Without a doubt KB4490628 must be installed first and the system rebooted prior to proceeding any further. With this method, there are no WU controls to manage supersedence because we are not using Windows Update. those users who manually download the security only updates from the Microsoft Catalog and manually install the updates outside of Windows Update. You will note that I am discussing “Group B” users, i.e. We are well aware of how Windows Update works. It would be interesting to hear from a group A user who installed KB4474419 and the March monthly rollup from Windows Update the installation sequence picked by WU. But, lacking clear instructions, who knows for sure?

So, it would appear that one should install KB4474419 before KB4489885 to avoid regressing the files in KB4489885. For the most part the files in KB4474419 have a February, 2019 date and lower version numbers than the files in KB4489885 which has mostly March, 2019 file dates.

There are a huge number of files in both patches, a lot of them common to both. You can view the file dates in KB4489885 and KB4474419 by looking at the associated Microsoft KB articles and scrolling to “file information”.

My main concern is accidentally regressing files in the March Security Only Update – KB4489885. However, I don’t think the install sequence for KB4474419 – the SHA-2 Code Signing Support is quite as straight forward. I agree with the reasoning for installing KB4490628 -the Servicing Stack Update – first and rebooting. I’ve been following the discussions regarding KB4490628 and KB4474419 trying to determine the installation sequence. I’m an IT professional and a group B user.

Kb4474419 and kb4490628