September 2026 updates: investigate KB5123099, WinGet and backup problems

2026-10-24 · Microsoft Edge Stable 155 → 156.0.4314.42

Edge 155 will not start: check the confirmed fix

Microsoft confirms startup failures for some existing profiles following an update restart scheduled through the Edge management service. Its issue tracker identifies Stable 155; the release notes identify 156.0.4314.42, released on 22 October 2026, as the fix. No KB number, precise affected minor-version range or general error code is supplied. This does not explain every Edge startup failure.

1. Before changes, record the installed version, channel, affected profile and time of the managed restart. Save open work and preserve profile data and the existing recovery plan. Do not delete the profile or reset synchronization.
2. For an approved Stable channel, use the regular update process. If Edge still opens: Settings and more → Help and feedback → About Microsoft Edge, or edge://settings/help; finish the offered update and restart. If the browser will not start or is centrally managed, IT must use its approved deployment process. Do not bypass management policies or switch channels.
3. Then verify the version actually running: at least the confirmed fix 156.0.4314.42 in the appropriate Stable branch. Reopen the original profile and test a noncritical work page. If the failure remains, this case is not verified as fixed; report the version and event time to IT.

If new problems appear, pause deployment and use the documented recovery plan with IT. Microsoft documents administrative version rollback but warns about data loss and older security vulnerabilities; do not downgrade without validation. Its issue tracker also describes a conditional Policy-folder intervention. No deletion procedure is recommended here: establish fix deployment and backups first. No independent Edge reproduction test or universal repair guarantee is claimed.

Microsoft sources: Release notes · Known issues · Update settings · Administrative rollback

2026-10-23 · Windows / Windows Server

Check installation prerequisites and boot media

Checked on 23 October 2026: the server articles record clarified prerequisites in their 22 October change logs. This is a documentation revision, not a new package or a confirmed fix for every installation failure. The packages below were released on 13 October 2026. An older KB is an example of the minimum baseline; an applicable later cumulative update also meets the date requirement.

Package / product / build / required baseline

• KB5126655 — Windows Server 2022 — 20348.5761 — ≥ 2025-07-08 (KB5062572)
• KB5126651 — Windows Server 2019 / Windows 10 Enterprise LTSC 2019 — 17763.9376 — ≥ 2025-07-08 (KB5062557)
• KB5126868 — Windows Server 2016 / Windows 10 Enterprise LTSB 2016 / Windows 10 IoT Enterprise LTSB 2016 — 14393.9612 — ≥ 2025-07-08 (KB5062560)

Before retrying, record the product, actual installed build, package/SSU state, installation method and exact error. Check the baseline and latest required SSU against the individual Microsoft article. Offline Server 2022 images additionally need KB5030216 or a later LCU dated 12 September 2023 or later; the stated minimum SSU version 20348.1960 is not the current OS build. 0x800f0823 means CBS_E_NEW_SERVICING_STACK_REQUIRED, not proof of the cause of every update failure.

For modified installation media only: Microsoft warns of 0xc0430001 if boot.stl is absent or does not match the Windows version and architecture. September articles KB5122876 (17763.9245) and KB5123099 (14393.9512) also contain this guidance. Preserve the original ISO and working medium unchanged, and service only a copy using the complete Microsoft procedure. The recommended Update WinPE workflow takes boot.stl from the serviced WinPE image and places it at efi\microsoft\boot\boot.stl on the medium. Do not copy a file from another Windows version or disable Secure Boot.

Verification and recovery: boot the rebuilt medium on suitable test hardware with Secure Boot unchanged; verify Setup starts and retest the original error before rollout. If it fails, discard the modified copy and return to the unchanged original suitable for that test hardware. This does not establish a link to user reports of winload.efi failures after normal updates, nor recommend blanket removal of security updates. No Windows installation test was performed by us.

Sources and complete procedure

• https://support.microsoft.com/help/5126655
• https://support.microsoft.com/help/5126651
• https://support.microsoft.com/help/5126868
• https://support.microsoft.com/help/5122876
• https://support.microsoft.com/help/5123099
• https://learn.microsoft.com/en-us/windows/deployment/update/media-dynamic-update

2026-10-22 · .NET / Windows · MSRC 2.0 (2026-10-19)

.NET CVE-2026-70197: October updates are not a confirmed complete fix

Status and scope

MSRC revision 2.0, dated 19 October 2026, says CVE-2026-70197 has not been addressed. The full retrieval on 22 October confirms that statement; a complete mitigation is being prepared and tested. The original .NET announcement describes a Windows-specific System.Net.Sockets flaw when reusing SocketAsyncEventArgs across IPv4 and IPv6 datagram sockets. An undersized native address buffer can corrupt memory. Microsoft describes a network attack requiring neither authentication nor user interaction, but with high attack complexity. This does not establish that every .NET application is exploitable.

An update reference is not proof of remediation

The MSRC table still lists .NET 8.0 / KB5130034 / 8.0.32, .NET 9.0 / KB5130035 / 9.0.21 and .NET 10.0 / KB5130036 / 10.0.13 on Windows, plus .NET 11.0.0-rc.2, Visual Studio 2026 18.10.4 and Visual Studio 2022 17.14.42. The older GitHub advisory still labels versions as patched. This source conflict must be explicit: do not omit the newer MSRC correction. No confirmed complete fix or release date is established.

