April 19, 2026—KB5091571 (OS Build 25398.2276) Out-of-band

Summary

This out-of-band update for Windows Server, version 23H2 (KB5091571) is cumulative. It includes fixes and improvements that are part of the following update:

• April 14, 2026—KB5082060 (OS Build 25398.2274)

The following is a summary of the issues that this out-of-band update addresses when you install this update. The bold text within the brackets indicates the item or area of the change we are documenting.

• [Domain controllers (known issue)] Fixed: After installing the April 14, 2026, (KB5082060) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. In some cases, Local Security Authority Subsystem Service (LSASS) might stop responding, leading to repeated restarts, and preventing authentication and directory services, which can make the domain unavailable.

If you installed earlier updates, your device downloads and installs only the new updates contained in this package.

To view the latest updates about this release, visit the Windows release health dashboard or the update history page for Windows Server 23H2. 

To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained.

For information on Windows update terminology, see the different types of Windows software updates.

Windows Server, version 23H2 servicing stack update (KB5086285) - 25398.2273

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Simplifying on-premises deployment of servicing stack updates.

Known issues in this update

How to get this update

Before you install this update

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

If you want to remove the LCU 

File Information

For a list of the files provided in this update, download the file information for out-of-band update 5091571. 

For a list of the files provided in the servicing stack update, download the file information for SSU (KB5086285) - version 25398.2273.