May 9, 2017—KB4019472 (OS Build 14393.1198)

View products that this article applies to.

Release Date:

May 09, 2017

Version:

OS Build 14393.1198

Improvements and fixes

This security update includes quality improvements. No new operating system features are being introduced in this update. Key changes include:

Addressed issue where the PC Settings pages do not display the correct options after the installation of KB3213986 and a language pack.
Addressed issue where fonts appear differently based on whether an app uses Graphics Device Interface (GDI) or GDI Plus.
Addressed issue where applications that use msado15.dll stop working after installing security update KB4015550.
Addressed issue that causes a device to become unresponsive when users try to enable end-user-defined characters (EUDCs).
Addressed issue that causes a device to crash every time a user logs off from a remote session using a Virtual Desktop Agent (VDA).
Addressed issue where changing the scaling setting of the display prevents DPI-aware tools (Notepad, MS Paint, etc.) from accepting input or drawing correctly when using the Japanese IME.
Addressed issue that causes Windows Explorer’s CPU usage to be at 20% when an executable file is hosted on a file share and its Offline attribute is set.
Addressed issue where Windows Event Forwarding between two 2012 R2 servers makes reports incompatible with third-party Security Information and Event Management software.
Addressed issue where the BitLocker Drive Encryption wizard shows the "Choose which encryption mode to use" page even when the BitLocker GPO is enabled.
Addressed issue where AppLocker fails to block binaries with revoked certificates.
Addressed issue where a virtual machine (VM) loses network connectivity if the VM does not send Address Resolution Protocol packets for five minutes and the VM is connected to a wireless NIC.
Addressed issue that causes the loss of a VPN connection when using a computer with an integrated WAN card (cellular card).
Addressed issue where multipath I/O did not properly restore service after the check condition "Illegal request, LUN not available (sense codes 05/25/00)" occurs.
Addressed issue where a Stop 0x27 error occurs after a user provides the domain username and password.
Addressed issue where users can create folders on a USB flash drive when "Deny write access" is set for Removable Storage Access.
Addressed an issue where crash dump generation hangs at 0% on a system with over 750 GB of physical memory and Hyper-V enabled.
Addressed an issue with a paging file space leak that leads Windows to a crash, blue screen, or data loss.
Addressed issue that prevents access to a website when Automatic Rebind of Renewed Certificate and Directory Service Mapper are enabled.
Addressed a crash in Services.exe with the error code “0xc0000374 - A heap has been corrupted,” and requires a system restart.
Addressed issue where Windows Defender anti-virus definitions, which are regulated by the network, prevent other updates (LCU, drivers) from being downloaded.
Addressed issue where Internet Explorer 11 does not save JavaScript files when exporting to an MHT file.
Addressed issue that prevents Internet Explorer 11 from following redirects when the Include-Referer-Token-Binding-ID header is set to “true.”
Addressed issue that causes users to get logged out from a Web-application intermittently.
Updated Internet Explorer 11’s New Tab Page with an integrated newsfeed.
Deprecated SHA-1 Microsoft Edge and Internet Explorer 11 for SSL/TLS Server Authentication. See Advisory 4010323 for more information.
Addressed additional issues with the Windows Shell, enterprise security, Datacenter Networking, storage networking, Internet Information Services, Active Directory, clustering, Windows Server, the client platform, and Internet Explorer.
Security updates to Windows COM, Windows SMB Server, Windows server, Internet Explorer, and Microsoft Edge.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

↑ Back to the top

Known issues in this update

Symptom	Workaround
End User Defined Characters (EUDC) may not be visible in some applications.	There is not yet a mitigation for this issue. We are working on a fix and will make it available for download when ready.
This security update introduced an issue in which, if an iSCSI target becomes unavailable, attempts to reconnect will cause a leak. Initiating a new connection to an available target will work as expected.	Microsoft is working on a resolution and will provide an update in an upcoming release. For more information about this issue, see the following section.