Safe diagnosis

Inventory with dotnet --info and dotnet --list-runtimes; keep results internal. For self-contained applications, also check the bundled runtime actually used; the central list is insufficient. Application owners must assess their specific socket/datagram usage. Successful installation and functional tests do not prove this CVE is fixed. No vendor-confirmed workaround command is established. Do not disable protections or generally uninstall October updates. Individually assessed network restrictions would be conditional risk reduction, not proven mitigation.

Recovery and verification

These inventory queries change nothing. Before a future confirmed runtime/application update, preserve the deployment, configuration and a tested recovery path. Then compare Microsoft's confirmed minimum with the runtime actually in use, restart services under change control and run business regression tests. Mark the CVE resolved only after current vendor confirmation. No independent exploit or repair test is claimed.

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70197
• https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Oct
• https://github.com/dotnet/announcements/issues/466
• https://github.com/dotnet/runtime/security/advisories/GHSA-4mpw-cpwj-hxxj

2026-10-16 · Outlook for Microsoft 365

Classic Outlook: search results do not follow mailbox changes

Microsoft’s article, dated 29 September 2026, describes server-assisted search in Outlook for Microsoft 365. Results may remain stale after moving a message, changing its category or marking it read/unread. Even a single mailbox in online mode can be affected. The article identifies no specific KB, build or numeric error code. Microsoft says a fix is in progress, with no estimated availability; this is not a released fix.

Record the Outlook version, update channel, mailbox type, online mode and search scope. In “Current Folder”, use an unimportant test message to check whether changing its read/unread status updates the result, then restore the original status. Do not move important messages just to reproduce the problem. A search failure alone does not establish this cause.

Microsoft’s temporary workaround disables server-assisted search and falls back to legacy Windows Desktop Search. Before trying it, IT must check whether local search covers the required content and whether central policy controls the setting. Record whether the value exists, its type and original data; back up the affected registry key. The documented setting appears below. Do not deploy it indiscriminately or override organizational policy.

Repeat the same search and verify both current results and completeness against known test messages. Faster searching alone is not success. If results disappear or behavior worsens, restore the exact original value and type. Remove only a value newly created for this trial, not the whole key. Once Microsoft confirms a fix, withdraw the workaround under change control and retest. No registry change or independent reproduction was performed for this article. No affiliate links.

HKEY_CURRENT_USER\software\policies\Microsoft\office\16.0\outlook\search
DWORD: DisableServerAssistedSearch
Value: 1

Microsoft Support · 29.09.2026

As of 15 October 2026: The following additions update the older desktop, AC-3, RDP and domain-trust findings. Older dated sections remain as research history; statements such as “no fix yet” describe their historical status. No independent reproduction is claimed.

October fixes for a black desktop and AC-3: 15 October 2026

On 13 October Microsoft confirmed a fix for Explorer failures after sign-in, particularly on Azure Virtual Desktop hosts with FSLogix and some existing profiles. Not every black screen has this cause. Windows 11 24H2/25H2/26H2 uses KB5127648; 26H1 uses KB5127646. KB5127648 also fixes AC-3 crashes in applications relying on Windows' legacy audio decoding. Do not extend that AC-3 claim to 26H1. No universal error code is documented for these two problems.

Record version, build, architecture, update history and the affected application or profiles first. In managed environments verify host/profile backups and recovery. Install the appropriate cumulative update through the approved update channel and restart. Check winver: 24H2 → 26100.9711, 25H2 → 26200.9711, 26H2 → 26300.9711; 26H1 → 28000.3231. For a later update, verify its build against its own KB. Repeat the same sign-in and AC-3 playback, comparing Explorer events and crash logs. Do not delete profiles.

Before the fix, starting explorer.exe through Task Manager could temporarily help; Microsoft also provides a version-specific Known Issue Rollback. The workaround is not required after the fix. IT should retire managed KIR settings only with recorded prior state and a pilot test. If a new regression occurs, stop the test, preserve logs and use the approved recovery path. Do not routinely uninstall security updates.

Remote Desktop remains unresolved: non-admin users may receive 0xC000000D when Administrator protection is enabled on the destination host. KB5127648/KB5127646 are not a confirmed fix for this issue. Microsoft documents a temporary IT-managed policy change, not a general user recommendation to weaken protection. Any approved trial needs exact policy-state capture, a limited host scope, restoration and a connection retest. USB Audio Class 1.0 Code 10 is not universally fixed either.

Microsoft KB5127648 · Microsoft KB5127646 · Microsoft Release Health · Microsoft Release Health

Domain trust: confirmed resolution, not a new October patch

As of 11 October 2026, Microsoft identifies the 22 September update as the resolution for certain Credential Guard-protected machine accounts using Machine Identity Isolation (MII). The documentation revision on 8 October is not a new patch release date. Windows 11 24H2/25H2/26H2 use KB5124010 (builds 26100.9550/26200.9550/26300.9550); Microsoft lists KB5124006 separately for 26H1. Do not interchange packages between versions.

Affected devices can lose their trust relationship with an on-premises AD domain while cached offline sign-in still works. No specific numeric error code is established here. Not every sign-in failure has this cause.

Before making changes, record the version, build, update history, error message and MII management method. Prepare a verified backup, local recovery access and an operational recovery plan. IT should check the appropriate approved cumulative update and its known issues, install it and restart. Then verify the build, an actual online domain sign-in and the secure channel without repair switches. If unsuccessful, preserve logs and follow the prepared recovery plan; do not routinely uninstall updates or rejoin the domain.

