July 16, 2019—KB4507466 (OS Build 17134.915)

Applies to: Windows 10, version 1803

Highlights


  • Updates an issue that prevents a device from recognizing a Microsoft account until you sign out and sign in again. 
  • Updates an issue that affects applications that manage files, folders, and device settings.
  • Improves compatibility with the Window-Eyes screen reader application.
  • Updates an issue to keep your App permissions settings when resetting your device.

Improvements and fixes


This update includes quality improvements. Key changes include:

  • Addresses a performance issue that may occur on some websites that use WebAssembly. 
  • Addresses an issue that may prevent the personal identification number (PIN) prompt from appearing when authenticating in Internet Explorer. 
  • Updates time zone information for Brazil. 
  • Addresses an issue that fails to bypass automatic sign in (Autologon) when you press and hold the Shift key during startup. 
  • Addresses an issue that prevents the Windows Event Log service from processing notifications that the log is full. This causes issues with some Event Log behaviors such as archiving the log when it reaches a maximum file size and you’ve configured the "Archive the log when full, do not overwrite events" setting. Additionally, the Local Security Authority (LSA) cannot handle CrashOnAuditFail scenarios when the Security Log is full, and events cannot be written. 
  • Addresses an issue that prevents a system from recognizing a Microsoft account or Azure Active Directory account until the user signs out and signs in again. 
  • Addresses an issue that may prevent the Netlogon service from establishing a secure channel and reports the error, “0xC000007A – ERROR_PROC_NOT_FOUND.” 
  • Addresses an issue that fails to update the PIN policy (minimum length, required digits and special characters, etc.) for Windows Hello for Business when a PIN already exists on the machine. 
  • Addresses an issue that may sometimes cause systems that have Trusted Platform Module (TPM) devices to stop working. 
  • Addresses an issue that may cause authentication to fail when using Windows Hello for Business on a server running Windows Server 2016 with the Server Core option installed. 
  • Addresses an issue that causes a device to stop working because of a race condition between stream tear down and sync root disconnect.
  • Addresses an issue that causes applications that use windows.storage.dll to stop working and displays ExceptionCode c0000005 (Access violation) when the process closes. 
  • Reinforces the Certificate Revocation List (CRL) on Internet Key Exchange version 2 (IKEv2) machines for certificate-based virtual private network (VPN) connections, such as Device Tunnel, in an Always On VPN deployment. 
  • Improves performance for Server Message Block (SMB) clients that have directories that contain more than 500,000 files.
  • Addresses an issue that prevents Microsoft Application Virtualization (App-V) scripting from working if you run it when you’re not connected to a domain controller (DC). App-V scripting also fails when you run it in an environment that only contains Microsoft Azure Active Directory.
  • Addresses an issue with opening or using the Window-Eyes screen reader application that may result in an error and prevent some features from functioning as expected.
  • Addresses an issue that may fail to keep App permissions settings when you select Keep my files after selecting Reset this PC.
  • Addresses an issue that may cause a cluster node to lose membership in a cluster and cause all its workloads to fail over. This issue may occur when a cluster node creates a Live Dump.
  • Addresses an issue that causes a Windows device to incorrectly register host A records for two network interface controllers (NIC) after establishing a virtual private network (VPN) connection to the corporate domain. This occurs when the device is configured with two NICs and one of them is a VPN. To implement this solution, make the following registry changes and then restart your device:

    Setting: DisableNRPTForAdapterRegistration

    Path: HKLM\System\CurrentControlSet\Services\Dnscache\Parameters

    Type: DWORD

    Value: A value of 1 means that only the host A records for the VPN interface will register on an active VPN connection. A value of 0 (default) means host A records will also be registered for other local interfaces.

If you installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

Known issues in this update


Symptom Workaround
Certain operations, such as rename, that you perform on files or folders that are on a Cluster Shared Volume (CSV) may fail with the error, “STATUS_BAD_IMPERSONATION_LEVEL (0xC00000A5)”. This occurs when you perform the operation on a CSV owner node from a process that doesn’t have administrator privilege.

Do one of the following:

  • Perform the operation from a process that has administrator privilege.
  • Perform the operation from a node that doesn’t have CSV ownership.
Microsoft is working on a resolution and will provide an update in an upcoming release.
We are investigating reports that a small number of devices may startup to a black screen during the first logon after installing updates.

To mitigate this issue, press Ctrl+Alt+Delete, then select the Power button in the lower right corner of the screen and select Restart. Your device should now restart normally.

We are working on a resolution and will provide an update in an upcoming release.

Devices that start up using Preboot Execution Environment (PXE) images from Windows Deployment Services (WDS) or System Center Configuration Manager (SCCM) may fail to start with the error "Status: 0xc0000001, Info: A required device isn't connected or can't be accessed" after installing this update on a WDS server.

For mitigation instructions, see KB4512816.

We are working on a resolution and will provide an update in an upcoming release.

Devices connected to a domain that is configured to use MIT Kerberos realms may not start up or may continue to restart after installation of this update. Devices that are domain controllers or domain members are both affected.

If you are not sure if your device is affected, contact your administrator. Advanced users can check if this registry key exists HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\MitRealms or for “Define interoperable Kerberos v5 realm settings” policy under Computer Configuration -> Policies -> Administrative Templates > System -> Kerberos.

This issue is resolved in KB4512501.

How to get this update


Before installing this update

Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU. For more information, see Servicing stack updates.

If you are using Windows Update, the latest SSU (KB4509094) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog

Install this update

Release Channel Available Next Step
Windows Update or Microsoft Update Yes Go to Settings > Update & Security > Windows Update and select Check for updates.
Microsoft Update Catalog Yes To get the standalone package for this update, go to the Microsoft Update Catalog website.
Windows Server Update Services (WSUS) No

You can import this update into WSUS manually. See the Microsoft Update Catalog for instructions.

 

File information

For a list of the files that are provided in this update, download the file information for cumulative update 4507466