More information about the iSCSI issue

Windows Server 2012 R2 and Server 2016 computers that experience disconnections to iSCSI attached targets may show many different symptoms. These include, but are not limited to:

The operating system stops responding
You receive Stop errors (Bugcheck errors) 0x80, 0x111, 0x1C8, 0xE2, 0x161, 0x00, 0xF4, 0xEF, 0xEA, 0x101, 0x133, or 0xDEADDEAD.
User log on failures occur together with a "No Logon Servers Available" error.
Application and service failures occur because of ephemeral port exhaustion.
An unusually high number of ephemeral ports are being used by the System process.
An unusually high number of threads are being used by the System process.

Cause

This issue is caused by a locking issue on Windows Server 2012 R2 and Windows Server 2016 RS1 computers, causing connectivity issues to the iSCSI targets. The issue can occur after installing any of the following updates:

Windows Server 2012 R2

Release date	KB	Article title
May 16, 2017	KB 4015553	April 18, 2017—KB4015553 (Preview of Monthly Rollup)
May 9, 2017	KB 4019215	May 9, 2017—KB4019215 (Monthly Rollup)
May 9, 2017	KB 4019213	May 9, 2017—KB4019213 (Security-only update)
April 18, 2017	KB 4015553	April 18, 2017—KB4015553 (Preview of Monthly Rollup)
April 11, 2017	KB 4015550	April 11, 2017—KB4015550 (Monthly Rollup)
April 11, 2017	KB 4015547	April 11, 2017—KB4015547 (Security-only update)
March 21, 2017	KB 4012219	March 2017 Preview of Monthly Quality Rollup for Windows 8.1 and Windows Server 2012 R2

Windows Server 2016 RTM (RS1)

Release date	KB	Article title
May 16, 2017	KB 4023680	May 26, 2017—KB4023680 (OS Build 14393.1230)
May 9, 2017	KB 4019472	May 9, 2017—KB4019472 (OS Build 14393.1198)
April 11, 2017	KB 4015217	April 11, 2017—KB4015217 (OS Build 14393.1066 and 14393.1083)

Verification

Verify the version of the following MSISCSI driver on the system:

c:\windows\system32\drivers\msiscsi.sys

The version that will expose this behavior is 6.3.9600.18624 for Windows Server 2012 R2 and version 10.0.14393.1066 for Windows Server 2016.

The following events are logged in the System log:

Event source	ID	Text
iScsiPrt	34	A connection to the target was lost, but the Initiator successfully reconnected to the target. Dump data contains the target name.
iScsiPrt	39	The Initiator sent a task management command to reset the target. The target name is given in the dump data.
iScsiPrt	9	Target did not respond in time for a SCSI request. The CDB is given in the dump data.

Review the number of threads that are running under the System process, and compare this to a known working baseline.
Review the number of handles that are currently opened by the System process, and compare this to a known working baseline.
Review the number of ephemeral ports that are being used by the System process.
From an administrative Powershell, run the following command:

Get-NetTCPConnection | Group-Object -Property State, OwningProcess | Sort Count

Or, from an administrative CMD prompt, run the following NETSTAT command together with the "Q" switch. This shows "bound" ports that are no longer connected:

NETSTAT –ANOQ

Focus on ports that are owned by the SYSTEM process.

For the three previous points, anything more than 12,000 should be considered suspect. If iSCSI targets are present in the computer, there is high probability that the issue will occur.

Resolution

If the event logs indicate that many reconnections are occurring, work with your iSCSI and network fabric vendor to help diagnose and correct the reason for the failure to maintain connections to iSCSI targets. Make sure that iSCSI targets can be accessed over the current network fabric. Install updated fixes when they become available. This article will be updated with the specific KB article number of the fix to install when it becomes available.

Note We do not recommend that you uninstall any of the March, April, May, or June security rollups. Doing so will expose the computers to known security exploits and other bugs that are mitigated by monthly updates. We recommend that you first work with iSCSI target and network vendors to resolve the connectivity issues that are triggering target reconnects.

↑ Back to the top

How to get this update

This update will be downloaded and installed automatically from Windows Update. To get the stand-alone package for this update, go to the Microsoft Update Catalog website.

Update replacement information
This update replaces the previously released update KB4015217.
File information
For a list of the files that are provided in this update, download the file information for cumulative update KB4019472.

↑ Back to the top