Windows Server 20348.709 → 20348.4648

54 releases · 0 breaking changes · 92 security fixes · 0 advisories fixed

92security0breaking1deprecated29feature231fix

Is 20348.709 affected? · What changed up to 26100.33650

Breaking changes

None in the release notes.

Security changes

security [Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote… in 20348.4648
security [WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a… in 20348.4648
security [PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content. in 20348.4529
security [App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows… in 20348.4405
security [Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication. in 20348.4405
security [Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287. in 20348.4297
security [Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios. in 20348.4294
security [Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change,… in 20348.4294
security [File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to… in 20348.4294
security [App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,… in 20348.4171
security [File server]⁠ This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already… in 20348.4171
security Security update: includes the July 2025 Security Updates in 20348.3932
security [Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain… in 20348.3932
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3692
security It addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local… in 20348.3561
security Security update: includes the April 2025 Security Updates in 20348.3453
security [OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes… in 20348.3453
security [Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more… in 20348.3453
security Security update: includes the February 2025 Security Updates in 20348.3207
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3207
security [USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update. in 20348.3207
security Security update: includes the January 2025 Security Updates in 20348.3091
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.3091
security Security update: includes the December 2024 Security Updates in 20348.2966
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2849
security Security update: includes the October 2024 Security Updates in 20348.2762
security Security update: includes the September 2024 Security Updates in 20348.2700
security [Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. The error message is, “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security… in 20348.2700
security Security update: includes the August 2024 Security Updates in 20348.2655
security [Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2655
security [BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. This issue is more likely to occur if device encryption is on. Go to Settings > Privacy & Security > Device encryption. To unlock your drive, Windows… in 20348.2655
security [Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. in 20348.2655
security [Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. This SBAT update will not apply to systems that dual-boot Windows and Linux. After the SBAT… in 20348.2655
security [Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out. in 20348.2655
security Security update: includes the July 2024 Security Updates in 20348.2582
security [BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. See CVE-2024-38058 for more information. in 20348.2582
security Security update: includes the June 2024 Security Updates in 20348.2527
security This update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers. in 20348.2527
security This update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call. in 20348.2527
security Security update: includes the May 2024 Security Updates in 20348.2461
security This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2461
security This update addresses an issue that affects Group Policy Folder Redirection in a multi-forest deployment. The issue stops you from choosing a group account from the target domain. Because of this, you cannot apply advanced folder redirection settings to that domain. This issue occurs when the… in 20348.2461
security Security update: includes the April 2024 Security Updates in 20348.2402
security This update addresses a known issue that affects the Local Security Authority Subsystem Service (LSASS). It might leak memory on domain controllers (DCs). This issue occurs after you install KB5035857 (March 12, 2024). The leak occurs when on-premises and cloud-based Active Directory DCs process… in 20348.2342
security Security update: includes the March 2024 Security Updates in 20348.2340
security The update affects Active Directory domains that host mobile device management (MDM) providers. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.” To do this, they can allow an Active Directory Key Distribution Center (KDC) to read user security… in 20348.2340
security Security update: includes the February 2024 Security Updates in 20348.2322
security This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database. in 20348.2322
security This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2322
security Security update: includes the January 2024 Security Updates in 20348.2227
security Security update: includes the December 2023 Security Updates in 20348.2159
security Security update: includes the November 2023 Security Updates in 20348.2113
security This update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.2113
security Security update: includes the October 2023 Security Updates in 20348.2031
security This update addresses an issue that affects Kerberos delegation. It might fail in the wrong way. The error code is 0xC000006E (STATUS_ACCOUNT_RESTRICTION). This issue might occur when you mark the intermediate service account as “This account is sensitive and cannot be delegated” in Active… in 20348.2031
security To protect against CVE-2023-44487, you should install the latest Windows update. Based on your use case, you can also set the limit of the RST_STREAMS per minute using the new registry keys in this update. You can create the DWORD registry values in the table below under the following registry… in 20348.2031
security Security update: includes the September 2023 Security Updates in 20348.1970
security This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It stops responding. This occurs when you use Azure Virtual Desktop (AVD). in 20348.1970
security This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS) process. It might stop responding. Because of this, the machine restarts. The error is 0xc0000005 (STATUS_ACCESS_VIOLATION). in 20348.1970
security Security update: includes the August 2023 Security Updates in 20348.1906
security This update addresses a deadlock in Internet Protocol Security (IPsec). When you configure servers with IPsec rules, they stop responding. This issue affects virtual and physical servers. in 20348.1906
security This update affects the Windows Kernel Vulnerable Driver Blocklist, DriverSiPolicy.p7b. It adds drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks. in 20348.1906
security Security update: includes the July 2023 Security Updates in 20348.1850
security Security update: includes the June 2023 Security Updates in 20348.1787
security This update addresses an issue that might affect the Local Security Authority Subsystem Service (LSASS). It might close sporadically. The system logs the exception 0xc0000710 in the Application Error event 1000. Because of this, the domain controller restarts unexpectedly. This issue affects… in 20348.1787
security This update addresses an issue that affects the Windows Kernel. This issue is related to CVE-2023-32019. To learn more, see KB5028407. in 20348.1787
security Security update: includes the May 2023 Security Updates in 20348.1726
security This update addresses a race condition in Windows Local Administrator Password Solution (LAPS). The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is… in 20348.1726
security Security update: includes the April 2023 Security Updates in 20348.1668
security Security update: includes the March 2023 Security Updates in 20348.1607
security This update addresses an issue that occurs when an access control policy denies you access to a resource. When you sign out, the system does not delete the POST Security Assertion Markup Language (SAML) Request cookie. This stops you from choosing other resources the next time you sign in. in 20348.1607
security This update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). LSASS might stop responding. This occurs after you run Sysprep on a domain-joined machine. in 20348.1607
security This update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is,… in 20348.1607
security Security update: includes the February 2023 Security Updates in 20348.1547
security This update addresses an issue that affects all commands that change security tags. On Windows 11, version 22H2 computers, the change will fail if you update the Network Controller but not the Remote Server Administration Tools (RSAT) clients. in 20348.1547
security Security update: includes the January 2023 Security Updates in 20348.1487
security Security update: includes the December 2022 Security Updates in 20348.1366
security It addresses a known issue that might affect Windows Servers that have the Domain Controller (DC) role. They might have Kerberos authentication issues if both of the following are true: You might receive Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 errors. These appear in the… in 20348.1251
security Security update: includes the November 2022 Security Updates in 20348.1249
security It addresses security vulnerabilities in the Kerberos and Netlogon protocols as outlined in CVE-2022-38023, CVE-2022-37966, and CVE-2022-37967. For deployment guidance, see the following: in 20348.1249
security KB5020805: How to manage the Kerberos Protocol changes related to CVE-2022-37967 in 20348.1249
security KB5021130: How to manage Netlogon Protocol changes related to CVE-2022-38023 in 20348.1249
security KB5021131: How to manage the Kerberos Protocol changes related to CVE-2022-37966 in 20348.1249
security It addresses an issue that might affect some types of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections. These connections might have handshake failures. For developers, the affected connections are likely to receive one or more records followed by a partial record with a… in 20348.1131
security Security update: includes the October 2022 Security Updates in 20348.1129
security Security update: includes the September 2022 Security Updates in 20348.1006
security This update contains miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release. in 20348.1006
security Security update: includes the August 2022 Security Updates in 20348.887
security Addresses an issue that might cause the Local Security Authority Server Service (LSASS) to leak tokens. This issue affects devices that have installed Windows updates dated June 14, 2022 or later. This issue occurs when the device performs a specific form of service for user (S4U) in a non-Trusted… in 20348.887
security Security update: includes the July 2022 Security Updates in 20348.825
security Security update: includes the June 2022 Security Updates in 20348.768
security Addresses an elevation of privilege (EOP) vulnerability under CVE-2022-30154 for the Microsoft File Server Shadow Copy Agent Service. To become protected and functional, you must install the June 14, 2022 or later Windows update on both the application server and the file server. The application… in 20348.768

Deprecations

deprecated [Line Printer Daemon (LPD) protocol] Using this deprecated protocol to print might not work as you expect or fail. This issue occurs after you install the July 9, 2024, and later updates. Note When it is no longer available, clients, like UNIX, that use it will not connect to a server to print.… in 20348.2655

Every release in between

20348.4648 Jan 13, 2026 Release notes ↗

other[Compatibility] This update removes the following modem drivers: agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64) and smserial.sys (x86). Modem hardware dependent on these specific drivers will no longer work in Windows.

security[Credentials autofill] This update introduces a security hardening behavior restricting certain applications to autofill credentials during remote support sessions or automated authentication workflows. With this change, credential dialogs do not respond to virtual keyboard input from remote…

fix[Remote Desktop] Fixed: This update addresses an issue that causes SearchIndexer (the Windows service that indexes files for search) to stop responding on Citrix hosts, which might prevent users from starting remote sessions.

feature[Windows Deployment Services (WDS] This update introduces a change in behavior in which WDS will stop supporting hands-free deployment functionality by default. Detailed guidance for IT administrators is available in Windows Deployment Services (WDS) Hands‑Free Deployment Hardening Guidance.

security[WinSqlite3.dll] Fixed: The Windows core component, WinSqlite3.dll, has been updated. Previously, some security software might have detected this component as vulnerable. Note WinSqlite3.dll is a separate component from sqlite3.dll, which is found in application-specific directories and is not a…

20348.4529 Dec 9, 2025 Release notes ↗

security[PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content.

