Monday, September 1, 2014

Alert - Microsoft Security Bulletin MS14-045 (KMD) Revised to Address a Known Issue

What is the purpose of this alert?

On August 27, 2014, Microsoft revised security bulletin MS14-045 - Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege - to address known issues associated with installation of security update 2982791.

Summary

To address known issues with security update 2982791, Microsoft rereleased MS14-045  to replace the 2982791 update with the 2993651 update for all supported releases of Microsoft Windows. Microsoft expired the original update 2982791 on August 15, 2014.

All customers should apply the 2993651 update, which replaces the expired 2982791 update.

For more information about the known issues with the original 2982791 update, see the Known Issues section of Microsoft Knowledge Base Article 2982791.

Answers to Frequently Asked QUestions

Q: I already successfully installed the original 2982791 security update and am not experiencing any difficulties. Should I apply the replacement update 2993651, released on August 27, 2014?

A: Yes. All customers should apply the 2993651 update, which replaces the expired 2982791 update.

Q: Is it necessary to uninstall the expired 2982791 update before applying the replacement 2993651 update?

A: Technically, it is not necessary to uninstall the expired 2982791 update before applying the replacement 2993651 update; however, Microsoft strongly recommends it. Customers who do not remove the expired 2982791 update at some point will retain a listing for 2982791 under installed updates in Control Panel.

Q: I uninstalled the original 2982791 security update. Should I apply the replacement update 2993651, released on August 27, 2014?

A: Yes. To be protected from CVE-2014-0318 and CVE-2014-1819, all customers should apply the rereleased update (2993651), which replaces the expired 2982791 update.

Q: What if I experienced difficulties restarting my system after installing the original security update 2982791?

A: Customers who experienced difficulties restarting their systems after installing the original security update 2982791 should no longer experience this problem after installing the replacement update 2993651.

ADditional information

Ø  Microsoft Security Bulletin MS14-045 - Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation of Privilege - https://technet.microsoft.com/library/security/ms14-045

Ø  Microsoft KB Article 2993651 - MS14-045: Description of the security update for kernel-mode drivers: August 27, 2014 - http://support.microsoft.com/kb/2993651  

Ø  Microsoft KB Article 2982791 - MS14-045: Description of the security update for kernel-mode drivers: August 12, 2014 - http://support.microsoft.com/kb/2982791   

Regarding Information Consistency

We strive to provide you with accurate information in static (this mail) and dynamic (web-based) content. Microsoft’s security content posted to the web is occasionally updated to reflect late-breaking information. If this results in an inconsistency between the information here and the information in Microsoft’s web-based security content, the information in Microsoft’s web-based security content is authoritative.

If you have any questions regarding this alert please contact your Technical Account Manager.


Thank you,

Wednesday, August 20, 2014

ALERT ALTER ALERT: Urgent communication to customers

Hi,

I would like to alert you about a set of patches that were released on Aug 12th that can potentially cause Blue Screens (crashes, bug checks) on customers’ Windows machines from Vista all the way up to 8.1. Microsoft is currently investigating these patches and more details will be shared as they become available.

These patches are being Automatically installed on customers’ machine via the Windows Update feature and/or they are being rolled up and packaged via the System Center updates in the Enterprises automatically. We need to immediately alert ALL our customer to make sure that these 4 patches are NOT installed on their machines until further notice.

For more details:
MS14-045: Description of the security update for kernel-mode drivers: August 12, 2014
Mitigations
Open the Programs and Features item in Control Panel, and then click View installed updates. Find and then uninstall any of the following updates that are currently installed:
◦KB2982791
◦KB2970228
◦KB2975719
◦KB2975331

If you search the update via article ID only on “Installed Updates” UI, you won’t see the updates listed. You need to search as “KB2982791”.  I have this update and KB2975719 installed on machines..



