September 9, 2025—KB5065426 (OS Build 26100.6584)
Applies To
Release Date:
09/09/2025
Version:
OS Build 26100.6584
Windows Secure Boot certificate expirationImportant: Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. This might affect the ability of certain personal and business devices to boot securely if not updated in time. To avoid disruption, we recommend reviewing the guidance and taking action to update certificates in advance. For details and preparation steps, see Windows Secure Boot certificate expiration and CA updates.
To learn more about Windows update terminology, see types of Windows updates and monthly quality update types. For an overview, see the update history page for Windows Server 2025.
Stay informed! Follow @WindowsUpdate for the latest updates from the Windows Release Health Dashboard.
Improvements
This security update contains fixes and quality improvements from KB5063878 (released August 12, 2025). The following summary outlines key issues addressed by this update. Also, included are available new features. The bold text within the brackets indicates the item or area of the change.
-
[Settings]
-
New! Find answers to commonly asked questions about Windows Server in the new FAQs section under Settings > System > About. It covers topics like system setup, performance, and compatibility—all in one place.
-
New! The dialog to rename your printer under Settings > Bluetooth & devices > Printers & scanners now matches the Windows Server look and feel.
-
New ! Mouse settings are now easier to access under Settings > Accessibility > Mouse and Mouse pointer and touch, with no need to open Control Panel. You’ll find updated icons for Mouse pointer speed and Enhance mouse pointer precision, plus options for customizing the mouse indicator, pointer trails, and hover activation time.
-
-
[Taskbar]
-
New! Admins can configure taskbar policies so users can unpin specific apps, ensuring they are not repinned during the next policy refresh. To turn on this feature, use the new PinGeneration option.
-
Fixed: When using Tab and Shift + Tab to move keyboard focus around the taskbar, if you go backwards at least once you can get keyboard focus stuck on the taskbar frame, which could lead screen readers to just say “pane.”
-
Fixed: On login, the keyboard focus might unexpectedly be set to widgets in the taskbar, which can cause widgets to open.
-
-
[Voice Access]
-
New! Voice access now includes an in-product experience that highlights new features and improvements. Use the settings menu to open or dismiss it anytime.
-
New! You can find voice access under Accessibility in Quick Settings at the lower-right corner of your screen near the clock. To open Quick Settings, select the network, volume, or battery icon.
-
Fixed: Voice access might stop responding with error “working on it” when dictating.
-
-
[Voice Typing] New! You control the profanity filter. When you turn it on, it masks profanity with asterisks. When you turn it off, words appear as spoken. To change the setting, open voice typing (Win + H), select the settings icon, and turn on the Filter profanity switch.
-
[Windows Share]
-
New! Make last-minute edits such as cropping, rotating, and adding filters to images shared through the Windows Share window.
-
New! When you drag a local file from File Explorer or your desktop, a tray appears at the top of your screen. Drop the file into a suggested app or select More to open the Windows share window.
-
New! Add apps that support sharing directly to the right-click menu for local files in File Explorer or on the desktop.
-
-
[BitLocker] Fixed: This update addresses an issue where devices with BitLocker on removable drives could encounter a blue screen error after resuming from sleep or hybrid-booting.
-
[Bluetooth] Fixed: Settings might stop responding when loading information about Bluetooth devices.
-
[Boot menu screens] Fixed: This update addresses the issue where early boot screens, such as BitLocker PIN, BitLocker Recovery key, and boot menu screens, render slowly.
-
[Display] Fixed: Unexpected changes to screen size and window position might occur after waking from sleep for some devices.
-
[File Explorer] Fixed: If you have disconnected network drives while conducting a search from Home, it might prevent searches from executing and you remain on Home.
-
[Input]
-
Fixed: Voice typing won't start from the touch keyboard when using the Chinese (Simplified) narrow layout.
-
Fixed: When using the Symbols section of the touch keyboard, pressing the key to change pages might unexpectedly insert a character into password fields.
-
Fixed: Typing in some apps might stop working after disconnecting from a remote desktop session.
-
-
[JPG] Fixed: When using CopyPixels the pixels may be unexpectedly inverted in certain cases.
-
[Memory leak] Fixed: This update addresses an issue in the Input Service that causes increased memory usage, potentially impacting performance in multi-user, multi-lingual, and remote desktop usage.
-
[Microsoft Management Console (MMC)] Fixed: Improved the colors used in MMC when items are selected, both generally, and when contrast modes are enabled.
-
[Network] Fixed: This update addresses an issue where Windows Server 2025 always shows the network as "public" on new domain controllers. It now checks for a domain controller name before using loopback addresses to ensure proper Lightweight Directory Access Protocol (LDAP) binding.
