[Explorer09]

Okay, may you guys help me try this thing?

Keep the KB2638806's "Installed" registry entry and remove the KB960803 one. Then check Windows Update and see if it still offers KB960803.

I think the answer would be no, but I don't have the time and hardware to try that out.

[5eraph]

The answer is yes, it still offers KB960803. I told you that already.

It's not hard to test on a running system. And it's easy to add the registry entry in RegEdit after it's been removed for testing. It should take no more than a couple minutes to remove the registry entry using RegEdit, check the update website, then add the entry back and check again.

[Explorer09]

Yes, I get it. Time to blame Microsoft.

(Tested today on a freshly-installed Win XP x64 on VirtualBox)
 wxp-x64-960803.JPG (120.45K)
Number of downloads: 11

This post has been edited by Explorer09: 16 May 2012 - 06:53 AM

[Explorer09]

Oh no, nLite did not directly integrate these updates completely.
KB960803
KB2296011
KB2638806
KB2659262

Did anyone notice that?

[Kurt_Aust]

nLite bug fix and optional updates

Deletion:
Hotfix\084-WindowsServer2003.WindowsXP-KB946026-x64-ENU.exe

Move and Rename:
Hotfix\528-WindowsServer2003.WindowsXP-KB2296011-x64-ENU.exe to RunOnce\WindowsServer2003.WindowsXP-KB2296011-x64-ENU.exe
Hotfix\776-WindowsServer2003.WindowsXP-KB2638806-x64-ENU.exe to RunOnce\WindowsServer2003.WindowsXP-KB2638806-x64-ENU.exe
Hotfix\820-WindowsServer2003.WindowsXP-KB2659262-x64-ENU.exe to RunOnce\WindowsServer2003.WindowsXP-KB2659262-x64-ENU.exe

Replace (optional):
# ▼. RunOnce\WindowsUpdateAgent30-x64.exe 7,740,264

Additions (all at Hotfix):
@ . . . 440-WindowsServer2003.WindowsXP-KB982666-x64-ENU.exe . . . 1,637,248 . MS10-040 - Internet Information Services (IIS)
@ ▼ 608-WindowsServer2003.WindowsXP-KB2478953-x64-ENU.exe . . 5,054,336 . MS11-005 - Active Directory
@ . . . 068-WindowsServer2003.WindowsXP-KB925066-x64-ENU.exe .. . . . 764,808 . Distributed File System (DFS)
@ . . . 108-WindowsServer2003.WindowsXP-KB955417-x64-ENU.exe .. . . . 763,440 . Don't trust the French with your secrets
# ▼. 260-WindowsServer2003.WindowsXP-KB955704-x64-ENU.exe . . 13,240,192 . exFAT file system
@ . . . 172-WindowsServer2003.WindowsXP-KB960680-v2-x64-ENU.exe . . 715,640 . Currency Symbols
@ . . . 256-WindowsServer2003.WindowsXP-KB971314-x64-ENU.exe .. . . . 895,888 . PCL Inbox Printer Drivers
@ . . . 488-WindowsServer2003.WindowsXP-KB2264107-x64-ENU.exe . . 2,261,376 . External Libraries Load Control


Thank you Explorer09 for reporting that nLite bug, I'll have to keep an eye out in future for that ASMS folder.

I've also taken a look at the optional updates that 5eraph includes and added those that aren't Hotfix by Request (HBRs), I already had most of them, the most significant addition being exFAT partition support.

[5eraph]

LOL @ KB955417. Caught me off guard.

[Explorer09]

Kurt_Aust, on 02 June 2012 - 05:52 PM, said:

