Microsoft won’t let you install future security updates until your antivirus vendor sets a specific registry key that certifies compatibility with Windows.

As part of this week’s security updates for the Meltdown and Spectre CPU attacks, Microsoft required that all third-party antivirus vendors confirm compatibility with its CPU fixes and then to set a registry key in their products to certify compatibility. Without the key being set, Microsoft’s security update simply won’t install.

Microsoft has now clarified that this new rule will apply to all future security updates and means users running non-conforming third-party antivirus won’t be protected by Microsoft’s future patches.

“Customers will not receive the January 2018 security updates (or any subsequent security updates) and will not be protected from security vulnerabilities unless their antivirus software vendor sets the following registry key”, Microsoft’s updated support page notes.

During testing of the patches for the two attacks, Microsoft discovered some antivirus had been making “unsupported calls into Windows kernel memory” that stop a machine from booting or cause blue screen of death (BSOD) errors after the patch is applied. To avoid this issue, it introduced the new rules.

Security researcher Kevin Beaumont has compiled a list of antivirus products that are both compatible with Microsoft’s CPU update and have the required Windows registry key set correctly. As ZDNet reported earlier this week, some vendors are doing both, while others have only confirmed compatibility.

However, it seems conventional antivirus products meet both requirements, while next-generation security products have only confirmed compatibility.

Beaumont explains Microsoft is using the new certification process to prevent antivirus vendors bypassing Microsoft’s Kernel Patch Protection, which it introduced in 2007 to defend against rootkits.

As he notes, the bypass technique some vendors are using is similar to the way rootkits work, which involves injecting their product into a Windows hypervisor to intercept system calls to memory locations that Microsoft changed in response to the Meltdown attack.

“Because some antivirus vendors are using very questionable techniques they end up [causing] systems to blue screen of death – aka get into reboot loops. This shouldn’t be possible in the latest operating systems, but some antivirus vendors have managed it by taking themselves into the hypervisor… Antivirus makers really shouldn’t be messing with systems like this.”

He estimates there are five key vendors that use this technique. Currently, the list of fully compatible antivirus currently includes Avast, AVG, Avira, Bitdefender, ESET, F-Secure, Kaspersky, Malwarebytes, Sophos, and Symantec. McAfee, Trend Micro, and Webroot are among the firms that will soon join this group.

However, next-gen security providers including CrowdStrike, Cylance, FireEye, and Palo Alto Networks have only confirmed compatibility but so far haven’t been willing to set the specific registry key.

Next-gen providers claim they’re not setting the registry key because they don’t want to risk causing a BSOD in the event a customer also has other antivirus software installed.

A problem with next-gen providers not setting the registry key is that their products used to be sold as an addition to legacy antivirus, but are now being sold as the primary antivirus.

So customers who’ve made that switch must manually set the registry key to install the updates, something that Microsoft says should only be undertaken with extreme caution.

Previous and related coverage

Windows Meltdown-Spectre fix: How to check if your AV is blocking Microsoft patch

Antivirus firms are playing patch catch-up, as Microsoft releases Meltdown firmware updates for Surface devices.

Windows Meltdown-Spectre patches: If you haven’t got them, blame your antivirus

Microsoft says your antivirus software could stop you from receiving the emergency patches issued for Windows.

Critical flaws revealed to affect most Intel chips since 1995

Most Intel processors and some ARM chips are confirmed to be vulnerable, putting billions of devices at risk of attacks. One of the security researchers said the bugs are “going to haunt us for years.”