ReFS issues with latest Windows Server Updates (KB5009624, KB5009557, KB5009555)

Microsoft has pulled now the updates from the update servers:

https://www.bleepingcomputer.com/news/microsoft/microsoft-pulls-new-windows-server-updates-due-to-critical-bugs/amp/

It’s a good start in 2022. To many things go sideways. :)

Nope that’s it, Microsoft took it too far this morning! Decided my headset and webcam were untrustworthy (or maybe they meant the person on them, aka me!) 😆

KB5009555 for Windows 2022 doesn’t seem to have been pulled. My test server still downloads this update from Windows Update. However, this is the faulty update which causes the raw ReFS issue.

FYI the out of bound update, KB5010794, is still breaking ReFS for 2012r2.

So possibly it’s the combination of installing the past ‘bad’ update and KB5010794 together that is needed? We blocked the original so we had KB5010794 install by itself. From your link:
 

So, I pulled it through today (I informed myself and resisted for a long time).
Thank you to everyone here who helped share information.
The new patches were used: KB5010791 (2019 server), KB5010790 (2016 server) and KB5010794 (server 2012R2)
1x 2012R2 server (DC)
4x 2019 server (DCs)
4x 2016 server (RODCs)
All servers had the latest patch status the Dec. Patchday updates.
First the 4x 2019 servers with KB5010791 (because it's a cumulative update, pulled from the update catalog), then the 2012R2 via Windows Update, here I selected the 'bad' January update from 01/11/22 TOGETHER with the optional KB5010794 and installed both at once.
Finally the 4x 2016s with KB5010790 from the Update Catalog.
Everything is running - lucky :)

Can people on here please confirm if they are using Refs on VMWare VM’s   (where the hotplug feature makes the drives appear as removable)
Vmware fix to overcome that is https://kb.vmware.com/s/article/1012225?lang=en_us

Or are some of your system really using removable drives?

For WS2012R2 using refsv1  the OOB fix will not and never will overcome the issue on removable drives
The Microsoft OOB fix is only for refs 3.x on removable drives in ws2016 and later
NOte - some systems running later OS’s may be using old disk formatted with refs v1  and so those refsv1 disks will be affected if they are considered removable

fsutil fsinfo refsinfo x:   will show the refs version
although of course cant run taht if the volume is already showing RAW!

KB5010691: ReFS-formatted removable media may fail to mount or mounts as RAW after installing the January 11, 2022 Windows updates (microsoft.com)
Mentions the OOB fix but unfortunately doesnt link to them
Mentions  applicable to refs v2  (aka 3.x)
Unfortunately doesnt mention the vmware aspect  or the 2012r2/refsv1 aspect

This setting indeed solves the issue for us on a Windows Server 2019 machine. Now the ReFS volume is accessible again after installing the updates. However, other VMs which still have accessible ReFS volumes after installing the patches don't have this configuration setting and they also have the eject option on the taskbar for the virtual disk. So, although the devices.hotplug setting fixes the issue, it's not the whole story.

Thanks @stephc_msft ! Questionable though why MS Support isn't aware of this setting.

@stephc_msft  When running the fsutil command on our affected server it returns:

REFS Volume Serial Number :       0xb660b96e60b935c9
REFS Version   :                  1.2
Number Sectors :                  0x0000000004fe0000
Total Clusters :                  0x000000000009fc00
Free Clusters  :                  0x0000000000049906
Total Reserved :                  0x0000000000000000
Bytes Per Sector  :               512
Bytes Per Physical Sector :       512
Bytes Per Cluster :               65536
Checksum Type:                    CHECKSUM_TYPE_NONE

So it looks like we have the old ReFS version although the system is running Windows Server 2019. Why is this volume still on the old version, shouldn't it be upgraded automatically? Other Windows 2019 machines which don't have the issue have ReFS version 3.4.

 You’re definetly right with that

Better check with a different person, just to be sure

But perhaps it’s a security feature? Microphones and webcams can spy on you, so better throw it all away

@Iams3leI’m sure this won’t be the last time we see such issues; just hope it won’t be in January…

@vNote42Reboots tend to solve problems and make the system more stable; so you’re spot on with “it’s a feature”

aww bad patch MS

//VPN /IPSec Issue: Certain IPSEC connections might fail

• https://docs.microsoft.com/en-us/windows/release-health/status-windows-11-21h2#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-21h2#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-21h1#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-20h2#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1909#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1809-and-windows-server-2019#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1607-and-windows-server-2016#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1507#2773msgdesc
• https://docs.microsoft.com/en-us/windows/release-health/status-windows-server-2022#2773msgdesc

//Domain Controller rebooting issue

• https://docs.microsoft.com/en-us/windows/release-health/stat...
• https://docs.microsoft.com/en-us/windows/release-health/stat...

//Hyper V issue

• https://docs.microsoft.com/en-us/windows/release-health/stat...
• https://docs.microsoft.com/en-us/windows/release-health/stat...

That’s because Microsoft released them AGAIN on a FRIDAY 🤯

https://www.bleepingcomputer.com/news/microsoft/microsoft-resumes-rollout-of-january-windows-server-updates/