Important This article contains information that shows how to help lower security settings or how to turn off security features on a computer. You can make these changes to work around a specific problem. Before you make these changes, we recommend that you evaluate the risks that are associated with implementing this workaround in your particular environment. If you implement this workaround, you should take any appropriate additional steps to help protect the computer.
Summary
In addition to the changes that are listed for the vulnerabilities that are described in Microsoft Security Bulletin MS15-097, this security bulletin addresses a defense-in-depth update for the secdrv.sys driver, a third-party driver. The update turns off the service for the secdrv.sys driver. This may affect the ability to run some older games.
To learn more about the vulnerabilities, see Microsoft Security Bulletin MS15-097.
To learn more about the vulnerabilities, see Microsoft Security Bulletin MS15-097.
More Information
Important
- All future security and nonsecurity updates for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 require update 2919355 to be installed. We recommend that you install update 2919355 on your Windows RT 8.1-based, Windows 8.1-based, or Windows Server 2012 R2-based computer so that you receive future updates.
- If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Add language packs to Windows.
Known issues in this security update
- After you install this security update, some programs may not run. (For example, some video games may not run.) To work around this issue, you can temporarily turn on the service for the secdrv.sys driver by running certain commands, or by editing the registry.
Note When you no longer require the service to be running, we recommend that you turn off the service again.
Warning This workaround may make a computer or a network more vulnerable to attack by malicious users or by malicious software such as viruses. We do not recommend this workaround but are providing this information so that you can implement this workaround at your own discretion. Use this workaround at your own risk.
To do this, type the following commands at an elevated command prompt. You should press Enter after you type each command.- To disable the driver's service, type the following command:
sc config secdrv start= disabled
- To set the driver's service to manual, type the following command:
sc config secdrv start= demand
- To enable the driver's service (and to set it to automatic), type the following command:
sc config secdrv start=auto
- To manually start the driver's service, type the following command:
sc start secdrv
- To manually stop the driver's service, type the following command:
sc stop secdrv
- To disable the driver's service, type the following command:
322756 How to back up and restore the registry in Windows
Or, you can edit the registry directly. To do this, follow these steps:- Click Start, click Run, type regedit in the Open box, and then click OK.
- Locate and then click the following subkey in the registry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\secdrv
- Right-click Start, and then click Modify.
- In the Value data box, do one of the following:
- Type 4 to disable the driver's service, and then click OK.
- Type 3 to set the driver's service to manual, and then click OK.
- Type 2 to set the driver's service to automatic, and then click OK.
- Exit Registry Editor.
How to obtain and install the update
Method 1: Windows Update
Method 2: Microsoft Download Center
You can obtain the stand-alone update package through the Microsoft Download Center. Follow the installation instructions on the download page to install the update.
Click the download link in the following table that corresponds to the version of Windows that you are running. Find out if your computer is running the 32 or 64-bit version of Windows
| Windows version | Download link |
|---|---|
| Windows Vista SP2 |  Download 32-bit (KB3086255)Download 64-bit (KB3086255) |
| Windows Server 2008 SP2 | Download 32-bit (KB3086255)Download 64-bit (KB3086255) |
| Windows 7 SP1 | Download 32-bit (KB3086255)Download 64-bit (KB3086255) |
| Windows Server 2008 R2 SP1 | Download 64-bit (KB3086255) |
| Windows 8 | Download 32-bit (KB3086255)Download 64-bit (KB3086255) |
| Windows Server 2012 | Download 64-bit (KB3086255) |
| Windows 8.1 | Download 32-bit (KB3086255)Download 64-bit (KB3086255) |
| Windows Server 2012 R2 | Download 64-bit (KB3045685) |