The fix disables MII enforcement regardless of configuration; it does not fully restore that protection. Successful installation alone does not prove that a damaged secure channel has been repaired.

Microsoft Release Health · Microsoft Release Health · Microsoft KB5124010

Microsoft MSRC: October 2026 · KB / Build

3 October: AC-3 crashes after KB5124010 — no confirmed fix yet

Microsoft confirmed on 2 October 2026 that applications using Windows to decode AC-3/Dolby Digital audio may crash after the 22 September preview update KB5124010 and later updates. Windows 11 24H2, 25H2 and 26H2 are affected, not Windows Server. The respective KB builds are 26100.9550, 26200.9550 and 26300.9550. Older applications may close at launch or during audio playback; applications with their own decoding are not automatically affected.

Diagnosis, not a repair promise (3 October 2026): Microsoft is working on a correction. No confirmed fixed build, universal error code or official workaround is available for this issue yet.

1. Record the version and build with winver and the installed KB in update history. Note the application, version, crash time and triggering audio feature; timing alone does not prove this issue.
2. Preserve the original file and back up your work. Use a copy and a non-critical task to check whether the same trigger recurs. Do not treat codec packs, registry changes or blanket update removal as a fix.
3. Stop the test if it fails and retain the original/backup unchanged. Share logs without confidential content with your IT team or vendor. Once Microsoft identifies a suitable correction, have it approved through the normal process and retest the same task: launch, playback and saved output must work.

Return path: this diagnosis changes no system settings; close the test copy and return to the preserved original where the function remains usable. A single crash-free attempt does not prove a permanent fix. We have not reproduced the issue ourselves.

Microsoft Windows Release Health (02.10.2026) · Microsoft KB5124010

2 October: fix for invisible voicemail attachments in Outlook

Microsoft confirms that classic Outlook for Microsoft 365 on Windows can hide MP3/WAV attachments in delivered voicemail, especially from integrated voicemail systems. Its notice dated 29 September 2026 states that build 16.0.20430.2000 and later fix the issue. No originating KB, complete affected build range or general error code is specified; this does not justify uninstalling a KB.

1. Keep the original message and record product, build and update channel; back up local Outlook data before updating. Use normal Office updates to install a corrected build approved for your channel. On managed devices, involve IT and do not force a channel change.
2. Meanwhile, open the same message in Outlook on the web or new Outlook. Alternatively, open the message separately and use File → Save Attachments to save a copy in a controlled location. Do not delete profiles or original messages.

Restart Outlook after updating and check the same message: the correct audio attachment must be visible and playable. If it still fails, give IT the build and findings. Fallback: retain the original and backup and use the tested web access; a blanket Office downgrade is not part of this guide. No independent reproduction; sources checked on 2 October 2026.

Microsoft: issue and fix · Microsoft: Current Channel

1 October: Office unlicensed or missing after KB5002907

Microsoft confirms unexpected effects of KB5002907 on some devices running Office 2016 or Office 2019 and has paused its rollout. The repair was intended to restore updating for outdated Microsoft 365 Apps, but left some devices without a functioning Office installation. Microsoft does not specify a general error code or an exact affected Office build range. This is not a Windows operating system update; do not force installation of the paused update.

1. First preserve the current state: check update history for KB5002907, record the product/version and error message, and back up documents and locally stored Outlook data. Timing alone does not prove that every Office failure was caused by this KB.
2. Office is present but reports no licence: reactivate the product you already purchased using Microsoft's activation instructions. Use the account associated with its purchase/licence; involve IT for volume licences. Do not uninstall or buy another licence as a precaution.
3. Office was actually removed: only then reinstall and activate the purchased product from the official source associated with your licence account. Check the version, language and 32-/64-bit edition first. Do not delete Outlook profiles or data files.
4. Verify success: open Word or Excel, check the product and activation status, then open, edit and save a copy of a document. If Outlook was affected, also check the original function and local data. If the problem persists, stop further cleanup and contact Microsoft Support with the product, KB, message and steps already taken.

Recovery and limits: keep backed-up files unchanged; if problems occur, plan restoration from backup with IT/support. Microsoft specifies the appropriate reactivation or reinstallation, not a guaranteed one-click rollback by removing the KB. Office 2016/2019 are out of support; successful reactivation does not restore security servicing.

Microsoft: KB5002907 · Activation · Reinstallation

30 September: known issues also affect Windows 11 26H2

Microsoft’s source dated 29 September 2026 also lists Windows 11 26H2 for a black desktop after sign-in (especially AVD/FSLogix), domain trust failures involving Machine Identity Isolation, and USB Audio Class 1.0 with no sound or Code 10. Status: mitigated, not fully resolved. The 26H2 page supplies no originating KB or complete affected build range. The Catalog associates KB5129195 with build 26300.9457 and KB5124010 with build 26300.9550; these are not proof that all three issues are fully fixed.

For the black desktop, the targeted KIR procedure below now also applies to 26H2: Microsoft explicitly lists KB5124010 260924_20021 for 26H2/25H2/24H2. KB5124006 260924_20071 remains for 26H1. First record build, profile and events and preserve data/policies; IT should apply only the matching policy to an affected test group. Restart, then check desktop startup and Explorer events using the same profile. If new problems appear, restore the saved policy configuration and restart; the original issue may return. Do not delete profiles.

