Download KB4474419: Enabling SHA-2 Code Signatures for Windows Server 2008 R2 and Windows 7

In recent months, Microsoft has been preparing for a significant change in its approach to code signing updates. As of March 12, 2019, the company extended support for SHA-2 signature evaluation for Windows 7 SP1 and its server counterparts.

To facilitate this transition, two Servicing Stack Updates (SSUs) were released: KB4490628 for Windows 7 SP1 and Windows Server 2008 R2 SP1. These updates are linked to the Microsoft Update Catalog on the ADV90009 advisory page and can be downloaded manually from there or via Windows Server Update Services (WSUS).

The Servicing Stack Updates, particularly KB4474419, add support for SHA-2 signature evaluation for Windows 7 SP1 and its server pendants. This update is automatically downloaded and installed via Windows Update.

As mentioned in the Microsoft blog post 'SHA-2 patch for Windows 7 arrives on March 2019,' users of Windows 7 SP1 (and its server counterparts) and WSUS will need a special update from April 2019 to enable their machines for SHA-2 code signatures. Without this update, these machines will not be able to process new updates in the future.

In an earlier blog post titled 'SHA-2 patch for Windows 7 arrives on March 2019,' I mentioned that Microsoft had announced it would only add SHA-2 signatures to its Windows updates from mid-2019 onwards – signing with SHA-1 would then no longer be necessary for security reasons. As of April 2019, users can download the required update, which adds support for SHA-2 code signaing.

In summary, KB4474419 is an essential update that enables SHA-2 code signature evaluation for Windows Server 2008 R2 and Windows 7 SP1. Users who have not yet downloaded this update should do so to ensure their machines are compatible with the latest updates from Microsoft.

Download kb4474419