If you haven’t seen the news, Windows released patches for two new zero-days, one for IE 9/10/11, and another for Windows Defender. These are severe - the IE issues are being exploited in the wild, the Defender issue can erode security. We covered the details here.
In a sad way, that’s good news.
The bad news is that Windows isn’t offering the IE patches through Windows Update. Instead, you need to push them manually…for every version, configuration, and processor. Rather than leave you guessing, we made a worklet that you can modify to patch every version one by one.
For Evaluation Code, enter the below, changing the KB number for the KB you are targeting:
#Define KB Number and check for presence. You need to enter the one specific to your OS version
############################################################################
$kbID = 'Your_KB_Number’
############################################################################
$installed = Get-Hotfix -Id $kbID -ErrorAction SilentlyContinue
if ( $installed ) {
#Compliant, so Exit 0 as success
Exit 0
} else {
#Non-Compliant, so Exit 1 as failure
Exit 1
}
Then enter the following Remediation Code, switching the file path to the one you need to install:
#Enter the name of the msu file you uploaded.
$fileName = “msu file specific to your OS”
#Launch the installer file and capture exit code to determine success
$installer = Start-Process -FilePath $fileName -ArgumentList “/quiet /passive /norestart” -Wait -PassThru
#Evaluate Exit Code for Success 0,1641,3010 are all considered successful
if ( $installer.ExitCode -in @(‘0’,‘1641’, ‘3010’)) {
Exit 0
} else { Exit 1 }
You will need to upload each update file as well. Some are large, and may take a while to upload. After that, save the policy, link it to any and all groups, and patch now.
Here’s the catch - you need the right KB and file version for each unique Windows version, and there are dozens. For now, this is the best way to apply the patch at scale. We have members of the team at Automox working to create a single worklet for every version, but if you have a worklet ready, please share!