Failure to install a required security patch to address CVE-2020-1147 - how to diagnose and install it

Question

Our existing SharePoint admins left for another company and two persons who were doing desktop support are filling in for them so they are new at installing patches. I know it is odd, but that is a situation caused due to budget shortfall.

They could not install the patch to address CVE-2020-1147 and message in log was "Installation Failure: Windows failed to install the following update with error 0x80070661: Security Update for Windows (KB4565579)"

I saw the information at https://support.microsoft.com/en-us/help/4565579/kb4565579

They told me the server has March 12, 2019 servicing stack update (SSU) (KB4490628), latest SHA-2 update (KB4474419). They don't know if the servers have Extended Security Updates (ESU) Licensing Preparation Package (KB4538483) and are checking on it.

1. If the servers don't have Extended Security Updates (KB4538483) is there a way to install this security update? We may not have the budget to buy it this year because of low revenue stemming from the pandemic

2. If the servers absolutely need Extended Security Updates (KB4538483) can that be purchased for 4 servers?

3. What else needs to be checked to ensure there is no other factor causing the security updates to fail?

Thanks

Answer 1

To answer your questions:

1. The Extended Security Updates (KB4538483) is a prerequisite to install Security Only Update (KB4565579), so there is no way to work around it.

2. You will need to deploy Windows Server Update Services (WSUS) to be able to get the updates.

   Computers in a computer group automatically contact the WSUS server over the next 24 hours to obtain updates. You don’t need to purchase individual licenses for the servers.

3. All prerequisites mentioned in the documents should be ensured. You can check what updates have been installed on the local machine via Control Panel > Programs > Programs and Features > Installed Updates.