Code 10 alone does not establish this USB cause. For continuing audio or domain trust failures, record configuration and timing and review the applicable vendor diagnosis with IT. This is no general fix, no instruction to disable Credential Guard broadly and no recommendation to change Windows versions. Earlier dated sections remain as history; this note extends their scope. No independent reproduction; sources checked on 30 September 2026.

Microsoft: Windows 11 26H2 — Release Health · Microsoft Update Catalog

27 September: Defender for Linux – SIGILL and cloned devices

Newly verified vendor information: Microsoft lists two fixes in Defender for Endpoint on Linux 101.26081.0010 (release version 30.126081.0010.0, September 2026): SIGILL crashes caused by bundled open-source libraries on processors without SSE4.1, and duplicate Defender device identities when cloned Linux VMs retain the template’s machine identifier. The source supplies no separate KB number, exact release day or complete range of affected earlier versions. This is not a Windows KB fix or the earlier process-scan restart issue.

First record the version, CPU capabilities and crash times on one affected test device; for clones, also compare device mappings in the Defender portal. Document the baseline with mdatp health. SIGILL alone does not establish this cause. Before changes, preserve policies and package version and verify a recovery procedure; do not delete or regenerate machine IDs.

IT-managed update: check the approved Microsoft package channel for 101.26081.0010 or a newer version suitable according to Microsoft. Ubuntu/Debian: sudo apt-get install --only-upgrade mdatp; RHEL variants: sudo yum update mdatp; SLES: sudo zypper update mdatp. Use only the command appropriate to the distribution. These commands do not necessarily select that exact build. Check the offered package and the version actually installed afterwards; stop on errors instead of disabling protection.

Verify recovery: run mdatp health again, repeat the previously affected normal workload on the same device and look for new SIGILL events. For cloned VMs, check distinct device identities and fresh reporting in the portal. The release note does not promise automatic cleanup of already merged portal objects; refer those cases to Microsoft Support. A running process alone proves neither recovery nor complete protection.

Rollback for a new regression: stop rollout. Microsoft documents --downgrade --mdatp in the Defender Deployment Tool (preview) to select an earlier, still supported and available version. IT should use it only with a previously verified package and saved configuration; the documentation’s version is an example, not a recommendation. Recheck health and the original workload afterwards; the earlier issues can return. Without a dependable rollback, do not expand deployment. Offboarding, blanket removal and identity cleanup are not substitutes. No independent reproduction test; vendor evidence checked on 27 September 2026.

Microsoft: Defender for Endpoint — release notes · Microsoft: Linux updates · Microsoft: Defender Deployment Tool (preview) · Microsoft: Linux commands

25 September: black desktop – targeted KIR mitigation

Microsoft reports a mitigation, not a permanent fix, as of 24 September 2026, 19:27 PT (25 September in Austria). After KB5120998 of 27 August 2026 and subsequent updates, Windows 11 24H2/25H2 can show a black screen after sign-in; originating builds 26100.9278/26200.9278. Version 26H1 (KB5120996, 28000.2804) is also affected. Reports primarily concern Azure Virtual Desktop with FSLogix and existing profiles: the desktop fails to start and Explorer may crash in application logs. No common error code is specified. This is distinct from the earlier RDS server issue; Microsoft lists no affected server platforms here.

First record version/build, installed KBs, profile configuration and events; back up data and existing policies. Temporary session recovery: Ctrl+Shift+Esc → Run new task → explorer.exe → OK. This is not a permanent fix.

For affected managed devices, IT should obtain the matching KIR policy through the Release Health source below: KB5124010 260924_20021 for 24H2/25H2; KB5124006 260924_20071 for 26H1. The package name is not an instruction to install the preview. The MSI installs a template, which is not sufficient on its own. Under Computer Configuration → Administrative Templates → the relevant KIR policy, set the matching OS policy to Disabled as instructed by Microsoft. Start with an affected test group, verify policy application and restart. KIR reverses only the relevant non-security change, not the entire cumulative update.

Then sign in with the same affected profile; verify automatic desktop loading and Explorer events. If the issue remains, escalate diagnostics to IT; do not delete profiles or indiscriminately uninstall updates. To reverse unwanted effects, restore the previous policy configuration through the same management system and restart; the original problem may return. Remove the KIR from management according to Microsoft after a later confirmed fix. We have not reproduced the issue ourselves.

Excel 2019: complete fix now confirmed

The newly retrieved Microsoft issue page, dated 23 September 2026, now explicitly identifies build 10417.20211 as the full fix for silent paste failures in Office 2019. The older 24 September section below records the evidence available then. Check product/build under File → Account, back up the original workbook, use the approved Office update channel and test values, formulas and conditional formatting in a copy. If results are wrong, preserve the original and return to the backup. Office Online Server KB4461632 is also listed as a fix, but requires its separate farm update process, not desktop update instructions.

Microsoft: Windows Release Health · Microsoft: KIR · Microsoft: Excel · Microsoft: Office 2019 · Microsoft: Office Online Server

24 September: File History fix available

Microsoft confirms a fix for File History failures following KB5124008. KB5124010, released on 22 September 2026, is an optional preview for Windows 11 24H2 (26100.9550) and 25H2 (26200.9550). Backup and restore to external drives or network locations were affected; a reconnect-drive message could appear despite an accessible destination. No single error code is specified. Older sections below record the situation at that time, not the absence of a fix today.

