Skip to content
IT // Adventures

Windows Updates Kb4480970 & Kb4480960

Problems with the January Windows updates Kb4480970 and Kb4480960.

2 min read
Contents

The January 2019 updates KB4480970 and KB4480960 for Windows 7 and Windows Server 2008 R2 cause problems when accessing file shares. If the updates above are installed on a host that offers network shares, users who have local admin permissions on that very host can no longer access it remotely.

The user “answer” analyzed the problem in the administrator.de forum and posted some suggested solutions.

Cause

After the updates are installed, SMB2 connections of the affected users fail with the message “Invalid Handle”. This is probably related to the changed handling of remote UAC tokens to do.

On closer inspection, Microsoft has actually made the system more secure with the patch, because the same remote UAC rules now apply as for administrative shares (e.g. admin$)!

Solution or workaround

Method 1: Work with users without admin rights

The method also recommended by Microsoft is to evaluate why users with local admin permissions need to access shares on the host in the first place.

Method 2: Uninstall the updates

After uninstalling the updates and a reboot, the problem naturally disappears as well.

Method 3: Adjust the UAC token filter policy

CAUTION, this workaround weakens the security of the system!

The remote UAC check can be controlled via a registry key. If the key “LocalAccountTokenFilterPolicy” is set to “1”, ALL users with local administrator rights also receive an administrator token remotely. However, this opens the system up to potential pass-the-hash attacks!

If access to the shares by local administrators is absolutely necessary, the registry key can be set via batch, PowerShell or GPO:

Set-ItemProperty -Path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System -Name  LocalAccountTokenFilterPolicy -Value 1 -Type DWord
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v LocalAccountTokenFilterPolicy /t REG_DWORD /d 1 /f

Sources