Content Modification: Patches for Windows published 2019-09-12

@bma
Can you verify the source release dates and applicable operating systems for the KB4512193 / KB4511516 fixlets?

According to the Microsoft Update Catalog, KB4512193 was a “2019-08 Preview of Quality Rollup for .NET Framework versions 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8” on Windows 7 and Server 2008 R2, and was last updated on 2019/08/21: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4512193

This update was then superseded by KB4514602 on 2019/09/06. KB4514602 is a " 2019-09 Security and Quality Rollup for .NET Framework 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8", applicable again to Windows 7 and Server 2008 R2: https://www.catalog.update.microsoft.com/Search.aspx?q=KB4514602

In these two updates, we have a preview of followed by a monthly rollup for the same .NET versions on the same operating systems.

KB4511516, on the other hand, is much more complicated. This KB was used for both 2019-07 Preview and 2019-08 Preview versions of the following .NET Framework versions:
4.6 for Windows Server 2008 SP2
4.6 for Windows Server 2008 SP2 for x64
4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7
4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2 for Windows 7 and Server 2008 R2 for x64

Similarly, KB4511525 is listed as a Preview version of a Quality Rollup for .NET Framework versions:
4.8 for Windows 7 (KB4511525)
4.8 for Windows 7 and Server 2008 R2 for x64 (KB4511525)

In my opinion you are introducing more confusion by labeling the KB4512193/KB4514602 updates (which are applicable for Server 2008 R2) as MS19-SEP KB4511516/KB4511525, when Server 2008 R2 already has an MS19-SEP update in KB4514602.

Seems like Microsoft really threw us a curve-ball here, but labeling non-security Preview updates as “Updates” in BigFix using the “MSXX-YYY” format does not seem to be consistent with previous practices. For our implementation of security metrics, this retroactive change will cause reporting issues due to the old patches now counting as in-scope for remediation, but having a release date back in August.