First make an independent copy of important files and record the Windows version and build. On managed PCs, follow IT approval. Install the applicable update through Windows Update and restart; a suitable later cumulative update may also include the fix. A preview is not a mandatory security update. Check the build with winver, create a test backup and restore a test file to a different location. Keep older backups. If new problems appear, retain diagnostics and build information and follow the existing recovery plan; consider uninstalling only if Windows offers it, as previous problems may return. This does not promise repair of already damaged files.

Excel: LTSC fix builds now corroborated by update histories

Microsoft identifies LTSC 2024 build 17932.21000 and LTSC 2021 build 14334.20918 as fixing silent paste failures. Official histories now list 17 and 16 September 2026 respectively. Check product and build under File → Account, copy the workbook and use the approved Office update route. Test values, formulas and conditional formatting in the copy. The issue overview dated 18 September describes mitigation only for Office 2019 build 10417.20208 and the earlier revision of Office 2016 KB5002665. The updated KB5002665 now identifies the latest revision as a complete fix, specifically for Excel 2016 MSI, not Click-to-Run. For that product, use the current download linked by the KB; the same KB number alone does not prove the revision. A newer 2019 build alone does not prove a complete fix. Paste Special may help with the appropriate option; values do not replace formulas. If results differ, close without overwriting the original and return to the backup. No blanket uninstall advice, single error code or in-house reproduction test.

Microsoft: KB5124008 · Microsoft: KB5124010 · Microsoft: Excel · Microsoft: LTSC 2024 · Microsoft: LTSC 2021 · Microsoft: KB5002665

20 September: File History issue confirmed – no fix yet

On 19 September 2026, Microsoft added a known issue to KB5124008, released on 8 September for Windows 11 24H2/25H2 (26100.9445/26200.9445). File History backups to an external drive or network location may stop updating. A request to reconnect the drive can appear even when the destination works; the backup timestamp may remain unchanged or previous versions may be unavailable. Crash events may mention FileHistory.exe and KERNELBASE.dll. No single numeric error code is specified. Microsoft is working on a future update; the 14 September OOB update is not a confirmed fix for this issue.

Diagnosis, not a repair promise: use winver to check the version/build and update history to check the KB; record destination availability, the last backup time and event details. Do not delete existing backups, format the drive or routinely remove security updates. For urgently needed files, make an additional copy to a separate available destination and open sample files; this replaces neither version history nor a full system backup. To verify recovery later, change a harmless test file, create a new backup version, restore that version to another location and compare it. A new timestamp alone is insufficient. Keep originals and existing backups as the recovery path. No independent reproduction was performed; older sections below describe their earlier state.

Microsoft KB5124008 · 19.09.2026 / 20.09.2026

19 September: Excel correction has a remaining issue; Defender fix

Microsoft released KB5002665 on 16 September 2026 for MSI-based Excel 2016, not Click-to-Run/Microsoft 365. It fixes silent paste failures following KB5002914, but pasting may still fail in workbooks with conditional formatting. The KB does not specify a single product build or numeric error code. Do not apply this fix to Office Online Server or other Excel editions.

First back up the workbook and ensure a recovery option; check the installed Office edition and bitness and use only the matching official package. Retest the same paste operation on a copy, compare destination cells, formulas, formatting and conditional formatting, then save and reopen. If the issue remains, selectively try the Paste Special options in the 17 September section; values replace formulas. Undo an incorrect result or use the unchanged backup. Do not routinely remove the security update; one successful test does not establish universal reliability.

Defender false alerts: Microsoft identifies version 4.18.26080.4, released 17 September, as the fix. Verify protection separately; do not disable antivirus.

Microsoft KB5002665 · Microsoft Release Health

17 September: domain trust issue confirmed; Excel workaround added

Microsoft confirmed the domain issue on 16 September 2026 at 14:15 PT (updated 14:23 PT). On Windows 11 24H2/25H2 with KB5124008 of 8 September 2026, builds 26100.9445/26200.9445, or later updates, some Credential Guard protected machine accounts can lose trust with an on-premises AD domain. The key condition is previously configured Machine Identity Isolation enforcement in an unsupported environment: Microsoft requires the Windows Server 2025 domain functional level. Valid domain credentials can be rejected while cached offline sign-in may still work. No numeric error code is specified; Microsoft says AD replication is unaffected.

Only for this confirmed configuration: administrators should first back up the affected policies or registry values and ensure local administrative access. Disable Machine Identity Isolation through the same management method used to enable it (Intune, Group Policy or direct registry configuration); the linked Microsoft guidance provides the exact settings. Do not disable Credential Guard indiscriminately or leave the domain without diagnosis. Restart the device, then repair the secure channel in administrative PowerShell:

Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Enter credentials only in the protected local dialog. Afterwards, run Test-ComputerSecureChannel without -Repair and test an online domain sign-in: expect True and successful sign-in. Keep the previous settings for rollback, but re-enable them under controlled conditions only after the incompatibility is resolved; otherwise the failure can return. Microsoft plans another Windows update but does not yet identify a final fix here. For 26H1, also listed as affected, consult its own Release Health page.

