September 14, 2021—KB5005618 (Security-only update)
Applies To
Release Date:
14/09/2021
Version:
Security-only update
Summary
Learn more about this security update, including improvements and fixes, any known issues, and how to get the update.Ā
Important:Ā Windows Server 2008 Service Pack 2 (SP2) hasĀ reached the end of mainstream support and areĀ now in extended support.Ā Starting in July 2020, there will no longer be optional, non-security releases (known asĀ "C"Ā releases) for this operating system. Operating systems in extended support haveĀ onlyĀ cumulative monthly security updates (known as the "B" or Update Tuesday release).
Verify thatĀ you have installed the required updates listed in theĀ How to get this updateĀ sectionĀ beforeĀ installing this update.Ā WSUS scan cab files will continue to be available for Windows Server 2008 SP2.Ā If you have a subset of devices running this operating systemĀ without ESU, they might show asĀ non-compliantĀ in your patch management and compliance toolsets.Improvements and fixes
This security update includes quality improvements. Key changes include:
-
AddressesĀ an issue in which a driver might not install if the driver is signed with more than one code sign signatures.
-
This update also contains miscellaneous security improvements to internal OS functionality.
For more information about the resolved security vulnerabilities, please refer to the newĀ Security Update GuideĀ website.
Known issues in this update
Symptom |
Workaround |
After installing this update and restarting your device, you might receive the error, āFailure to configure Windows updates. Reverting Changes. Do not turn off your computerā, and the update might show asĀ FailedĀ inĀ Update History. |
This is expected in the following circumstances:
If you have purchased an ESU key and have encountered this issue, please verify you have applied all prerequisites and that your key is activated. For information on activation, please see thisĀ blogĀ post.Ā For information on the prerequisites, see the "How to get this update" section of this article. |
Certain operations, such asĀ rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, āSTATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)ā. This occurs when you perform the operation on a CSV owner node from a process that doesnāt have administrator privilege. |
Do one of the following:
Microsoft is working on a resolution and will provide an update in an upcoming release. |
After installingĀ this update, devices which attempt to connect to a network printer for the first time might fail to download and install the necessary printer drivers. Devices which had connected to and installed the printer prior to the installation ofĀ this update are unaffected and operations to that printer will succeed as usual. This issue has been observed in devices which access printers via a print server using HTTP connections. When a client connects to the server to install the printer, a directory mismatch occurs, which causes the installer files to generate incorrectly. As a result, the drivers may not download. NoteĀ The printer connection methods described in this issue are not commonly used by devices designed for home use. The printing environments affected by this issue are more commonly found in enterprises and organizations. |
This issue was resolved in KB5006715. |
After installingĀ this update on a print server, printing properties defined on that server might not be correctly provided to clients. Note this issue is specific to print servers and does not impact standard network printing. This issue will not cause printing operations to fail, however, custom settings defined on the server ā for example, duplex print settings ā will not be applied automatically, and clients will print with default settings only. This issue results from an improper building of the data file which contains the printer properties. Clients which receive this data file will not be able to use the file content and will instead proceed with default printing settings. Clients who have previously received the settings package prior to the installation ofĀ this update are unaffected. Servers which use default print settings and have no custom settings to provide to clients are unaffected. NoteĀ The printer connection methods described in this issue are not commonly used by devices designed for home use. The printing environments affected by this issue are more commonly found in enterprises and organizations. |
This issue was resolved in KB5007246. |
After installing this update, you might receive a prompt for administrative credentialsĀ every time you attempt to print in environments in which the print server and print client are in different times zones. Ā Note The affected environments described in this issue are not commonly used by devices designed for home use. The printing environments affected by this issue are more commonly found in enterprises and organizations. |
This issue was resolved in KB5006715. If after installing KB5006715 you still receive the prompt every time you print, see Q1 in the "Frequently ask questions" section of KB5005652āManage new Point and Print default driver installation behavior (CVE-2021-34481). |
How to get this update
Before installing this update
IMPORTANTĀ Customers who have purchased theĀ Extended Security Update (ESU)Ā forĀ on-premises versions of this OSĀ must follow the proceduresĀ inĀ KB4522133Ā to continue receiving security updates after extended support endsĀ onĀ January 14, 2020.
For more information on ESU and which editions are supported, seeĀ KB4497181.
Prerequisite:
You must installĀ the updates listed below andĀ restart your deviceĀ before installing the latest Rollup. Installing these updates improves the reliability of the update process and mitigates potential issues while installing the Rollup and applying Microsoft security fixes.
-
TheĀ April 9, 2019 servicing stack update (SSU) (KB4493730). To get the standalone package for this SSU, search for it in theĀ Microsoft Update Catalog.Ā This update is required to install updates that are only SHA-2 signed.
-
The latest SHA-2 update (KB4474419) released October 8, 2019. If you are using Windows Update, the latest SHA-2 update will be offered to you automatically. This update is required to install updates that are only SHA-2 signed. For more information on SHA-2 updates, seeĀ 2019 SHA-2 Code Signing Support requirement for Windows and WSUS.
-
The Extended Security Updates (ESU) Licensing Preparation Package (KB4538484) or the Update for the Extended Security Updates (ESU) Licensing Preparation Package (KB4575904). The ESU licensing preparation package will be offered to you from WSUS.Ā To get the standalone package for ESU licensing preparation package, search for it in theĀ Microsoft Update Catalog.
After installing the items above, we strongly recommendĀ that you install theĀ latestĀ SSUĀ (KB4580971). If you are using Windows Update, the latest SSUĀ will be offered to you automatically if you are an ESU customer.Ā To get the standalone package for the latestĀ SSU, search for it in theĀ Microsoft Update Catalog.Ā For general information about SSUs,Ā seeĀ Servicing stack updatesĀ andĀ Servicing Stack Updates (SSU): Frequently Asked Questions.
REMINDERĀ If you are using Security-only updates, you will also need to install all previous Security-only updates and the latest cumulative update for Internet Explorer (KB5005563).
Install this update
Release Channel |
Available |
Next Step |
Windows Update and Microsoft Update |
No |
See the other options below. |
Microsoft Update Catalog |
Yes |
To get the standalone package for this update, go to theĀ Microsoft Update CatalogĀ website. |
Windows Server Update Services (WSUS) |
Yes |
This update will automatically syncĀ with WSUS if you configureĀ Products and ClassificationsĀ as follows: Product:Ā Ā Windows Server 2008 Service Pack 2 Classification: Security Updates |
File information
For a list of the files that are provided in this update, download theĀ file information for update 5005618.