MS15-097: Description of the security update for the graphics component in Windows: September 8, 2015

Important This article contains information that shows how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, you should take any appropriate additional steps to help protect the computer.

Summary

In addition to the changes that are listed for the vulnerabilities that are described in Microsoft Security Bulletin MS15-097, this security bulletin addresses a defense-in-depth update for the secdrv.sys driver, a third-party driver. The update turns off the service for the secdrv.sys driver. This may affect the ability to run some older games.

To learn more about the vulnerabilities, see Microsoft Security Bulletin MS15-097.

More Information

Important

All future security and nonsecurity updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows RT 8.1-based, Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.

Known issues in this security update

After you install this security update, some programs may not run. (For example, some video games may not run.) To work around this issue, you can temporarily turn on the service for the secdrv.sys driver by running certain commands, or by editing the registry.

Note When you no longer require the service to be running, we recommend that you turn off the service again.

Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.

To do this, type the following commands at an elevated command prompt. You should press Enter after you type each command.
- To disable the driver's service, type the following command:
```
sc config secdrv start= disabled 
```
- To set the driver's service to manual, type the following command:
```
sc config secdrv start= demand 
```
- To enable the driver's service (and to set it to automatic), type the following command:
```
sc config secdrv start=auto 
```
- To manually start the driver's service, type the following command:
```
sc start secdrv 
```
- To manually stop the driver's service, type the following command:
```
sc stop secdrv 
```

ImportantThis section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

322756 How to back up and restore the registry in Windows

Or, you can edit the registry directly. To do this, follow these steps:

Click Start, click Run, type regedit in the Open box, and then click OK.
Locate and then click the following subkey in the registry:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\secdrv
Right-click Start, and then click Modify.
In the Value data box, do one of the following:
- Type 4 to disable the driver's service, and then click OK.
- Type 3 to set the driver's service to manual, and then click OK.
- Type 2 to set the driver's service to automatic, and then click OK.
Exit Registry Editor.

How to obtain and install the update

Method 1: Windows Update

This update is available through Windows Update. When you turn on automatic updating, this update will be downloaded and installed automatically. For more information about how to turn on automatic updating, see
Get security updates automatically.

Note For Windows RT and Windows RT 8.1, this update is available through Windows Update only.

Method 2: Microsoft Download Center

You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.

Click the download link in the following table that corresponds to the version of Windows that you are running. Find out if your computer is running the 32 or 64-bit version of Windows

Windows version	Download link
Windows Vista SP2	Download 32-bit (KB3086255) Download 64-bit (KB3086255)
Windows Server 2008 SP2	Download 32-bit (KB3086255) Download 64-bit (KB3086255)
Windows 7 SP1	Download 32-bit (KB3086255) Download 64-bit (KB3086255)
Windows Server 2008 R2 SP1	Download 64-bit (KB3086255)
Windows 8	Download 32-bit (KB3086255) Download 64-bit (KB3086255)
Windows Server 2012	Download 64-bit (KB3086255)
Windows 8.1	Download 32-bit (KB3086255) Download 64-bit (KB3086255)
Windows Server 2012 R2	Download 64-bit (KB3045685)

More Information

File information

The English United States) version of this software update installs files that have the attributes that are listed in the following tables. The dates and times for these files are listed in Coordinated Universal Time UTC). The dates and times for these files on your local computer are displayed in your local time and with your current daylight saving time DST) bias. Additionally, the dates and times may change when you perform certain operations on the files.

Windows Vista and Windows Server 2008 file information

The files that apply to a specific product, milestone SPn), and service branch LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version Product Milestone Service branch
6.0.6002.19xxx Windows Vista SP2 and Windows Server 2008 SP2 SP2 GDR
6.0.6002.23xxx Windows Vista SP2 and Windows Server 2008 SP2 SP2 LDR
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Version	Product	Milestone	Service branch
6.0.6002.19xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	GDR
6.0.6002.23xxx	Windows Vista SP2 and Windows Server 2008 SP2	SP2	LDR

Note The MANIFEST files .manifest) and MUM files .mum) that are installed are not listed.

For all supported x86-based versions of Windows Vista and Windows Server 2008

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	20,480	24-Aug-2015	13:59	x86
Secdrv.sys	4.3.86.0	20,480	24-Aug-2015	14:00	x86

For all supported x64-based versions of Windows Vista and Windows Server 2008

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	23,040	07-May-2014	23:47	x64
Secdrv.sys	4.3.86.0	23,040	07-May-2014	23:51	x64

Windows 7 and Windows Server 2008 R2 file information

The files that apply to a specific product, milestone RTM, SPn), and service branch LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version Product Milestone Service branch
6.1.7601.18xxx Windows 7 and Windows Server 2008 R2 SP1 GDR
6.1.7601.22xxx Windows 7 and Windows Server 2008 R2 SP1 LDR
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Version	Product	Milestone	Service branch
6.1.7601.18xxx	Windows 7 and Windows Server 2008 R2	SP1	GDR
6.1.7601.22xxx	Windows 7 and Windows Server 2008 R2	SP1	LDR

Note The MANIFEST files .manifest) and MUM files .mum) that are installed are not listed.