-
[Print] Fixed: Non-admin users can't uninstall printers that they’ve added.
-
[Print] To meet security goals and support new print capabilities, this update transitions Windows printing components from MSVCRT to a modern Universal C Runtime Library.
As a result of this change, print clients running versions of Windows prior to Windows 10, version 2004 and Windows Server, version 2004 (Build number 19041) will intentionally fail to print to remote print servers running Windows 11, versions 24H2 or 25H2, and Windows Server 2025, that have installed this update, or later updates. Attempting to print from an unsupported print client to an updated print server will fail with one of the following errors:
-
The printer driver is not installed on this computer. Some printer properties will not be accessible unless you install the print driver.
-
Windows cannot connect to the printer.
To work around this issue, either (1) upgrade your print client to Windows 10, version 22H2, or a newer version of Windows; or, (2) configure print clients released prior to Windows 10, version 22H2, to use pre-Windows Server 2025 print servers.
-
-
[USB] Fixed: Certain USB devices might become disconnected after sleep, until you reboot your PC.
-
[App compatibility (known issue)] Fixed: Addresses an issue that caused non-admin users to receive unexpected User Account Control (UAC) prompts when MSI installers perform certain custom actions. These actions might include configuration or repair operations in the foreground or background, during the initial installation of an application.
This issue could prevent non-admin users from running apps that perform MSI repairs, including Office Professional Plus 2010 and multiple applications from Autodesk (including AutoCAD). This fix reduces the scope for requiring UAC prompts for MSI repairs and enables IT admins to disable UAC prompts for specific apps by adding them to an allowlist.
For more information, see Unexpected UAC prompts when running MSI repair operations after installing the August 2025 Windows security update.
-
[File server] This update enabled auditing SMB client compatibility for SMB Server signing as well as SMB Server EPA. This allows customers to assess their environment and identify any potential device or software incompatibility issues before deploying the hardening measures that are already supported by SMB Server. For detailed guidance, see CVE-2025-55234.
-
[PowerShell 2.0] Starting in September 2025, Windows Server 2025, will no longer include Windows PowerShell 2.0. This legacy component was introduced in Windows 7 and officially deprecated in 2017. Most users won’t be affected, as newer versions such as PowerShell 5.1 and PowerShell 7.x remain available and supported. If you use older scripts or tools that depend on PowerShell 2.0, update them to avoid compatibility issues.
If you've already installed previous updates, your device will download and install only the new updates included in this package.
For more information about security vulnerabilities, please refer to the Security Update Guide and the September 2025 Security Updates.
Windows Server 2025 servicing stack update (KB5064531) - 26100.5074
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. To learn more about SSUs, see Simplifying on-premises deployment of servicing stack updates.
Known issues in this update
Symptoms We are aware of an edge case affecting hotpatched devices that have installed the September 2025 Hotpatch update (KB5065474) or the September 2025 security update (KB5065426). These devices might experience failures with PowerShell Direct (PSDirect) connections when the host and guest virtual machines (VMs) are both not fully updated. When a patched guest VM attempts to connect to an unpatched host (or vice versa), the system is expected to fall back to a legacy handshake and clean up the socket gracefully. However, this fallback mechanism fails intermittently, resulting in socket cleanup issues. The connection failure might appear random, and users might observe Event ID 4625 logged in the Security Event log within Windows Event Viewer.
Workaround
This issue is addressed in KB5066360. If your hotpatched device is experiencing issues with PSDirect connection, we recommend updating both the host and guest VM with these updates.
Symptoms
After installing the Windows update released on or after September 9, 2025, you might fail to connect to shared files and folders using the Server Message Block (SMB) v1 protocol on NetBIOS over TCP/IP (NetBT). This issue can occur if either the SMB client or the SMB server has the September 2025 security update installed.
Note: The SMBv1 protocol is deprecated and no longer installed by default in modern versions of Windows and Windows Server. Deployments that use newer versions of the protocol, SMBv2 or SMBv3, are not affected by this problem.
Workaround
This issue is addressed in KB5066835.
Symptoms
Active Directory domain controllers (DC) running on Windows Server 2025 and also running the schema master Flexible Single Master Operation (FSMO) role, will allow duplicate entries in attributes of schema objects. Commonly affected attributes include auxiliaryClass, possSuperiors, mayContain with values such as msExchBaseClass, msExchContainer, and msExchVirtualDirectoryFlags.
When this occurs, Active Directory replication fails with a schema mismatch error, such as error 8418: The replication operation failed because of a schema mismatch between the servers involved."
