Windows Security Update Archives

Winsage

October 16, 2026

Networking problems after the October 2026 Windows update? NTLM might be to blame

The Windows security update scheduled for October 2026 will block requests using the outdated NTLMv1 security protocol. The BlockNtlmSSO registry value governs this change; if unset, Windows will default to Enforce mode, blocking NTLMv1-derived credentials. Administrators can temporarily set this value to 0 to allow NTLMv1, but Microsoft warns this reduces security. The deprecation of NTLM was first announced in 2024, with audit logs for NTLMv1 usage introduced in August 2025. NTLM was first introduced in 1993, and while it has been removed from Windows 11 24H2 and Windows Server 2025, traces remain in certain configurations. Credential Guard must be enabled, and the BlockNtlmSSO value must not be set to Audit mode for NTLMv1-derived credentials to be allowed. Microsoft aims to eliminate NTLM entirely, and the upcoming update signals the need for organizations to accelerate their transition away from NTLMv1.

Winsage

October 15, 2026

Microsoft: Recent Windows updates may trigger Remote Desktop failures

Microsoft has acknowledged an issue affecting non-admin users connecting to devices via Remote Desktop after recent Windows updates, specifically when the "Administrator protection" feature is enabled. This feature, introduced with the KB5067036 update for Windows 11 versions 24H2 and 25H2 in October 2025, restricts users to standard permissions and requires authentication through Windows Hello for certain actions. Users may encounter connection failures with error code 0xC000000D after applying the KB5124010 September 2026 non-security preview update on systems running Windows 11 versions 24H2, 25H2, 26H1, or 26H2. This issue primarily affects enterprise-managed remote devices configured as Remote Desktop hosts with Administrator protection enabled. Organizations using Windows security baselines have this feature enabled by default unless configured otherwise. A temporary workaround involves disabling Administrator protection, and IT administrators can reset the "User Account Control Type Of Admin Approval Mode" policy using Microsoft Intune or Group Policy. Similar issues have been addressed by Microsoft in the past, including a problem resolved in March 2025 and emergency updates issued last month for Remote Desktop Services failures on Windows Server devices.

Winsage

October 11, 2026

Windows PCs that are not up to date will lose Windows Update itself in 2027

Windows machines that are not current with updates will face changes in access to Windows Update due to two critical certificate expirations on May 17, 2027, and June 19, 2027. Supported versions must install specific security updates before these dates to maintain access. - Windows 11, version 25H2 and later: No action required. - Windows 11, version 24H2 and Windows Server 2025: Must install the September 2025 Windows security update or later, before June 19, 2027. - Other in-support Windows 11 versions and Windows Server 2022: Must install the July 2026 Windows security update or later, before June 19, 2027. - In-support Windows 10 versions: Must install the July 2026 Windows security update or later, before June 19, 2027. - Windows 10 Enterprise 2019 LTSC, Windows Server 2019, and Windows Server 2016: Must install the July 2026 Windows security update or later, before May 17, 2027. - Any other Windows version: Upgrade to a supported release to maintain access. Devices that are up to date will continue receiving updates without interruption, while those that are behind will lose access to Windows Update services after the expiration dates. Out-of-support versions will lose access entirely. The notice regarding the certificate expiration was posted on October 8, 2026, and reiterated on October 10, 2026.

Winsage

September 21, 2026

Microsoft: September updates break File History backup feature

Microsoft has issued a caution regarding the File History backup feature in Windows, indicating potential functionality issues on certain systems after installing the September 2026 security updates. Users may experience application crashes related to FileHistory.exe and KERNELBASE.dll, and may be unable to create or update backups. Misleading messages such as “Reconnect your drive” may appear, and the “Last Backup” timestamp may fail to update. Affected Windows versions include Windows 10 21H2 or later, Windows 10 Enterprise LTSC 2016/2019, and Windows 11 23H2 and later. Microsoft has acknowledged ongoing issues related to the September 2026 updates and is working on solutions.

Winsage

September 8, 2026

Microsoft releases Windows security update addressing 723 flaws

Microsoft released its September 2026 security updates, addressing two critical Windows elevation-of-privilege vulnerabilities: CVE-2026-85880 and CVE-2026-81963. Both vulnerabilities were exploited before their public disclosure on September 8. CVE-2026-85880 involves a heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC), allowing low-privileged attackers to gain SYSTEM privileges. CVE-2026-81963 affects the Windows Update Stack due to improper link resolution and access controls, enabling similar privilege escalation. The September release also includes 974 Common Vulnerabilities and Exposures (CVEs) across various Microsoft products, with 723 affecting Windows. Users of Windows 11 24H2 and 25H2 receive updates via KB5124008, while Windows 11 26H1 receives KB5124012. Windows 11 24H2 Home or Pro editions will reach end of servicing on October 13, 2026. Users are advised to install the updates promptly and back up important data.

