https://www.theregister.com/2024/11/08/windows_2025_surprise_install/ # # Sign in / up The Register(r) -- Biting the hand that feeds IT # # # Topics Security Security All SecurityCyber-crimePatchesResearchCSO (X) Off-Prem Off-Prem All Off-PremEdge + IoTChannelPaaS + IaaSSaaS (X) On-Prem On-Prem All On-PremSystemsStorageNetworksHPCPersonal TechCxOPublic Sector (X) Software Software All SoftwareAI + MLApplicationsDatabasesDevOpsOSesVirtualization (X) Offbeat Offbeat All OffbeatDebatesColumnistsScienceGeek's GuideBOFHLegalBootnotesSite NewsAbout Us (X) Special Features Special Features All Special Features Cybersecurity Month VMware Explore Blackhat and DEF CON Cloud Infrastructure Month Malware Month The Reg in Space Spotlight on RSA Vendor Voice Vendor Voice Vendor Voice All Vendor Voice Vonage Amdocs GE Vernova with AWS GE Vernova with AWS Siemens and AWS Gen AI Siemens and AWS IT/OT Amazon Web Services (AWS) New Horizon in Cloud Computing DDN Google Cloud Data Transformation Google Gemini Hewlett Packard Enterprise: Edge-to-Cloud Platform Intel vPro VMware (X) Resources Resources Whitepapers Webinars & Events Newsletters [oses] OSes 11 comment bubble on white Microsoft still not said anything about unexpected Windows Server 2025 installs 11 comment bubble on white Affected business calls situation 'mindbogglingly dangerous' as sysadmins reminded to check backup and restore strategies icon Richard Speed Fri 8 Nov 2024 // 16:25 UTC # Microsoft remains silent over Windows Server 2025 turning up in the guise of a security update earlier this week, much to the chagrin of affected administrators. On November 5, Microsoft seemingly mislabeled the Windows Server 2025 upgrade with a globally unique identifier (GUID) for updates. The result was that some administrators' were faced with a surprise install of Windows Server 2025 thanks to patching software downloading and installing what was tagged as an update but instead turned out to be a whole new operating system. The erroneous labeling itself was not enough to trigger an installation. However, some deployments of third party patching software misclassified it and applied it to servers. The problem was initially noted by a customer of security business Heimdal who arrived in the office to find Windows Server 2025 unexpectedly on their hardware. [oses] According to Heimdal, Microsoft mistakenly labeled the Windows Server 2025 upgrade as KB5044284, a security update. [oses] [oses] Morten Kjaersgaard, chairman and founder of Heimdal, told The Register: "We noticed that the Microsoft Server 2025 migration is automatic, which is mindbogglingly dangerous given the operational risk for customers facing unexpected downtime. "On top of that, which is extremely concerning, the licensing check for Server 2025 happens only after the upgrade, which is completely irrational and adds further risk for end users, because you are then forced to pay for a new license, post your upgrade, as a rollback is virtually impossible to guarantee. [oses] "Imagine if your electric car - say, a Tesla - received an automatic software update, but you couldn't drive on the new version, until you entered your credit card details to pay the full MSRP once again for the upgrade. Tesla would promptly be out of business, especially since you already paid for the car once." Days after we asked the company for comment, a Microsoft spokesperson told El Reg "we're looking into this" and promised an update if it had anything to add. Since then, silence. For affected administrators, silence will not be acceptable. Kjaersgaard told us on November 7 that Microsoft had pulled back the update however he hadn't seen a sign of a rollback being made available. He noted that such a rollback would be "technically very challenging" and said Heimdal was committed to ensuring that affected customers have a way forward via the company's Microsoft contacts. * Sysadmin shock as Windows Server 2025 installs itself after update labeling error * Buckle up, admins - Windows Server 2025 officially hits GA * Admins using Windows Server Update Services up in arms as Microsoft deprecates feature * Microsoft to stop telling investors about peformance of server products A problematic update causing problems on Windows hardware? It all sounds rather familiar, though thankfully more limited in scope. Jim Gaynor, editorial vice president at IT consultancy Directions on Microsoft, drew parallels with the CrowdStrike incident. He said: "This underscores that customers need to have careful monitoring of their patch/update management systems to avoid unintended consequences, and they should also have solid backup and restore processes in place to be able to recover from a failed patch/update of any sort. The CrowdStrike incident was just four months ago, after all - it's the same lesson. [oses] "It also shows the risk of Microsoft promoting paid and/or potentially disruptive upgrades in 'trusted' channels that have traditionally been reserved for items customers could more or less blindly accept. Items that customers have been encouraged to quickly accept in the name of maintaining security. "By putting something like an OS upgrade that requires paid license keys to activate in that channel, it means that a small error in labeling or classification or even a misclick from a hurried user could have some pretty serious consequences. "Overall, whether it's CrowdStrike, Microsoft, or anyone else, vendors need to exercise care in how they present and deliver updates and patches - and putting a paid upgrade in the channel used for updates and patches is a risky and, in my opinion, ill-considered move that doesn't serve their customers." (r) Addendum on November 8: Microsoft is said to have pulled for now the update that was causing Server 2025 to be installed. Get our Tech Resources # Share More about * Microsoft * Operating System * Server More like these x More about * Microsoft * Operating System * Server * Sysadmin * Windows Server Narrower topics * Active Directory * Android * Azure * Bing * BSoD * CentOS * Debian * Elementary OS * Excel * Exchange Server * Firmware * Help Desk * HoloLens * Home lab * Internet Explorer * iOS * LinkedIn * Linux * macOS * Microsoft 365 * Microsoft Build * Microsoft Edge * Microsoft Fabric * Microsoft Ignite * Microsoft Office * Microsoft Surface * Microsoft Teams * .NET * Office 365 * OS/2 * Outlook * Patch Tuesday * Pluton * Qubes * SharePoint * Skype * SQL Server * Ubuntu * UEFI * Unix * Visual Studio * Visual Studio Code * Who, Me? * Windows 10 * Windows 11 * Windows 7 * Windows 8 * Windows Server 2003 * Windows Server 2008 * Windows Server 2012 * Windows Server 2013 * Windows Server 2016 * Windows Subsystem for Linux * Windows XP * Xbox * Xbox 360 Broader topics * Bill Gates * Windows More about # Share 11 comment bubble on white COMMENTS More about * Microsoft * Operating System * Server More like these x More about * Microsoft * Operating System * Server * Sysadmin * Windows Server Narrower topics * Active Directory * Android * Azure * Bing * BSoD * CentOS * Debian * Elementary OS * Excel * Exchange Server * Firmware * Help Desk * HoloLens * Home lab * Internet Explorer * iOS * LinkedIn * Linux * macOS * Microsoft 365 * Microsoft Build * Microsoft Edge * Microsoft Fabric * Microsoft Ignite * Microsoft Office * Microsoft Surface * Microsoft Teams * .NET * Office 365 * OS/2 * Outlook * Patch Tuesday * Pluton * Qubes * SharePoint * Skype * SQL Server * Ubuntu * UEFI * Unix * Visual Studio * Visual Studio Code * Who, Me? * Windows 10 * Windows 11 * Windows 7 * Windows 8 * Windows Server 2003 * Windows Server 2008 * Windows Server 2012 * Windows Server 2013 * Windows Server 2016 * Windows Subsystem for Linux * Windows XP * Xbox * Xbox 360 Broader topics * Bill Gates * Windows TIP US OFF Send us news --------------------------------------------------------------------- Other stories you might like Sysadmin shock as Windows Server 2025 installs itself after update labeling error Screens sprayed with coffee after techies find Microsoft's latest OS in unexpected places OSes6 Nov 2024 | 92 Windows 11 continues to creep up behind Windows 10 Dark alley and a brick in a sock required to accelerate market share growth? OSes4 Nov 2024 | 52 Microsoft turning away AI training workloads - inferencing makes better money Azure's acceleration continues, but so do costs AI + ML31 Oct 2024 | 18 AI-assisted malware resistance, response and recovery How visibility into the life of an IO all the way from the storage controller to the flash media aids cyber protection Sponsored Feature [oses] Is Microsoft's AI Copilot? CoPilot? Co-pilot? MVP creates site to help get it right When you say 'team' do you mean 'Teams' or a SharePoint 'team site'? Letmecorrectthatforyou.com explains the difference Software28 Oct 2024 | 40 Microsoft accused of 'greenwashing' as AI used in fossil fuel exploration Activists press Redmond to come clean on 'material reputational, legal, and operational risks' AI + ML31 Oct 2024 | 40 Buckle up, admins - Windows Server 2025 officially hits GA Thank you, vNext... and yes, there are plenty of updates to keep you busy OSes4 Nov 2024 | 15 Microsoft rolls out AI-enabled Notepad to Windows Insiders Rewrite 'please leave my text editor alone' OSes7 Nov 2024 | 47 Microsoft reshuffles execs in Europe, Middle East and Africa unit UK CEO becomes EMEA president after taking on role in Brit industrial strategy PaaS + IaaS28 Oct 2024 | 1 Microsoft accuses Google of creating a lobbying front called 'Open Cloud Coalition' Seemingly dissatisfied with CISPE settlement, new UK-centric cloudy industry group calls for end to 'restrictive licensing' Software29 Oct 2024 | 12 Microsoft tries out wooden bit barns to cut construction emissions The two hybrid datacenters promise 35% less embodied carbon than steel builds, 65% less than concrete On-Prem1 Nov 2024 | 73 Black screens still plague Windows 10 Azure Virtual Desktop users Meanwhile, even Task Manager is no match for the broken patch OSes4 Nov 2024 | 8 The Register icon Biting the hand that feeds IT About Us* * Contact us * Advertise with us * Who we are Our Websites* * The Next Platform * DevClass * Blocks and Files Your Privacy* * Cookies Policy * Privacy Policy * Ts & Cs * Do not sell my personal information Situation Publishing Copyright. All rights reserved (c) 1998-2024 no-js