the management point with WINS. Records the availability of the management point every 10 minutes.
• Mpfdm.log - Management point component that moves client files to the corresponding SMS\INBOXES folder.
• MPMSI.log - Management point .msi installation log.
• MPSetup.log - Records the management point installation wrapper process.
• Ntsvrdis.log - Configuration Manager 2007 server discovery.
• Offermgr.log - Records advertisement updates.
• Offersum.log - Records summarization of advertisement status messages.
• Policypv.log - Records updates to the client policies to reflect changes to client settings or advertisements.
• Replmgr.log - Records the replication of files between the site server components and the Scheduler component.
• Rsetup.log - Reporting point setup log.
• Sched.log - Records site-to-site job and package replication.
• Sender.log - Records files that are sent to other child and parent sites.
• Sinvproc.log - Records client software inventory data processing to the site database in Microsoft SQL Server.
• Sitecomp.log - Records maintenance of the installed site components.
• Sitectrl.log - Records site setting changes to the Sitectrl.ct0 file.
• Sitestat.log - Records the monitoring process of all site systems.
• Smsdbmon.log - Records database changes.
• Smsexec.log - Records processing of all site server component threads.
• Smsprov.log - Records WMI provider access to the site database.
• SMSReportingInstall.log - Records the Reporting Point installation. This component starts the installation tasks and processes configuration changes.
• SMSSHVSetup.log - Records the success or failure (with failure reason) of installing the System Health Validator point.
• Srvacct.log - Records the maintenance of accounts when the site uses standard security.
• Statmgr.log - Writes all status messages to the database.
• Swmproc.log - Processes metering files and maintains settings.

Admin Console Log Files

• RepairWizard.log - Records errors, warnings, and information about the process of running the Repair Wizard.
• ResourceExplorer.log - Records errors, warnings, and information about running the Resource Explorer.
• SMSAdminUI.log - Records the local Configuration Manager 2007 console tasks when you connect to Configuration Manager 2007 sites.

Management Point Log Files

• MP_Ddr.log - Records the conversion of XML.ddr records from clients, and copies them to the site server.
• MP_GetAuth.log - Records the status of the site management points.
• MP_GetPolicy.log - Records policy information.
• MP_Hinv.log - Converts XML hardware inventory records from clients and copies the files to the site server.
• MP_Location.log - Records location manager tasks.
• MP_Policy.log - Records policy communication.
• MP_Relay.log - Copies files that are collected from the client.
• MP_Retry.log - Records the hardware inventory retry processes.
• MP_Sinv.log - Converts XML hardware inventory records from clients and copies them to the site server.
• MP_Status.log - Converts XML.svf status message files from clients and copies them to the site server.

Mobile Device Management Log Files

• DmClientHealth.log - Records the GUIDs of all the mobile device clients that are communicating with the Device Management Point.
• DmClientRegistration.log - Records registration requests from and responses to the mobile device client in Native mode.
• DmpDatastore.log - Records all the site database connections and queries made by the Device Management Point.
• DmpDiscovery.log - Records all the discovery data from the mobile device clients on the Device Management Point.
• DmpFileCollection.log - Records mobile device file collection data from mobile device clients on the Device Management Point.
• DmpHardware.log - Records hardware inventory data from mobile device clients on the Device Management Point.
• DmpIsapi.log - Records mobile device communication data from device clients on the Device Management Point.
• dmpMSI.log - Records the MSI data for Device Management Point setup.
• DMPSetup.log - Records the mobile device management setup process.
• DmpSoftware.log - Records mobile device software distribution data from mobile device clients on the Device Management Point.
• DmpStatus.log - Records mobile device status messages data from mobile device clients on the Device Management Point.
• FspIsapi.log - Records Fallback Status Point communication data from mobile device clients and client computers on the Fallback Status Point.

Mobile Device Client Log Files

• DmCertEnroll.log - Records certificate enrollment data on mobile device clients.
• DMCertResp.htm (in \temp) - Records HTML response from the certificate server when the mobile device Enroller program requests a client authentication certificate on mobile device clients.
• DmClientSetup.log - Records client setup data on mobile device clients.
• DmClientXfer.log - Records client transfer data for Windows Mobile Device Center and ActiveSync deployments.
• DmCommonInstaller.log - Records client transfer file installation for setting up mobile device client transfer files on client computers.
• DmInstaller.log - Records whether DMInstaller correctly calls DmClientSetup and whether DmClientSetup exits with success or failure on mobile device clients.
• DmInvExtension.log - Records Inventory Extension file installation for setting up Inventory Extension files on client computers.
• DmSvc.log - Records mobile device management service data on mobile device clients.