For all supported x86-based versions of Windows 7

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	20,480	24-Aug-2015	15:02	x86
Secdrv.sys	4.3.86.0	20,480	24-Aug-2015	15:03	x86

For all supported x64-based versions of Windows 7 and Windows Server 2008 R2

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	23,040	03-Jun-2015	20:16	x64
Secdrv.sys	4.3.86.0	23,040	03-Jun-2015	20:16	x64

Windows 8 and Windows Server 2012 file information

The files that apply to a specific product, milestone RTM,SPn), and service branch LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version Product Milestone Service branch
6.2.920 0.16 xxx Windows 8 and Windows Server 2012 RTM GDR
6.2.920 0.20 xxx Windows 8 and Windows Server 2012 RTM LDR
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Version	Product	Milestone	Service branch
6.2.920 0.16 xxx	Windows 8 and Windows Server 2012	RTM	GDR
6.2.920 0.20 xxx	Windows 8 and Windows Server 2012	RTM	LDR

Note The MANIFEST files .manifest) and MUM files .mum) that are installed are not listed.

For all supported x86-based versions of Windows 8

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	20,480	02-Jun-2012	14:32	x86
Secdrv.sys	4.3.86.0	20,480	02-Jun-2012	14:32	x86

For all supported x64-based versions of Windows 8 and Windows Server 2012

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	23,040	02-Jun-2012	14:32	x64
Secdrv.sys	4.3.86.0	23,040	02-Jun-2012	14:32	x64

Windows 8.1 and Windows Server 2012 R2 file information

The files that apply to a specific product, milestone RTM,SPn), and service branch LDR, GDR) can be identified by examining the file version numbers as shown in the following table:
Version Product Milestone Service branch
6.3.920 0.16 xxx Windows 8.1 and Windows Server 2012 R2 RTM GDR
GDR service branches contain only those fixes that are widely released to address widespread, critical issues. LDR service branches contain hotfixes in addition to widely released fixes.

Version	Product	Milestone	Service branch
6.3.920 0.16 xxx	Windows 8.1 and Windows Server 2012 R2	RTM	GDR

Note The MANIFEST files .manifest) and MUM files .mum) that are installed are not listed.

For all supported x86-based versions of Windows 8.1

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	20,480	18-Jun-2013	12:25	x86

For all supported x64-based versions of Windows 8.1 and Windows Server 2012 R2

File name	File version	File size	Date	Time	Platform
Secdrv.sys	4.3.86.0	23,040	18-Jun-2013	14:48	x64

How to obtain help and support for this security update

Properties

Article ID: 3086255 - Last Review: May 14, 2017 - Revision: 2

Applies to

Windows Server 2012 R2 Datacenter, Windows Server 2012 R2 Standard, Windows Server 2012 R2 Essentials, Windows Server 2012 R2 Foundation, Windows 8.1 Enterprise, Windows 8.1 Pro, Windows 8.1, Windows RT 8.1, Windows Server 2012 Datacenter, Windows Server 2012 Datacenter, Windows Server 2012 Standard, Windows Server 2012 Standard, Windows Server 2012 Essentials, Windows Server 2012 Foundation, Windows Server 2012 Foundation, Windows 8 Enterprise, Windows 8 Pro, Windows 8, Windows RT, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Datacenter, Windows Server 2008 R2 Enterprise, Windows Server 2008 R2 Standard, Windows Web Server 2008 R2, Windows Server 2008 R2 Foundation, Windows 7 Service Pack 1, Windows 7 Ultimate, Windows 7 Enterprise, Windows 7 Professional, Windows 7 Home Premium, Windows 7 Home Basic, Windows 7 Starter, Windows Server 2008 Service Pack 2, Windows Server 2008 Datacenter, Windows Server 2008 Enterprise, Windows Server 2008 Standard, Windows Web Server 2008, Windows Server 2008 Foundation, Windows Server 2008 for Itanium-Based Systems, Windows Vista Service Pack 2, Windows Vista Ultimate, Windows Vista Enterprise, Windows Vista Business, Windows Vista Home Premium, Windows Vista Home Basic, Windows Vista Starter, Microsoft Windows Server 2003 Service Pack 2, Microsoft Windows Server 2003, Datacenter Edition (32-bit x86), Microsoft Windows Server 2003, Enterprise Edition (32-bit x86), Microsoft Windows Server 2003, Standard Edition (32-bit x86), Microsoft Windows Server 2003, Web Edition, Microsoft Windows Server 2003, Datacenter x64 Edition, Microsoft Windows Server 2003, Enterprise x64 Edition, Microsoft Windows Server 2003, Standard x64 Edition, Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems, Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems