Important
This update is being released as an exception for devices that are past Year 3 of the Extended Security Updates (ESU) program. It is provided to deliver a quality improvement.
Windows Server 2012 reached the end of support on October 10, 2023. The Extended Security Updates (ESU) program for Windows Server 2012 ended on October 13, 2026. This update is the final security update provided through the ESU program. We recommend upgrading to a supported version of Windows Server. For more information, see Overview of Windows Server upgrades.
The installation of this Extended Security Update (ESU) might fail when you try to install it on an Azure Arc-enabled device that is running Windows Server 2012. For a successful installation, please make sure all Subset of endpoints for ESU only are met as described in Connected Machine agent network requirements.
Summary
This non-security out-of-band (OOB) update for Windows Server 2012 (KB5135580) is cumulative. It includes updates from previous releases, along with additional non-security improvements.
Tip
To learn more about Windows out-of-band (OOB) updates, including the differences between security and non-security updates and guidance for deploying them, see Windows out-of-band (OOB) updates.
Windows Server 2012
This update includes fixes and quality improvements that are part of the following update:
The following is a summary of the issues that this update addresses. The bold text within the brackets indicates the item or area of the change we are documenting.
[Storage] Fixed: This update addresses an issue that affects Multipath I/O (MPIO)-managed iSCSI disks. Affected disks might unexpectedly go offline or display error C0000010 on the Details tab of Device Manager. After you install this update, MPIO-managed iSCSI disks remain online and no longer display this error.
[Audio (known issue)] Fixed: This update addresses an issue where some USB Audio Class 1.0 devices might fail to start or produce audio.
[Certificates] This update includes an updated trusted root certificate payload. It is intended for devices that do not receive current certificate trust list (CTL) updates, including updates to the list of untrusted certificates. These include devices in disconnected environments, devices that cannot access Microsoft’s certificate-update service, and devices where automatic CTL updates are disabled. To learn more, see Certificates and trust in Windows.
For more information about the resolved security vulnerabilities, please refer to the Deployments | Security Update Guide and the November 2026 Security Update.
For information about the various types of Windows updates, such as critical, security, driver, service packs, and so on, see Description of the standard terminology that is used to describe Microsoft software updates.
To view other notes and messages, see the Windows Server 2012 update history home page.
Known issues in this update
Microsoft is not currently aware of any issues with this update.
How to get this update
Before installing this update
To install any Windows Server 2012 Monthly Rollup released on or after January 14, 2025, we recommend you first install the latest Servicing Stack Update (SSU). If your device or offline image does not have the latest SSU installed, you might not be able to install this update.
Caution
Until you install the latest SSU, this update might not be offered to your device. To reduce your security risk, install the latest SSU as soon as possible.
- If you use Windows Update, the latest SSU KB5127357 will be offered to you automatically. If the latest SSU is not installed, you might not be able to install this update.
- If you use the Update Catalog, we recommend you download and install the latest SSU KB5127357 If the latest SSU is not installed, you might not be able to install this update.
- If you are a Windows Server Update Services (WSUS) administrator, you must approve SSU KB5127357 and this update KB5135580.
Deployment
If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file may prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.
Note
The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.
To ensure the boot.stl file is included as part of the installation media, do one of the following:
- Use the Update WinPE script to update an existing Windows image. (Recommended)
- Manually copy the boot.stl file from the devices Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.
For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.
Language packs
If you install a language pack after you install this update, you must reinstall this update. Therefore, we recommend that you install any language packs that you need before you install this update. For more information, see Learn about adding a language pack to Windows.
Install this update
To install this update, use one of the following release channels.
| Available | Next step |
|---|---|
|
This update is only available form the Microsoft Update Catalog. |
File information
A list of the files included in this update is provided in a CSV (comma-delimited) (.csv) file. You can open the file in a text editor, such as Notepad, or in Microsoft Excel.
Note The English (United States) version of this software update might contain files for additional languages.
Download the file information for out-of-band update KB5135580.