On Wed, 4/16/2025 8:55 AM, CrudeSausage wrote:
At what point do we finally give up?
<https://www.bleepingcomputer.com/news/microsoft/microsoft-warns-of-blue-screen-crashes-caused-by-april-updates/>
Microsoft warned customers this week that their systems might crash with a blue screen error caused by a secure kernel fatal error after installing Windows updates released since March.
According to advisory updates for the KB5055523 April cumulative update and the KB5053656 March preview update, this known issue affects devices running Windows 11, version 24H2. Those affected will see their PCs crash after installing these updates and restarting their devices.
"After installing this update and restarting your device, you might encounter a blue screen exception with error code 0x18B indicating a SECURE_KERNEL_ERROR," Microsoft said.
Until a fix is rolled out through Windows Update, Microsoft resolved this issue via Known Issue Rollback (KIR), a feature that reverses buggy non-security updates delivered via Windows Update.
This fix will propagate automatically to all home, non-managed enterprise devices, and business devices not managed by IT departments over the next 24 hours. To expedite the rollout, Microsoft advises affected users to restart their devices, which ensures the fix is applied faster.
After installation, you can find the Group Policy under Computer Configuration > Administrative Templates. To deploy it on affected endpoints, you must go to the Local Computer Policy or the Domain policy on the domain controller using the Group Policy Editor to choose the Windows version you want to target.
"You will need to install and configure the Group Policy for your version of Windows to resolve this issue. You will also need to restart your device(s) to apply the group policy setting," Microsoft added.
Windows admins can find additional guidance on deploying KIR Group Policies on the Microsoft support website.
Earlier this week, Microsoft released emergency Windows updates to address an issue affecting local audit logon policies in Active Directory Group Policy and warned admins that Windows Server 2025 domain controllers might become inaccessible after restarts, causing services and apps to fail.
Today, Redmond also started deploying a fix for an issue causing some Windows devices to be offered Windows 11 upgrades despite Intune policies blocking them.
This article was written by an AI.
It's hard to know what it used as a trigger event, to make all this text up.
https://windowsforum.com/threads/windows-11-24h2-update-failures-how-microsoft-addresses-the-blue-screen-secure_kernel_error-crisi.361032/?amp=1 "miscellaneous security improvements to internal OS functionality" <== is it snowing in here or what ?
This is what I got on one search string.
And telling an Enterprise IT to enable the KIR policy, why would they
do that ? The Enterprise person would just reimage the machine and
tip it upright that way. Done and done. Enterprise IT have been
to the rodeo, they know what to do. They would hold back updates.
The employee would go back to work.
*******
There is a report of one here, from June 29, 2024 , and against Win11.
This is a driver issue, that seems to have triggered a similar response.
That might even mean it's against an earlier version of W11.
https://answers.microsoft.com/en-us/windows/forum/all/windows-11-blue-screen-securekernelerror-18b/3d8b10ac-b749-4af4-991b-d75894287547 nt!HvlSkCrashdumpCallbackRoutine and nt!KiProcessNMI.
And that seems to be related to Hypervisor. Windows runs on top of
the inverted hypervisor, but it's hard to say what kernel this is.
It could be the sandbox kernel for example.
Unless we have diagrams of the expanded virtualization ecosystem on
this puppy, we'll never make any progress interpreting these
bullshit articles with sprinkles on top. What good is telling
customers you have a problem you don't want to tell them about ?
The root cause might be traceable to some CVE, but the articles
have no information at all to go on.
I bet the crashes all have certain features that are common. Yet
the information about the crashes does not hint about what that
would be. In the second link, where an fiio driver causes a problem
at kernel level, multiple people reported the problem and could
correlate the problems showed up when they got their USB DAC.
That's the normal activity that goes with problem reports.
If "thousands of yokels" have been tipped over, where are
the hits in Google ? Would they, perhaps, all be Enterprise
customers and suffering from a code of silence (the blanket NDA thing) ?
Sorry, article made up, no signal in evidence.
And this is not the first issue that's been like this.
While the Google search AI is responsible for gating off most
of the signal, some issues are so silent, it's like they
don't even exist. All I can get from Borncity is regurgitated
press release. That's not like Born. There was a time, enthusiast
sites provided color commentary. If they can't find a signal
either, what the hell is going on ??? IDK.
"There's a fire!!! But, there's no smoke and no heat. Um, that is all."
Paul
Re: Microsoft warns of blue screen crashes caused by April updates