Operating System Deployment Log Files

• CCMSetup.log - Provides information about client-based operating system actions.
• CreateTSMedia.log - Provides information about task sequence media when it is created. This log is generated on the computer running the Configuration Manager 2007 administrator console.
• DriverCatalog.log - Provides information about device drivers that have been imported into the driver catalog.
• MP_ClientIDManager.log - Provides information about the Configuration Manager 2007 management point when it responds to Configuration Manager 2007 client ID requests from boot media or PXE. This log is generated on the Configuration Manager 2007 management point.
• MP_DriverManager.log - Provides information about the Configuration Manager 2007 management point when it responds to a request from the Auto Apply Driver task sequence action. This log is generated on the Configuration Manager 2007 management point.
• MP_Location.log - Provides information about the Configuration Manager 2007 management point when it responds to request state store or release state store requests from the state migration point. This log is generated on the Configuration Manager 2007 management point.
• Pxecontrol.log - Provides information about the PXE Control Manager.
• PXEMsi.log - Provides information about the PXE service point and is generated when the PXE service point site server has been created.
• PXESetup.log - Provides information about the PXE service point and is generated when the PXE service point site server has been created.
• Setupact.log Setupapi.log Setuperr.log Provide information about Windows Sysprep and setup logs.
• SmpIsapi.log - Provides information about the state migration point Configuration Manager 2007 client request responses.
• Smpmgr.log - Provides information about the results of state migration point health checks and configuration changes.
• SmpMSI.log - Provides information about the state migration point and is generated when the state migration point site server has been created.
• Smsprov.log - Provides information about the SMS provider.
• Smspxe.log - Provides information about the Configuration Manager 2007 PXE service point.
• SMSSMPSetup.log - Provides information about the state migration point and is generated when the state migration point site server has been created.
• Smsts.log - General location for all operating system deployment and task sequence log events.
• TaskSequenceProvider.log - Provides information about task sequences when they are imported, exported, or edited.
• USMT Log loadstate.log - Provides information about the User State Migration Tool (USMT) regarding the restore of user state data.
• USMT Log scanstate.log - Provides information about the USMT regarding the capture of user state data.

Network Access Protection Log Files

• Ccmcca.log - Logs the processing of compliance evaluation based on Configuration Manager NAP policy processing and contains the processing of remediation for each software update required for compliance.
• CIAgent.log - Tracks the process of remediation and compliance. However, the software updates log file, *Updateshandler.log - provides more informative details on installing the software updates required for compliance.
• locationservices.log - Used by other Configuration Manager features (for example, information about the client’s assigned site) but also contains information specific to Network Access Protection when the client is in remediation. It records the names of the required remediation servers (management point, software update point, and distribution points that host content required for compliance), which are also sent in the client statement of health.
• SDMAgent.log - Shared with the Configuration Manager feature desired configuration management and contains the tracking process of remediation and compliance. However, the software updates log file, Updateshandler.log, provides more informative details about installing the software updates required for compliance.
• SMSSha.log - The main log file for the Configuration Manager Network Access Protection client and contains a merged statement of health information from the two Configuration Manager components: location services (LS) and the configuration compliance agent (CCA). This log file also contains information about the interactions between the Configuration Manager System Health Agent and the operating system NAP agent, and also between the Configuration Manager System Health Agent and both the configuration compliance agent and the location services. It provides information about whether the NAP agent successfully initialized, the statement of health data, and the statement of health response.

System Health Validator Point Log Files

• Ccmperf.log -Contains information about the initialization of the System Health Validator point performance counters.
• SmsSHV.log - The main log file for the System Health Validator point; logs the basic operations of the System Health Validator service, such as the initialization progress.
• SmsSHVADCacheClient.log - Contains information about retrieving Configuration Manager health state references from Active Directory Domain Services.
• SmsSHVCacheStore.log - Contains information about the cache store used to hold the Configuration Manager NAP health state references retrieved from Active Directory Domain Services, such as reading from the store and purging entries from the local cache store file. The cache store is not configurable.
• SmsSHVRegistrySettings.log - Records any dynamic changes to the System Health Validator component configuration while the service is running.
• SmsSHVQuarValidator.log - Records client statement of health information and processing operations. To obtain full information, change the registry key LogLevel from 1 to 0 in the following location:HKLM\SOFTWARE\Microsoft\SMSSHV\Logging\@GLOBAL

Desired Configuration Management Log Files

• ciagent.log - Provides information about downloading, storing, and accessing assigned configuration baselines.
• dcmagent.log - Provides high-level information about the evaluation of assigned configuration baselines and desired configuration management processes.
• discovery.log - Provides detailed information about the Service Modeling Language (SML) processes.
• sdmagent.log - Provides information about downloading, storing, and accessing configuration item content.
• sdmdiscagent.log - Provides high-level information about the evaluation process for the objects and settings configured in the referenced configuration items.

Wake On LAN Log Files

• Wolmgr.log - Contains information about wake-up procedures such as when to wake up advertisements or deployments that are configured for Wake On LAN.
• WolCmgr.log - Contains information about which clients need to be sent wake-up packets, the number of wake-up packets sent, and the number of wake-up packets retried.

