Server 2025 Archives

Winsage

September 19, 2026

Microsoft fixes bug behind ‘Defender Antivirus is turned off’ alerts

Microsoft resolved an issue that caused misleading alerts indicating that Defender Antivirus was disabled after recent updates. This fix was confirmed in an update to the Windows release health dashboard and was implemented in the Microsoft Defender Antivirus update (version 4.18.26080.4) rolled out on September 17. The bug, acknowledged by Microsoft in late August, affected users in the Release Preview Channel of the Windows Insider program since at least June and impacted all supported versions of Windows clients and servers. Users received erroneous notifications in the Windows Security app prompting them to activate Microsoft Defender Antivirus, despite it functioning correctly. Misleading alerts could appear upon Windows startup and intermittently thereafter, even when notification settings were disabled.

Winsage

September 18, 2026

Windows 11 Update Can Break Active Directory Trust Relationships

A recent security update from Microsoft, KB5124008, has caused disruptions for organizations using on-premises Active Directory, particularly affecting domain-joined Windows 11 devices with Credential Guard. After installing this update, some devices lost their secure trust relationship with the domain, preventing users from logging in with valid credentials. The issue is linked to Machine Identity Isolation, a security feature that enhances machine account credential protection but requires domain controllers to operate at the Windows Server 2025 Domain Functional Level. Organizations that enabled this feature without meeting the prerequisite may experience trust relationship failures. Microsoft has suggested a workaround to disable Machine Identity Isolation and plans to suspend its enforcement in an upcoming update while improvements are made.

Winsage

September 17, 2026

Microsoft patch gives domain-joined Windows PCs trust issues

Microsoft acknowledged a significant issue affecting Windows 11 versions 24H2, 25H2, and 26H1 related to Active Directory domain logins as of September 16. This issue stems from changes made to Machine Identity Isolation in the September 2026 security update (KB5124008), which may cause Credential Guard-protected machine accounts to lose their secure channel with an on-premises Active Directory domain, preventing users from signing in with valid domain credentials. The update activates Machine Identity Isolation but does not enforce it immediately, and it is only compatible with environments linked to domain controllers operating at the Windows Server 2025 Domain Functional Level (DFL) or higher. Microsoft advised that devices not connected to Windows Server 2025 domain controllers will need to disable Machine Identity Isolation. A workaround involves disabling the feature through Intune, Group Policy, or the Windows Registry, followed by a device restart and repairing the secure channel using the Test-ComputerSecureChannel PowerShell command. Microsoft plans to address this issue in a future update by temporarily halting Machine Identity Isolation enforcement while enhancements are made.

Winsage

September 16, 2026

Windows Server 2022 Nears End of Mainstream Support

Organizations using Windows Server 2022 will lose mainstream support on October 13, 2026, although security updates will continue through extended support until October 2031. Customers are encouraged to plan for an upgrade to Windows Server 2025 to avoid potential security vulnerabilities and complications in future migrations. Microsoft recommends early evaluation and testing of Windows Server 2025 to ensure compatibility and smooth transition. Additionally, support for the Azure Edition’s hotpatching capability has been extended to October 2027, providing some customers more time to strategize their migration. However, remaining on Windows Server 2022 means missing out on new features and enhancements.

Winsage

September 16, 2026

Windows Server 2022 reaches end of mainstream support next month

Microsoft has announced that mainstream support for Windows Server 2022 will end next month, transitioning to an extended support phase that lasts until October 2031. Windows Server 2022 was released in September 2021 and will receive its final mainstream support update on October 13, 2026. After this date, it will continue to receive essential security updates at no extra cost until October 14, 2031. Hotpatching for Windows Server 2022 will be available until October 2027 for Datacenter: Azure Edition. Microsoft encourages administrators to upgrade to Windows Server 2025, which began rolling out to Windows Insiders in January 2024 and is expected to be generally available by November 2024. Windows Server 2025 will have mainstream support until November 13, 2029, followed by five years of extended support until November 14, 2034. A 180-day trial of Windows Server 2025 is available through the Microsoft Evaluation Center.