20348.4405 Nov 11, 2025 Release notes ↗

security[App compatibility (known issue)] Fixed: This update addresses an issue that created unexpected User Account Control (UAC) prompts for some apps, including Autodesk AutoCAD. For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows…

security[Security] Fixed: This update addresses an issue that affects Windows Server domain controllers using Microsoft Defender for Endpoint. After domain controller promotion, changes to registry permissions disrupted cloud-based communication.

fix[Networking] Fixed: This update fixes an issue in the HTTP.sys request parser, a Windows component that reads and processes HTTP requests. The parser allowed a single line break within HTTP/1.1 chunk extensions, where the RFC 9112 standard requires a carriage return and line feed (CRLF) sequence…

20348.4297 Oct 23, 2025 Release notes ↗

security[Windows Server Update Services (WSUS)] Fixed: This update addresses a remote code execution (RCE) vulnerability that was identified in WSUS reporting web services. For more information about the security fix, see CVE-2025-59287.

20348.4294 Oct 14, 2025 Release notes ↗

fixFixed: An issue where some characters didn’t display correctly when using the Chinese Input Method Editor (IME).

fixFixed: This update addresses an issue where certain Chinese characters appeared as empty boxes in some text fields, such as those used in Connection Manager Administration Kit, when a character limit was set.

fix[Networking (known issue)] Fixed: This update addresses an issue where you might not be able to connect to shared files and folders if you're using the Server Message Block (SMB) v1 protocol on NetBIOS over TCP/IP NetBIOS (NetBT). This can happen after installing update KB5065432.

fix[PowerShell] Fixed: This update addresses an issue that affects PowerShell Remoting and Windows Remote Management (WinRM), where commands might time out after 10 minutes.

security[Stability issue] Fixed: This update addresses an issue observed in rare cases after installing the May 2025 security update and subsequent updates causing devices to experience stability issues. Some devices became unresponsive and stopped responding in specific scenarios.

fix[System services and reliability] Fixed: Addresses an issue that caused McpManagement service to appear without a description on Windows.

other[Compatibility] This update removes the ltmdm64.sys driver. Fax modem hardware dependent on this specific driver will no longer work in Windows.

security[Cryptography] This update enforces a security hardening improvement by requiring use of Key Storage Provider (KSP) instead of Cryptographic Service Provider {CSP) for RSA-based smart card certificates. If you experience problems with smart card authentication as a result of this design change,…

security[File Explorer] After installing this update, File Explorer automatically disables the preview feature for files downloaded from the internet. This change is designed to enhance security by preventing a vulnerability when users preview potentially unsafe files. For details, including steps to…

20348.4171 Sep 9, 2025 Release notes ↗

security[App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background,…

security[File server]⁠ This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already…

fix[Input] Fixed: This update addresses an issue with the Chinese (Simplified) Input Method Editor (IME) where some extended characters appeared as empty boxes.

fix[Performance]⁠ Fixed: This update addresses an issue where a single, oversized Certificate Revocation List (CRL) file slows down system performance. To improve speed and privacy, the system now plans to use smaller, partitioned CRLs.

20348.4052 Aug 12, 2025 Release notes ↗

fix[Input (know issue)] Fixed: An issue when using the Microsoft Changjie IME (input method editor) for Traditional Chinese might cause problems such as not being able to form or select words, unresponsive spacebar or blank key, incorrect word output, or a broken candidate window display. This can…

20348.3932 Jul 8, 2025 Release notes ↗

securitySecurity update: includes the July 2025 Security Updates

fix[DHCP Server (known issue] Fixed: An issue in which the DHCP Server service might intermittently stop responding and affects IP renewal for clients.

fix[Language and character support] Fixed: An issue that affected some Chinese characters and experienced compliance issue with GB18030. These characters didn’t display correctly or weren’t accepted when using extended Unicode. A modern ICU-based solution now properly supports GB18030-2022…

fix[Performance]⁠ Fixed: This update addresses an issue that prevented the complete removal of unused language packs and Feature on Demand packages, which previously led to unnecessary storage use and longer Windows Update installation times.

security[Microsoft RPC Netlogon protocol] This update includes a security hardening change to the Microsoft RPC Netlogon protocol. This change improves security by tightening access checks for a set of remote procedure call (RPC) requests. After this update is installed, Active Directory domain…

20348.3807 Jun 10, 2025 Release notes ↗

fixFixed: An issue where some characters appear wider than standard characters, and the sample paragraph in the font preview section doesn’t display correctly.

fixFixed: This update addresses an issue where some GB18030-2022 characters don’t display correctly within the extended Chinese character set⁠.⁠

fix[Memory leak] Fixed: This update addresses an issue in the Input Service that causes increased memory usage, potentially impacting performance in multi-user, multilingual, and remote desktop environments.

fix[Settings] Fixed: This update addresses an issue in the Settings app where turning on the "Prohibit Access to Control Panel and PC Settings" policy could make the system repeatedly restart and automatically enter repair mode.

fix[Windows Hello] Fixed: This update addresses an issue that prevents users from signing in with self-signed certificates when using Windows Hello for Business with the Key Trust model.

20348.3695 May 23, 2025 Release notes ↗

fix[Hyper-V Platform] Fixed: An issue in the direct send path for a guest physical address (GPA) where confidential virtual machines running on Hyper-V with Windows Server 2022 might intermittently stop responding or restart unexpectedly, affecting service availability and requiring manual…

20348.3692 May 13, 2025 Release notes ↗

fix[Desktop Windows Manager (DVM)] Fixed: This update addresses an issue that affects the DWM, where it stops responding due to an access error in dwmredir.dll during remote session while connection or disconnection, resulting in a black or grey screen.

fix[Graphics kernel] Fixed: This update addresses an issue that occurs when starting a new console session after closing the previous one, and the new session doesn't start successfully.

other[Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)]⁠ This update applies improvements to SBAT for the detection of Linux systems

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

20348.3566 Apr 16, 2025 Release notes ↗

20348.3561 Apr 11, 2025 Release notes ↗

securityIt addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local…

20348.3453 Apr 8, 2025 Release notes ↗

securitySecurity update: includes the April 2025 Security Updates

other[Daylight Saving Time (DST)] Update for the Aysen region in Chile to support the government DST change order in 2025. For more info about DST changes, see the Daylight Saving Time & Time Zone Blog.

security[OS Security] After installing this update or a later Windows update, a new %systemdrive%\inetpub folder will be created on your device. This folder should not be deleted regardless of whether Internet Information Services (IIS) is enabled on the target device. This behavior is part of changes…

security[Kerberos Authentication] Change of behavior: Adds protections for a vulnerability which occurs when a certificate authority is part of the Windows root store but not the NTAuth store. This change enabled by default might cause Event ID: 45 events to be logged on the domain controller. For more…

20348.3328 Mar 11, 2025 Release notes ↗

other[Daylight saving time (DST)] This update supports (DST) changes in Paraguay.

fix[Open Secure Shell (OpenSSH) (known issue)] Fixed: The service fails to start, which stops SSH connections. There is no detailed logging, and you must run the sshd.exe process manually.

feature[GB18030-2022] This update adds support for this amendment.

fix[Azure Virtual Network] Fixed: You can turn off the VNET metering feature with the following registry key. Registry key: HKLM\CurrentControlSet\Services\NcHostAgent\Parameters\Plugins\Vnet Registry key: MeteringDisabled (DWORD type) Data to be set: 1

20348.3207 Feb 11, 2025 Release notes ↗

securitySecurity update: includes the February 2025 Security Updates

fix[Task Manager] Fixed: The CPU index number might be wrong when you set process affinity. This occurs on servers that have two or more non-uniform memory access (NUMA) nodes.

feature[GB18030-2022] This update adds support for this amendment.

fix[Memory leak] Fixed: Leaks occur when predictive input ideas show.

fix[Device Health Attestation] Fixed: When you upgrade from Windows Server 2016, a crucial item is not there. Because of this, service fails.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fix[Directory enumeration] Fixed: This might fail if a directory has symbolic links that have long target names.

fix[Bind Filter Driver] Fixed: Your system might stop responding when it accesses symbolic links.

fix[Digital/Analog converter (DAC) (known issue)] Fixed: You might experience issues with USB audio devices. This is more likely when you use a DAC audio driver based on USB 1.0. USB audio devices might stop working, which stops playback.

security[USB cameras] Fixed: Your device does not recognize the camera is on. This issue occurs after you install the January 2025 security update.

fix[USB audio device drivers] Fixed: The code 10 error message, “This device cannot start” appears. This occurs when you connect to certain external audio management devices.