Software Updates Site Server Log Files

• ciamgr.log - Provides information about the addition, deletion, and modification of software update configuration items.
• distmgr.log - Provides information about the replication of software update deployment packages.
• objreplmgr.log - Provides information about the replication of software updates notification files from a parent to child sites.
• PatchDownloader.log - Provides information about the process for downloading software updates from the update source specified in the software updates metadata to the download destination on the site server.
• replmgr.log - Provides information about the process for replicating files between sites.
• smsdbmon.log - Provides information about when software update configuration items are inserted, updated, or deleted from the site server database and creates notification files for software updates components.
• SUPSetup - Provides information about the software update point installation. When the software update point installation completes, Installation was successful is written to this log file.
• WCM.log - Provides information about the software update point configuration and connecting to the Windows Server Update Services (WSUS) server for subscribed update categories, classifications, and languages.
• WSUSCtrl.log - Provides information about the configuration, database connectivity, and health of the WSUS server for the site.
• wsyncmgr.log -Provides information about the software updates synchronization process.

WSUS Server Log Files

• Change.log - Provides information about the WSUS server database information that has changed.
• SoftwareDistribution.log - Provides information about the software updates that are synchronized from the configured update source to the WSUS server database.

Software Updates Client Computer Log Files

• CAS.log - Provides information about the process of downloading software updates to the local cache and cache management.
• CIAgent.log - Provides information about processing configuration items, including software updates.
• LocationServices.log - Provides information about the location of the WSUS server when a scan is initiated on the client.
• PatchDownloader.log - Provides information about the process for downloading software updates from the update source to the download destination on the site server. This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.
• PolicyAgent.log - Provides information about the process for downloading, compiling, and deleting policies on client computers.
• PolicyEvaluator - Provides information about the process for evaluating policies on client computers, including policies from software updates.
• RebootCoordinator.log - Provides information about the process for coordinating system restarts on client computers after software update installations.
• ScanAgent.log - Provides information about the scan requests for software updates, what tool is requested for the scan, the WSUS location, and so on.
• ScanWrapper - Provides information about the prerequisite checks and the scan process initialization for the Inventory Tool for Microsoft Updates on Systems Management Server (SMS) 2003 clients.
• SdmAgent.log - Provides information about the process for verifying and decompressing packages that contain configuration item information for software updates.
• ServiceWindowManager.log - Provides information about the process for evaluating configured maintenance windows.
• smscliUI.log - Provides information about the Configuration Manager Control Panel user interactions, such as initiating a Software Updates Scan Cycle from the Configuration Manager Properties dialog box, opening the Program Download Monitor, and so on.
• SmsWusHandler - Provides information about the scan process for the Inventory Tool for Microsoft Updates on SMS 2003 client computers.
• StateMessage.log - Provides information about when software updates state messages are created and sent to the management point.
• UpdatesDeployment.log - Provides information about the deployment on the client, including software update activation, evaluation, and enforcement. Verbose logging shows additional information about the interaction with the client user interface.
• UpdatesHandler.log - Provides information about software update compliance scanning and about the download and installation of software updates on the client.
• UpdatesStore.log - Provides information about the compliance status for the software updates that were assessed during the compliance scan cycle.
• WUAHandler.log - Provides information about when the Windows Update Agent on the client searches for software updates.
• WUSSyncXML.log - Provides information about the Inventory Tool for the Microsoft Updates synchronization process. This log is only on the client computer configured as the synchronization host for the Inventory Tool for Microsoft Updates.

Windows Update Agent Log File

• WindowsUpdate.log - Provides information about when the Windows Update Agent connects to the WSUS server and retrieves the software updates for compliance assessment and whether there are updates to the agent components.

Unable to perform any task error: TFTP Download: smsboot\x64\abortpxe.com

Solution:

https://social.technet.microsoft.com/Forums/systemcenter/en-US/4f2b4b85-ecd6-4e00-a445-b59acfcc544a/unable-to-perform-any-task-error-tftp-download-smsbootx64abortpxecom?forum=configmgrosd

I do the following -

1) Go to Unprovisioned computers and clear out the PXE adverts for those systems.
2) Go to All Systems collection and update collection membership. I'll often find an "unknown" or two in there. I delete these, update collection membership again.

90% of the time, I'm able to PXE again. Otherwise, I simply need to wait 5 or 10 minutes and the issue goes away.

Sure wish I knew the exact solution for that issue. From what I understand, there's a Regkey in WDS that can be set to delete the PXE cache, but its not recommended to make that change in Prod.

Software Updates Notification behavior and time restart

Client Settings
Open Client Settings > Computer Agent

See options

Deployment deadline greater than 24 hours – remind user every 48 hours

Deployment deadline less than 24 hours – remind user every 4 hours

Deployment deadline less than 1 hour – remind user every 15 minutes

See restart options

Display temporary notification to the user that indicates the interval before the user is logged off or before the computer restarts – 90 mins

Display a dialog box that the user cannot close which displays the countdown interval before the user is logged off or before the computer restarts – 15 mins

Deployment

I like to choose the option above when deploying the updates - show all notifications to the user and show in software center.