Based on the queries I’m getting I’ve consolidated these FAQ for all:

When this update was released? August 12
How many incident did we receive? I know about 10 cases on the first 3 days, and we had our first one in MEA today.
Can customers still download these updates? No, PG expired these updates on Aug 15th
What about customer who downloaded and installed these updates already? Not all machines hit the issue, we advise customers to uninstall these updates as a pre-caution.
What are the symptoms on the affected machine? Blue screen bug check 0x50
What is the solution if the machine crashed from this update? Solution documented on the same article http://support.microsoft.com/kb/2982791 under “known issue 3”
Is it ok not to uninstall the update? We recommend to uninstall these update as a pre-caution only, PG are still investigating the behavior.


SQL report will show Name Serial Number Manufacturer Model OS Type OS Version TopConsoleUser0 Last Logged BIOS Date IP Address Default IP Gateway Chassis Type

For Server :
SQL :

SELECT   
 dbo.v_GS_COMPUTER_SYSTEM.Name0 AS [NetBIOS Name], 
 --dbo.v_GS_COMPUTER_SYSTEM.Roles0 AS [Roles],
 dbo.v_GS_OPERATING_SYSTEM.Description0 AS [Description], 
 dbo.v_GS_COMPUTER_SYSTEM.Manufacturer0 AS [Make],
 dbo.v_GS_COMPUTER_SYSTEM.Model0 AS [Model], 
 dbo.v_RA_System_IPAddresses.IP_Addresses0 AS [IP Address], 
 dbo.v_GS_SYSTEM_ENCLOSURE.SerialNumber0 AS [Service Tag (Dell)]
 
FROM         dbo.v_GS_COMPUTER_SYSTEM
  
 INNER JOIN  
  dbo.v_GS_PC_BIOS 
  ON 
  dbo.v_GS_COMPUTER_SYSTEM.ResourceID = dbo.v_GS_PC_BIOS.ResourceID 
 INNER JOIN 
  dbo.v_RA_System_IPAddresses 
  ON
  dbo.v_GS_PC_BIOS.ResourceID = dbo.v_RA_System_IPAddresses.ResourceID 
 INNER JOIN
  dbo.v_GS_SYSTEM_ENCLOSURE 
  ON
  dbo.v_RA_System_IPAddresses.ResourceID = dbo.v_GS_SYSTEM_ENCLOSURE.ResourceID 
 INNER JOIN
  dbo.v_GS_OPERATING_SYSTEM 
  ON
  dbo.v_GS_SYSTEM_ENCLOSURE.ResourceID = dbo.v_GS_OPERATING_SYSTEM.ResourceID 
 WHERE    
  (dbo.v_RA_System_IPAddresses.IP_Addresses0 LIKE '10.%')
  AND
  (Roles0 like '%Server_NT%')
ORDER BY
  [NetBIOS Name]

SQL report will show Name Serial Number Manufacturer Model OS Type OS Version TopConsoleUser0 Last Logged BIOS Date IP Address Default IP Gateway Chassis Type


For client

SQL:
SELECT DISTINCT 
v_GS_COMPUTER_SYSTEM.Name0, v_GS_PC_BIOS.SerialNumber0, v_GS_COMPUTER_SYSTEM.Manufacturer0, v_GS_COMPUTER_SYSTEM.Model0, 
 v_GS_OPERATING_SYSTEM.Caption0 AS [OS Type], v_GS_OPERATING_SYSTEM.CSDVersion0 AS [OS Version], v_GS_SYSTEM_CONSOLE_USAGE_MAXGROUP.TopConsoleUser0, 
 v_R_System.User_Name0 AS [Last Logged], 
 v_GS_PC_BIOS.ReleaseDate0 AS [BIOS Date], v_GS_NETWORK_ADAPTER_CONFIGUR.IPAddress0, v_GS_NETWORK_ADAPTER_CONFIGUR.DefaultIPGateway0, CASE WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '1' THEN 'Virtual' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '2' THEN 'Blade Server' WHEN 
v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '3' THEN 'Desktop' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '4' THEN 'Low-Profile Desktop' WHEN 
v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '5' THEN 'Pizza-Box' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '6' THEN 'Mini Tower' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 
LIKE '7' THEN 'Tower' WHEN v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 LIKE '8' THEN 'Portable' WHEN v_GS_SYSTEM_ENCLOSURE.ChassisTypes0 LIKE '9' THEN 
'Laptop' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '10' THEN 'Notebook' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '11' THEN 'Hand-Held' 
WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '12' THEN 'Mobile Device in Docking Station' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '13' 
THEN 'All-in-One' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '14' THEN 'Sub-Notebook' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '15' THEN 
'Space Saving Chassis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '16' THEN 'Ultra Small Form Factor' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 
LIKE '17' THEN 'Server Tower ChASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '18' THEN 'Mobile Device in Docking Station' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 
LIKE '19' THEN 'Sub-ChASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '20' THEN 'Bus-Expansion chASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 
LIKE '21' THEN 'Peripheral ChASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '22' THEN 'Storage ChASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 
LIKE '23' THEN 'Rack-Mounted ChASsis' WHEN v_GS_SYSTEM_ENCLOSURE.ChASsisTypes0 LIKE '24' THEN 'Sealed-Case PC' ELSE 'Unknown' END AS 'Chassis Type' 

