Overview

This executable configures Windows registry controls used by Microsoft's guidance for processor microarchitectural and speculative-execution side-channel mitigations.

Processor Speculative-Execution Mitigation Configuration

Windows Server KB4072698 / Windows Client KB4073119

Executable: KB4072698.exe or KB4073119.exe

Solution

1. Access the Device

• Log in to the Windows device where the mitigation needs to be applied.

• Ensure that you have the required Administrator privileges.

2. Detect Processor Configuration

The executable queries WMI to determine the processor topology:

• Number of physical cores.

• Number of logical processors.

The registry configuration is applied based on the relationship between logical processors and physical cores.

3. Configure Memory Management Settings

The executable configures the following registry key:

• Registry key: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

When logical processors exceed physical cores, it writes:

• FeatureSettingsOverride = 72

• FeatureSettingsOverrideMask = 3

Otherwise, it writes:

• FeatureSettingsOverride = 8264

• FeatureSettingsOverrideMask = 3

4. Configure Hyper-V Host Setting

If the Virtualization Version value is present, the executable writes the following setting:

• Registry key: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization

• Value: MinVmVersionForCpuBasedMitigations

• Data: 1.0

5. Apply the Configuration

The executable runs silently and:

• Detects processor topology.

• Checks for the Hyper-V virtualization registry value.

• Writes the corresponding mitigation configuration based on the detected system configuration.

6. Verify the Configuration

Verify the following registry settings according to the processor configuration:

When logical processors exceed physical cores:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management 
FeatureSettingsOverride    72 FeatureSettingsOverrideMask    3

Otherwise:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management 
FeatureSettingsOverride    8264 FeatureSettingsOverrideMask    3

If the Virtualization Version value is present, verify:

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Virtualization 
MinVmVersionForCpuBasedMitigations    1.0

What the Executable Does

The executable runs silently, detects processor topology, checks for the Hyper-V virtualization registry value, and writes the corresponding mitigation configuration.

References

Microsoft KB4072698: Windows Server and Azure Stack HCI guidance:

https://support.microsoft.com/en-us/servicing/os/windows-server/2019/12/kb4072698-windows-server-and-azure-stack-hci-guidance-to-protect-against-silicon-based-microarchitec

Microsoft KB4073119: Windows client guidance:

https://support.microsoft.com/en-us/topic/kb4073119-windows-client-guidance-for-it-pros-to-protect-against-silicon-based-microarchitectural-and-speculative-execution-side-channel-vulnerabilities-35820a8a-ae13-1299-88cc-357f104f5b11