I also like to configure update deployments with a deadline of 1 week away (this is the default setting).

Updates available

When the device retrieves policy the user is notified that updates are available. 

User receives notification. The user is invited to "Click here for options".

If the user "clicks for options" they are informed that updates are available with a deadline of 1 week. They are invited to "Apply all required changes now" or can click to "Remind me later". Most users will choose "Remind me later".

The software update information is available in the Software Center. 


Deadline

When the deadline arrives the updates are downloaded to the computer cache. Note that this does not happen exactly at the deadline time.

It is not a great idea to deploy updates to thousands of machines at exactly the same time. Therefore each client adds a random time of up to two hours to the installation specific deadline time. This random additional time isn't configurable. (Note that Deadline Randomization is now disabled by default in SP1).

Restart

Now the restart countdown commences (90 minutes by default). 

The user is notified.

The required restart can be seen in the Software Center

Click the balloon notification to see the dialog box. The user can Hide the notification at this time. Note that even when the balloon notification disappears the restart timer remains in the system tray. The user can click on the restart timer icon in the system tray at any time to open the dialog box (assuming of course you haven't hidden notifications in the system tray).

User receives additional notification of pending restart, which can be hidden.

Countdown has entered last 15 minutes. The user is notified by a dialog box and the notification cannot be hidden or minimised. It will remain in the foreground until the computer restarts. All other applications remain in the background - no excuses for the user.

[Security Alert] - November 2014 Microsoft Security Bulletin Release

Hi All

The purpose of this alert is to provide you with an overview of the new security bulletin(s) being released on November 11, 2014. New security bulletins are released monthly to address critical product vulnerabilities.

New Security Bulletins

Microsoft is releasing the following fourteen (14) new security bulletins for newly discovered vulnerabilities.

BULLETIN NUMBER	SEVERITY	BULLETIN TITLE & KB Article	AFFECTED SOFTWARE*	IMPACT	RESTART	CVE Vulnerability #
MS14-064	Critical	Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443)	All supported editions of Microsoft Windows.	Remote Code Execution	May require	CVE-2014-6332, CVE-2014-6352
MS14-065	Critical	Cumulative Security Update for Internet Explorer (3003057)	Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 on affected Windows clients and servers.	Remote Code Execution	Requires	CVE-2014-4143, CVE-2014-6337, CVE-2014-6341, CVE-2014-6342, CVE-2014-6343, CVE-2014-6344, CVE-2014-6347, CVE-2014-6348, CVE-2014-6351, CVE-2014-6353, CVE-2014-6349, CVE-2014-6350 CVE-2014-6340, CVE-2014-6345, CVE-2014-6346, CVE-2014-6323 CVE-2014-6339
MS14-066	Critical	Vulnerability in Schannel Could Allow Remote Code Execution (2992611)	All supported releases of Microsoft Windows.	Remote Code Execution	Requires	CVE-2014-6321
MS14-067	Critical	Vulnerability in XML Core Services Could Allow Remote Code Execution (2993958)	All supported releases of Microsoft Windows.	Remote Code Execution	May require	CVE-2014-4118
MS14-069	Important	Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3009710)	Microsoft Word 2007, Microsoft Word Viewer, and Microsoft Office Compatibility Pack.	Remote Code Execution	May require	CVE-2014-6333, CVE-2014-6334, CVE-2014-6335
MS14-070	Important	Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935)	Microsoft Windows Server 2003.	Elevation of Privilege	May require	CVE-2014-4076
MS14-071	Important	Vulnerability in Windows Audio Service Could Allow Elevation of Privilege (3005607)	Microsoft Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1.	Elevation of Privilege	Requires	CVE-2014-6322
MS14-072	Important	Vulnerability in .NET Framework Could Allow Elevation of Privilege (3005210)	Microsoft .NET Framework 1.1 Service Pack 1, .NET Framework 2.0 Service Pack 2, .NET Framework 3.5, .NET Framework 3.5.1, .NET Framework 4, .NET Framework 4.5, .NET Framework 4.5.1, and  .NET Framework 4.5.2 on affected releases of Microsoft Windows.	Elevation of Privilege	May require	CVE-2014-4149
MS14-073	Important	Vulnerability in Microsoft SharePoint Foundation Could Allow Elevation of Privilege (3000431)	Microsoft SharePoint Server 2010.	Elevation of Privilege	May require	CVE-2014-4116
MS14-074	Important	Vulnerability in Remote Desktop Protocol Could Allow Security Feature Bypass (3003743)	Microsoft Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1	Security Feature Bypass	Requires	CVE-2014-6318
MS14-076	Important	Vulnerability in Internet Information Services (IIS) Could Allow Security Feature Bypass (2982998)	Microsoft Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2 RTM.	Security Feature Bypass	May require	CVE-2014-4078
MS14-077	Important	Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3003381)	Active Directory Federation Services 2.0,	Information Disclosure	May require	CVE-2014-6331
MS14-078	Moderate	Vulnerability in IME (Japanese) Could Allow Elevation of Privilege (2992719)	Active Directory Federation Services 2.1, and Active Directory Federation Services 3.0.	Elevation of Privilege	May require	CVE-2014-4077
MS14-079	Moderate	Vulnerability in Kernel-Mode Driver Could Allow Denial of Service (3002885)	Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, and Microsoft Office 2007.	Denial of Service	Requires	CVE-2014-6317

Customers are advised to review the information in these bulletins, test and deploy the updates immediately in their environments, if applicable.

