So this past weekend I drove out to my parents' place for the usual Sunday dinner, and per usual, my mom cornered me before we'd even sat down. "Can you look at the computer, it's doing the update thing again." The update thing turned out to be a Windows 7 machine that hadn't restarted in something like four months, sitting there with a queue of pending patches so long the Windows Update screen just kind of... gave up. No error message. No progress bar. Just the little gear spinning at whatever speed it wanted.
Ten days after WannaCry hit hospitals in the UK and shipping companies and a Spanish telecom and basically anyone still running old SMBv1 shares on an unpatched box, and here's my own mother, three feet from me at the dinner table, running exactly the kind of setup that thing loved to eat. I'm not going to rehash the whole outbreak here, everyone's already read six versions of that story this month. What I actually want to talk about is how depressingly normal her laptop's situation is, because I'd bet real money it's not unusual.
What I actually found
- Automatic updates set to "notify but don't download," which in practice means never, because who actually clicks the notification
- An antivirus subscription that expired back in January and had been silently doing nothing since
- SMBv1 still enabled (it's on by default going back to XP, and nobody ever turns it off unless they know to)
- A backup situation that consisted of "some photos are on the SD card from the camera, probably"
None of this is exotic. This is just what a normal person's laptop looks like after two or three years of nobody touching the settings. And I get it, computers should not require a systems administrator living down the hall to stay safe, but that's not the world we're in yet, so here's what I actually did, in case anyone else is doing the same rounds this week.
The fifteen-minute fix
First, Windows Update itself. If it's stuck (and on an old install it often is), open an elevated command prompt and run net stop wuauserv, delete the contents of C:\Windows\SoftwareDistribution\DataStore, then net start wuauserv and try again. Fixed it in about ninety seconds instead of the twenty-minute troubleshooter dance.
Second, get MS17-010 installed specifically, that's the patch that closes the SMB hole WannaCry used. Microsoft even pushed it out for XP and Server 2003, which they hadn't done in years, which tells you how seriously they were taking it.
Third, and this is the part I actually care about most: turn off SMBv1 entirely if you don't need it, which almost nobody does anymore. PowerShell, run as admin: Disable-WindowsOptionalFeature -Online -FeatureName SMB1Protocol. It should've been off by default a decade ago honestly, and I don't fully understand why Microsoft waited this long to even talk about deprecating it.
Fourth, an actual antivirus that isn't expired. I put Windows Defender back to doing its job instead of the zombie subscription that was just sitting there giving false comfort.
Fifth, and I had to actually sit her down for this one, an external drive for backups. Forty dollars at Best Buy for a 1TB drive, File History turned on, done. It's not glamorous but it's the difference between "ransomware encrypted my files" being a headline you read about and "ransomware encrypted my files" being your actual Tuesday.
I don't think my mom is going to remember any of the technical steps, and that's fine, that's not really the point. The point is that somebody has to do this for the people who aren't going to do it themselves, and right now that somebody is whoever happens to show up for dinner. I keep thinking there should be a better system than "hope your kid is around" but I don't have a good answer for what that system looks like. Maybe forced update cycles that can't be deferred past some reasonable window. People would hate that too, though, and I get why.
Anyway, laptop's patched, drive's plugged in, and I have a standing reminder in my phone to check back on it in three months, because I already know nobody's going to click that little shield icon in the taskbar unprompted.