20348.3095 Jan 18, 2025 Release notes ↗

fix[Non-uniform memory access (NUMA) nodes] Fixed: Some servers that have two or more NUMA nodes fail to start up.

20348.3091 Jan 14, 2025 Release notes ↗

securitySecurity update: includes the January 2025 Security Updates

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

20348.2966 Dec 10, 2024 Release notes ↗

securitySecurity update: includes the December 2024 Security Updates

fix[Motherboard replacement] Fixed: Windows does not activate after you replace a motherboard.

20348.2849 Nov 12, 2024 Release notes ↗

fix[FrameShutdownDelay] Fixed: The browser ignores its value in the “HKLM\SOFTWARE\Microsoft\Internet Explorer\Main” registry key.

fix[vmswitch] Fixed: A vmswitch triggers a stop error. This occurs when you use Load Balancing and Failover (LBFO) teaming with two virtual switches on a virtual machine (VM). In this case, one virtual switch uses single root Input/Output virtualization (SR-IOV).

fix[Collector sets] Fixed: They do not close properly when an exception occurs during startup or while the set is active. Because of this, the command to stop a collector set stops responding.

feature[Product activation phone numbers] This adds new phone numbers for several regions.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fix[Windows Backup] Fixed: Backup sometimes fails. This occurs when a device has an Extensible Firmware Interface (EFI) system partition (ESP).

fix[Cace disk] Fixed: The "Starting Maintenance mode" exception flag appears after you remove a cache disk.

other[Remote Desktop Connection Broker in high availability mode] This update turns on Kerberos authentication for smart cards.

20348.2762 Oct 8, 2024 Release notes ↗

securitySecurity update: includes the October 2024 Security Updates

feature[Software Defined Networking (SDN)]New! The SDN API now performs better for large-scale deployments. Watch for load balancer connectivity issues after you install this update. If you have any, move the SDNAPI microservice to another node. An SDN admin can move the service. To do that, use the…

fix[MSIX applications] Fixed: When you install them from an HTTPS URI, they fail to open. This issue occurs when the download of the app is not complete. This damages the package.

fix[Task Manager] Fixed: It stops responding when you select the “Performance” tab.

fix[Direct Composition batched presentations] Fixed: A brief flash of triangles or boxes show on the screen. This issue affects browsers, like Microsoft Edge, and other apps.

fix[Input Method Editor (IME)] Fixed: When a combo box has input focus, a memory leak might occur when you close that window.

fix[AppLocker] Fixed: The rule collection enforcement mode is not overwritten when rules merge with a collection that has no rules. This occurs when the enforcement mode is set to “Not Configured.”

fix[Remote Desktop (known issue)] Fixed: Windows Servers might disrupt Remote Desktop connections across your company. This issue might occur if you use a legacy protocol in the Remote Desktop Gateway. An example protocol is Remote Procedure Call over HTTP. If the issue occurs, it is sporadic, like…

fix[Containers (known issue)] Fixed: Container networking on Kubernetes might not work as you expect. Containers fail to reach external networks or communicate between pods. It might affect you when you use Calico to set up container networking on development or production instances. If affected,…

20348.2700 Sep 10, 2024 Release notes ↗

securitySecurity update: includes the September 2024 Security Updates

feature[Windows Installer] When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. Because of this, you must update your automation scripts. Application owners must add the Shield icon. It indicates…

other[IE mode] Pop-up windows open in the background instead of in the foreground.

other[AppContainer] Printers do not work as you expect when you use them in a restricted setting, like AppContainer.

other[BitLocker] You might not be able to decrypt a BitLocker data drive. This occurs when you move that drive from a newer version of Windows to an older version.

security[Dual boot of Windows and Linux (known issue)] Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. The error message is, “Verifying shim SBAT data failed: Security Policy Violation. Something has gone seriously wrong: SBAT self-check failed: Security…

20348.2655 Aug 13, 2024 Release notes ↗

securitySecurity update: includes the August 2024 Security Updates

other[Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH, and the host loses data. This occurs because win32kbase.sys stops responding.

other[Windows Defender Application Control (WDAC)] A memory leak occurs that might exhaust system memory as time goes by. This issue occurs when you provision a device.

other[Protected Process Light (PPL) protections] You can bypass them.

security[Windows Kernel Vulnerable Driver Blocklist file (DriverSiPolicy.p7b)] This update adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

other[Microsoft 365 Defender (known issue] The Network Detection and Response (NDR) service might encounter issues. This interrupts network data reporting. If this issue affects you, a message appears on the service health page of the Microsoft 365 admin center. You can also view the status of NDR on…

security[BitLocker (known issue)] A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. This issue is more likely to occur if device encryption is on. Go to Settings > Privacy & Security > Device encryption. To unlock your drive, Windows…

security[Lock screen] This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi.

other[NetJoinLegacyAccountReuse] This update removes this registry key. For more information refer to KB5020276—Netjoin: Domain join hardening changes.

security[Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)] This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. This SBAT update will not apply to systems that dual-boot Windows and Linux. After the SBAT…

security[Domain Name System (DNS)] This update hardens DNS server security to address CVE-2024-37968. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out.

deprecated[Line Printer Daemon (LPD) protocol] Using this deprecated protocol to print might not work as you expect or fail. This issue occurs after you install the July 9, 2024, and later updates. Note When it is no longer available, clients, like UNIX, that use it will not connect to a server to print.…

20348.2582 Jul 9, 2024 Release notes ↗

securitySecurity update: includes the July 2024 Security Updates

other[Absent apps and features] Some apps and features are absent after you upgrade to Windows 11.

feature[Double-wide character set range] This update adds new ranges to the double-wide character set range. This ensures that the PowerShell console identifies and handles them the right way.

other[Input Method Editor (IME)] The candidate list fails to show or shows in the wrong position.

other[Windows Presentation Foundation (WPF)] A malformed Human Interface Device (HID) descriptor causes WPF to stop responding.

other[Remote Desktop Session Host (RDSH)] Users cannot connect to the RDSH. This occurs because dwm.exe stops responding.

other[Remote Desktop MultiPoint Server] A race condition causes the service to stop responding.

other[Windows Local Administrator Password Solution (LAPS)] Its Post Authentication Actions (PAA) do not occur at the end of the grace period. Instead, they occur at restart.

other[Remote Authentication Dial-In User Service (RADIUS) protocol] This issue is related to MD5 collisions. For more information, see KB5040268.

security[BitLocker] This update adds PCR 4 to PCR 7 and 11 for the default Secure Boot validation profile. See CVE-2024-38058 for more information.

featureThis update changes how IT administrators should set up remote paths for file shortcut icons (.LNK files). The set up now requires that you configure the policy “Allow the use of remote paths in file shortcut icons”. If you don’t configure this policy, icons on the Start menu, Windows desktop and…

20348.2529 Jun 20, 2024 Release notes ↗

otherThis update addresses a known issue that affects the BCryptSignHash API. Because of this issue, the API returns “STATUS_INVALID_PARAMETER.” This occurs when callers use NULL padding input parameters for RSA signatures. This issue is more likely to occur when Customer-Managed Key (CMK) are in use,…

20348.2527 Jun 11, 2024 Release notes ↗

securitySecurity update: includes the June 2024 Security Updates

featureNew! This update affects Server Message Block (SMB) over Quick UDP Internet Connections (QUIC). It turns on the SMB over QUIC client certificate authentication feature. Admins can use it to restrict which clients can access SMB over QUIC servers. To learn more, see Configure SMB over QUIC client…

featureNew! The LCU will no longer have the reverse differentials. The client will generate the playback delta. This change will help to reduce the LCU package size by about 20%. This change also offers a few advantages. It:

otherImproves performance on slow connections.

otherThis update affects the version of curl.exe that is in Windows. The version number is now 8.7.1.

fixThis update addresses an issue that affects Outlook and OneNote. Their search function stops working. This occurs when you use Azure Virtual Desktop (AVD).

securityThis update addresses an issue that affects lsass.exe. It stops responding. This occurs after you install the April 2024 security updates on Windows servers.

fixThis update addresses an issue that affects Windows Hello for Business. You cannot use it to authenticate to Entra ID on certain apps. This occurs when you use Web Access Management (WAM).