This issue can be observed when running Exchange Server setup forestprep and the schema master role for Active Directory is running Windows Server 2025. This breaks replication in the entire Active Directory enterprise environment because the schema across domain controllers is now inconsistent.
Note: This issue appears to have existed since the initial release of Windows Server 2025, but recent Exchange Server cumulative updates (for Exchange Server SE) have exposed it.
Workaround
To work around the issue, manually remove the duplicate entries in the AD schema. If you would like help in generating a script to help remove the duplicate entries, contact Microsoft’s Support for business.
The issue is under investigation, and additional information will be shared as soon as it becomes available.
Symptoms
After installing September 2025 security update (KB5065426), applications that use the Active Directory directory synchronization (DirSync) control for on-premises Active Directory Domain Services (AD DS), such as when using Microsoft Entra Connect Sync, can result in incomplete synchronization of large AD security groups exceeding 10,000 members.
Workaround
This issue can be mitigated using Known Issue Rollback (KIR) for enterprise-managed devices managed by IT departments that have installed the affected update and encountered this issue. IT administrators can resolve this issue by installing and configuring the special Group Policy listed below.
Group Policy downloads with Group Policy name:
Download for Windows 11, Versions 24H2 and 25H2 and Windows Server 2025 — Windows 11 24H2, Windows 11 25H2 and Windows Server 2025 KB5066835 251016_21401 Known Issue Rollback
The special Group Policy can be found in Computer Configuration > Administrative Templates > Windows 11 24H2, Windows 11 25H2 and Windows Server 2025 KB5066835 251016_21401 Known Issue Rollback. For information on deploying and configuring these special Group Policy, see How to use Group Policy to deploy a Known Issue Rollback.
Important: You will need to install and configure the Group Policy for Windows Server 2025. Then restart Windows Server 2025 to apply the group policy setting. (Windows 11 is out of scope of this notification and guidance.)
Alternatively, affected customers can apply the following registry key as a workaround to disable the feature change.
Warning: Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk. For more information, see Windows registry for advanced users.
Path: Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides
Name: 2362988687
Type: REG_DWORD
Value: 0
The issue is under investigation, and additional information will be shared as soon as it becomes available.
How to get this update
Before you install this update
Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.
Install this update
To install this update, use one of the following Windows and Microsoft release channels.
|
Available |
Next Step |
 |
This update downloads and installs automatically from Windows Update and Microsoft Update. |
|
Available |
Next Step |
|
|
This update downloads and installs automatically from Windows Update for Business in accordance with configured policies. |
|
Available |
Next Step |
||||
|
Yes 1 |
Before you install this update To get the standalone package(s) for this update, go to the Microsoft Update Catalog website. This KB contains one or more MSU files that require installation in a specific order. Install this update Method 1: Install all MSU files together Download all MSU files for KB5065426 from Microsoft Update Catalog and place them in the same folder (for example, C:/Packages). Use Deployment Image Servicing and Management (DISM.exe) to install the target update. DISM will use the folder specified in PackagePath to discover and install one or more prerequisite MSU files as needed. Updating Windows PC To apply this update to a running Windows PC, run the following command from an elevated Command Prompt:
Or, run the following command from an elevated Windows PowerShell prompt:
Or use Windows Update Standalone Installer to install the target update. Updating Windows Installation media To apply this update to Windows Installation media, see Update Windows installation media with Dynamic Update. Note: When downloading other Dynamic Update packages, ensure they match the same month as this KB. If the SafeOS Dynamic Update or Setup Dynamic Update is not available for the same month as this KB, use the most recently published version of each. To add this update to a mounted image, run the following command from an elevated Command Prompt:
Or, run the following command from an elevated Windows PowerShell prompt:
Method 2: Install each MSU file individually, in order Download and install each MSU file individually either using DISM or Windows Update Standalone Installer in the following order:
|
1 This latest cumulative update includes updates for AI components. Even though the AI component updates are included in the update, the AI components are only applicable to Windows Copilot+ PCs and will not install on Windows PC or Windows Server.
|
Available |
Next Step |
|
|
This update will automatically sync with Windows Server Update Services (WSUS) if you configure Products and Classifications as follows: Product: Microsoft Server operating system-24H2 Classification: Security Updates |
If you want to remove the LCU
To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.
Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.
File Information
For a list of the files provided in this update, download the file information for cumulative update 5065426.
For a list of the files provided in the servicing stack update, download the file information for the SSU (KB5064531) - version 26100.5074.
Need more help?
Want more options?
Explore subscription benefits, browse training courses, learn how to secure your device, and more.
Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.