Summaries for new bulletin(s) may be found at https://technet.microsoft.com/library/security/ms14-nov.

Note: In Microsoft’s Advance Notification last week there was mention of plans to release 16 new security bulletins. In the list of 14 bulletins released today, the bulletin numbering skips MS14-068 and MS14-075. The reason for this is that two of the scheduled security bulletins have slipped out of the November bulletin release due to a quality issue found in testing early this week. The bulletins that have slipped out of the November bulletin release are being fixed and will be released once they meet quality standards sufficient for broad public distribution. There is no specific ETA for release of these bulletins at this time.

The Malicious Software Removal Tool and Non-Security Updates

·         Microsoft is releasing an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Server Update Services (WSUS), Windows Update (WU), and the Download Center. Information on the Microsoft Windows Malicious Software Removal Tool is available at http://support.microsoft.com/?kbid=890830.

·         High priority non-security updates Microsoft releases to be available on Microsoft Update (MU), Windows Update (WU), or Windows Server Update Services (WSUS) will be detailed in the KB article found at http://support.microsoft.com/?id=894199.

Re-released Security Advisory

Microsoft rereleased one (1) security advisory on November 11, 2014. Here is an overview:

Security Advisory 2755801	Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
What Has Changed?	Microsoft routinely updates this security advisory to announce the availability of a new update for Adobe Flash Player. On November 11, 2014, Microsoft released an update (3004150) for Internet Explorer 10 on Windows 8, Windows Server 2012, and Windows RT, and for Internet Explorer 11 on Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1. The update addresses the vulnerabilities described in Adobe Security bulletin APSB14-24. For more information about this update, including download links, see Microsoft Knowledge Base Article 3004150.
More Information	https://technet.microsoft.com/library/security/2755801

Out-of-Date ActiveX Control Blocking in Internet Explorer

Starting on November 11, 2014, Microsoft will expand the out-of-date ActiveX control blocking feature to block outdated versions of Silverlight. This update notifies you when a webpage tries to load a Silverlight ActiveX control older than (but not including) Silverlight 5.1.30514.0.

Additional resources

·         Internet Explorer begins blocking out-of-date ActiveX controls

·         Out-of-date ActiveX control blocking

·         Update to block out-of-date ActiveX controls in Internet Explorer

·         List of out-of-date ActiveX Controls blocked by this feature

·         Administrative Templates for Internet Explorer

·         Additional manageability setting for out-of-date ActiveX control blocking in Internet Explorer

New Security Bulletin Technical Details

In the following tables of affected and non-affected software, software editions that are not listed are past their support lifecycle. To determine the support lifecycle for your product and edition, visit the Microsoft Support Lifecycle website at http://support.microsoft.com/lifecycle/.

Bulletin Identifier	Microsoft Security Bulletin MS14-064
Bulletin Title	Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443)
Executive Summary	This security update resolves two privately reported vulnerabilities in Microsoft Windows Object Linking and Embedding (OLE). The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerabilities by modifying how the affected operating systems validate the use of memory when OLE objects are accessed, and by modifying how Internet Explorer handles objects in memory.
Severity Ratings and Affected Software	This security update is rated Critical for all supported editions of Microsoft Windows.
Attack Vectors	CVE-2014-6332: ·         An attacker could host a specially crafted website that is designed to exploit these vulnerabilities through Internet Explorer, and then convince a user to view the website. ·         Websites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit these vulnerabilities. CVE-2014-6352: ·         User interaction is required to exploit this vulnerability. For an attack to be successful by sending an email message to a locally logged-on user, the user must open an attachment that contains a specially crafted OLE object. ·         In an email attack scenario, an attacker could exploit the vulnerability by sending a specially-crafted file to the user and persuading the user to open the file. ·         In a web-based attack scenario, an attacker would have to host a website that contains a PowerPoint file that is used to attempt to exploit this vulnerability. ·         Compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability.
Mitigating Factors	CVE-2014-6332: ·         Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. ·         An attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or instant message that takes users to the attacker's website. CVE-2014-6352: ·         In observed attacks, User Account Control (UAC) displays a consent prompt or an elevation prompt, depending on the privileges of the current user, before a file containing the exploit is executed. UAC is enabled by default on Windows Vista and newer releases of Microsoft Windows. ·         Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. ·         An attacker would have to convince users to visit the website, typically by getting them to click a link in an email message or instant message that takes users to the attacker's website. ·         To help protect your computer, files from potentially unsafe locations are opened in Protected View. By using Protected View, you can read a file and see its contents while reducing the risks. Protected View is enabled by default.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS11-038 and MS14-060.
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-064

