On decommissioning of update servers for 2000, XP, (and Vista?) as of July 2019

[VistaLover]

On 8/8/2020 at 9:36 PM, VistaLover said:

... That link also mentions the following:

Quote

WUA validates that the Wsusscn2.cab is signed by a valid Microsoft certificate before running an offline scan.

Note

In accordance with our SHA-1 deprecation initiative, the Wsusscn2.cab file is no longer dual-signed using both SHA-1 and the SHA-2 suite of hash algorithms (specifically SHA-256). This file is now signed using only SHA-256. Administrators who verify digital signatures on this file should now expect only single SHA-256 signatures.

... so without SHA-2 code-signing support (AFAIAA, this can't be implemented to OSes prior to Vista SP2 and in the latter, packages targeting originally WS2008SP2 are needed ), that method will become a moot one...

I foresee that the next release will only be SHA-2 signed...

... And, as expected, that has just happened! The latest WSUSscn2.cab file (links are still the same as in my previous post) is ONLY SHA-2 signed and probably just useless under XP SP3:

M$ is putting an end to everything pre-Win7, it seems...

[ppgrainbow]

I still have the July 2020 version of the WSUSscn2.cab file as a backup. I'm wondering if it will still work under Windows XP and Windows Vista even though they're out of support.

[Dave-H]

Does anyone have a version from 2019 archived?
As I can get the Nov 2018 version to work, but can't get the July 2020 version to work, I'd like to see if one from 2019 will work.

[MicahMoo11]

4 hours ago, Dave-H said:

Does anyone have a version from 2019 archived?
As I can get the Nov 2018 version to work, but can't get the July 2020 version to work, I'd like to see if one from 2019 will work.

yes i do however i did removed a lot of vista assets over the years the only household is my sister. everybody us moved on windows server 2008 sp2.

https://mega.nz/folder/9ccGBQhT#xczjcL8L2kvul7UfNbR_yg ( it shorld be under wumt(1).zip

[Dave-H]

Thanks @MicahMoo11, but I'm afraid the file in wumt(1).zip seems to be the same as the one I've already got, the 2020 file.

[MicahMoo11]

38 minutes ago, Dave-H said:

Thanks @MicahMoo11, but I'm afraid the file in wumt(1).zip seems to be the same as the one I've already got, the 2020 file.

sorry i forget i moved to july sense it was the last for shu 1 support. sadly i no longer have the 2019 build.

again in the future i will Double chick before making future comments.

[IntMD]

9 hours ago, Dave-H said:

Does anyone have a version from 2019 archived?
As I can get the Nov 2018 version to work, but can't get the July 2020 version to work, I'd like to see if one from 2019 will work.

I'll bite, have you checked the cab's signature properties whether it's actually SHA1/SHA256 double-signed or SHA2-only (do this from a modern windows as XP iirc seems to not be able to offer the signature tab for the cab, say one of those WinPE live-cds)

[Dave-H]

3 hours ago, MicahMoo11 said:

sorry i forget i moved to july sense it was the last for shu 1 support. sadly i no longer have the 2019 build.

again in the future i will Double chick before making future comments.

No problem, thanks anyway!

[Dave-H]

46 minutes ago, IntMD said:

I'll bite, have you checked the cab's signature properties whether it's actually SHA1/SHA256 double-signed or SHA2-only (do this from a modern windows as XP iirc seems to not be able to offer the signature tab for the cab, say one of those WinPE live-cds)

I have a utility to check in XP, it's definitely SHA1 signed.
That's why I can't understand why it won't work for me in WUMT.

[win32]

31 minutes ago, Dave-H said:

have a utility to check in XP, it's definitely SHA1 signed.

That 7zip component simply calculates the checksums for the executable. It does not check for any digital signatures tied to it.

My Windows 2000 does in fact allow me to check for digital signatures/certificates via file properties in Explorer. So XP should as well.

I just checked a Vista update from this year. Click the Digital Signatures tab, then click "Details", and then "Advanced" tab. Under "digest algorithm", it says sha256.

Edited August 12, 2020 by win32

[TigTex]

I can confirm. The new wsusscn2.cab doesn't have a sha1 signature.

Here's the last version with sha1 signature

Filename:  wsusscn2_sha1.cab

Date: 14 July 2020

Link: http://www.mediafire.com/file/jxklkf1p8bjifff/wsusscn2_sha1.cab/file

MD5: fe805bbf07898f2ab4ebc5e8a63983a8

Edited August 13, 2020 by TigTex

[Dave-H]

13 hours ago, win32 said:

That 7zip component simply calculates the checksums for the executable. It does not check for any digital signatures tied to it.

My Windows 2000 does in fact allow me to check for digital signatures/certificates via file properties in Explorer. So XP should as well.

I just checked a Vista update from this year. Click the Digital Signatures tab, then click "Details", and then "Advanced" tab. Under "digest algorithm", it says sha256.

I guess maybe I don't have the properties tab on cab files in Explorer on XP because I have cab files associated with WinZip?

Anyway, I checked the file on Windows 10 Explorer, which does show the details, and it's definitely the right digital signature date and definitely SHA1 signed.
It just doesn't work when I try to use it!

[tafaxo]

I have been seeing this issue with Windows XP updates since August 10. I tried to update the system via WUMT and I was getting error 0x80072F8F. However, in offline mode, it finds updates via the TigTex .cab file...

[Condor.07]

On 8/12/2020 at 8:35 AM, ppgrainbow said:

I still have the July 2020 version of the WSUSscn2.cab file as a backup. I'm wondering if it will still work under Windows XP and Windows Vista even though they're out of support.

but how do you find Windows Vista SP2 updates with WUMT ?
I've tried everything ...
downloaded the updates that immediately started Windows Update (KB3205638, KB4012583, KB4015195, KB4015380)
updates for the Windows 2008 SP2 SHA2 (KB4474419, KB4493730)
finds nothing!

[Vistapocalypse]

1 hour ago, Condor.07 said:

but how do you find Windows Vista SP2 updates with WUMT ?
I've tried everything ...

updates for the Windows 2008 SP2 SHA2 (KB4474419, KB4493730)
finds nothing!

Adding SHA-2 support definitely won’t help (in fact will hinder) because there are no updates for “Vista 6.0.6003.” @TigTex said WUMT worked on Vista here. (Un)Fortunately, my own Vista is fully updated and backed up, so I’m just a spectator here.