fixThis update addresses an issue that affects a Microsoft Entra ID account. Devices cannot authenticate a second one. This occurs after you install the Windows update, dated November 13, 2023.

fixThis update addresses an issue that affects Microsoft Edge. The UI is wrong for the Internet Options Data Settings.

fixThis update addresses an issue that affects Storage Spaces Direct (S2D) and Remote Direct Memory Access (RDMA). When you use them with SMBdirect in your networks, the networks fail. You also lose the ability to manage clusters.

fixThis update addresses an issue that affects Containers. They do not move past the “ContainerCreating” status.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). It prevents a stop error that occurs when you apply more than 32 policies.

fixThis update addresses an issue that might stop your system from resuming from hibernate. This occurs after you turn on BitLocker.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). The issue copies unsigned WDAC policies to the Extensible Firmware Interface (EFI) disk partition. It is reserved for signed policies.

fixThis update addresses an issue that affects Enhanced Fast Reconnect. It fails. This occurs when you use it with third-party remote desktop protocol (RDP) providers.

fixThis update addresses an issue that affects the Remote Desktop Session Host (RD Session Host). A deadlock occurs when a large number of users sign in.

fixThis update addresses an issue that affects dsamain.exe. It stops responding. This occurs when the Knowledge Consistency Checker (KCC) runs evaluations.

securityThis update addresses an issue that affects lsass.exe. It leaks memory. This occurs during a Local Security Authority (Domain Policy) Remote Protocol (LSARPC) call.

fixThis update addresses an issue that affects the kernel stack. It might overflow. Because of this, VMs might shut down prematurely.

featureStarting in this update, File Explorer adds the Mark of the Web (MoTW) tag to files and folders that come from untrusted locations. When MapUrlToZone classifies a file as “Internet,” that file also gets this tag. Because of this change, the “LastWriteTime” time stamp is updated. This might affect…

20348.2461 May 14, 2024 Release notes ↗

securitySecurity update: includes the May 2024 Security Updates

otherThis update addresses a known issue that might affect domain controllers (DC). NTLM authentication traffic might increase.

fixThis update addresses an issue that affects IE mode. A webpage stops working as expected when there is an open modal dialog.

fixThis update addresses an issue in that affects IE mode. It stops responding. This occurs if you press the left arrow key when an empty text box has focus and caret browsing is on.

fixThis update addresses an issue that affects Wi-Fi Protected Access 3 (WPA3) in the Group Policy editor. HTML preview rendering fails.

fixThis update addresses an issue that affects a server after you remove it from a domain. The Get-LocalGroupMember cmdlet returns an exception. This occurs if the local groups contain domain members.

otherThis update affects next secure record 3 (NSEC3) validation in a recursive resolver. Its limit is now 1,000 computations. One computation is equal to the validation of one label with one iteration. DNS Server Administrators can change the default number of computations. To do this, use the…

fixThis update addresses an issue that affects a network. An error occurs when credentials expire.

fixThis update addresses an issue that occurs when you use LoadImage() to load a top-down bitmap. If the bitmap has a negative height, the image does not load, and the function returns NULL.

securityThis update includes quarterly changes to the Windows Kernel Vulnerable Driver Blocklist file, DriverSiPolicy.p7b. It adds to the list of drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fixThis update addresses an issue that affects a workstation that is not in a domain. When you connect from it to a share and use an IPV6 address, you get the error, “ERROR_BAD_NET_NAME.”

otherThis update addresses a known issue that might cause your VPN connection to fail. This occurs after you install the update dated April 9, 2024, or later.

fixThis update addresses an issue that might affect Virtual Secure Mode (VSM) scenarios. They might fail. These scenarios include VPN, Windows Hello, Credential Guard, and Key Guard.

securityThis update addresses an issue that affects Group Policy Folder Redirection in a multi-forest deployment. The issue stops you from choosing a group account from the target domain. Because of this, you cannot apply advanced folder redirection settings to that domain. This issue occurs when the…

fixThis update affects Windows Defender Application Control (WDAC). The update addresses an issue that might cause some apps to fail when you apply WDAC Application ID policies.

20348.2402 Apr 9, 2024 Release notes ↗

securitySecurity update: includes the April 2024 Security Updates

featureNew! This update affects Windows Hello for Business. IT admins can now use mobile device management (MDM) to turn off the prompt that appears when users sign in to an Entra-joined machine. To do this, they can turn on the “DisablePostLogonProvisioning” policy setting. After a user signs in,…

otherThis update supports daylight saving time (DST) changes in Palestine. To learn more, see Interim guidance for DST changes announced by Palestinian Authority for 2024, 2025.

otherThis update supports DST changes in Kazakhstan. To learn more, see Interim guidance for Kazakhstan time zone changes 2024.

otherThis update supports DST changes in Samoa. To learn more, see Interim guidance for Samoa DST changes 2021.

fixThis update addresses an issue that causes high CPU usage. This occurs after you open the Snipping Tool.

fixThis update addresses an issue that affects a network resource. You cannot access it from a Remote Desktop session. This occurs when you turn on the Remote Credential Guard feature and the client is Windows 11, version 22H2 or higher.

fixThis update addresses an issue that affects Microsoft Edge IE mode. When you open many tabs, it stops responding.

fixThis update addresses an issue that affects DNS servers. They receive Event 4016 for a timeout of the Lightweight Directory Access Protocol (LDAP). This occurs when they perform DNS registrations. Name registrations fail with Active Directory Domain Services (AD DS). The issue remains until you…

fixThis update addresses an issue that affects workload virtual machines (VM). They lose their connection to the network in production environments.

fixThis update addresses an issue that affects mouse cursor movements. They lag in some screen capture scenarios, especially when you use the Remote Desktop Protocol (RDP).

fixThis update addresses an issue that affects the Group Policy service. It fails after you use LGPO.exe to apply an audit policy to the system.

fixThis update addresses an issue that affects the display of a smart card icon. It does not appear when you sign in. This occurs when there are multiple certificates on the smart card.

fixThis update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system.

fixThis update addresses an issue that affects temporary group membership. Users whose memberships have expired appear when you search for them in LDAP. This occurs even though Active Directory has removed them.

fixThis update addresses an issue that affects a root directory. When you open an alternate data stream and delete something, you get an error.

fixThis update addresses an issue that affects the Resilient File System (ReFS). A stop error prevents the OS from starting up correctly.

fixThis update addresses an issue that occurs when you create a file that spans more than one directory. When you rename the original directory, you get an error.

fixThis update addresses an issue that affects fastfat.sys. It stops responding. This occurs because of a race condition.

fixThis update addresses an issue that affects Name Service Provider Interface (NSPI) queries. They might fail. If they do, lsass.exe stops responding on a domain controller.

20348.2342 Mar 22, 2024 Release notes ↗

securityThis update addresses a known issue that affects the Local Security Authority Subsystem Service (LSASS). It might leak memory on domain controllers (DCs). This issue occurs after you install KB5035857 (March 12, 2024). The leak occurs when on-premises and cloud-based Active Directory DCs process…

20348.2340 Mar 12, 2024 Release notes ↗

securitySecurity update: includes the March 2024 Security Updates

securityThe update affects Active Directory domains that host mobile device management (MDM) providers. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.” To do this, they can allow an Active Directory Key Distribution Center (KDC) to read user security…

otherKB5014754: Certificate-based authentication changes on Windows domain controllers

otherPreview of SAN URI for Certificate Strong Mapping for KB5014754

fixThis update addresses an issue that affects the touch keyboard. It might not show during out-of-box experience (OOBE).

fixThis update addresses an issue that makes the troubleshooting process fail. This occurs when you use the Get Help app.

fixThis update addresses an issue that affects Remote Desktop Web Authentication. You might not be able to connect to sovereign cloud endpoints.

otherThis update affects HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. Your device can now set and maintain the correct default permissions.

otherThis update addresses a memory allocation issue in the Host Network Service (HNS). It causes high memory usage. It also affects service and pod deployment.

