Add registry keys for Jan 2018 security patches & meltdown patch

[#154297605] Signed-off-by: Natalie Arellano <narellano@pivotal.io>
cloudfoundry · Jan 12, 2018 · 3bf5421 · 3bf5421
1 parent a60f5be
commit 3bf5421
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/bosh-psmodules/modules/BOSH.WindowsUpdates/BOSH.WindowsUpdates.psm1 b/bosh-psmodules/modules/BOSH.WindowsUpdates/BOSH.WindowsUpdates.psm1
@@ -40,6 +40,14 @@ function Wait-WindowsUpdates {
 
 function Install-WindowsUpdates {
 
+    # Set registry key so that we will receive the Jan 2018 patches (KB4056895)
+    REG ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat /f /v cadca5fe-87d3-4b96-b7fb-a231484277cc /t REG_DWORD /d 0
+
+    # Set registry keys so that KB4056898 will be enabled
+    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverride /t REG_DWORD /d 0 /f
+    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management" /v FeatureSettingsOverrideMask /t REG_DWORD /d 3 /f
+    reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization" /v MinVmVersionForCpuBasedMitigations /t REG_SZ /d "1.0" /f
+
     if (test-path "C:\provision\patch.msu") {
         Write-Log "Already installed out-of-band patch"
     } else {