Windows 10 KB4598298 Update Fixes Crashes And Restart Issues

Microsoft has released the KB4598298 update for all editions of Windows 10 and Windows Server versions 1809 and 1909, with fixes for unexpected system restart issues, system crashes due to BitLocker, and multiple LSASS issues.

After installing the KB4598298 non-security preview cumulative update you may experience issues with system and user certificates getting lost if updating from Windows 10 1809 or later versions using outdated update media.

“The preview update for Windows 10, version 20H2 and Windows 10, version 2004 will be available in the near term,” Microsoft added in a Windows Message Center update.

Further details regarding the types of updates Microsoft releases each month can be found inside Windows 10 update servicing cadence primer.

KB4598298 update highlights

With KB4598298 monthly “C” release preview update, Microsoft addresses a webio.dll issue that would cause unexpected system restarts due to a LSASS access violation throwing an 0xc0000005 exception code.

The update also fixes LSASS issues leading to server memory leaks when Kerberos Armoring is toggled on and to the process freezing after installing Windows updates released in September 2020 and later.

KB4586819 also addresses issues causing the BitLocker volume encryption service to stop working with a BITLOCKER_FATAL_ERROR (error 0x120) or to fail after deployment on Hybrid Azure Active Directory (Azure AD) joined devices.

Other highlights included in this update:

• Updates an issue with some special key combinations used in DaYi, Yi, and Array IMEs that might cause an application to stop working.
• Updates an issue that prevents you from opening a document that is on the Windows desktop and generates the error, “The directory name is invalid.”
• Updates an issue that displays a blank lock screen after a device wakes up from Hibernate.
• Corrects historical daylight savings time (DST) information for the Palestinian Authority.
• Adds a notification that tells you when your device is close to end of service (EOS). At EOS, your device will stop receiving important quality and security updates.
• Updates an issue that fails to show Extract all on the shortcut menu when you right-click an online-only ZIP file.

Also Read: How Formidable is Singapore Cybersecurity Masterplan 2020?

What’s changed in KB4598298

Since KB4598298 is a preview update, it is considered optional and it will not be installed automatically by Windows 10. To install it manually, open Windows Update and perform a manual ‘Check for updates.’

Next, you’ll find the link to download and install this update by going to the ‘Optional updates available’ area.

The update can also be downloaded manually from the Microsoft Catalog. After installing this update, Windows 10, version 1909 will be updated to build 18363.1350.

To minimize issues with this update, Microsoft also recommends installing the latest servicing stack update (SSU) installed before this cumulative update is deployed. If you are using Windows Update, the latest SSU will be installed for you automatically.

Here is the full list of key quality improvements and fixes delivered by this non-security update:

