WTF, MS?

Frankly, that could probably be the tagline to this blog, but hey. Having had a run-in with a couple of trojans last night, I left the computer on overnight running a full scan, and by this afternoon it was showing the antimalware software running at 25% CPU pretty much constantly. Time for a clean reboot. On checking task manager following boot, I saw an Edge process kick off automatically, with nothing running. A bit of Googling led to this post on Windows Central which shows the bad effect Chrome has on everyone else - it used to be that only Chrome pre-loaded trash into memory (which was why, when I installed it many moons ago to test, it doubled my laptop's boot time) but now everyone's doing it, presumably because everyone's using Chromium as a base. The fix is to use group policies to stop it - Computer Configuration > Administrative Templates > Windows Components > Microsoft Edge and disable "Allow Microsoft Edge to pre-launch at Windows startup" and "Allow ME to start and load the Start and New Tab page at Windows startup". Also stops it when Windows is idle. (Nothing bugs me quite so much as the computer suddenly storming into life when it should be sitting there quietly, twiddling its silicon thumbs.)

New, yet old

 Left my machine running during tea, because I had a metric fucktonne* of work open - apps and various file explorer windows - and wanted to come back to it.

Came back, the machine was off. Nothing - repeat, nothing - in the event logs. No power cut either, everything else in the house running fine. Windows update (always a bastard) had not run.

Disturbed, I had a root around to find that the last file before it died was telemetry - specifically, Microsoft Office Click-to-run. Programs and Features is now showing Office with an install date of today.

A bit of Googling reveals the following:

https://social.technet.microsoft.com/Forums/en-US/cd971c47-bb24-49bc-9b53-6ec1cbdc9870/windows-update-no-office-2016-updates?forum=win10itprosecurity

i.e. if you have any Click-to-run version of Office installed, then updates are controlled within the applications, independent of Windows Update on the machine. 

I have no idea whether the update-and-shutdown-and-screw-your-workflow was by design, or if something failed, but updates are now disabled on this computer. I'll decide when to run them, thanks very much.

---

* 1.61x an imperial fuckton.

What a festering pile of SPP

 Ah, Microsoft devs. What on earth is the point of you? I'm always amazed when I do a Google search for an issue - any issue really - and find it's been a problem for years, through many iterations of the Windows OS and that dozens, if not hundreds, of fee-paying users continue to experience issues and Microsoft continues to do sweet FA, other than laugh all the way to the bank - while Bill Gates gets universal acclaim for saving humanity with the small change that one of his cleaning staff found down the back of just one of his many sofas.

I digress. This blog is pretty moribund, partly because I'm retraining to get the hell out of IT (because I looked at Linux, and at the online Linux communities, and decided I'd rather try my luck elsewhere). But it's here, so I may as well still use it for this one, which is peculiar. 

Software Protection Platform - this service handles licensing within Windows, for those apps and services which are registered with it. So it will be kicked off by Windows itself on login, plus Office, Windows Update, Windows Defender, and various remote access calls. I started poking it because, while it appears to be working on my system, it was making a lot of random calls and kept rescheduling itself for 2122. (There's no reason for this, other than bad coding - something about there being a 100-year default if an end-point isn't properly specified.) But a number of people are having major issues with it, and have been since at least Windows 8 - and the issues are still occurring in Windows 11. This can be the service failing to start, taking ages to start (during which time the system hangs) or the service randomly restarting and closing down apps, and sometimes computers, in the process. Tumbleweed from Microsoft, obvs.

SPP is a weird one because there are 3 tasks in the scheduler relating to it, and it will work fine if you disable 2 of them and leave the main SvcRestartTask running. The service itself is set to Automatic start and the only options are on or off - you can't set it to Manual even with PowerShell. If the service is running, any call to it will kick off reporting to Event Viewer, and the last thing it does is reconfigure the SvcRestartTask for 100 years in the future. If you disable the service, Windows will not be able to guarantee the licensing and things will break. If you leave the service enabled but disable SvcRestartTask - or even change its parameters - then licensing will work absolutely fine, but the SPP service will bitch every 30s to Event Log that the the task can't be rescheduled. So I can only assume there's something hardcoded into the service itself to do with that, as I can't find another task or service that would cause it. 

For anyone for whom this is causing actual problems, the only fix seems to be to work out (with the help of, say, PSTools) what exactly is causing the SPP service to kick off; if you're sitting there minding your own business and suddenly the system hangs or your app closes due to this, then something is calling SPP to trigger it (on servers this often seems to be remote management programs, and on desktops Windows Update seems to be the culprit). WU certainly can be disabled without issue, and only enabled when it's convenient to actually have it hog your bandwidth and system resources downloading fixes for things which Microsoft couldn't be bothered to code correctly in the first place.