November 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

New features and improvements

This update rollup includes the following new features and improvements:

• Refreshed language packs

• Defense-in-depth security and Schannel hardening

• Support for newer hardware (boot order allowance, SD card improvements, USB debugging)

• Improved Web Services for Devices (WSD) printer support during network switches

• Performance and reliability improvements in clustered virtual machine mission-critical environments

• Improved manageability

• Additional hardware support (devices that have third-party disk encryption software enabled can now be upgraded to Windows 8.1 more easily)

This November update rollup also includes all previous updates since the previous image update in April 2014. This is a convenient single step to bring Windows clients and servers up to date. Unlike our April update, the November update rollup is not required to be able to continue to receive security or other updates. However, we strongly recommend that you deploy it to Windows clients and servers to benefit from these new features and improvements as well as to prevent many known issues that have been resolved since April. This update is thoroughly tested to the same quality level as our previous service packs. However, unlike service packs, this update does not change the version number and does not deprecate or change any APIs in a manner that would require recertification.

Issues that this update resolves

This update package fixes the problems that are documented in the following Microsoft Knowledge Base articles.

Known issues in this update

• You receive a 0x800f0922 or 0x80070005 error message when you try to install this update
  
  Symptoms
  Assume that you have either of the following configurations:

  • You have a Windows Server 2012 R2 server that is running on hardware that has UEFI that has Secure Boot enabled.

  • You have a Windows Server 2012 R2-based Hyper-V host that is running, and you are running a Generation 2 virtual machine guest that uses UEFI firmware support and that has the Secure Boot option enabled. Additionally, the guest virtual machine is running Windows Server 2012 R2.

  In these configurations, update 3000850 may not be installed, and you receive a 0x800f0922 or 0x80070005 error message.
  
  Solution
  To resolve this problem, follow these steps:

  1. Install the updated servicing stack update 2975061, and then restart the computer.

  2. Try to reinstall this update.

• The computer may crash if you restore the system to a restore point that was created before update rollup 3000850 was installed
  
  Notes

  • This problem applies only to Windows 8.1 editions.

  • An installation of a Windows update typically creates a restore point to which the system can be rolled back in case the installation or the updates cause any problems. In this case, the computer may experience startup failures if you try to roll back the system to a restore point that was created before you installed update rollup 3000850.

  • If the computer has Windows Recovery Environment (WRE) configured, the system automatically restores itself to the last-known working state.

  
  Workaround
  To work around this problem, use the Programs and Features item in Control Panel instead of System Restore. To do this, click View installed updates in the navigation panel in Programs and Features, select KB3000850 in the list, and then click Uninstall.

• After you apply this update on a computer, the computer does not respond during shutdown if you have enabled Fast Startup.
  
  Solution
  
  If you do not encounter the issue but have enabled Fast Startup, install hotfix 3042085 before you apply the November 2014 update.
  If you have encountered the issue, to work around this issue, restart your computer.

• After you install security update 2992611 or update 3000850, domain users who log on to domain-joined Windows 8.1 computers experience the following issues:

  • Adding new account in Windows Live Mail 2012 fails with error 0x80090345.

  • Saving RDP passwords fails with no apparent error.

  • Opening Credential Manager fails with error 0x80090345.

  • Explorer hangs when encrypting a file. A WPA trace contains the following signature:
    

    Explorer taking ~664 seconds to Encrypt a file. TID #3376. 
    This is being serviced by LSASS TID #1488 .
    LSASS TID#3848 is executing the sspCryptUnprotectData call which leads into GetMasterKey. 
    GetMasterKey is taking ~664 seconds (TimesinceLast). LSASS TID 3848. We spend the whole time waiting on LSASS TID 576 which is performing DCLocator pings to find a DC.
    File Encryption delay/hang is also accounted by the same code change where the backup is required. 

  Workaround
  To work around this problem, set the value of the ProtectionPolicy registry entry to 1 to enable local backup of the MasterKey instead of requiring a RWDC in the following registry subkey:
  

  HKEY_LOCAL_MACHINE\Software\Microsoft\Cryptography\Protect\Providers\df9d8cd0-1501-11d1-8c7a-00c04fc297eb

• Text for DNS events is not rendered in DNS Manager mmc snap-in after you install August 2014 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 (2975719) or a later version of monthly updates on Windows Server 2012 R2-based DNS servers.
  
  Workaround
  To work around this problem, view DNS events by using the Event Viewer and Computer Management snap-ins.

How to obtain the update rollup

Method 1: Windows UpdateThis update is provided as an Important update from Windows Update. If you turn on automatic updates, this update is automatically installed.

For more information about Windows Update, see frequently asked questions on Windows Update.

Method 2: Microsoft Download CenterYou can also obtain the stand-alone update package through the Microsoft Download Center.

Download the x86-based Windows 8.1 update package now.
Download the x64-based Windows 8.1 update package now.
Download the x64-based Windows Server 2012 R2 update package now.

Notes

• The update for Windows RT 8.1 can be obtained only from Windows Update.

• Update KB3016437 is applicable only to computers that have the Windows Server 2012 R2 Active Directory Domain Services (AD DS) role enabled. If you try to install KB3016437 on a Windows client or a Windows server on which AD DS role is not turned on, the update does not install. There are no other adverse effects.

For more information about how to download Microsoft support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to obtain Microsoft support files from online services Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help prevent any unauthorized changes to the file.

Update detail information

PrerequisitesTo apply this update, you must first install update 2919355 on Windows 8.1 or Windows Server 2012 R2.

Restart informationYou must restart the computer after you apply this update.

Update replacement informationThis update does not replace any previously released update.

File informationFile detail information

For a list of the files that are provided in this update 3000850, download the file information for update 3000850.

File hash information

The following table lists the thumbprints of the certificates that are used to sign the updates (.msu). Verify the certificate thumbprint in this Microsoft Knowledge Base article against the certificate thumbprint indicated on the update that you download.

References

See the terminology that Microsoft uses to describe software updates.