Additions (all at Hotfix):
@ . . . 440-WindowsServer2003.WindowsXP-KB982666-x64-ENU.exe . . . 1,637,248 . MS10-040 - Internet Information Services (IIS)
@ ▼ 608-WindowsServer2003.WindowsXP-KB2478953-x64-ENU.exe . . 5,054,336 . MS11-005 - Active Directory
@ . . . 068-WindowsServer2003.WindowsXP-KB925066-x64-ENU.exe .. . . . 764,808 . Distributed File System (DFS)
@ . . . 108-WindowsServer2003.WindowsXP-KB955417-x64-ENU.exe .. . . . 763,440 . Don't trust the French with your secrets
# ▼. 260-WindowsServer2003.WindowsXP-KB955704-x64-ENU.exe . . 13,240,192 . exFAT file system
@ . . . 172-WindowsServer2003.WindowsXP-KB960680-v2-x64-ENU.exe . . 715,640 . Currency Symbols
@ . . . 256-WindowsServer2003.WindowsXP-KB971314-x64-ENU.exe .. . . . 895,888 . PCL Inbox Printer Drivers
@ . . . 488-WindowsServer2003.WindowsXP-KB2264107-x64-ENU.exe . . 2,261,376 . External Libraries Load Control

In the MS security bulletin, it say that Windows XP x64 does not need the MS10-040 (KB982666) update, and

Quote

http://technet.micro...lletin/MS10-040
[1]This operating system [Windows 2003/Vista/2008] is only affected when Extended Protection for Authentication has been installed.

Also KB2478953 is unnecessary because Active Directory Application Mode (ADAM) is not part of the standard installation of Windows XP x64.

This post has been edited by Explorer09: 03 June 2012 - 07:31 PM

[5eraph]

The affected component described in KB982666 is Internet Information Services 6, which is included in the x64 versions of both WinXP and Win2003. If you check the Applies To section of KB973917 you'll see that "Extended Protection for Authentication in Internet Information Services (IIS)" does apply to Windows XP x64, which strongly suggests that KB982666 should apply as well. KB982666 installs in Windows XP x64. It's better to be safe than sorry.

KB2478953 still applies to Windows XP x64 and directly replaces NetLogon.dll and wNetLogon.dll in the source. ADAM need not be present to slipstream with nLite. When slipstreamed it's one less update that needs to be installed later if the machine needs access to a network where Active Directory is in use.

[Kurt_Aust]

5eraph: You've got to admit, the KB955417 note accurately describes what in fact is fixed and is less obscure about it than most such notes.

Explorer09: Yes I did read the description on KB982666 and KB2478953 when they first came out which is why they weren't included at that time. As you might note they are now included only as optional updates, as indicated by the green description note.

[Explorer09]

Kurt_Aust, on 05 June 2012 - 01:18 AM, said:

Explorer09: Yes I did read the description on KB982666 and KB2478953 when they first came out which is why they weren't included at that time. As you might note they are now included only as optional updates, as indicated by the green description note.

Yes, I see. But my problem is that neither of these updates have been offered to me by Windows Update, and MS has clearly said that Windows XP x64 is not affected.

I think you would better write a footnote about the reason why you include them. Something like this:
"Although Windows XP x64 is not affected by the vulnerability described in MS10-040 and MS11-005, these two updates patch some Windows XP x64 files and provides optional extended protection."

By the way, KB982666 replaces KB973917, and KB973917 replaces KB970430. So would you also remove KB970430 from the list?

This post has been edited by Explorer09: 06 June 2012 - 10:11 PM

[Kurt_Aust]

Explorer09, on 06 June 2012 - 09:44 PM, said:

By the way, KB982666 replaces KB973917, and KB973917 replaces KB970430. So would you also remove KB970430 from the list?

Good point, it will be done with this month's updates.

I'll be off at a Sci-Fi con for the next few days, toasting the passing of "The greatest Sci-Fi writer in history". << NSFW

[5eraph]

Just a reminder: KB982666 can no longer be optional if KB970430 is removed. It is necessary to have one or the other after installing KB968389.

This post has been edited by 5eraph: 07 June 2012 - 05:48 AM

[Explorer09]

5eraph, on 07 June 2012 - 05:11 AM, said:

Just a reminder: KB982666 can no longer be optional if KB970430 is removed. It is necessary to have one or the other after installing KB968389.

Are you sure about this? I find no information on Microsoft website saying that KB968389 depends on any other updates.

Another reminder: Neither KB982666, KB970430, or KB968389 is offered by Windows Update. I checked this less than a month ago.

This post has been edited by Explorer09: 10 June 2012 - 08:58 AM

[5eraph]

Check again after installing KB968389, Explorer09. That's what I did. The update site will list KB970430.

KB970430 requires KB968389, not the other way around.

