Windows Server 20348.3095 → 20348.5024

Breaking changes

None in the release notes.

Security changes

• security [Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082142) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority… in 20348.5024
• security Security update: includes the April 2026 Security Updates in 20348.5020
• security [Kerberos protocol] This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. For more information see,… in 20348.5020
• security [Remote Desktop] This update improves protection against phishing attacks that use Remote Desktop (.rdp) files. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. A one-time security warning also appears… in 20348.5020
• security [Vulnerable driver blocklist] This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Backup applications that rely on blocked drivers might experience failures when attempting to mount or manage disk images. These… in 20348.5020
• security [Windows Deployment Services (WDS)] This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. For more information about this change, see Windows Deployment Services (WDS) Hands-Free Deployment Hardening Guidance related to CVE-2026-0386. in 20348.5020
• security Security update: includes the March 2026 Security Updates in 20348.4893
• security [Graphics] Fixed: This update addresses an issue where certain GPU configurations might recently have experienced a system error related to dxgmms2.sys, resulting in the KERNEL_SECURITY_CHECK_FAILURE error. in 20348.4773
• security [OS Security (known issue)] Fixed: After installing the Windows security update released on or after January 13, 2026, some PCs which run Virtual Secure Mode (VSM) are unable to shut down or enter hibernation. Instead, the device restarts. in 20348.4773
• security [Remote Desktop] Fixed: After installing the January 2026 Windows security update (KB5073457), some users experienced sign-in failures during Remote Desktop connections. This issue affected authentication steps for different Remote Desktop applications on Windows such as the Windows App. in 20348.4650
• security [Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote… in 20348.4648
• security [WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a… in 20348.4648
• security [PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content. in 20348.4529
• security [App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows… in 20348.4405
• security [Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication. in 20348.4405
• security [Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287. in 20348.4297
• security [Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios. in 20348.4294
• security [Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change,… in 20348.4294
• security [File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to… in 20348.4294
• security [App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,… in 20348.4171
• security [File server]⁠ This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already… in 20348.4171
• security Security update: includes the July 2025 Security Updates in 20348.3932
• security [Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain… in 20348.3932
• security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3692
• security It addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local… in 20348.3561
• security Security update: includes the April 2025 Security Updates in 20348.3453
• security [OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes… in 20348.3453
• security [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more… in 20348.3453
• security Security update: includes the February 2025 Security Updates in 20348.3207
• security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3207
• security [USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. in 20348.3207

Every release in between