Here is Microsoft's Security Advisory on the vulnerabilities, which have been assigned three "CVE" numbers:
CVE-2017-5715 - Branch target injection ("Spectre")
CVE-2017-5753 - Bounds check bypass ("Spectre")
CVE-2017-5754 - Rogue data cache load ("Meltdown")
The Microsoft KB for how these vulnerabilities impact SQL ...
I assume you're talking about me, and I'm not sure what post you mean, but here is my thought:
Patch your SQL Servers regularly.
I'm such a huge fan of patches that I wanted to make it easier for people to find the most current updates for SQL Server, so I built SQLServerUpdates.com.
If you ever want justification for why you should be patching, just go ...
When patching SQL Server:
Apply the most recent Service Pack, then
Apply the most recent Cumulative Update for that Service Pack.
You never have to go through Service Packs or Cumulative Updates in order. Just use the most recent of each, in the order above.
You can apply SP2 for SQL 2014 without SP1 being installed first, then apply CU8 for SP2. Like Service Packs, cumulative updates are just that - cumulative - so you do not need to apply each incremental CU. But to install the latest SP2 CU, you first need to apply SP2.
The scenario is called out and supported on the link you've provided.
Availability Group with One Remote Secondary Replica
If you have deployed an availability group only for disaster recovery, you may need to fail over the availability group to an asynchronous-commit secondary replica. Such configuration is illustrated by the following figure:
Should I update it to the latest SP + CU (SP3 CU4)?
When a new SQL Server service pack is released, Microsoft provides only 12 months of full support for the previous service pack.
Support is limited for older SPs:
For customers on supported products with service pack versions that
have left full support, Microsoft offers commercially reasonable
PowerShell has a built-in mechanism for this which should be easier than the previous answer.
From an Internet-connected computer, run Save-Module sqlserver -path c:\tmp (substitute whatever path you want for the module to be saved to). This will save the module to a directory of the same name in c:\tmp (c:\tmp\SqlServer).
Then, copy that whole directory ...
The ideal situation is to have a server that, in terms of OS and other software, exactly matches the production environment, upon which you can perform the update first. That way you know everything that is required.
This would preferably be a VM that you could snapshot, so if you encounter and fix a problem you can revert to the snapshot and start again ...
To understand the jargons, Aaron Bertrand has a #BackToBasics blog post
Also, refer to this decision matrix for TLS 1.2 support or MS KB - TLS 1.2 support for Microsoft SQL Server
10.50.6220 => SQL Server 2008R2 SP3 GDR
10.50.6529 => SQL Server 2008R2 SP3 QFE
From the decision matirx, if you dont want TLS 1.2 support, dont install 10.50.6542. TLS 1.2 ...
When you restored the VM, its LSN was no longer in sync with the primary and thus it can't be resumed. The primary is too far ahead to resume.
You'll need to drop the secondary and add it to the Availability Group again in order to resume synchronizing. You can do this with an existing FULL backup plus the LOG chain.
According to SQLServerBuilds SP1 CU15 was released after SP2.
SP1 CU15 was released on 2019-05-16, SP2 was released on 2018-04-24.
Given that from SQL 2017 there will no longer be any service packs, this is no longer relevant moving forwards, but in the past Microsoft would release fixes in parallel for supported service packs. As an example this kb ...
None of the services in your screenshot have anything to do with VMWare.
The one you highlighted is Wmiprvse.exe which is basically WMI
WMI resides in a shared service host with several other services. To avoid stopping all the services when a provider fails, providers are loaded into a separate host process named "Wmiprvse.exe".
The other ones are
This is an unsupported configuration as per the docs
Mixing versions of SQL Server instances in the same AG is not supported outside of a rolling upgrade and should not exist in that state for extended periods of time as the upgrade should take place quickly. The other option for upgrading SQL Server 2016 and later is through the use of a distributed ...
To prevent SQL Server updates to be installed automatically, you need to:
open up PowerShell window (Command prompt will also work)
type "sconfig.cmd" and run it
press 5 to select "Windows Update Settings"
set it to "M" which is "Manual"
Important: choose "Manual", NOT "DownloadOnly", because even ...
You should only require a server reboot if something is locked, correct.
However, during the patching, the SQL service will be stopped, patched then restarted so you'll actually be bouncing the service itself twice. Once for the SP, then again for the CU.
