Updating Windows to deal with daylight savings changes for 2007

Usage and Config Patch
1

(imported topic written by BenKus)

We have been receiving many questions about the upcoming daylight savings changes. Here is a quick summary for everyone:

The US (and some other countries) changed the hours for daylight savings starting in 2007. To reflect this new daylight savings information, computers must be updated and Microsoft has released patches for supported Windows operating systems that updates to the new daylight savings time information. These patches have been incorporated into the BigFix Fixlet site “Patches for Windows (Enterprise Security)”.

Current published Fixlets to address DST issues includes the OSes:

  • Windows Server 2003
  • Windows XP
  • Windows XP Professional x64 Edition / Windows Server 2003 x64 Edition

*Note that Windows Vista ships with the new DST rules already included.

Important Note for customers with Windows 2000 and below

Microsoft does not currently make available patches for OSes that are no longer supported (Win2000, WinNT, Win98, Win95). Note that if you have “extended Hotfix Support” for Windows 2000, Microsoft will give you a patch for Win2000 DST, but this patch is not publicly available for all customers. (More info at http://www.microsoft.com/windows/timezone/dst2007.mspx).

Since Microsoft has not released official public patches for these other operating systems, we cannot provide and support Fixlets to adjust daylight savings for older operating systems on our current Fixlet sites.

However, due to heavy demand from our customers, we did find a way to adjust the registry settings in Windows 2000 to properly set the new DST information using information published by Microsoft (see here for more information http://support.microsoft.com/kb/914387). We are making these Fixlets available only through professional services because there is not an officially supported Microsoft patch and it is outside of the scope of our “Patches for Windows” sites.

The Fixlets for updating DST information for unsupported Microsoft operating systems are only available by contacting our Professional Services department at professional_services@bigfix.com.

We will be able to deliver to you custom Fixlets that should be easily importable into your deployment that will allow you to update DST information on the older Microsoft operating systems. There will be a relatively small professional services fee for these Fixlets that will cover the development and support of these custom Fixlets.

Please send questions to

professional_services@bigfix.com

.

Ben

2

(imported comment written by BenKus)

Minor corrections/updates:

  • The Windows XP fixlet for DST is now restricted to Windows XP SP1/SP2 because those are the only operating systems technically supported by the patch.

-Our professional services department is now offering patches for many more unsupported OSes, (for instance, we have a XP Gold Fixlet).

  • As of this moment, Microsoft is not supporting the Newfoundland and W.Australia time zone updates in their official patches (for XP/2003). Our professional services department has created Fixlets that can update all the timezones (including Newfoundland and W.Australia time zones) for all operating systems (including all versions of Windows 2003/XP/2000/NT/Me/98/95).

BigFix Professional Services contact info above.

Ben

http://support.microsoft.com/kb/914387

3

(imported comment written by keving91)

What about *NIX flavors? Do ou plan on supporting any of these OSes? If so, which?

Need help ASAP for my bosses meeting.

Thanks

Kevin

4

(imported comment written by tim_tsai)

Hey Kevin,

Here is a summary of what we currently cover in our non-Windows patch sites:

==Patches for AIX==

The following APAR’s are available that makes the necessary DST changes:

AIX 5.3 = IY75211

AIX 5.2 = IY75213

AIX 5.1 = IY75214

These individual patches are “software fixes”, which does not fall under our “Patches for AIX” coverage. However, the patches for AIX 5.2 and 5.3 are rolled into Technology Levels, which we do support:

AIX 5.2 - fix included in TL 5200-08 or later

AIX 5.3 - fix included in TL 5300-04 or later

==Patches for Red Hat Enterprise Linux==

RHEA-2006:0745 is the latest update that contains the DST changes, this is supported in our coverage:

Fixlet ID 200674501 (RHEL3)

Fixlet ID 200674503 (RHEL4)

==Patches for SUSE Linux Enterprise==

SLES10 and SLED10 already has the DST changes included in the initial release.

SLES9 requires a “recommended update” for glibc, which does not fall under our patch coverage.

==Patches for Solaris==

Solaris 8 (SPARC) - timezone patch 109809-05 or later and libc patch 108993-52 or later, Fixlet message available.

Solaris 9 (SPARC) - timezone patch 113225-07 or later and libc patch 112874-33 or later, Fixlet message available.

Solaris 10 (SPARC) - timezone patch 122032-03 or later and libc patch 119689-07 or later (obsoleted by 118833-24), Fixlet message available.