FROM         v_GS_PC_BIOS INNER JOIN 
                      v_GS_COMPUTER_SYSTEM ON v_GS_PC_BIOS.ResourceID = v_GS_COMPUTER_SYSTEM.ResourceID INNER JOIN 
                      v_GS_NETWORK_ADAPTER_CONFIGUR ON v_GS_COMPUTER_SYSTEM.ResourceID = v_GS_NETWORK_ADAPTER_CONFIGUR.ResourceID INNER JOIN 
                      v_GS_OPERATING_SYSTEM ON v_GS_COMPUTER_SYSTEM.ResourceID = v_GS_OPERATING_SYSTEM.ResourceID INNER JOIN 
                      v_R_System ON v_GS_COMPUTER_SYSTEM.ResourceID = v_R_System.ResourceID LEFT OUTER JOIN 
                      v_GS_SYSTEM_CONSOLE_USAGE_MAXGROUP ON v_GS_COMPUTER_SYSTEM.ResourceID = v_GS_SYSTEM_CONSOLE_USAGE_MAXGROUP.ResourceID INNER JOIN 
v_GS_SYSTEM_ENCLOSURE ON v_R_System.ResourceID = v_GS_SYSTEM_ENCLOSURE.ResourceID 
WHERE     (v_GS_NETWORK_ADAPTER_CONFIGUR.IPEnabled0 = 1) AND (NOT (v_GS_NETWORK_ADAPTER_CONFIGUR.DefaultIPGateway0 IS NULL)) AND 
                      (v_R_System.Operating_System_Name_and0 LIKE '%Workstation%') 
ORDER BY v_GS_PC_BIOS.ReleaseDate0






Thursday, June 5, 2014

Face Book Page

https://www.facebook.com/pages/System-Center-2012/233309080195571?ref=bookmarks

How to deploy software prerequisites with SCCM 2012

In business, some professional software need prerequisite software, most of the time, it is necessary to have the prerequisites installed in a first time for the software to be usable.
With SCCM 2012, this task is very easy (there since SMS 2003)…:-)
It simply allows us to link two packages, one for prerequisite and another for professional software.
I will explain very simply and effectively how to perform this operation.
Most of the time, the software used need meadows required software Java, Flash and other types, I’ll use two software in my example:
Java Version 7 Update 45
Firefox Version 26
Let’s GO !!!
1-It’s necessary  to have 2 package created previously (Firefox and Java in my example)
2-Select Install Package tab and click on Properties
3-Select Advanced Tab and click on Run another program first and select program
4-Select Always run this program first
Now, when you deploy Firefox , java The prerequisites must be installed before Firefox !
If the prerequisite java having problems installing the Firefox installation will be interrupted due to failure of the previous installation.
This allows to be on the smooth installation of software and its prerequisites!
5-Java and Firefox Installation Done !
6-Verify Java in firefox browser OK !
Deployment finish with success !!!