Looking at the server installation point - https is inaccessible from Internet Explorer and Edge, while it works fine from Chrome:
The Microsoft fix is impacting other areas of infrastructure as well. The immediate workaround is to uninstall KB 3163622 / 3163018 from affected PCs until either Microsoft resolves the issue or Infor provides an official mitigation. It also appears that there may be group policy changes that can be made to address this, but I haven't tested these yet:
"MS16-072 changes the security context with which user group policies are retrieved. This by-design behavior change protects customers' computers from a security vulnerability. Before MS16-072 is installed, user group policies were retrieved by using the user's security context. After MS16-072 is installed, user group policies are retrieved by using the machines security context. This issue is applicable for the following KB articles:
3159398 MS16-072: Description of the security update for Group Policy: June 14, 2016
3163017 Cumulative update for Windows 10: June 14, 2016
3163018 Cumulative update for Windows 10 Version 1511 and Windows Server 2016 Technical Preview 4: June 14, 2016
3163016 Cumulative Update for Windows Server 2016 Technical Preview 5: June 14 2016
Symptoms
All user Group Policy, including those that have been security filtered on user accounts or security groups, or both, may fail to apply on domain joined computers.
Cause
This issue may occur if the Group Policy Object is missing the Read permissions for the Authenticated Users group or if you are using security filtering and are missing Read permissions for the domain computers group.
Resolution
To resolve this issue, use the Group Policy Management Console (GPMC.MSC) and follow one of the following steps:
Add the Authenticated Users group with Read Permissions on the Group Policy Object (GPO).
If you are using security filtering, add the Domain Computers group with read permission."
KB3161608 causes the same problem for Windows 7 devices. The information from infor is that a) they are aware of the problem, b) to un-install KB3161608 and C) upgrade to dotnet framework 4.6
ReplyDelete(if KB 3146717 is still not installed, you need to install the KB 3146717 which is the .Net 4.6.x update )
Thanks for this article, I've got same error message with remote desktop connection on Windows Server 2012 R2 but can't find which KB I have to uninstall to make M3 work again.
ReplyDeleteJeff.
Hi Jeff. There's a workaround now as per http://movexblog.blogspot.com/2016/08/windows-10-patch-ms16-072-3163622.html
DeleteThis comment has been removed by the author.
ReplyDeleteFYI - Mathias Wallgren posted a solution here: https://www.linkedin.com/pulse/urgent-notification-infor-smart-office-connection-server-wallgren
ReplyDelete