This post has been edited by 5eraph: 10 June 2012 - 03:01 PM

[Explorer09]

5eraph, on 10 June 2012 - 02:47 PM, said:

Check again after installing KB968389, Explorer09. That's what I did. The update site will list KB970430.

KB970430 requires KB968389, not the other way around.

I got the claim about what you said in Microsoft's article. Thanks.

Quote

http://support.microsoft.com/kb/970430
To use the features that this update includes, you must have the update 968389 installed on the computer. For more information, click the following article number to view the article in the Microsoft Knowledge Base:
968389 Extended Protection for Authentication

By the way, I found some more items on the list that need to be corrected.
KB936357 (Intel CPU update) - This is a high-priority update.
KB971029 (Autorun patch) - This is a high-priority update, too.
KB2492386 - This is offered as optional updates in Windows Update.

KB982316 - Not offered in my Windows Update. (I think this should be optional.)
KB2345886 - Not offered in my Windows Update. (I think this should be optional.)

[5eraph]

KB936357 - This update is high priority on hardware with Intel CPUs, but not for AMD or other processors. I no longer have an AMD machine to verify this, but it was true as of 2008/06/06 when I had AMD hardware.

KB971029 - Was initially offered as an optional update on Windows Update on 2011/02/08. I don't know when it got bumped up to high priority status.

KB2345886 - Install KB968389 first, then you will see this update on the Windows Update site (just like KB970430 ).

I could do this all day, but Microsoft is releasing more updates in a few hours.

[Explorer09]

5eraph, on 12 June 2012 - 08:42 AM, said:

KB2345886 - Install KB968389 first, then you will see this update on the Windows Update site (just like KB970430 ).

Finally I get it. It was my mistake all the time. When I said I checked Windows Update, I did so only once.
I didn't realize that KB2345886 and KB970430 two updates are offered at the second check.

OK, both KB2345886 and KB970430 are high-priority updates, and require KB968389 (also high-priority) to be installed first.

This post has been edited by Explorer09: 14 June 2012 - 06:19 PM

[Kurt_Aust]

June updates

Deletions:
Hotfix\344-WindowsServer2003.WindowsXP-KB970430-x64-ENU.exe
Hotfix\744-WindowsServer2003.WindowsXP-KB2641690-v2-x64-ENU.exe
Hotfix\764-WindowsServer2003.WindowsXP-KB2633952-v2-x64-ENU.exe
Hotfix\804-WindowsServer2003.WindowsXP-KB2621440-x64-ENU.exe
Hotfix\904-IE8-WindowsServer2003.WindowsXP-KB2675157-x64-ENU.exe
RunOnce\install_flash_player_11_active_x_32bit.exe
RunOnce\install_flash_player_11_active_x_64bit.exe
RunOnce\NDP20SP2-KB2656369-x64.exe
RunOnce\NDP40-KB2656368-x64.exe

Additions:
@ . . . Hotfix\828-WindowsServer2003.WindowsXP-KB2698707-x64-ENU.exe .. . . 709,376 . Time Zone - Cumulative
@ . . . Hotfix\832-WindowsServer2003.WindowsXP-KB2718704-x64-ENU.exe . . 1,717,216 . Fraudulent Digital Certificates Cumulative
@ ▼ Hotfix\836-WindowsServer2003.WindowsXP-KB2709162-x64-ENU.exe . . 4,365,056 . MS12-041 - Kernel-Mode Drivers
@ . . . Hotfix\840-WindowsServer2003.WindowsXP-KB2685939-x64-ENU.exe .. . . 781,568 . MS12-036 - Remote Desktop Protocol (RDP)
# ▼. Hotfix\904-IE8-WindowsServer2003.WindowsXP-KB2699988-x64-ENU.exe 43,846,912 . MS12-037 - Cumulative Security Update

# ▼. RunOnce\install_flash_player_11_active_x.exe 9,225,928 . Updated 11 June
@ . . . RunOnce\NDP20SP2-KB2656369-v2-x64.exe 1,556,416 MS12-025 - XAML Browser Applications (XBAPs)
# ▼. RunOnce\NDP20SP2-KB2686828-x64.exe 11,962,488 . MS12-038 - XAML Browser Applications (XBAPs)
@ . . . RunOnce\NDP40-KB2656368-v2-x64.exe . 1,748,400 . MS12-025 - XAML Browser Applications (XBAPs)
@ ▼. RunOnce\NDP40-KB2686827-x64.exe . . . 4,348,008 . MS12-038 - XAML Browser Applications (XBAPs)

and .Net keeps BAP, BAP, BAPing along ...