• Enables administrators to disable standalone Internet Explorer using a Group Policy while continuing to use Microsoft Edge’s IE Mode.
• Enables you to configure certain policies that support Microsoft Edge IE Mode using mobile device management (MDM).
• Addresses an issue that displays a User Account Control (UAC) dialog box unexpectedly when you turn on speech recognition.
• Addresses an issue that fails to notify the target application when you select the Copy link command on the Share menu.
• Changes the way DirectX 12 runtime components load by splitting the d3d12.dll binary into two pieces: d3d12.dll and d3d12core.dll. This change improves versioning and updating for these components.
• Addresses an issue that prevents JumpList items from functioning. This occurs when you create them using the Windows Runtime (WinRT) Windows.UI.StartScreen API for desktop applications that are packaged in the MSIX format.
• Addresses an issue that occurs when the Mandatory Profile check box is selected when you copy a user profile.
• Addresses an issue with some special key combinations used in DaYi, Yi, and Array IMEs that might cause an application to stop working.
• Addresses an issue that prevents you from opening a document that is on the Windows desktop and generates the error, “The directory name is invalid.” This issue occurs after changing the desktop location in the Location tab of the Desktop Properties dialog box (File Explorer > This PC > Desktop).
• Addresses an issue that displays a blank lock screen after a device wakes up from Hibernate.
• Corrects historical daylight savings time (DST) information for the Palestinian Authority.
• Addresses an issue with German translations of Central European Time.
• Adds support for serial number control using the registry.
• Addresses an issue that causes the upload of diagnostic logs to a management service, such as Microsoft Intune, to fail. The failure occurs because of a network time-out on a slow network.
• Displays a notification to a user when an administrator signs in to an MDM service, such as Microsoft Intune, to find the location of a managed device.
• Addresses an issue that causes the silent mode deployment of BitLocker to fail with the error 0x80310001. This issue occurs when deploying BitLocker encryption to Hybrid Azure Active Directory (Azure AD) joined devices.
• Addresses an issue that causes an unexpected system restart because of exception code 0xc0000005 (Access Violation) in LSASS.exe; the faulting module is webio.dll.
• Addresses an issue that might cause systems that use BitLocker to stop working with the error 0x120 (BITLOCKER_FATAL_ERROR).
• Addresses an issue that causes a device to stop working when deploying Microsoft Endpoint Configuration Manager if AppLocker is enabled on the device.
• Addresses an issue that might cause a black screen to appear or delay signing in to Hybrid Azure Active Directory joined machines. Additionally, there is no access to login.microsoftonline.com.
• Addresses an issue that cause the LSASS.exe process to leak memory on a server that is under a heavy authentication load when Kerberos Armoring (Flexible Authentication Secure Tunneling (FAST)) is enabled.
• Addresses a memory leak on Windows servers that are configured as Active Directory domain controllers. This issue occurs when the Key Distribution Center (KDC) attempts to fetch the Service for User (S4U) client name during certificate authentication.
• Addresses an issue that causes LSASS.exe to stop working because of a race condition that results in a double free error in Schannel. The exception code is c0000374, and the Event Log displays Schannel event 36888, fatal error code 20, and error state 960. This issue occurs after installing Windows updates from September 2020 and later.
• Addresses an issue in which a principal in a trusted MIT realm fails to obtain a Kerberos service ticket from Active Directory domain controllers (DC). This occurs on devices that installed Windows Updates that contain CVE-2020-17049 protections and configured PerfromTicketSignature to 1 or higher. These updates were released between November 10, 2020 and December 8, 2020. Ticket acquisition also fails with the error, “KRB_GENERIC_ERROR”, if callers submit a PAC-less Ticket Granting Ticket (TGT) as an evidence ticket without providing the USER_NO_AUTH_DATA_REQUIRED flag.
• Addresses an issue with HTTP caching that interferes with kiosk mode that targets Azure AD groups.
• Addresses an issue with using Windows Defender Application Control (WDAC) and running a file while Managed Installer (MI) or Intelligent Security Graph (ISG) is enabled. You can now use fsutil to look for the $KERNEL.SMARTLOCKER.ORIGINCLAIM extended-attribute (EA) on a file. If this EA is present, then MI or ISG can run the file. You can use fsutil in conjunction with Enabling ISG and MI diagnostic events.
• Addresses an issue that allows an app that has been blocked from hydrating files to continue hydrating files in some cases.
• Addresses an issue that prevents access to a Volume Shadow Copy Service (VSS) snapshot of Resilient File System (ReFS) volumes for 30 minutes. This occurs when the ReFS volumes contain 100,000 or more concurrently open files. As a result, a time-out occurs, which causes backups of the first and third applications to fail.
• Adds a notification that tells you when your device is close to end of service (EOS). At EOS, your device will stop receiving important quality and security updates.
• Addresses an issue with Administrative Template settings you configure using a Group Policy Object (GPO). When you change the value of the policy settings to NOT CONFIGURED, the system fails to remove the previous settings. This issue is most noticeable with roaming user profiles.
• Addresses an issue that fails to show Extract all on the shortcut menu when you right-click an online-only ZIP file.
• Updates the process for enrolling in online speech recognition. If you are already enrolled, you will see a message that asks you to review the new settings. If you choose not to contribute your speech data for human review, you can still use online speech recognition. The new settings contain one button to turn on online speech recognition and another button that turns on the collection of your voice clips. If you turn on the collection of your voice clips, you can turn it off at any time using the same button in the new settings page.

Also Read: Going Beyond DPO Meaning: Ever Heard of Outsourced DPO?