Windows Server 2022 Archives

Winsage

June 16, 2025

Windows Server update may disrupt IP refreshes

Microsoft has acknowledged that the June security update has caused complications for users of Windows Server systems, specifically affecting the Dynamic Host Configuration Protocol (DHCP) service, which is failing and leading to improper functioning of IP refreshes. The issue impacts multiple versions of Windows Server, including 2016 (KB5061010), 2019 (KB5060531), 2022 (KB5060526), and 2025 (KB5060842). Users have reported that the DHCP service may stop responding after installing the update, with one administrator noting their 2016 server crashed shortly after the update was applied. Microsoft is working on a solution and advises affected users to uninstall the update to restore functionality. The company has a history of DHCP-related issues dating back over a decade and has faced other problems with Windows Server updates in the past year, including issues with keyboard and mouse inputs and authentication challenges.

Winsage

June 16, 2025

Microsoft: June Windows Server security updates cause DHCP issues

Microsoft has identified an issue with the June 2025 security updates that causes the Dynamic Host Configuration Protocol (DHCP) service to freeze on certain Windows Server systems. This affects the service's ability to apply renewals of unicast IP addresses, impacting network operations. Microsoft has acknowledged that the DHCP Server service may intermittently stop responding after the update and is working on a resolution. Additionally, other issues affecting Windows Server systems have been addressed, including application failures and authentication problems on domain controllers. Out-of-band updates were previously issued to fix bugs causing Hyper-V virtual machines to restart or freeze, and emergency updates were released for issues with Windows containers on certain Windows Server versions.

Winsage

June 12, 2025

Microsoft Resolves Windows Server 2025 Restart Bug Disrupting Active Directory Connectivity

Microsoft released updates in June 2025 to address critical issues affecting Windows Server 2025 domain controllers, specifically authentication failures and network connectivity problems. The updates, encapsulated in KB5060842, resolved issues stemming from security update KB5055523, which altered certificate validation methods for Kerberos authentication. This change led to logging errors for self-signed certificates and affected Windows Hello for Business Key Trust deployments. Additionally, a separate issue prevented domain controllers from managing network traffic correctly after restarts, causing them to revert to standard firewall profiles. Microsoft provided a temporary workaround for administrators to manually restart network adapters until a permanent fix was implemented. The June updates addressed a total of 66 vulnerabilities, including 10 rated as Critical, and recommended immediate installation. Microsoft advised against setting the AllowNtAuthPolicyBypass registry key to ‘2’ for domain controllers using self-signed certificates until the latest updates were applied.

Winsage

May 27, 2025

Windows Server emergency update fixes Hyper-V VM freezes, restart issues

Microsoft has released an emergency update, KB5061906, to address unexpected freezes and restarts affecting Hyper-V virtual machines on Windows Server 2022, particularly Azure confidential VMs. This cumulative out-of-band update resolves a critical issue in the direct send path for guest physical addresses, which could cause these VMs to stop responding or restart. The update is not automatically installed and must be manually downloaded from the Microsoft Update Catalog. Standard Hyper-V deployments are largely unaffected, with rare exceptions. Organizations using Windows Server 2022 with Hyper-V should apply this update if they have not yet deployed the May 2025 Windows security update (KB5058385).

Winsage

May 26, 2025

Microsoft releases an update to tackle a built-in issue in Windows images, but who is it for?

Microsoft encourages users to adopt the latest version of Windows or a version eligible for monthly security updates to protect against security threats. Older Windows ISOs are vulnerable due to outdated security updates and antimalware software. Microsoft has released an update for Microsoft Defender to enhance the security of these older Windows images. This update includes the latest Microsoft Defender binaries, which must be applied offline to WIM and VHD files for Windows 11, Windows 10 (Enterprise, Pro, Home), Windows Server 2022, 2019, and 2016. The update improves both the anti-malware client and engine, with package sizes of 78.2 MB for ARM64, 128 MB for x86, and 132 MB for x64 systems. Users need a 64-bit version of Windows 10 or later, PowerShell 5.1 or later, and specific modules to implement the update. Regular updates every three months are recommended for optimal security.

