Applies To
Windows Server 2025, all editions

Release Date:

09/12/2025

Version:

OS Build 26100.7447

​​​​​This cumulative update for Windows Server 2025 (KB5072033), includes the latest security fixes and improvements, along with non-security updates from last month’s optional preview release. To learn more about differences between security updates, optional non-security preview updates, out-of-band (OOB) updates, and continuous innovation, see Windows monthly updates explained. For information on Windows update terminology, see the different types of Windows software updates.

To view the latest updates about this release, visit the Windows release health dashboard or the update history page for Windows Server 2025. 

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Starting with the January 2026 security update, Windows Server 2025 will have its own KB identifiers. These identifiers are separate from those for Windows 11 versions 24H2 and 25H2. This change improves clarity for administrators. Installation and management processes remain the same.

Windows Secure Boot certificate expiration

Important: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.

Improvements

This security update contains fixes and quality improvements from KB5068861 (released November 11, 2025) and KB5072359 (released November 18, 2025). The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change. ​​​​

  • [File Explorer] ​​​​​​​​​​​​​​ New!  Dividers now separate top-level icons in the File Explorer context menu.

  • [General] New!​​​​​​​ When an app requests access to location, camera, microphone, or other device capabilities, Windows shows a redesigned system dialog box. To emphasize the privacy prompt, the screen dims slightly, and the prompt appears at the center of the screen.

  • [Search on the Taskbar] New!​​​​​​​ When you use Search from the Windows taskbar, a new grid view will help you more quickly and accurately identify the desired image within your search.

  • [Settings]  ​​​​​​​New!  Windows activation and expiration prompts match the Windows 11 design and appear as system notifications when action is required. There also have been improvements to messaging under Settings > System > Activation.

  • [Taskbar] 

    • New!​​​​​​​ The larger clock with seconds is now back in the notification center, displayed above the date and calendar. To turn this option on, go to Settings > Time & language > Date & time, and turn on Show time in the Notification Center.

    • Fixed: If you accidentally click and drag your mouse across the taskbar preview thumbnail, the preview might stop working.

  • [Task Manager] New! Task Manager now uses standard metrics to show CPU workload consistently across all pages, aligning with industry standards and third-party tools. If you prefer the previous view, you can enable a new optional column called CPU Utility in the Details tab to display the earlier CPU usage value shown on the Processes page.

  • [PowerShell 2.0] Starting in August 2025, Windows 11, version 24H2, will no longer include Windows PowerShell 2.0. This legacy component was introduced in Windows 7 and officially deprecated in 2017. Most users won’t be affected, as newer versions such as PowerShell 5.1 and PowerShell 7.x remain available and supported. If you use older scripts or tools that depend on PowerShell 2.0, update them to avoid compatibility issues.

  • [Audio] Improved: Addressed an underlying audio service stops responding which could impact the ability to play audio in certain cases.

  • [Active Directory (known issue)]) Fixed: This update addresses an issue that occurs when you use ntdsutil.exe with 8KB database pages during an in-place upgrade to Windows Server 2025. The issue could damage the NTDS.dit database and prevent the Domain Controller from mounting it.

  • [Cryptographic Provider (known issue)] Fixed: Fixed: This update addresses an issue where you might see an error in Windows Event Viewer with Error ID 57. The event displays the following message: The 'Microsoft Pluton Cryptographic Provider' provider was not loaded because initialization failed.

  • [dbgcore.dll] Fixed: An underlying issue with dbgcore.dll could result in certain apps, including explorer.exe, crashing.

  • [Device management] Fixed: This update addresses an issue that prevented some system recovery features from working properly due to a temporary file sharing conflict. This affected certain device management tools and disrupted key functions on some devices.

  • [File system]​​​​​​​ Fixed: An issue in Resilient File System (ReFS) where using backup apps with large files could sometimes exhaust system memory.

  • [Input]

    • Fixed: Attempting to type Chinese with an IME after copying something with CTRL + C can result in the first character not displaying.

    • Fixed: An underlying issue related to textinputframework.dll could result in certain apps like Sticky Notes and Notepad crashing.

    • Fixed: This update addresses an issue with the Chinese (Simplified) Input Method Editor (IME) where some extended characters appear as empty boxes.

    • [Fixed This update addresses an issue that prevents typing on the touch keyboard when using the Microsoft Changjie, Microsoft Bopomofo, or Microsoft Japanese Input Method Editors (IMEs). The issue occurs after switching to a previous version of the IME.

  • [Kerberos]​​​​​​​ Fixed: There might be an underlying crash in Kerberos when attempting to access a cloud file share.

  • [Live captions] Fixed: Changing the opacity of live captions in Settings > Accessibility > Captions > Caption Style, has no effect.

  • [Login] Improved: Addressed some underlying cases which could lead to you seeing a blank white screen, or a screen saying, "just a moment", for a few minutes when logging into your PC.

  • [PowerShell 5.1] Invoke-WebRequest now includes a confirmation prompt with a security warning of script execution risk. You can choose to continue or cancel the request. For additional details, see CVE-2025-54100 and KB5074596: PowerShell 5.1: Preventing script execution from web content.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

For more information about security vulnerabilities, please refer to the Security Update Guide and the December 2025 Security Updates.

Windows Server 2025 servicing stack update (KB5071142) - 26100.7295

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Simplifying on-premises deployment of servicing stack updates.

Known issues in this update

After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. 

How to get this update

Before you install this update

​​​​​​​Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available

Next Step

Included

This update downloads and installs automatically from Windows Update and Microsoft Update.

If you want to remove the LCU

To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.

Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.

File Information

For a list of the files provided in this update, download the file information for cumulative update 5072033. 

For a list of the files provided in the servicing stack update, download the file information for the SSU (KB5071142) - version 26100.7295. 

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.