Excel: for KB5002914 (Excel 2016, 8 September 2026; the issue notice also names 2019/2021/2024) and KB5002910 (Office Online Server, Excel Online), Microsoft now suggests trying Paste Special: Formulas, Formulas & Number Formatting, Values, Values & Number Formatting, or Link. This is not a guaranteed fix for silent paste failure without an error message. Use a file copy first: values lose formulas and links create dependencies. Check destination cells, formulas and formatting, save and reopen. Undo unexpected results or discard the copy. Do not routinely uninstall security updates solely for this issue.

Primary sources and limits: checked on 17 September 2026. No independent reproduction; earlier sections record their respective historical status.

Microsoft Release Health 24H2 · 25H2 · 26H1 · KB5002914 · KB5002910

16 September: new SQL CUs do not clear the known issues; Citrix confirms the RDS route

On 15 September 2026, Microsoft released SQL Server 2025 CU9, KB5122048 (17.0.5005.3), and SQL Server 2022 CU27, KB5104824 (16.0.4295.3). Both still list error 7416 for MSDASQL linked servers using @provstr and c0000005 when querying sys.dm_exec_requests during database recovery as known issues. The new version numbers do not establish a fix for these problems. SESSION_CONTEXT in parallel query plans is also listed as a known risk.

The conditional diagnosis below still applies: check the build, provider and recovery phase; suspend only the affected monitoring query during recovery. Back up its configuration first, then re-enable it and check the same query and error log. Do not equate CU and GDR servicing branches; no blanket branch switch, trace flag change or update rollback is recommended. Before a planned CU test, back up databases and instance configuration and test the recovery procedure.

Citrix CTX697101 now points to the 14 September OOB packages for the RDS issue and instructs installation on the appropriate VDA followed by a restart. This supports the RDS remedy described below but does not establish a fix for all profile or black-screen problems. No independent reproduction; new individual reports remain separate.

Microsoft: KB5122048 · Microsoft: KB5104824 · Citrix: CTX697101

15 September: OOB updates fix RDS and Plan9 – USB audio only partly fixed

Microsoft released out-of-band cumulative updates on 14 September 2026. They fix the confirmed RDS connection/sign-in issues following the September updates and, on affected Windows clients, missing Plan9 host shares in HCS-managed Linux VMs used by applications such as WSL or Claude Cowork. This supersedes the older statements below that no published fix was available for these confirmed issues. It does not establish a common cause for all Citrix black screens.

Choose the matching package: check product, version, edition, architecture and installed build first. The target builds below are not interchangeable packages; Windows 11 Insider listings are not recommendations for production systems.

• Windows 11 25H2 / 24H2: KB5129195 — 26200.9457 / 26100.9457
• Windows 11 26H1: KB5129194 — 28000.2956
• Windows 11 23H2: KB5129242 — 22631.7584
• Windows 10 22H2 ESU / 21H2 LTSC 2021: KB5129236 — 19045.7727 / 19044.7727
• Windows Server 2025: KB5129235 — 26100.33451
• Windows Server 2022: KB5129237 — 20348.5631
• Windows Server 2019 / Windows 10 LTSC 2019: KB5129238 — 17763.9247
• Windows Server 2016 / Windows 10 LTSB 2016: KB5129239 — 14393.9514
• Windows Server 2012 R2 ESU: KB5129243
• Windows Server 2012 ESU: KB5129244

Distinguish RDS from Plan9: Microsoft requires no change to a previously deployed temporary RDS Group Policy mitigation before installation. For a temporary Plan9 mitigation, however, re-enable the relevant Group Policy, install the matching OOB update and restart. Change only the documented mitigation, not unrelated security policies.

Before a pilot, back up the machine image, affected data/profile containers and policy state, and verify recovery access. Obtain the package only through the Microsoft channel specified in its KB; do not describe Catalog-only packages as automatic Windows Update releases. Follow architecture-specific SSU/checkpoint prerequisites. After installation and any required restart, verify the KB and target build, repeated RDS sign-ins and longer connections; for Plan9, read the host share from the guest and check it with a test file. If conditions worsen, stop the pilot and restore the saved image and policy state in a controlled manner; do not apply a blanket WUSA removal procedure to combined SSU/LCU packages.

USB Audio Class 1.0: 8-channel/3D modes are fixed. Code 10, no audio, volume stuck at zero and unresponsive sound settings remain explicitly unresolved. This OOB update is not a verified fix for Excel paste failures, domain trust, AMD/GPU or arbitrary profile problems. New user reports of installation failures do not establish a general regression; no independent reproduction was performed.

Hotpatch exception: KB5129241 lists 26200.9448/26100.9448 and requires Hotpatch enrollment and KB5124008. It is not a replacement package for any PC. Microsoft says this Hotpatch requires no restart; still follow the separate Plan9 policy instruction above. SafeOS KB5129255 targets WinRE and does not replace an RDS client update.

Microsoft Release Health 25H2 · 26H1 · Microsoft Update Catalog · KB5129241 · KB5129255

September 10 follow-up: new reports are not confirmed KB defects

KB5124008, released on September 8, 2026, applies to Windows 11 24H2/25H2, builds 26100.9445/26200.9445. New user reports describe a black screen after sign-in in Citrix environments, including Windows 11 25H2 with VDA 2507 CU2 and FSLogix or UPM profile containers. They mention Application Popup event 26 involving explorer.exe. This is not automatically the previously resolved black-wallpaper issue. The reports establish neither general impact nor KB5124008 as the sole cause. No verified permanent fix for this specific combination is established here.