[krick]

Thank you for this impressive and well thought out guide.

I have a few questions. None of this is criticism, I'm asking honest questions because I want to learn the best way to make my CD/DVD.

1) Is the directory structure contained in your Config_XP-64_date.7z file supposed to overlay the contents copied from one's XP x64 CD or is it just something to keep the files organized before slipstreaming?

2) When I was integrating SP2 using nlite, I got a warning dialog about existing hotfixes that needed to be removed before applying the service pack. Is this normal? My XP x64 source was copied directly from a factory pressed CD. Any hotfixes present must have been put there by Microsoft.

3) Your "Internet Explorer 8 subgroup" has an old version of 5eraph's Internet Explorer 8 AddOn from 2009_03 along with several updates. I assume that the latest version of 5eraph's Internet Explorer 8 AddOn already has those updates included. Can I just use that instead, or is there some specific reason you're using the older version?

4) Regarding DirectX... I see that you're using the directx_Jun2010_redist.exe in RunOnce. code65536 built addon packs for DirectX (later maintained by Yumeyao) that purport to be equivalent, yet quite smaller. Is there some advantage to or benefit from using the redist version that I'm not considering? http://www.ryanvm.ne...opic.php?t=8136

5) Regarding WMP11... There's a comment near the end of this thread by user ricktendo64 about KB970159 and the boooggy's WMP11 slipstreaming tool. What is he talking about?... http://www.ryanvm.ne...amer&start=1050

[Kurt_Aust]

krick, on 22 June 2012 - 04:02 PM, said:

1) Is the directory structure contained in your Config_XP-64_date.7z file supposed to overlay the contents copied from one's XP x64 CD or is it just something to keep the files organized before slipstreaming?

Both, after slipsteaming one should copy the Run*_XP-64.bat files and the AddOns & RunOnce folders to the nLite working directory as indicated in step 9 of the guide.

krick, on 22 June 2012 - 04:02 PM, said:

2) When I was integrating SP2 using nlite, I got a warning dialog about existing hotfixes that needed to be removed before applying the service pack. Is this normal? My XP x64 source was copied directly from a factory pressed CD. Any hotfixes present must have been put there by Microsoft.

No it is not normal, are you sure that your CD isn't SP2 already? Check the root directory of the CD, if it has WIN51AP.SP2 then the disk is Service Pack 2.

krick, on 22 June 2012 - 04:02 PM, said:

3) Your "Internet Explorer 8 subgroup" has an old version of 5eraph's Internet Explorer 8 AddOn from 2009_03 along with several updates. I assume that the latest version of 5eraph's Internet Explorer 8 AddOn already has those updates included. Can I just use that instead, or is there some specific reason you're using the older version?

Yes you can use the updated version if you like, in fact you can use 5eraph's pack and skip the vast majority of the Hotfixes, needing only DirectX, WMP11 and .Net related ones.

krick, on 22 June 2012 - 04:02 PM, said:

4) Regarding DirectX... I see that you're using the directx_Jun2010_redist.exe in RunOnce. code65536 built addon packs for DirectX (later maintained by Yumeyao) that purport to be equivalent, yet quite smaller. Is there some advantage to or benefit from using the redist version that I'm not considering? http://www.ryanvm.ne...opic.php?t=8136

You can try it, but I haven't tested it. Considering I've never heard of an x64 capable computer that only has a CD rather than a DVD drive I've never been worried about the size of the various installers.

krick, on 22 June 2012 - 04:02 PM, said:

5) Regarding WMP11... There's a comment near the end of this thread by user ricktendo64 about KB970159 and the boooggy's WMP11 slipstreaming tool. What is he talking about?... http://www.ryanvm.ne...amer&start=1050

Googling it, it seems to be similar to the old and tempermental Media Transfer Protocol, as it's not a high priority download it's not included in the update list.