Bulletin Identifier	Microsoft Security Bulletin MS14-065
Bulletin Title	Cumulative Security Update for Internet Explorer (3003057)
Executive Summary	This security update resolves seventeen privately reported vulnerabilities in Internet Explorer. The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. The security update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory, by adding additional permission validations to Internet Explorer, and by helping to ensure that affected versions of Internet Explorer properly implement the ASLR security feature.
Severity Ratings and Affected Software	This security update is rated Critical for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 6 (IE 6), Internet Explorer 7 (IE 7), Internet Explorer 8 (IE 8), Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.
Attack Vectors	·         A maliciously crafted website. ·         Compromised websites and websites that accept or host user-provided content or advertisements. Only CVE-2014-6339: ·         An attacker could tie this security feature bypass vulnerability to an additional vulnerability, usually a remote code execution vulnerability. The additional vulnerability would take advantage of the security feature bypass for exploitation. For example, a remote code execution vulnerability that is blocked by ASLR, could be exploited after a successful ASLR bypass.
Mitigating Factors	For CVE-2014-6349 and CVE-2014-6350: ·         These vulnerabilities by themselves do not allow arbitrary code to be run. The vulnerabilities would have to be used in conjunction with another vulnerability that allowed remote code execution. For example, an attacker could exploit another vulnerability to run arbitrary code through Internet Explorer, but due to the context in which processes are launched by Internet Explorer, the code might be restricted to run at a low integrity level (very limited permissions). However, an attacker could, in turn, exploit any of these vulnerabilities to cause the arbitrary code to run at a medium integrity level (permissions of the current user).
Restart Requirement	This update requires a restart.
Bulletins Replaced by This Update	MS14-056
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-065

Bulletin Identifier	Microsoft Security Bulletin MS14-066
Bulletin Title	Vulnerability in Schannel Could Allow Remote Code Execution (2992611)
Executive Summary	This security update resolves a privately reported vulnerability in the Microsoft Secure Channel (Schannel) security package in Windows. The vulnerability could allow remote code execution if an attacker sends specially crafted packets to a Windows server. The security update addresses the vulnerability by correcting how Schannel sanitizes specially crafted packets.
Severity Ratings and Affected Software	This security update is rated Critical for all supported releases of Microsoft Windows.
Attack Vectors	An attacker could attempt to exploit this vulnerability by sending specially crafted packets to a Windows server.
Mitigating Factors	Microsoft has not identified any mitigations for this vulnerability.
Restart Requirement	This update requires a restart.
Bulletins Replaced by This Update	MS10-085, MS12-049, and 2868725 in Microsoft Security Advisory 2868725.
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-066

Bulletin Identifier	Microsoft Security Bulletin MS14-067
Bulletin Title	Vulnerability in XML Core Services Could Allow Remote Code Execution (2993958)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a logged-on user visits a specially crafted website that is designed to invoke Microsoft XML Core Services (MSXML) through Internet Explorer. The security update addresses the vulnerability by modifying the way that Microsoft XML Core Services parses XML content.
Severity Ratings and Affected Software	This security update for Microsoft XML Core Services 3.0 is rated Critical for affected releases of Microsoft Windows clients and Important for affected releases of Microsoft Windows servers.
Attack Vectors	·         Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site. ·         Attacker takes advantage of compromised websites and/or sites hosting ads from other providers. ·         Non-Microsoft web applications and services that utilize the MSXML library for parsing XML could also be vulnerable to this attack.
Mitigating Factors	·         Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an instant message that takes users to the attacker's website or by getting them to open an attachment sent through email. There is no way for an attacker to force the user to view malicious content. ·         Exploitation only gains the same user rights as the logged-on account. ·         By default, all Microsoft email clients open HTML email messages in the Restricted Sites zone. ·         By default, IE runs in Enhanced Security Configuration mode for all Windows Servers.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS14-005 and MS14-033.
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-067

Bulletin Identifier	Microsoft Security Bulletin MS14-069
Bulletin Title	Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3009710)
Executive Summary	This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a specially crafted file is opened in an affected edition of Microsoft Office 2007. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The security update addresses the vulnerabilities by correcting the way that Microsoft Office parses specially crafted files.
Severity Ratings and Affected Software	This security update is rated Important for supported editions of Microsoft Word 2007, Microsoft Word Viewer, and Microsoft Office Compatibility Pack.
Attack Vectors	·         Exploitation of this vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office software. ·         Web scenario: o    Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site. o    Attacker takes advantage of compromised websites and/or sites hosting ads from other providers. ·         Email scenario: o   Attacker sends specially-crafted file and persuades user to open file.
Mitigating Factors	·         Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an instant message that takes users to the attacker's website, or by getting them to open an attachment sent through email. There is no way for attacker to force user to view malicious content. ·         Exploitation only gains the same user rights as the logged-on account. ·         The vulnerability cannot be exploited automatically through email. Instead, the user must open an email attachment.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS14-017 and MS14-061.
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-069