Record the Windows build, VDA and profile-management versions, installation time and event text. Before testing, back up the profile container and machine image and verify the recovery procedure. Compare the existing profile with an additional test profile only in an isolated test environment; do not delete the original. Starting Explorer once is a reported session test, not a permanent fix. Success means repeated normal sign-ins with the original profile and no recurring event 26. Restore the saved test image if the situation worsens.

Another individual report mentions 0x80073712 when moving from 26200.9168 to 26200.9445; interrupted installation attempts complicate attribution. This does not justify a blanket uninstall or registry recommendation. We have not reproduced these reports; Microsoft Release Health and the KB page were checked again.

Microsoft: KB5124008 · Microsoft: Release Health · Reddit: Citrix · Reddit: 0x80073712

Excel: pasting can fail without an error message

As checked on 11 September, Microsoft's KB5002914 dated 8 September 2026 contains a new issue notice: pasting in Excel 2016, 2019, 2021 and 2024 may do nothing; the source stays selected and the destination stays unchanged. No error code is specified. KB5002914 itself is the Excel 2016 MSI package, not a universal update for every listed version. Microsoft is investigating; the article does not yet provide a confirmed fix or workaround.

Diagnosis, not a promised repair: first save a separate backup of the workbook. Record the Excel version, full build, installation type and installed updates. In a copy, paste a distinctive test value into an empty cell and inspect the destination; for formulas, compare both the formula and its result. Do not continue working with data you only assume was transferred. Compare with a blank workbook. To undo the test, close the test copy without applying its changes to the original. After a confirmed fix becomes available, repeat the test and reopen the saved copy. Do not routinely uninstall updates or disable protection.

Microsoft: KB5002914

12 September 2026 update: RDS, Plan9 and USB audio

Microsoft confirmed three issues on 11 September. This update supersedes the earlier classification of Plan9 as only a user report; it does not confirm other user reports. The updates mapped below were released on 8 September. Before testing, record the version, build, KB, exact symptoms and configuration, back up data and document the original state.

RDS: Connections may fail, sign-ins may hang and management tools may become unresponsive. The status is Mitigated, not permanently fixed. Only for a VM inaccessible through RDP, Microsoft describes stopping with deallocation and then starting it as possible temporary help. Do this only with working management access outside RDP and planned downtime; unsaved session data may be lost. Start the same VM, then test sign-in and session stability for several minutes. If access is not restored, escalate through the management console instead of repeatedly forcing restarts. No final repair update is named yet.

Plan9: HCS-managed Linux VMs may start while shared host folders are missing. Microsoft names WSL and Claude Cowork; ordinary Hyper-V VMs without Plan9 are excluded. No confirmed fix. Preserve host files, record the share path and error, and test only with a copy. A missing mount is not evidence of deleted data. To undo the test, discard the test copy; do not reset the VM. After a confirmed fix, check the same share and test file again.

USB Audio Class 1.0: Code 10, silence or multichannel failures on Windows 11 24H2/25H2/26H1. Microsoft mentions user success with two channels but does not guarantee it. Only if stereo is supported and the setting is accessible, record the old mode, test two channels and check both; restore the original mode if unsuccessful. This is not a universal Code 10 fix and does not apply to servers. Excel KB5002914 remains under investigation; the Teams/Outlook ARM fix is unchanged. No blanket uninstall or disabling of protection.

Mapping: product / KB / build

• Windows 11 25H2 — KB5124008 — 26200.9445
• Windows 11 24H2 — KB5124008 — 26100.9445
• Windows 11 26H1 — KB5124012 — 28000.2954
• Windows 11 23H2 — KB5122880 — 22631.7582
• Windows 10 22H2 / 21H2 — KB5122878 — 19045.7725 / 19044.7725
• Windows Server 2025 — KB5122871 — 26100.33438
• Windows Server 2022 — KB5122882 — 20348.5622
• Windows Server 2019 / Windows 10 LTSC 2019 — KB5122876 — 17763.9245
• Windows Server 2016 / Windows 10 LTSC 2016 — KB5123099 — 14393.9512

KB5122880: On 16 October 2026, Microsoft corrected the title and navigation to OS build 22631.7582 for Windows 11 23H2. This resolves the previously documented discrepancy with 22621.7582 in this source. It is a documentation correction, not a new update or additional bug fix. Continue checking the installed Windows version and build on the affected device; do not confuse it with the separately listed servicing stack version. RDS affects additional platforms including Server 2012/R2; their exact KB mapping remains open here.

Microsoft: history-health · Microsoft: health24 · Microsoft: health26 · Microsoft: health23 · Microsoft: health10 · Microsoft: healthserver2025 · Microsoft: healthserver2022 · Microsoft: healthserver2019 · Microsoft: healthserver2016 · Microsoft: KB5124008 · Microsoft: KB5122880

September 13: Citrix lists KIR mitigations — validate the scope

Citrix CTX697101 now lists KIR packages for affected VDAs. Indicators include event 20498, Winlogon 6005 and TermService stuck in StopPending; black screens are listed separately. This is vendor mitigation guidance, not a permanent fix tested here. Microsoft KBs still direct administrators needing immediate help to Support. The earlier absence of vendor guidance is therefore outdated.

