Last week I wrote about a mysterious new patch for Windows 7 and 8.1 machines called KB 3123862. Released on Feb. 3, the nearly undocumented optional patch claimed it would ease the transition to Windows 10.
Yesterday, Feb. 10, Microsoft changed the patch from optional to recommended, and it's now being installed automatically on millions of machines. One big problem: Nobody seems to know what the patch does.
The timing of the metamorphosis is a bit unclear. Microsoft's official Windows Update content page says KB 3123862 was released as a recommended update on Feb. 9. I started hearing about it on Feb. 10. The KB article itself was last updated today, Feb. 11. The article is now up to version 3.
Here's what we know about it.
The KB article title says the patch "updated capabilities to upgrade Windows 8.1 and Windows 7." The one-line description in the KB article says simply, "This update adds capabilities to some computers that lets users easily learn about Windows 10 or start an upgrade to Windows 10."
In my warning last week, I compared this patch to the much-maligned KB 3035583, the patch that started us on the "Get Windows 10" coerced Win10 upgrade campaign. KB 3123862's switch from optional to recommended -- which means that Win7 and 8.1 computers with default upgrade settings will automatically install it -- sounds even more like the "Get Windows 10" campaign.
On AskWoody.com, frequent contributor PKCano ran the patch on a freshly installed Windows 7 SP 1 system. Here's what she found:
- Explorer.exe changed from version6.1.7601.17567 to version 6.1.7601.19135. Timestamp went from 2/24/11 11:30 p.m. to 1/21/16 11:13 p.m.; notably, the size swelled from 2555KB to 2904KB
- ExplorerFrame.dll changed from version 6.1.7601.18952 to 6.1.7601.19135, timestamp from 8/6/15 12:44 p.m. to 1/22/16 12 a.m.; no change in file size
- Shell32.dll changed from version 6.1.7601.18952 to 6.1.7601.19135, timestamp from 8/6/15 12:44 p.m. to 1/21/16 11:13 p.m.; file size went from 12574KB to 12576KB
- Authui.dll changed from version 6.1.7601.18896 to 6.1.7601.19135, timestamp from 6/15/15 4:43 p.m. to 1/21/16 11:59 p.m.; no change in file size
So the version numbers are now aligned. The big mystery: What in the world caused explorer.exe to swell by 350KB?
GWX Control Panel author Josh Mayfield installed the earlier, optional version of the patch and found that it didn't add any new processes or tasks, nor did it monkey with the GWX registry entries. In particular, KB 3123862 doesn't revive the Get Windows 10 icon in the system tray, and it doesn't change DisableOSUpgrade in the registry.
There's a lengthy reddit post on the subject, but it doesn't shed any light on the nature of the patch.
It isn't clear to me if any of the Group Policy settings or registry settings that are designed to fend off the Windows 10 upgrade onslaught will have any effect on what KB 3123862 is doing. Microsoft certainly hasn't documented anything about this newly recommended update.
The patch now appears on WSUS update servers. Admins trying to make a decision about deploying it across organizations are caught trying to judge a patch to key Windows system files that's basically undocumented.
It's a Dirty Harry patch. You have to ask yourself one question: "Do I feel lucky?" Well, do ya?