Bulletin Identifier	Microsoft Security Bulletin MS14-070
Bulletin Title	Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935)
Executive Summary	This security update resolves a publically reported vulnerability in TCP/IP that occurs during input/output control (IOCTL) processing. This vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of another process. If this process runs with administrator privileges, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by correcting how the Windows TCP/IP stack handles objects in memory during IOCTL processing.
Severity Ratings and Affected Software	This security update is rated Important for all supported editions of Windows Server 2003.
Attack Vectors	To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take complete control over the affected system.
Mitigating Factors	Microsoft has not identified any mitigating factors for this vulnerability.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS09-048
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-070

Bulletin Identifier	Microsoft Security Bulletin MS14-071
Bulletin Title	Vulnerability in Windows Audio Service Could Allow Elevation of Privilege (3005607)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an application uses the Microsoft Windows Audio service. The security update addresses the vulnerability by adding additional permission validations to the Microsoft Windows Audio service component.
Severity Ratings and Affected Software	This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1.
Attack Vectors	·         Attacker hosts a malicious website utilizing the vulnerability, then convinces users to visit the site. ·         Attacker takes advantage of compromised websites and/or sites hosting ads from other providers.
Mitigating Factors	This vulnerability by itself does not allow arbitrary code to be run. The vulnerability would have to be used in conjunction with another vulnerability that allowed remote code execution. For example, an attacker could exploit another vulnerability to run arbitrary code through Internet Explorer, but due to the context in which processes are launched by Internet Explorer, the code might be restricted to run at a low integrity level (very limited permissions). However, an attacker could, in turn, exploit this vulnerability to cause the arbitrary code to run at a medium integrity level (permissions of the current user).
Restart Requirement	This update requires a restart.
Bulletins Replaced by This Update	None
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-071

Bulletin Identifier	Microsoft Security Bulletin MS14-072
Bulletin Title	Vulnerability in .NET Framework Could Allow Elevation of Privilege (3005210)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft .NET Framework. The vulnerability could allow elevation of privilege if an attacker sends specially crafted data to an affected workstation or server that uses .NET Remoting. The security update addresses the vulnerability by properly enforcing security controls for application memory.
Severity Ratings and Affected Software	This security update is rated Important for Microsoft .NET Framework 1.1 Service Pack 1, .NET Framework 2.0 Service Pack 2, .NET Framework 3.5,  .NET Framework 3.5.1, .NET Framework 4, .NET Framework 4.5, .NET Framework 4.5.1, and .NET Framework 4.5.2 on affected releases of Microsoft Windows.
Attack Vectors	An attacker could send specially crafted data to an affected workstation or server that uses .NET Remoting, allowing the attacker to execute arbitrary code on the targeted system.
Mitigating Factors	·         .NET Remoting is not widely used by applications; only custom applications that have been specifically designed to use .NET Remoting would expose a system to the vulnerability. ·         .NET Remoting endpoints are not accessible to anonymous clients by default.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS14-026
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-072

Bulletin Identifier	Microsoft Security Bulletin MS14-073
Bulletin Title	Vulnerability in Microsoft SharePoint Foundation Could Allow Elevation of Privilege (3000431)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft SharePoint Server. An authenticated attacker who successfully exploited this vulnerability could run arbitrary script in the context of the user on the current SharePoint site. The security update addresses the vulnerability by correcting how SharePoint Server sanitizes modified lists within the SharePoint mobile browser view
Severity Ratings and Affected Software	This security update is rated Important for supported editions of Microsoft SharePoint Server 2010.
Attack Vectors	An attacker could modify certain lists within SharePoint to exploit this vulnerability, and then convince users to browse to the modified list.
Mitigating Factors	Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an instant message that takes users to the attacker's website, or by getting them to open an attachment sent through email. There is no way for attacker to force user to view malicious content.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	MS13-084
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-073

Bulletin Identifier	Microsoft Security Bulletin MS14-074
Bulletin Title	Vulnerability in Remote Desktop Protocol Could Allow Security Feature Bypass (3003743)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass when Remote Desktop Protocol (RDP) fails to properly log audit events. The security update addresses the vulnerability by correcting the way RDP handles authentication and logging.
Severity Ratings and Affected Software	This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1.
Attack Vectors	An attacker could use this vulnerability to evade detection of multiple failed logon attempts.
Mitigating Factors	Microsoft has not identified any mitigating factors for this vulnerability.
Restart Requirement	This update requires a restart.
Bulletins Replaced by This Update	MS10-085, MS14-030, and Microsoft Security Advisory 2871997.
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-074