20348.2322 Feb 13, 2024 Release notes ↗

securitySecurity update: includes the February 2024 Security Updates

fixThis update addresses an issue that affects remote direct memory access (RDMA) performance counters. They do not return networking data on VMs in the right way.

fixThis update addresses an issue that affects fontdrvhost.exe. It stops responding when you use Compact Font Format version 2 (CFF2) fonts.

otherThis update addresses a memory leak in ctfmon.exe.

otherThis update addresses a memory leak in TextInputHost.exe.

fixThis update addresses an issue that affects protected content. It stops cross-process windows from being created. Because of this update, you can keep using out-of-process hosting for things like WebView2 under protected, top-level windows.

fixThis update addresses an issue that affects touchscreens. They do not work properly when you use more than one monitor.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). Its “allow” policies might block some binaries from running.

featureThis update affects Unified Extensible Firmware Interface (UEFI) Secure Boot systems. It adds a renewed signing certificate to the Secure Boot DB variable. You can now opt for this change. For more details, see KB5036210.

fixThis update addresses an issue that affects the download of device metadata. Downloads from the Windows Metadata and Internet Services (WMIS) over HTTPS are now more secure.

securityThis update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It might stop working. This occurs when you access the Active Directory database.

fixThis update addresses an issue that affects the Certificate Authority snap-in. You cannot select the "Delta CRL" option. This stops you from using the GUI to publish Delta CRLs.

fixThis update addresses an issue that affects a local account. You cannot sign in to an account that Windows LAPS manages. This occurs if you set the "Require Smart Card for Interactive Logon" policy.

fixThis update addresses an issue that affects Server Message Block (SMB) connections. They disconnect when all of the following are true:

otherYou change the client and server encryption cipher list from the default values.

otherThe client and server do not have any ciphers in common.

otherSMB encryption is not in use.

otherA multi-channel configuration, such as RDMA, is in place.

fixThe update addresses an issue that affects SMB over a Quick UDP Internet Connection (QUIC). It stops responding if port 445 is blocked.

otherThis update changes a setting in Active Directory Users & Computers. By default, the snap-in now uses a strong certificate mapping of X509IssuerSerialNumber. It does not use the weak mapping of x509IssuerSubject.

otherThis update addresses a known issue that affects chromium-based internet browsers, such as Microsoft Edge. They might not open correctly. They might also show a white screen and stop responding when you open them. Devices that have browser-specific Image File Execution Options (IFEO) might also…

20348.2227 Jan 9, 2024 Release notes ↗

securitySecurity update: includes the January 2024 Security Updates

fixThis update addresses an issue that affects Microsoft Intune. One of its new features does not work properly.

fixThis update addresses an issue that affects account lockout event 4625. The format of the event is wrong in the ForwardedEvents log. This occurs when an account name is in the user principal name (UPN) format.

fixThis update addresses an issue that affects hybrid joined devices. You cannot sign in to them if they are not connected to the internet. This occurs when you use a Windows Hello for Business PIN or biometric credentials. This issue applies to a cloud trust deployment.

fixThis update addresses an issue that affects the Trusted Sites Zone logon policy. You cannot manage it using mobile device management (MDM).

fixThis update addresses an issue that affects Microsoft Excel. It stops responding when you try to share a file as a PDF in Outlook.

fixThis update addresses an issue that affects the Server Manager pop-up text. It removes the words “Azure Automanage.”

fixThis update addresses an issue that affects XPath queries on FileHash and other binary fields. It stops them from matching values in event records.

fixThis update addresses an issue that affects certain network functions on VMs. Deployment of them fails.

fixThis update addresses an issue that affects the Network Controller. The issue makes you create more rules for outbound traffic so that return traffic is not blocked.

fixThis update addresses an issue that affects a WS_EX_LAYERED window. The window might render with the wrong dimensions or at the wrong position. This occurs when you scale the display screen.

fixThis update addresses an issue that affects printing to PDF metadata. It extracts the username that you sign in with and puts it into the author name metadata box. Instead, print to PDF should place your display name in that box.

fixThis update addresses an issue that affects disk partitions. Your system might stop responding. This occurs if you add space from a deleted partition to an existing BitLocker partition.

fixThis update addresses an issue that affects Windows Defender Application Control (WDAC). AppID Tagging policies might greatly increase how long it takes your device to start up.

fixThis update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system.

fixThis update addresses an issue that affects the display of a smart card icon. The icon does not appear when you sign in. This occurs when there are multiple certificates on the smart card.

fixThis update addresses an issue that affects Active Directory domain controllers. They report DS_BUSY errors when you create new users. This only occurs on primary domain controller emulators (PDCe).

fixThis update addresses an issue that affects the Windows Local Administrator Password Solution (Windows LAPS). The LAPS account does not work. This occurs if the password is older than the age that the maximum age device policy allows.

fixThis update addresses an issue that affects the Kerberos Key Distribution Center (KDC). It returns a KDC_ERR_S_PRINCIPAL_UNKNOWN error during trust referrals, which is wrong.

fixThis update addresses an issue that affects the msDS-KeyCredentialLink attribute. In some cases, it is updated when it should not be.

fixThis update addresses an issue that causes lsass.exe to stop responding. Because of this, a restart loop occurs.

fixThis update addresses an issue that affects the Key Distribution Service (KDS). It does not start in the time required if LDAP referrals are needed.

20348.2159 Dec 12, 2023 Release notes ↗

securitySecurity update: includes the December 2023 Security Updates

featureThis update affects the Netherlands time zone. It adds the recent man-made landmass outside of Rotterdam to the shape files.

otherThis update affects Microsoft Defender for Endpoint (MDE). It enables Conditional Access (CA) scenarios.

20348.2113 Nov 14, 2023 Release notes ↗

securitySecurity update: includes the November 2023 Security Updates

otherThis update supports daylight saving time (DST) changes in Syria. To learn more, see Interim guidance for Syria DST changes 2022.

fixThis update addresses an issue that affects UI Automation and caching mode.

otherThis update affects Windows Autopilot profiles. The process to download the Windows Autopilot policy is more resilient. This helps when a network connection might not be fully initialized. This update increases the retry attempts when you try to download the Windows Autopilot profile.

fixThis update addresses an issue that causes your device to restart when you do not expect it. This occurs after you restore a system.

otherThis update affects user mode printer drivers. They unload unexpectedly. This occurs when you print from multiple print queues to the same printer driver.

fixThis update addresses an issue that affects Xenon or Argon containers. They do not start.

otherThis update affects Windows Server: Azure Edition. It is easier to view attestation failure notifications.

fixThis update addresses an issue that affects an Application Virtualization (App-V) environment. Copy operations within it stop working. This occurs after you install the April 2023 update.

fixThis update addresses an issue that blocks external connections. This occurs when you set up a Kubernetes load balanced service and turn on session affinity.

fixThis update addresses an issue that affects NCryptGetProperty(). Calling it with NCRYPT_KEY_TYPE_PROPERTY returns 0x1 instead of 0x20. This occurs when the key is a machine key.

fixThis update addresses an issue that affects Windows LAPS. Its PasswordExpirationProtectionEnabled policy fails to turn on the setting.

fixThis update addresses an issue that affects the refsutil.exe inbox utility. Options, like salvage and leak, do not work well on Resilient File System (ReFS) volumes.

fixThis update addresses an issue that might affect a large reparse point. You might get a stop error when you use NTFS to access it. This issue occurs after a canceled FSCTL Set operation changes the reparse tag.

fixThis update addresses an issue that affects a machine that is used as a remote desktop session (RDS) host. An RDR_FILE_SYSTEM (0x27) stop error occurs. Because of this, everyone that uses RDS starts up from this machine.

otherThis update addresses a known issue that affects virtual machines (VMs) that run on VMware ESXi hosts. Windows Server 2022 might fail to start up. The affected VMs will receive an error with a blue screen and a stop code: PNP DETECTED FATAL ERROR.

fixThis update addresses an issue that affects a COM+ component. It might stop responding. This occurs because of a deadlock during COM+ Just-in-Time (JIT) activation. However, this part of this update is off by default for this version of Windows. If you have this issue, you must contact Microsoft…

20348.2031 Oct 10, 2023 Release notes ↗

securitySecurity update: includes the October 2023 Security Updates

featureNew! This update adds an Azure Arc Setup Optional Component. It includes a new Azure Arc system tray icon and a new Server Manager entry for Azure Arc Management. There is also a graphical installer for the Azure Connected Machine agent. Now, you can turn on Azure Arc using just a few clicks. You…

featureNew! This update completes the work to comply with the GB18030-2022 requirements. It removes and remaps characters for Microsoft Wubi input and Microsoft Pinyin U-mode input. You can no longer enter character codepoints that are not supported. All the required codepoints are up to date.

otherThis update addresses a race condition. This occur when codepages load during the early part of startup. This leads to stop error a 0x7e.

otherThis update changes the spelling of Ukraine's capital from Kiev to Kyiv.

otherThis update supports daylight saving time (DST) changes in Greenland.

fixThis update addresses an issue that affects scheduled tasks. Tasks that call the credential manager API might fail. This occurs if you select [Run only when user is logged on] and [Run with highest privileges].

securityThis update addresses an issue that affects Kerberos delegation. It might fail in the wrong way. The error code is 0xC000006E (STATUS_ACCOUNT_RESTRICTION). This issue might occur when you mark the intermediate service account as “This account is sensitive and cannot be delegated” in Active…

fixThis update addresses an issue that affects PCI devices. You might get an error when you turn on Kernel Direct Memory Access (DMA) protection.

otherThis update improves the efficiency and performance of the Recommended Troubleshooter.