Winsage

September 15, 2026

Microsoft issues emergency Windows 11 update to fix its record-breaking patch

Microsoft has rolled out an emergency out-of-band update to address issues from its September Patch Tuesday update, which affected nearly 1,000 vulnerabilities and caused bugs in folder shares on Hyper-V-based Linux virtual machines, Remote Desktop Services sessions, and certain USB audio devices. The new update targets multiple versions of Windows 11 (26h1, 25H2, and 24H2) and also includes updates for Windows Server 2025, 2022, and LTSC versions of Windows 10 and Windows Server 2012 and 2012 R2. In 2023, Microsoft has increasingly issued out-of-band updates, including four in January, two in March, and one in July, to resolve various issues.

Winsage

September 14, 2026

Latest Windows Server Updates Cause Remote Desktop Issues

Organizations that implemented Microsoft’s September 2026 security updates are experiencing challenges with Remote Desktop Services (RDS) on Windows Server systems, leading to instability and connection failures. Issues typically arise hours after the update, causing ongoing Remote Desktop sessions to freeze, difficulties in disconnecting, and failures in establishing new connections. Affected systems include Windows Server 2012 through Windows Server 2025 and select Windows client versions, with problems such as failed RDP connections, sign-in difficulties, unresponsive management tools, and servers stalling during Remote Desktop configuration. Microsoft advises administrators to uninstall the September 2026 updates, which would remove security enhancements, and is investigating the root cause while providing Known Issue Rollback policies. For inaccessible virtual machines, restarting the affected VM is recommended as a temporary measure.

Winsage

September 11, 2026

September Windows Server updates break Remote Desktop Services

Windows administrators are experiencing significant challenges with Remote Desktop Services (RDS) following the installation of the September 2026 cumulative updates for Windows Server versions 2019, 2022, and 2025. Users are unable to connect, and some require a hard reset to regain functionality. Reports indicate that RDS servers initially function well but fail after a few hours, with existing sessions struggling to disconnect and new connections failing. Administrators have noted that issues arise after user logouts, leading to service crashes and deadlocks between Remote Desktop and the Local Session Manager. Microsoft has not confirmed the cause of these failures, which affect all mentioned Windows Server releases. Some administrators have restored functionality by rolling back the updates, but this also removes important security fixes. Microsoft is investigating the issue and will provide guidance.

Winsage

September 10, 2026

CVE-2026-85880 and CVE-2026-81963: Microsoft Patches Two Actively Exploited Windows Zero-Days

Microsoft's Patch Tuesday on September 8, 2026, addressed two critical Windows privilege escalation vulnerabilities: CVE-2026-85880 and CVE-2026-81963, both with a CVSS score of 7.8. CVE-2026-85880 is a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC), allowing attackers with low-privilege local access to escalate privileges to SYSTEM. CVE-2026-81963 involves improper link resolution in the Windows Update Stack, enabling similar privilege escalation. Both vulnerabilities require no user interaction and have been actively exploited prior to the patch release. CISA added them to its Known Exploited Vulnerabilities catalog on September 8, 2026, with a remediation deadline of September 22 for U.S. federal agencies. CVE-2026-85880 affects various Windows 10 and Server versions but excludes Windows 11 and Windows Server 2025. CVE-2026-81963 impacts newer Windows platforms, including Windows 11 and Windows Server 2025. Microsoft released security updates for both vulnerabilities on September 8, 2026, and organizations are advised to prioritize these updates. Security teams should monitor for signs of privilege escalation and unusual SYSTEM-level activities related to these vulnerabilities.

Winsage

September 9, 2026

Critical Windows BitLocker Flaw Sparks Urgent Patch

On September 8, 2026, Microsoft disclosed a security vulnerability identified as CVE-2026-69449, related to a heap-based buffer overflow in the Windows BitLocker component, allowing authorized attackers to execute code on compromised machines. The vulnerability is classified as CWE-122, and is assessed as “Exploitation Less Likely.” It affects Windows 10, Windows 11, and Windows Server versions from 2012 to 2025. The fixes are included in cumulative updates KB5124008, KB5124012, KB5122878, and KB5122871. No public disclosure or observed exploitation occurred before the patch's release. The flaw allows for remote code execution through in-network attacks, primarily posing a risk to insiders. Affected systems include various versions of Windows 10, Windows 11, and Windows Server, applicable to both x64 and ARM64 architectures. Administrators should verify installed build numbers to ensure updates have been applied. The advisory does not specify which BitLocker code path is affected or the nature of the input that reaches the vulnerable buffer.