Microsoft won't let you install future security updates until your antivirus vendor sets a specific registry key that certifies compatibility with Windows.
As part of this week's security updates for the Meltdown and Spectre CPU attacks, Microsoft required that all third-party antivirus vendors confirm compatibility with its CPU fixes and then to set a registry key in their products to certify compatibility. Without the key being set, Microsoft's security update simply won't install.
Microsoft has now clarified that this new rule will apply to all future security updates and means users running non-conforming third-party antivirus won't be protected by Microsoft's future patches.
"Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key", Microsoft's updated support page says.
A point to clarify though is that Microsoft won't enforce this requirement indefinitely, but rather only until it sees enough machines have applied the January 3 CPU fixes. As it notes in the FAQ on the issue:
Microsoft added this requirement to ensure customers can successfully install the January 2018 security updates. Microsoft will continue to enforce this requirement until there is high confidence that the majority of customers will not encounter device crashes after installing the security updates.
During testing of the patches for the two attacks, Microsoft discovered some antivirus had been making "unsupported calls into Windows kernel memory" that stop a machine from booting or cause blue screen of death (BSOD) errors after the patch is applied. To avoid this issue, it introduced the new rules.
However, it seems conventional antivirus products meet both requirements, while next-generation security products have only confirmed compatibility.
Beaumont said Microsoft is using the new certification process to prevent antivirus vendors bypassing Microsoft's Kernel Patch Protection, which it introduced in 2007 to defend against rootkits.
As he notes, the bypass technique some vendors are using is similar to the way rootkits work, which involves injecting their product into a Windows hypervisor to intercept system calls to memory locations that Microsoft changed in response to the Meltdown attack.
"Because some antivirus vendors are using very questionable techniques they end up [causing] systems to blue screen of death -- aka get into reboot loops. This shouldn't be possible in the latest operating systems, but some antivirus vendors have managed it by taking themselves into the hypervisor... Antivirus makers really shouldn't be messing with systems like this."
He estimates there are five key vendors that use this technique. Beaumont argues Microsoft should set a date for when it will no longer require the compatibility registry key or risk a large number of machines going without patches. On the flip side, the vast majority of consumer PCs would not be using next-gen security products.
Currently, the list of fully compatible antivirus currently includes Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky, Malwarebytes, Sophos, and Symantec. McAfee, Trend Micro, and Webroot are among the firms that will soon join this group.
However, next-gen security providers including CrowdStrike, Cylance, FireEye, and Palo Alto Networks have only confirmed compatibility but so far haven't been willing to set the specific registry key.
Next-gen providers claim they're not setting the registry key because they don't want to risk causing a BSOD in the event a customer also has other antivirus software installed.
A problem with next-gen providers not setting the registry key is that their products used to be sold as an addition to legacy antivirus, but are now being sold as the primary antivirus.
So customers who've made that switch must manually set the registry key to install the updates, something that Microsoft says should only be undertaken with extreme caution.
Update, January 11: CrowdStrike confirms that it has now set the registry key.
Update, January 19: Palo Alto Networks says it is "actively working on an update that will automatically set this registry key, which will be released in the coming weeks".
Most Intel processors and some ARM chips are confirmed to be vulnerable, putting billions of devices at risk of attacks. One of the security researchers said the bugs are "going to haunt us for years."