otherThis update affects Windows Filtering Platform (WFP) connections. The redirect diagnostics for them has improved.

fixThis update addresses an issue that affects external binding. It fails. This occurs after you install Windows updates dated May 2023 or later. Because of this, there are issues that affect LDAP queries and authentication.

otherThis update affects Active Directory event ID 1644 processing. It now accepts events that are more than 64 KB in length. This change truncates Lightweight Directory Access Protocol (LDAP) queries that are in event 1644 to 20000 characters by default. You can configure the 20K value using the…

fixThis update addresses an issue that affects those who enable the “Smart Card is Required for Interactive Logon” account option. When RC4 is disabled, you cannot authenticate to Remote Desktop Services farms. The error message is, "An authentication error has occurred. The requested encryption type…

fixThis update addresses an issue that affects I/O over Server Message Block (SMB). It might fail when you use the LZ77+Huffman compression algorithm.

fixThis update addresses an issue that affects the Server Message Block (SMB) client. It does not reconnect all the persistent handles when the reauthentication of a session fails.

securityTo protect against CVE-2023-44487, you should install the latest Windows update. Based on your use case, you can also set the limit of the RST_STREAMS per minute using the new registry keys in this update. You can create the DWORD registry values in the table below under the following registry…

20348.1970 Sep 12, 2023 Release notes ↗

securitySecurity update: includes the September 2023 Security Updates

featureNew! This update affects firewall settings. You can now make changes that allow you to configure application group rules.

otherThis update supports daylight saving time (DST) changes in Israel.

fixThis update addresses an issue that affects Server Message Block (SMB). You cannot access the SMB shared folder. The errors are, “Not enough memory resources” or “Insufficient system resources.”

fixThe update addresses an issue that affects scheduled tasks. The tasks fail when they use stored local user account credentials. This occurs when you enable Credential Guard. The error message is "2147943726: ERROR_LOGON_FAILURE (The user name or password is incorrect).”

securityThis update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). It stops responding. This occurs when you use Azure Virtual Desktop (AVD).

fixThe update addresses an issue that affects those who use Windows Update for Business. After you are asked to change your password at sign in, the change operation fails. Then you cannot sign in. The error code is 0xc000006d.

securityThis update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS) process. It might stop responding. Because of this, the machine restarts. The error is 0xc0000005 (STATUS_ACCESS_VIOLATION).

fixThis update addresses an issue that affects the Tab Window Manager. It stops responding when you use IE mode.

fixThis update addresses an issue that is related to changes in the forwarding of events.

fixThis update addresses an issue that affects the Group Policy Service. It will not wait for 30 seconds, which is the default wait time, for the network to be available. Because of this, policies are not correctly processed.

featureThis update adds a new API for D3D12 Independent Devices. You can use it to create multiple D3D12 devices on the same adapter. To learn more, see D3D12 Independent Devices.

fixThis update addresses an issue that affects virtual machines (VM). Creating new VMs fails for Azure Stack Hub customers. This occurs when you add a new node to a cluster.

fixThis update addresses an issue that affects certain VMs. Deploying them fails. This occurs because certain VM images do not respond to Address Resolution Protocol (ARP) requests if the source is outside of the local network.

fixThis update addresses an issue that affects Azure Stack HCI customers. Your attempts to create VMs fail. This occurs when you delete and recreate server Representational State Transfer (REST) resources for the Network Controller.

fixThis update addresses an issue that affects print jobs that are sent to a virtual print queue. They fail without an error.

otherThis update affects Windows Defender Application Control (WDAC). Its policy to block software based on a hash might not stop the software from running.

otherThis update affects unsigned WDAC policies. They are copied to the Extensible Firmware Interface (EFI) disk partition. It is reserved for signed policies.

fixThis update addresses an issue that affects the Remote Desktop (RD) Web Role. If you enable that role, it fails when you upgrade RD deployments more than once.

fixThis update addresses an issue that affects Narrator. Its focus does not change when the keyboard focus changes. Because of this, Narrator reads the wrong label within the dialog that appears when you sign in.

fixThis update addresses an issue that affects the Microsoft Distributed Transaction Coordinator (DTC). It has a handle leak. Because of this, the system runs out of memory.

fixThis update addresses an issue that affects the Resultant Set of Policy (RSOP). The Windows LAPS "BackupDirectory" policy setting was not being reported. This occurs when the setting is set to 1, which is “Back up to AAD.”

fixThis update addresses an issue that affects authentication. Using a smart card to join or rejoin a computer to an Active Directory domain might fail. This occurs after you install Windows updates dated October 2022 or later. For more details, see KB5020276.

fixThis update addresses an issue that affects DPM 2019 and DPM 2022. When you try to install them, it fails. This occurs because the Resilient File System (ReFS) stops responding.

otherThis update turns on the Remote Desktop IP Virtualization feature. It simulates a single-user desktop. To do this, it supports per-session and per-program Remote Desktop IP Virtualization for Winsock applications. To learn more, see Remote Desktop IP Virtualization in Windows Server.

20348.1906 Aug 8, 2023 Release notes ↗

securitySecurity update: includes the August 2023 Security Updates

fixThis update addresses an issue that affects Microsoft Teams. It fails to send you notifications under certain conditions.

fixThis update addresses an issue that affects the Windows Management Instrumentation (WMI) repository. This causes an installation error. The issue occurs when a device does not shut down properly.

fixThis update addresses an issue that affects Event Forwarding Subscriptions. When you add an Event Channel to the subscription, it forwards events you do not need.

fixThis update addresses an issue that affects apps that use DirectX on older Intel graphics drivers. You might receive an error from apphelp.dll.

otherThis update enhances hinting for some of the letters of the Verdana Pro font family.

fixThis update addresses an issue that might affect your computer when you are playing a game. Timeout Detection and Recovery (TDR) errors might occur.

fixThis update addresses an issue that affects the software-defined networking (SDN) firewall In Memory Object Store DB. Its migration fails.

featureThis update affects text edit controls in XAML. You cannot edit the controls again after they become read only. This occurs when you use the new Microsoft Input Method Editor for Japanese, Chinese, and Korean.

fixThis update addresses an issue that affects applications that perform certain actions in a callback. The applications might stop working. These actions include closing a Window (WM_CLOSE).

securityThis update addresses a deadlock in Internet Protocol Security (IPsec). When you configure servers with IPsec rules, they stop responding. This issue affects virtual and physical servers.

fixThis update addresses an issue that affects Networking-MPSSVC-Svc. The issue causes a system to enter a restart loop. The stop code is 0xEF.

fixThis update addresses an issue that causes Windows to fail. This occurs when you use BitLocker on a storage medium that has a large sector size.

securityThis update affects the Windows Kernel Vulnerable Driver Blocklist, DriverSiPolicy.p7b. It adds drivers that are at risk for Bring Your Own Vulnerable Driver (BYOVD) attacks.

fixThis update addresses an issue that affects Active Directory Federation Services (AD FS). It might take several attempts to sign in to AD FS successfully. This is because the time calculation for the expiration of a single sign on cookie is wrong.

fixThis update addresses an issue that affects repair storage jobs. The jobs are suspended. This occurs after two physical disks in two different rack-level fault domains (three fault domain in total) lose communication.

fixThis update addresses an issue that affects AD Domains and Trusts snap-ins. They fail to enumerate domain trusts. The error message is, "The parameter is incorrect."

20348.1850 Jul 11, 2023 Release notes ↗

securitySecurity update: includes the July 2023 Security Updates

featureNew! This update improves several simplified Chinese fonts and the Microsoft Pinyin Input Method Editor (IME). They now support GB18030-2022. Characters in the Standard Chinese Characters List (GB18030-2022 implementation level 2) are available in Microsoft Yahei (regular, light, and bold),…

featureNew! This update removes Simplified Chinese handwriting recognition from Windows Server 2022. This is because conformant handwriting recognition is not available for Windows Server. Updated media will have this change. To update existing images, use the DISM tool to remove the Simplified Chinese…

fixThis update addresses an issue that affects console applications. They fail when you set the system locale to Japanese.

fixThis update addresses an issue that affects the Notepad combo box in Settings. It fails to show all the available options.

otherThis update addresses a race condition. It occurs when codepages load during early startup. This might cause a 0x7e stop error.

fixThis update addresses an issue that affects Microsoft Edge IE mode. The text on the status bar is not always visible.

fixThis update addresses an issue that affects the Microsoft HTML Application Host (HTA). This issue blocks code execution that uses Microsoft HTA. This occurs when you turn on Windows Defender Application Control (WDAC) User Mode Code Integrity (UMCI) enforced mode.

otherThe update addresses a random issue that affects svchost.exe. There is significant memory growth in a system. This occurs when svchost.exe contains the User Access Logging Service (UALSVC).