Winsage

July 15, 2026

Dell PCs are shutting down after Windows 11’s July update, Microsoft admits and blocks it

Microsoft has blocked the Windows 11 July 2026 update (KB5101650) on certain Dell PCs due to issues causing unexpected shutdowns, diminished performance, excessive heat, and battery drain. The problems are linked to the Intel Innovation Platform Framework Processor Participant driver, which affects power management. The complications stem from an optional June 2026 update (KB5095093) that introduced changes impacting the performance of some Dell PCs. Microsoft has not provided a list of affected models but is working with Dell to resolve the issue. The July update has been preemptively blocked from installation on incompatible devices, and a resolution is expected soon.

Winsage

June 1, 2026

Microsoft fixes KB5089549 Windows security update install issues

Microsoft resolved an issue causing installation failures and error code 0x800f0922 during the deployment of the May 2026 Windows 11 security update (KB5089549), which was linked to insufficient free space on the EFI System Partition (ESP). The problem mainly affected devices with 10 MB or less available space, leading to automatic rollbacks of the update. The resolution was provided through the release of the Windows 11 KB5089573 preview cumulative update on May 26, 2026. Users installing updates released on or after this date will not need a workaround, while those with earlier updates can use the Known Issue Rollback feature. Additionally, IT administrators in enterprise settings can manually address the issue through Group Policy configurations. The KB5089573 update introduced 30 changes to improve performance and reliability.

Winsage

May 19, 2026

Microsoft confirms patching issues in restricted Windows networks

Microsoft has issued a service alert indicating that customers in restricted network environments may encounter Windows Update failures, specifically error code 0x80010002, after installing the January 2026 optional non-security preview updates. Affected devices might download the February monthly Windows security update but could struggle with updates released in March and beyond due to changes in download timeout requirements. Microsoft is working on a resolution, and IT administrators can use Known Issue Rollback (KIR) as a workaround by configuring the appropriate Group Policy for their Windows version. A device restart is required to apply these settings. Historical issues include a bug fixed in April 2025 affecting WSUS installations and another issue resolved in August 2025 related to the Windows 11 24H2 cumulative update. Additionally, a KIR fix was provided for a known issue causing the May 2026 Windows 11 security update to fail with error code 0x800f0922.

Winsage

May 13, 2026

Microsoft releases Windows 10 KB5087544 extended security update

Microsoft has released the Windows 10 KB5087544 extended security update, which addresses vulnerabilities identified during the May 2026 Patch Tuesday and resolves issues related to Remote Desktop warnings. Users on Windows 10 Enterprise LTSC or enrolled in the ESU program can install it via Settings under Windows Update. The update upgrades Windows 10 to build 19045.7291 and Windows 10 Enterprise LTSC 2021 to build 19044.7291. The update focuses on security enhancements and bug fixes, addressing 120 vulnerabilities. Key fixes include resolving incorrect Remote Desktop security warning dialogs in multi-monitor setups, introducing dynamic status reporting for Secure Boot, and adjusting Daylight Savings Time for Egypt. A known issue may require users to input their BitLocker recovery key after installation, affecting systems with specific BitLocker Group Policy configurations. Microsoft suggests removing the affected Group Policy setting and suspending and resuming BitLocker as a temporary solution.

Winsage

May 10, 2026

Microsoft Confirms KB5083769 Breaks Macrium and Acronis Backups

Microsoft's April 2026 Windows security update, KB5083769, may disrupt image-mount operations for backup applications such as Macrium Reflect, Acronis Cyber Protect Cloud, UrBackup Server, and NinjaOne Backup due to the addition of the psmounterex.sys kernel driver to its Vulnerable Driver Blocklist. This action was taken to address a high-severity buffer overflow vulnerability, CVE-2023-43896. The inclusion of this driver in the blocklist has rendered several backup products inoperable, and Microsoft will not retract the block for security reasons. Administrators can use Event ID 3077 in the Code Integrity log to confirm that the blocklist is causing the failures. Microsoft advises updating backup applications to versions that include necessary driver protections instead of uninstalling or pausing the security patch. Additionally, the April updates have caused other issues, such as failures in Windows Server installations and devices booting into BitLocker recovery mode.