Bulletin Identifier	Microsoft Security Bulletin MS14-076
Bulletin Title	Vulnerability in Internet Information Services (IIS) Could Allow Security Feature Bypass (2982998)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Internet Information Services (IIS) that could lead to a bypass of the "IP and domain restrictions" security feature. Successful exploitation of this vulnerability could result in clients from restricted or blocked domains having access to restricted web resources. The security update addresses the vulnerability by changing how IIS handles requests when specific IP and domain restriction configurations exist.
Severity Ratings and Affected Software	This security update is rated Important for all supported editions of Microsoft Windows 8, Windows 8.1, Windows Server 2012, and Windows Server 2012 R2 RTM.
Attack Vectors	To exploit this vulnerability, an attacker would require in depth knowledge of the remote IIS server and corresponding network topology. An attacker would also need to have control of their reverse DNS information, or be able to poison the authoritative DNS of the IIS server, in order to provide a domain name that is formatted in a manner that causes the vulnerability.
Mitigating Factors	Microsoft has not identified any mitigating factors for this vulnerability.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	None
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-076

Bulletin Identifier	Microsoft Security Bulletin MS14-077
Bulletin Title	Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3003381)
Executive Summary	This security update resolves a privately reported vulnerability in Active Directory Federation Services (AD FS). The vulnerability could allow information disclosure if a user leaves their browser open after logging off from an application, and an attacker reopens the application in the browser immediately after the user has logged off. The security update addresses the vulnerability by ensuring that the logoff process properly logs off the user.
Severity Ratings and Affected Software	This security update is rated Important for the following: ·         AD FS 2.0 when installed on 32-bit and x64-based editions of Windows Server 2008 ·         AD FS 2.0 when installed on x64-based editions of Windows Server 2008 R2 ·         AD FS 2.1 when installed on x64-based editions of Windows Server 2012 ·         AD FS 3.0 when installed on x64-based editions of Windows Server 2012 R2
Attack Vectors	An attacker who successfully exploited this vulnerability could gain access to a user's information by reopening an application from which the user logged off. Since logoff failed an attacker would not be prompted to enter a username or password.
Mitigating Factors	Microsoft has not identified any mitigating factors for this vulnerability.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	None
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-077

Bulletin Identifier	Microsoft Security Bulletin MS14-078
Bulletin Title	Vulnerability in IME (Japanese) Could Allow Elevation of Privilege (2992719)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Input Method Editor (IME) (Japanese). The vulnerability could allow sandbox escape based on the application sandbox policy on a system where an affected version of the Microsoft IME (Japanese) is installed. An attacker who successfully exploited this vulnerability could escape the sandbox of a vulnerable application and gain access to the affected system with logged-in user rights. If the affected system is logged in with administrative rights, an attacker could then install programs; view, change or delete data; or create new accounts with full administrative rights. The security update addresses the vulnerability by correcting how the Microsoft IME (Japanese) component loads dictionary files that are associated with the vulnerability.
Severity Ratings and Affected Software	This security update is rated Moderate on all supported editions of Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2; it is also rated Moderate for all supported editions of Microsoft Office 2007 where Microsoft IME (Japanese) is installed.
Attack Vectors	In an attack scenario, an attacker would have to convince the user to open a malicious file that would invoke the vulnerable sandboxed application, resulting in a compromise of the sandbox policy. The attacker could then run a program with privileges of the logged on user.
Mitigating Factors	·         An attacker must have authenticated write access to the system to exploit this vulnerability. An anonymous user could not exploit the vulnerability. ·         Only implementations of Microsoft IME for Japanese are affected by this vulnerability. Other versions of Microsoft IME are not affected.
Restart Requirement	This update may require a restart.
Bulletins Replaced by This Update	None
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-078

Bulletin Identifier	Microsoft Security Bulletin MS14-079
Bulletin Title	Vulnerability in Kernel-Mode Driver Could Allow Denial of Service (3002885)
Executive Summary	This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker places a specially crafted TrueType font on a network share and a user subsequently navigates there in Windows Explorer. The security update addresses the vulnerability by ensuring that the Windows kernel-mode driver properly validates array indexes when loading TrueType font files.
Severity Ratings and Affected Software	This security update is rated Moderate for all supported releases of Microsoft Windows.
Attack Vectors	·         An attacker could host a specially crafted TrueType font on a network share and when the user navigates to the share in Windows Explorer, the vulnerability is triggered, causing the system to stop responding. ·         Email scenario o    Attacker sends a specially crafted file via email and convinces user to open the file. ·         Web scenario o    Attacker hosts a malicious website that contains a specially-crafted file, then convinces users to visit the site. o    Attacker takes advantage of compromised websites and/or sites hosting ads from other providers.
Mitigating Factors	Attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an instant message that takes users to the attacker's website, or by getting them to open an attachment sent through email. There is no way for attacker to force user to view malicious content.
Restart Requirement	This update requires a restart.
Bulletins Replaced by This Update	MS14-058
Full Details Top	http://technet.microsoft.com/security/bulletin/MS14-079

Regarding Information Consistency

We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Microsoft’s security content posted to the web is occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in Microsoft’s web-based security content, the information in Microsoft’s web-based security content is authoritative.