fixThis update addresses an issue that affects all the registry settings under the Policies paths. They might be deleted. This occurs when you do not rename the local temporary user policy file during Group Policy processing.

fixThis update addresses an issue that affects dot sourcing. It fails for files that contain a class definition in Windows PowerShell.

fixThis update addresses an issue that affects .msi files. A minor update is not installed. This occurs when you use the EnterpriseDesktopAppManagement configuration service provider (CSP) to distribute the .msi file.

fixThis update addresses an issue that affects msftconnecttext.net. It gets excessive HTTP traffic.

fixThis update addresses an issue that affects the Spooler service. It stops working. This issue occurs when you print using a certain workspace.

otherThe update addresses an intermittent issue that affects an audio stream. The issue disrupts the stream.

fixThis update addresses an issue that affects NCryptGetProperty(). When you call it with NCRYPT_KEY_TYPE_PROPERTY, the system returns 0x1 instead of 0x20. This occurs when the key is a machine key.

fixThis update addresses an issue that affects a tib.sys driver. It does not load. This occurs when HyperVisor-protected Code Integrity (HVCI) is enabled.

fixThis update addresses an issue that affects HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders. You can now set and maintain the correct default permissions for this directory path. When the permissions are wrong, the Start menu, search, and Azure Active Directory (Azure…

fixThis update addresses an issue that affects Active Directory Users & Computers. It stops responding. This occurs when you use TaskPad view to enable or disable many objects at the same time.

fixThis update addresses an issue that affects File Explorer. It might stop responding indefinitely. This occurs after you try to view the effective access permissions for files in File Explorer.

fixThis update addresses an issue that affects Live Migration. It might fail in a stretch cluster deployment. This occurs because the Storage Replica fails to retry after it receives a retry error from the Cluster API.

fixThis update addresses an issue that affects cluster name object of failover clustering. You cannot repair it on Azure Virtual Machines.

fixThis update addresses an issue that affects Remote Server Administration Tools (RSAT). In the Standard edition, Network Controller Management Tools is missing from the RSAT dialog.

20348.1787 Jun 13, 2023 Release notes ↗

securitySecurity update: includes the June 2023 Security Updates

fixThis update addresses an issue that affects servers that have Citrix and Ivanti as a Remote Desktop Services (RDS) server. Signing in to them takes a very long time.

otherThis update addresses a resource conflict issue between two or more threads (known as a deadlock). This deadlock affects COM+ applications.

fixThis update addresses an issue that affects the Storage Spaces Direct (S2D) cluster. It might not come online. This occurs after a periodic password rollover. The error code is 1326.

otherThis update addresses a memory leak. It occurs every time you print a rich text document.

fixThis update addresses an issue that might affect the Domain Name System (DNS) suffix search list. When you configure it, the parent domain might be missing.

otherThis update changes the support phone number for Microsoft India for Windows activation.

fixThis update addresses an issue that might cause some systems to stop working. This occurs when you implement firewall logging.

securityThis update addresses an issue that might affect the Local Security Authority Subsystem Service (LSASS). It might close sporadically. The system logs the exception 0xc0000710 in the Application Error event 1000. Because of this, the domain controller restarts unexpectedly. This issue affects…

securityThis update addresses an issue that affects the Windows Kernel. This issue is related to CVE-2023-32019. To learn more, see KB5028407.

20348.1726 May 9, 2023 Release notes ↗

securitySecurity update: includes the May 2023 Security Updates

featureNew! This update changes firewall settings. You can now configure application group rules.

fixThis update addresses an issue that affects conhost.exe. It stops responding.

otherThis update affects the Islamic Republic of Iran. The update supports the government’s daylight saving time change order from 2022.

otherThis update addresses issues that affect the 32-bit version of Windows Calculator.

fixThis update addresses an issue that affects apps that use DirectX on older Intel graphics drivers. You might receive an error from apphelp.dll.

fixThe update addresses an issue that sends unexpected password expiration notices to users. This occurs when you set up an account to use “Smart Card is Required for Interactive Logon” and set "Enable rolling of expiring NTLM secrets".

fixThis update addresses an issue that affects Microsoft Edge IE mode. Pop-up windows open in the background instead of in the foreground.

fixThis update addresses an issue that affects the software defined networking (SDN) virtual subnet. The delete operation creates an error. This stops the virtual subnet from being deleted.

fixThe update addresses an issue that affects AzureService Fabric containers. This change is off by default. To enable the change, set Globals.RouteResolutionOrderConfig to TRUE. To propagate the value, move the primary node for VswitchService and SDNAPI. After you set the value, this change will…

fixThis update addresses an issue that affects protected content. When you minimize a window that has protected content, the content displays when it should not. This occurs when you are using Taskbar Thumbnail Live Preview.

fixThis update addresses an issue that affects mobile device management (MDM) customers. The issue stops you from printing. This occurs because of an exception.

fixThis update addresses an issue that affects signed Windows Defender Application Control (WDAC) policies. They are not applied to the Secure Kernel. This occurs when you enable Secure Boot.

fixThis update addresses an issue that affects the Windows Defender Application Control. The policy that blocks software using a hash rule might not stop the software from running.

otherThis update addresses an Active Directory Federation Services (AD FS). You might need to retry authentication multiple times to sign in successfully.

fixThis update addresses an issue that affects accounts that run the Set-AdfsCertificate command. The command fails. This occurs when an account does not have read permissions for the related Distributed Key Manager (DKM) container.

securityThis update addresses a race condition in Windows Local Administrator Password Solution (LAPS). The Local Security Authority Subsystem Service (LSASS) might stop responding. This occurs when the system processes multiple local account operations at the same time. The access violation error code is…

fixThis update addresses an issue that affects the legacy Local Administrator Password Solution (LAPS) and the new Windows LAPS feature. They fail to manage the configured local account password. This occurs when you install the legacy LAPS .msi file after you have installed the April 11, 2023,…

fixThis update addresses an issue that affects SMB Direct. Endpoints might not be available on systems that use multi-byte character sets.

20348.1668 Apr 11, 2023 Release notes ↗

securitySecurity update: includes the April 2023 Security Updates

featureNew! This update adds many new features and improvements to Microsoft Defender for Endpoint. For more information, see What's new in Microsoft Defender for Endpoint.

featureNew! This update implements the new Windows Local Administrator Password Solution (LAPS) as a Windows inbox feature. For more information, see By popular demand: Windows LAPS available now!

fixThis update addresses an issue that affects inbound remote Component Object Model (COM) activations. They fail. The error code is 0x80010111. This occurs if the client protocol version is less than 5.7.

fixThis update addresses an issue that affects Microsoft PowerPoint. It stops working on Azure Virtual Desktop (AVD). This occurs when you use Visual Basic for Applications (VBA).

fixThis update addresses an issue that affects Windows Search. Windows Search fails inside of Windows container images.

otherThis update affects the Arab Republic of Egypt. The update supports the government’s daylight saving time change order for 2023.

fixThis update addresses an issue that affects the Key Distribution Center (KDC) service. When the service stops on a local machine, signing in to all local Kerberos fails. The error is STATUS_NETLOGON_NOT_STARTED.

fixThis update addresses an issue that affects the Windows Remote Management (WinRM) client. The client returns an HTTP server error status (500). This error occurs when it runs a transfer job in the Storage Migration Service.

fixThis update addresses an issue that affects Desired State Configuration. It loses its previously configured options. This occurs if metaconfig.mof is missing.

otherThis update addresses compatibility issues that affect some printers. These printers use Windows Graphical Device Interface (GDI) printer drivers. These drivers do not completely adhere to GDI specifications.

otherThis update addresses a stack overflow condition that causes a device to stop working. This occurs when you call xxxDestroyWindow() in Kernel mode.

otherThis update addresses a rare issue that might cause an input destination to be null. This issue might occur when you attempt to convert a physical point to a logical point during hit testing. Because of this, the computer raises a stop error.

fixThis update addresses an issue that affects certain processors that have firmware Trusted Platform Modules (TPM). You cannot use Autopilot to set them up.

fixThis update addresses an issue that affects the Fast Identity Online 2.0 (FIDO2) PIN credential icon. It does not appear on the credentials screen of an external monitor. This occurs when that monitor is attached to a closed laptop.

fixThis update addresses an issue that affects a Clustered Shared Volume (CSV). The CSV fails to come online. This occurs if you enable BitLocker and local CSV managed protectors, and the system recently rotated the BitLocker keys.

fixThis update addresses an issue that affects Windows Server 2022 domain controllers. They stop working. This occurs when they process Lightweight Directory Access Protocol (LDAP) requests.

fixThis update addresses an issue that affects Administrator Account Lockout policies. GPResult and Resultant Set of Policy did not report them.

fixThis update addresses an issue that affects MySQL commands. The commands fail on Windows Xenon containers.

fixThis update addresses an issue that affects Windows Server Failover Clustering. If you configure a cloud witness, both sites think that the other side is down. This is a “split-brain” scenario.