Example mapping: Windows 11 24H2/25H2, KB5124008, build 26100.9445/26200.9445 → 260912_00472; Server 2022, KB5122882, build 20348.5622 → 260911_18471. Use only the package matching the actual OS and KB in the current vendor instructions. Seven linked Microsoft targets were reachable; signatures and effectiveness were not tested here. Do not extend ambiguous package names to other systems.

Before a pilot, back up the machine image, profiles and existing policy state; verify recovery and independent console access. After checking provenance, signature and applicability, install the matching policy template; follow Microsoft's instructions to set only that specific KIR policy to Disabled and schedule a restart. This does not mean disabling Windows Update. Test repeated sign-ins, sign-outs and connections over several hours, checking events. If results worsen, restore the saved policy state and restart under controlled conditions; do not delete profiles. Retire the KIR carefully after an applicable permanent fix. Do not use it as a fix for USB audio, Plan9 or domain trust.

Citrix CTX697101 · Microsoft KB5122882 · Microsoft: Known Issue Rollback

September 14: distinguish RDS mitigation from Explorer black screens

Citrix CTX697101 still lists KIR packages. User comments dated September 13–14 nevertheless report a black screen with explorer.exe failing to start after applying the policy and restarting. One report specifies Windows 11 25H2 Enterprise multi-session, KB5124008, build 26200.9445, VDA 2507 CU2, non-persistent MCS and FSLogix 26.08 (3.26.826.17182), with Profile/ODFC containers on Azure Files. This is a user observation, not a confirmed general KIR defect or our own reproduction. RDS mitigation therefore does not promise to repair every Explorer/profile failure.

For an already approved KIR pilot, document policy application and the restart, then check connection stability and repeated sign-ins with the original profile. If the black screen persists, preserve diagnostic logs for the responsible support team. Do not delete profiles or UsrClass.dat or disable protection. If the situation worsens, restore the previously saved policy state in a controlled manner. No permanent fix for this exact combination is established here.

Citrix CTX697101 · Reddit / Citrix · Microsoft KB5124008

Source comparison on September 14: MSRC maps Windows 11 23H2 to build 22631.7582; the KB page and Release Health instead state 22621.7582. Resolve this source discrepancy before intervention; do not treat the builds as interchangeable. RDS mappings also now include Server 2012 with KB5123065 and Server 2012 R2 with KB5123066.

MSRC · KB5122880 · KB5123065 · KB5123066

5 October: Edge fix for Microsoft Print to PDF

Microsoft’s Stable release notes dated 29 September 2026 identify fix 154.0.4258.48: with Microsoft Print to PDF, the print dialog could fail to appear, close unexpectedly or show an error, through both Ctrl+P and Ctrl+Shift+P. This is an Edge issue on Windows, not a confirmed general printer or Windows KB fault. A complete affected earlier-version range and a common error code are not specified. As of 5 October, Stable 154.0.4258.53 is newer; this specific fix is not separately confirmed for Extended Stable 152.0.4191.111.

1. Save your work and preserve the original file. Note the version and channel at edge://version; do not share profile or sign-in data. Reproduce the symptom only with a non-sensitive test page and record the exact message.
2. In Edge, open Settings and more → Help and feedback → About Microsoft Edge (edge://settings/help), install the regular update offered and restart Edge after saving your work. On managed devices, involve IT; do not change policies or channels yourself.
3. Read the version again. Test Microsoft Print to PDF with the same page through both print routes. Save under a new filename and check the PDF for complete pages, readable text and correct orientation. A working dialog alone is not enough.
4. If the failure persists, record the version, channel, Windows build and message. Do not attribute other printer failures to this fix or reset spooler and drivers indiscriminately. Keep the original file unchanged.

Recovery: restoring the test file does not undo a browser update. Microsoft’s enterprise rollback is a temporary IT procedure requiring a verified target version and a tested data-recovery path; older versions carry security and data-loss risks. Check version-matched profile snapshots or permitted synchronization beforehand. Without a verified recovery path, do not downgrade yourself: stop testing and contact IT/support. No independent reproduction or guaranteed repair of every PDF output is claimed.

Sources: Release notes · Update procedure · Enterprise rollback

6 October: KB5104824 – new MDS warning, no fix yet

Microsoft updated its SQL Server 2022 CU27 article (KB5104824, build 16.0.4295.3; released 15 September 2026) on 5 October 2026. After installation, creating entities or attributes and loading hierarchies in Explorer may fail in Master Data Services (MDS). Microsoft is investigating a fix. As of 6 October, this notice provides no confirmed fix build, specific error code or MDS workaround.

Diagnosis, not a repair promise:

1. Record the SQL version, CU installation time and affected MDS function. Timing alone does not prove the cause; Microsoft does not specify the full range of affected configurations.
2. Do not create test entities or attributes in production data. Reproduce an already observed operation only in an existing, approved test environment with a backed-up initial state; record the time and a sanitized error message for IT.
3. If it fails, stop the test and restore its initial state using the previously verified recovery procedure. Do not treat blanket CU removal or trace flags as an MDS fix: the adjacent database-recovery mitigation concerns a different issue.
4. Assess success only after an explicitly applicable vendor fix in testing: the same MDS operation must work repeatedly without errors or unexpected data changes. Until then, escalate to your IT team or Microsoft Support. This diagnosis changes no server configuration; we have not reproduced the issue ourselves.

Microsoft: KB5104824 – SQL Server 2022 CU27