Winsage

May 19, 2025

Windows Remote Desktop Gateway UAF Vulnerability Allows Remote Code Execution

A critical vulnerability, designated as CVE-2025-21297, has been identified in Microsoft’s Remote Desktop Gateway (RD Gateway) due to a use-after-free (UAF) bug linked to concurrent socket connections during the service's initialization. This flaw, located in the aaedge.dll library within the CTsgMsgServer::GetCTsgMsgServerInstance function, allows multiple threads to overwrite a global pointer, leading to potential arbitrary code execution. The vulnerability affects multiple versions of Windows Server, including 2016, 2019, 2022, and 2025. Microsoft released security updates in May 2025 to address the issue, implementing mutex-based synchronization. The updates are KB5050011 for Windows Server 2016, KB5050008 for Windows Server 2019, KB5049983 for Windows Server 2022, and KB5050009 for Windows Server 2025. Security experts recommend applying these patches promptly and monitoring RD Gateway logs for unusual activity.

Winsage

May 17, 2025

9 Months Later, Microsoft Finally Fixes Linux Dual-Booting Bug

In August 2024, a security update aimed at improving Secure Boot disrupted dual-booting of Windows and Linux due to a vulnerability in the GRUB bootloader. This allowed malicious actors to bypass Secure Boot protections. Microsoft released a patch, KB5058385, on May 13, 2025, to resolve the issue by enhancing the Secure Boot Advanced Targeting (SBAT) system's ability to recognize legitimate Linux bootloaders, preventing them from being blocked. The patch is applicable to various versions of Windows, including Windows 11 (multiple versions) and Windows Server (multiple versions). The update will be automatically applied through Windows Update for affected installations.

Winsage

May 15, 2025

Windows Remote Desktop Gateway Vulnerability Let Attackers Trigger Dos Condition

The Microsoft Security Response Center (MSRC) has released critical security updates to address a significant vulnerability in the Windows Remote Desktop Gateway service, identified as CVE-2025-26677, which allows unauthorized attackers to cause denial of service (DoS) conditions. This vulnerability is rated as "High" severity with a CVSS score of 7.5 and affects multiple versions of Windows Server, including 2016, 2019, 2022, and 2025. Microsoft has provided security updates (KB5058383, KB5058392, KB5058385, and KB5058411) to rectify the issue. Additionally, another vulnerability, CVE-2025-29831, has been identified that could enable remote code execution (RCE) through a Use After Free weakness, also rated with a CVSS score of 7.5. This vulnerability requires user interaction, specifically an admin user to stop or restart the service, and affects Windows Server versions 2008 R2, 2012/R2, 2016, 2019, 2022, and 2025. Organizations are advised to prioritize patching both vulnerabilities and to review network configurations to limit exposure of Remote Desktop Gateway services. The vulnerabilities were discovered by security researchers from Kunlun Lab.

Winsage

May 6, 2025

Microsoft pushes fix for Windows 11 update 0x80240069 errors

Microsoft has resolved an issue that affected the delivery of Windows 11 24H2 feature updates via Windows Server Update Services (WSUS) after the installation of the April 2025 security updates. Users reported upgrade problems, specifically encountering error code 0x80240069 during attempts to update from Windows 11 23H2 or 22H2. The update complications primarily impact enterprise environments using WSUS, while home users are less likely to experience these issues. Microsoft is rolling out a fix through Known Issue Rollback (KIR) for enterprise-managed devices, requiring IT administrators to implement the KIR Group Policy on affected endpoints. Additionally, Microsoft is addressing a separate issue where some PCs were upgraded to Windows 11 despite Intune policies preventing such upgrades.

Winsage

April 30, 2025

Microsoft: Windows 11 24H2 updates fail with 0x80240069 errors

Microsoft has acknowledged a significant issue affecting enterprise users trying to upgrade to Windows 11 24H2 via Windows Server Update Services (WSUS) after installing the April 2025 security updates, specifically the monthly security update KB5055528. Users with Windows 11 23H2 or 22H2 are encountering Windows Update Service errors with the code 0x80240069, preventing the download process for Windows 11 24H2 from initiating or completing. Microsoft confirmed that devices with the April security update might be unable to update via WSUS. WSUS, primarily used in enterprise settings, has been deprecated as of September 2024, but Microsoft will continue to support existing functionalities. Additionally, Microsoft is addressing a "latent code issue" that has caused some devices to upgrade to Windows 11 despite Intune policies against such upgrades.