==HP-UX==

11.00 - PHCO_34673 - individual patch, not included in patch coverage.

11iv1 (11.11) - PHCO_34668, part of “Dec 2006 11.11 Quality Pack patch bundle”, Fixlet message available.

11iv2 (11.23) - PHCO_34669, part of “Sep 2006 11.23 Quality Pack patch bundle”, not included in patch coverage.

==Mac OS X==

Latest Mac OS X 10.4.8 patch includes the DST changes (Fixlet ID 261)

Mac OS X 10.3 and earlier - not supported, no update available from Apple.

===============

Note that some of these vendors provide additional DST updates for other applications such as Java Runtime. Please contact Professional Services for any updates that do not fall within our standard patch coverage.

5

(imported comment written by BenKus)

Our bundle of Fixlets offered by professional services for DST issues now includes a Fixlet to run the Outlook timezone update tool. Please contact professional services at the email address above for more details.

Ben

6

(imported comment written by SystemAdmin)

Microsoft certainly doesn’t make it easy to discover that their DST patch works for WinXP SP1. I guess that’s because official SP1 support has expired.

All their references to the patch that I have seen only mention SP2. The exception is the Knowledge Base article KB931836, which just says it applies to Home/Pro/Media Center versions and makes no mention of service packs at all. To be safe I only used it with SP2.

Until I downloaded the BigFix consumer client, that is, and was surprised (pleasantly) to see the patch recommended for an SP1 machine. Curious, I came to the forum and found this thread. Now I have the patch running with SP1!

I support a small office network as part of my job, and on my own time I’m a self-employed (and mostly self-educated) PC tech. I’m sure I have less access to solid information than most of you here. BigFix dropped some needed info right into my lap. So far I am impressed! Thanks.

EDIT: Looking more deeply into the forum, I see that it is intended for enterprise customers. I hope this post doesn’t waste anyone’s valuable time, and there is no need to reply. Just consider it a note of thanks from a “little guy.” :slight_smile:

7

(imported comment written by rola91)

JHawk

EDIT: Looking more deeply into the forum, I see that it is intended for enterprise customers. I hope this post doesn’t waste anyone’s valuable time, and there is no need to reply. Just consider it a note of thanks from a “little guy.” :slight_smile:

I think you may be right.

8

(imported comment written by drp91)

My first deployments of MS09-017 Office 2007 SP1/SP2 Compatibility Pack all failed. Manual installations of the downloaded Microsoft patch on machines with failed BES deployments failed with “program to be upgraded may be missing or the upgrade patch may update a different version of the program” error. Running an analysis against machines relevant for the fixlet show reporting machines to have the values listed as their DisplayVersion values in Office 2007 Compatibility Pack registry key at HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall:

12.0.4518.1014

12.0.6021.5000

12.0.6215.1000

12.0.6425.1000

All of the initial failed deployments targeted machines with either 12.0.4518.1014 or 12.0.6021.5000 for their DisplayVersion values. Test deployments of the fixlet against machines at 12.0.6215.1000 and 12.0.6425.1000 for DisplayVersion completed.

9

(imported comment written by rwest23)

Hi drp,

One of the relevance clauses for the Fixlet you reference (ID: 901736) reads as follows:

exists key whose ( ( ( it = 
"12" AND it >= 
"12.0.6215.1000" ) of ( value 
"DisplayVersion" of it as string as version ) ) AND ( ( ( length of it = 38 ) AND ( it contains 
"000000FF1CE}" ) AND ( ( it = 
"0000" OR ( hexadecimal integer it = 1033 ) ) of last 4 of ( first 19 of it ) ) AND ( ( it = 
"0020" OR it = 
"0011" OR it = 
"0012" OR it = 
"0013" OR it = 
"0014" OR it = 
"002E" OR it = 
"002F" OR it = 
"0030" OR it = 
"0031" OR it = 
"0033" OR it = 
"0035" OR it = 
"00CA" OR it = 
"0037" ) of last 4 of ( first 14 of it ) ) ) of ( name of it ) ) AND exists value 
"DisplayName" of it ) of key 
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry

Which basically means “is there an uninstall key in the registry that corresponds to the Office 2007 Compatibility Pack, standalone PowerPoint 2007, or one of the Office 2007 suites, and is at SP level 1 or greater?” The only way that 901736 could become relevant on a machine with DisplayVersion 12.0.4518.1014 or 12.0.6021.5000 (< SP1) for the Compatibility Pack key is if there were also other Office 2007 products installed on the same machine and at least one of those products was at SP level 1 or greater. You can check this by running the following Relevance in the Debugger:

( value 
"DisplayName" of it, value 
"DisplayVersion" of it ) of keys whose ( ( ( it = 
"12" ) of ( value 
"DisplayVersion" of it as string as version ) ) AND ( ( ( length of it = 38 ) AND ( it contains 
"000000FF1CE}" ) AND ( ( it = 
"0000" OR ( hexadecimal integer it = 1033 ) ) of last 4 of ( first 19 of it ) ) AND ( ( it = 
"0020" OR it = 
"0011" OR it = 
"0012" OR it = 
"0013" OR it = 
"0014" OR it = 
"002E" OR it = 
"002F" OR it = 
"0030" OR it = 
"0031" OR it = 
"0033" OR it = 
"0035" OR it = 
"00CA" OR it = 
"0037" ) of last 4 of ( first 14 of it ) ) ) of ( name of it ) ) AND exists value 
"DisplayName" of it ) of key 
"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" of registry

BigFix does not support systems with multiple Office products installed, so unfortunately if you find that these systems have multiple relevant keys then we cannot help you any further. Just to be perfectly clear, multiple Office products does

not

mean multiple products within a single suite (e.g. Excel 2007 and PowerPoint 2007), but rather multiple suites or standalone products (e.g. Office Professional 2003 and Office Ultimate 2007).

10

(imported comment written by drp91)

Hi Ben,

Thank you for keeping my original post alive, even though it arrived on the heels of another…

Yes, you’re right. Machines with pre-sp1 versions of Compatibility Pack testing true for fixlet relevance but which fail the product version requirement for the patch have either Office 2007 SP1 or SP2 installed and, therefore, have file versions >= SP1 version detected by Relevance clause 6.

Even though Compatibitliy Pack has served no purpose since Office 2007 replaced 2003 for these machines, it is still here in this environment. But until release of MS09-017, this environment has been patching for Compatibility Pack.

Microsoft’s Lifecycle Supported Service Packs document lists support for 2007 Microsoft Office SP0 as ended Jan. 13, 2009. Even though machines pass version check on these files, this patch seems to be requiring Compatibility Pack SP1 setup. Its installation behaviours seem to be showing that it’s working for machines which meet the relevance criteria plus an additional requirement that DisplayVersion for Compatibility Pack uninstall key >= SP1 version…

11

(imported comment written by rwest23)

Hi drp,

This issue of have an Office suite at >= SP1 and a gold Compatibility Pack installation turned out to be a very widespread issue, and so we decided to address it after all even though it isn’t technically within our support boundaries. We published a modified version of 901736 on Tuesday (5/19), so please take a look and let us know if it fixes the issue for you. Thanks!

Randy

12

(imported comment written by drp91)

Hi Randy,

Thank you for the reply.

I think our fixlet source is up-to-date (Got updated fixlet MS08-069: Vulnerabilities in Microsoft XML Core Services Could Allow Remote Code Execution – XML Core Services 4.0 – Windows 2000/XP/Vista CORRUPT PATCH today (thanks!), so assuming we’re working with the latest version. )

Based on results posted, it seems Microsoft patch requires installations of Office 2K7 Compatibility Pack to have DisplayVersion values no less than 12.0.6215.1000, the SP1 version.

If detection for MS09-017 Office 2007 SP1/SP2 Compatibility Pack excluded pre-SP1 installations, i.e. not include

installations where 2K7 CP DisplayVersion < 12.0.6215.1000, then detection should align with the patch installation behaviours observed in our environment.

13

(imported comment written by rwest23)

Hi drp,

Though it would now seem that it has mysteriously disappeared, there used to be a note in the

MS09-017 bulletin

stating that it was necessary to apply the Office Compatibility Pack update to Office Suites as well in order that those suites be completely remediated. We built our applicability Relevance according to this specification, but upon closer inspection of the .msp file contained within the patch, it applies to the Compatibility Pack exclusively. We will update the Fixlet to these specifications and publish a new version shortly.

Thank you for your patience in this matter, and please let us know if you have any further issues.

Randy

14

(imported comment written by jully91)

Hi

This is Jully I support a small office network as part of my job, and on my own time at my house I’m a self-employed PC Tech. I’m sure I have less information than most of you have I downloaded the Bigfix from consumer client it was patch recommended for an SP1 then I come to the forum and found this thread now the patch running with SP1. Bigfix dropped some information right into my laptop then I am impressed.

Thanks