No. Each CU contains all the fixes in the CUs prior to it.
For the second part of the question, the only RELIABLE way supported across most versions (2005+) is to get a 4 part number and compare it to any of the comprehensive build lists available on the internet:
You can also check @@Version but it's not reliable, ...
An official response from Mongo on 1/6/2018 (emphasis mine):
Recently disclosed research regarding security vulnerabilities in
almost all modern processors such as Intel and AMD (CVE-2017-5715,
CVE-2017-5753, and CVE-2017-5754) has prompted public and private
institutions, including cloud providers, to patch OS and hypervisor
Yes, the security fix is in the CU. Direct but private comment from a reliable source within Microsoft:
Security fixes always roll-up to any subsequent CU. That's been the case for years.
And from another colleague at Microsoft:
all CU servicing releases for a given baseline are 100% cumulative of all previous Security Updates, CUs, and On Demand ...
I would not go with SQL agent running Patch to upgrade sql server. During patching and/or after patching SQL server needs to be restarted along with a reboot of windows machine - depending on the files that are locked during patching.
Alternatives are described in my answer here : https://dba.stackexchange.com/a/105837/8783
Also, dbatools has Update-...
Nothing particular to worry about, but you will incur downtime as the SP runs its stuff in "script mode" during which users cannot connect.
It might go without saying, but I'd ensure you have a valid (i.e. tested) backup of the databases (including the system databases) on the affected system prior to doing any patching, whether on a single-node cluster, a ...
Should I stop validation at "Check Files in Use" or "Ready to update"? Have I validated everything I can by the end of "Check Files in Use"?
Just go ahead click NEXT and apply the service pack, you can safely ignore this process. The check files in use process is to handle scenario where end user does not want to restart after applying service pack in that ...
We have SSISDB installed and it's in an AG. I ran the upgrade package on the secondary and received an error
Secondary user databases in an availability group are not available to be written to (readable at best). Thus the upgrade failed as the database is part of the AG and not able to be written to.
How do I go about bringing this thing back up? Do I ...
You should install the latest CU for SQL 2012 SP3.
As of today (10 May 2017) it is CU8
The SQL version number will give you a good indication of what is more recent.
An explanation of what GDR means can be found here.
2012 SP4 contains all the same fixes as 2012 SP3 CU #10, and was basically just a rollup to release a final service pack. The only differences are going to be:
build number will be higher
longer end of life
potentially better chance of servicing for a security issue in the future
Personally I would go with 2012 SP4.
Does Microsoft support running SQL Always On clusters for a short period of time on different CU and/or SP levels. for a week or a couple of days?
This is not an official statement but I got this from my MS friend.
It would be supported subject to condition both CU and SP are supported. But the risk and burden lies on you. I have worked with such ...
You need both SQL and Windows patches, as well as CPU microcode updates, to be fully** protected.
GDR is meant to be security-only patches, whereas Cumulative Updates are bug fixes as well as security patches. Once you go from the GDR path on to the CU path, you're stuck there, i.e. you can't go back to GDR only.
(Confusingly, this latest Meltdown / ...
All software has bugs. Period.
I've heard it all over the years as to why people don't patch, but you are just going to cause heartache at some point. To be mission critical, maintain performance, availability, and security, and so on, you need to install updates. No one is saying to patch day one with most things (I would say Meltdown/Spectre are ...
The WmiPrvSE.exe belongs to the service Windows Management Instrumentation and is located in the %WINDIR%\SysWOW64\wbem directory.
However, when looking at the Task Manager compared to the details of the Windows Management Instrumentation service, you may notice that the service runs via the C:\WINDOWS\system32\svchost.exe -k netsvcs -p process/executable.
Firstly, it always better to test patches in DEV environment before applying on Production.
To answer, there won't be downtime/interruption for Instance 3 while patching/removing path on Instance 1, all you need select particular instance during the wizard or command line as follows:
KBXXXX.exe /qs /IAcceptSQLServerLicenseTerms /Action=Patch /InstanceName=...
With confirmation from Pix(from Chat) the correct way to remove cumulative update is to use
/RemovePatch instead of using /uninstall. The way to remove updates is documented in Installing Updates from Command Prompt.
The script would be
"sqlserver2014-kb4032541-x86_080a5c3a38b721a9587c2072375921161896e19d.exe" /qs /Action=RemovePatch /InstanceName=...