20348.1607 Mar 14, 2023 Release notes ↗

securitySecurity update: includes the March 2023 Security Updates

fixThis update addresses an issue that stops hyperlinks from working in Microsoft Excel.

featureThis update implements phase three of Distributed Component Object Model (DCOM) hardening. See KB5004442. After you install this update, you cannot turn off the changes using the registry key.

fixThis update addresses an issue that affects the registry size. It grows very large. This occurs because the registry entries are not removed when users sign out of an Azure Virtual Desktop (AVD) environment that uses FSlogix.

otherThis update affects the United Mexican States. This update supports the government’s daylight saving time change order for 2023.

fixThis update addresses an issue that affects the Get-WinEvent cmdlet. It fails. The system throws InvalidOperationException.

fixThis update addresses an issue that affects Azure Active Directory (Azure AD). Using a provisioning package for bulk provisioning fails.

fixThis update addresses an issue that affects the Routing and Remote Access Service (RRAS). RRAS cannot accept any new incoming virtual private network (VPN) connections.

securityThis update addresses an issue that occurs when an access control policy denies you access to a resource. When you sign out, the system does not delete the POST Security Assertion Markup Language (SAML) Request cookie. This stops you from choosing other resources the next time you sign in.

securityThis update addresses an issue that affects the Local Security Authority Subsystem Service (LSASS). LSASS might stop responding. This occurs after you run Sysprep on a domain-joined machine.

securityThis update addresses an issue that affects a computer account and Active Directory. When you reuse an existing computer account to join an Active Directory domain, joining fails. This occurs on devices that have installed Windows updates dated October 11, 2022 or later. The error message is,…

fixThis update addresses an issue that affects Storage Replication setup. Setup might fail on machines that use non En-US locales.

fixThis update addresses an issue that affects cluster name object (CNO) repairs. This issue stops you from using Failover Clustering to repair a CNO on an Azure virtual machine (VM).

otherThis update addresses a known issue that affects guest virtual machines (VMs). If they run Windows Server 2022 on some versions of VMware ESXi, the OS might not start up. This issue only affects Windows Server 2022 VMs that have Secure Boot turned on. The affected versions of VMware ESXi are…

20348.1547 Feb 14, 2023 Release notes ↗

securitySecurity update: includes the February 2023 Security Updates

featureNew! It updates the text and web link for Windows Admin Center (WAC) notifications. These appear after you sign in to the desktop unless you have turned them off. The WAC notifications highlight the available Windows Server management options.

fixThis update addresses an issue that affects searchindexer.exe. It randomly stops you from signing in or signing out.

fixThis update addresses an issue that affects local Kerberos authentication. It fails if the local Key Distribution Center (KDC) service is not active.

fixThis update addresses an issue that affects cbs.log. This issue logs messages that are not error messages in cbs.log.

fixThis update addresses an issue that affects a virtual machine (VM) that has a dual stack IPv4 and IPv6 private IP (PIP) address. When you migrate the VM from one host to another, the PIPv6 address stays mapped to the old host’s IPv6 Physical Address (PA). Because of this, the IPv6 PIP stops working.

securityThis update addresses an issue that affects all commands that change security tags. On Windows 11, version 22H2 computers, the change will fail if you update the Network Controller but not the Remote Server Administration Tools (RSAT) clients.

fixThis update addresses an issue that might occur when the Input Method Editor (IME) is active. Applications might stop responding when you use the mouse and keyboard at the same time.

fixThis update addresses an issue that might affect FindWindow() or FindWindowEx(). They might return the wrong window handle.

fixThis update addresses an issue that affects AppV. It stops file names from having the correct letter case (uppercase or lowercase).

fixThis update addresses an issue that affects Microsoft Edge. The issue removes conflicting policies for Microsoft Edge. This occurs when you set the MDMWinsOverGPFlag in a Microsoft Intune tenant and Intune detects a policy conflict.

fixThis update addresses an issue that affects Active Directory Federation Service (AD FS). The issue fails to apply the RequirePDC flag setting of “false.”

fixThis update addresses an issue that affects MSInfo.exe. It does not correctly report the enforcement status of the Windows Defender Application Control (WDAC) user mode policy.

fixThis update addresses an issue that affects the Resilient File System (ReFS) MSba tag. The issue causes a nonpaged pool leak.

fixThis update addresses an issue that affects parity virtual disks. Using Server Manager to create them fails.

20348.1487 Jan 10, 2023 Release notes ↗

securitySecurity update: includes the January 2023 Security Updates

fixThis update addresses an issue that might affect authentication. It might fail after you set the higher 16-bits of the msds-SupportedEncryptionTypes attribute. This issue might occur if you do not set the encryption types or you disable the RC4 encryption type on the domain.

fixThis update addresses an issue that causes the get-winevent command to fail. The error code is InvalidOperationException.

fixThis update addresses an issue that affects certain systems that have firmware Trusted Platform Modules. (TPM). This issue stops you from using AutoPilot to set up those systems.

featureThis update addresses issues that affect the Local Session Manager (LSM). These issues might allow users who do not have admin rights to perform actions that only an admin can.

otherThis update addresses a known issue that affects apps that use Microsoft Open Database Connectivity (ODBC) SQL Server Driver (sqlsrv32.dll) to connect to databases. The connection might fail. You might also receive an error in the app, or you might receive an error from the SQL Server.

20348.1368 Dec 20, 2022 Release notes ↗

otherThis update addresses an known issue that affects Hyper-V hosts that use software defined networking (SDN) and are managed by System Center Virtual Machine Manager (VMM). You might receive an error for workflows that involve:

featureCreating a new network adapter for an existing virtual machine (VM) that is joined to a VM network

featureCreating a new VM that has a network adapter that is joined to a VM network.

20348.1366 Dec 13, 2022 Release notes ↗

securitySecurity update: includes the December 2022 Security Updates

fixThis update addresses an issue that affects remote networks. This issue stops you from reconnecting to them using DirectAccess.

20348.1251 Nov 17, 2022 Release notes ↗

securityIt addresses a known issue that might affect Windows Servers that have the Domain Controller (DC) role. They might have Kerberos authentication issues if both of the following are true: You might receive Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 errors. These appear in the…

otherYou installed the November 8, 2022, or later update on the DC

otherYou configured the SupportedEncrytionType key to remove the RC4 cipher at a domain level or on individual accounts

20348.1249 Nov 8, 2022 Release notes ↗

securitySecurity update: includes the November 2022 Security Updates

securityIt addresses security vulnerabilities in the Kerberos and Netlogon protocols as outlined in CVE-2022-38023, CVE-2022-37966, and CVE-2022-37967. For deployment guidance, see the following:

securityKB5020805: How to manage the Kerberos Protocol changes related to CVE-2022-37967

securityKB5021130: How to manage Netlogon Protocol changes related to CVE-2022-38023

securityKB5021131: How to manage the Kerberos Protocol changes related to CVE-2022-37966

20348.1131 Oct 17, 2022 Release notes ↗

securityIt addresses an issue that might affect some types of Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connections. These connections might have handshake failures. For developers, the affected connections are likely to receive one or more records followed by a partial record with a…

20348.1129 Oct 11, 2022 Release notes ↗

securitySecurity update: includes the October 2022 Security Updates

otherIt addresses a known issue that might affect file copies that use Group Policy Preferences. They might fail or might create empty shortcuts or files that have 0 (zero) bytes.

20348.1006 Sep 13, 2022 Release notes ↗

securitySecurity update: includes the September 2022 Security Updates

securityThis update contains miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release.

20348.887 Aug 9, 2022 Release notes ↗

securitySecurity update: includes the August 2022 Security Updates

securityAddresses an issue that might cause the Local Security Authority Server Service (LSASS) to leak tokens. This issue affects devices that have installed Windows updates dated June 14, 2022 or later. This issue occurs when the device performs a specific form of service for user (S4U) in a non-Trusted…

20348.825 Jul 12, 2022 Release notes ↗

securitySecurity update: includes the July 2022 Security Updates

fixAddresses an issue that redirects the PowerShell command output so that transcript logs do not contain any content. Transcript logs might contain decrypted passwords if you turn PowerShell logging on. Consequently, the transcript logs lose the decrypted passwords.

20348.768 Jun 14, 2022 Release notes ↗

securitySecurity update: includes the June 2022 Security Updates

securityAddresses an elevation of privilege (EOP) vulnerability under CVE-2022-30154 for the Microsoft File Server Shadow Copy Agent Service. To become protected and functional, you must install the June 14, 2022 or later Windows update on both the application server and the file server. The application…