November 10, 2026—KB5131291 (OS Build 14393.9688)

Applies To
Windows Server 2016, all editions Windows 10 LTSB 2016 ESU

Important

Support for Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise 2016 LTSB ended on October 13, 2026. To continue receiving critical and important security updates, eligible devices must be enrolled in the Extended Security Updates (ESU) program. For enrollment requirements and activation instructions, see Enable Extended Security Updates (ESU) for Windows 10 LTSB 2016 and Windows 10 Enterprise LTSC 2021.

Summary

This article lists the security issues and quality improvements included in this cumulative security update.

Applies to: Windows Server 2016

This security update includes fixes and improvements that are a part of the following update:

The following is a summary of the issues that this update addresses. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

  • [Printing] - Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.

  • [Windows Deployment Services] Fixed: After installing this security update, the Import-WdsInstallImage cmdlet requires administrator privileges. Attempts to run the cmdlet as a non-administrator fail with an ACCESS_DENIED error.

  • [Remote Desktop]

    • Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
    • Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.

  • [Remote Desktop Web Access] Fixed: RD Web Access might fail to load and display “Unable to display RD Web Access” in Microsoft Edge or Google Chrome when XSLT is disabled by browser policy. RD Web Access pages are now rendered on the server and no longer depend on browser XSLT support. To learn more, see KB5130994: RD Web Access fails to load when XSLT is disabled in Microsoft Edge or Google Chrome.

  • [Exchange Server] This update fixes an issue that affects on-premises Exchange servers. The issue might prevent signing in to Outlook on the web (OWA), cause email messages to remain in the Outlook Outbox without being delivered, or prevent Exchange from accessing mailboxes during mailbox replication.

  • [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

Known issues in this update

Users might be unable to sign in to OWA or send emails on Exchange Server

Symptoms:

After installing this update, some on-premises Exchange servers might experience issues accessing or sending email. Users might be unable to sign in to Outlook on the web (OWA), or email messages sent from Outlook might remain in the Outbox and not be delivered. Additionally, Exchange might experience issues accessing mailboxes during mailbox replication.

In some affected configurations, Exchange Server OWA might fail with an error MapiExceptionMdbOffline: Unable to make connection to the server. (hr=0x80004005, ec=1142) with Event ID 1006 logged in the application log. Another reported symptom is growing email queues. Installing the October 2026 Exchange server security updates isn’t required for these issues to occur.

Workaround

This issue can be temporarily mitigated by modifying the registry key as described in Exchange servers may become unstable after installation of October 2026 Windows updates.

The October 2026 update introduced a default limit on the amount of memory used by Endpoint Mapper when handling Endpoint Lookup calls.

For workloads such as Exchange Server, the default limit of 512 simultaneous Endpoint Lookup calls might not be sufficient under heavy load. Administrators can use this registry setting to increase the maximum number of simultaneous Endpoint Lookup calls, which increases the amount of memory that Endpoint Mapper can use.

Microsoft Support: An additional mitigation is available for affected devices through Microsoft Support. To apply this mitigation in your organization, please contact Microsoft Support for business.

Next steps: Microsoft investigating this issue and will provide more information when it is available.

USB Audio Class 1.0 devices with error Code 10 or no output

Symptoms

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:

  • The device displays an error in Device Manager: "This device cannot start (Code 10).”
  • No audio output.
  • Volume controls are unresponsive or remain at zero.
  • Sound settings are unresponsive or unavailable.
  • Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode.

This issue is limited to USB Audio Class 1.0 devices.

Resolution

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026. This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.

IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.

How to get this update

Before you install this update

  • For Windows Update: You must have the Windows update released on or after July 8, 2025 (such as KB5062560) installed before installing this update.

  • For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: You must have the Windows update released on or after July 8, 2025 (such as KB5062560) installed before installing this update.

  • Servicing Stack Update (SSU): To install updates released on or after January 14, 2025, we recommend that you first install the latest Servicing Stack Update (SSU). If your device or offline image does not have the latest SSU installed, you might not be able to install this update. For general information about SSUs, see Servicing stack updates and ADV990001 | Latest Servicing Stack Updates.

    CAUTION: Until you install the latest SSU, this update might not be offered to your device. To reduce your security risk, install the SSU as soon as possible.

    • If you use Windows Update, the latest SSU (KB5131083) will be offered to you automatically. If the latest SSU is not installed, you might not be able to install this update.
    • If you use Windows Update for Business, the latest SSU (KB5131083) will be offered to you automatically. If the latest SSU is not installed, you might not be able to install this update.
    • If you use the Update Catalog, we recommend that you download and install the latest SSU (KB5131083). If the latest SSU is not installed, you might not be able to install this update.
    • If you are a Windows Server Update Services (WSUS) administrator, you must approve SSU KB5131083 and this update KB5131291.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

  • Use the Update WinPE script to update an existing Windows image. (Recommended)
  • Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Get and install this update

To get and install this update, use one of the following Windows and Microsoft release channels.

Available Next step
Available This update will be downloaded and installed automatically from Windows Update.

File information

A list of the files included in this update is provided in a CSV (Comma delimited) (*.csv) file. You can open the file in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download Download the file information for cumulative update KB5131291.

References

  • Microsoft Store application updates

    Windows updates do not install Microsoft Store application updates. Enterprise users should see Microsoft Store apps - Configuration Manager. Consumer users should see Get updates for apps and games in Microsoft Store.

  • Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.