October 26, 2026—KB5134134 (OS Build 28000.3237) Out-of-band

Applies To

Windows 11 version 26H1, all editions

This non-security out-of-band (OOB) update for Windows 11, version 26H1 (KB5134134) is cumulative. It includes updates from previous releases, along with additional non-security improvements.

Who should install this update

This out-of-band (OOB) update is intended for devices that do not receive current certificate trust list (CTL) updates, including updates to the list of untrusted certificates. Examples include devices in disconnected environments, devices that cannot access Microsoft’s certificate-update service and devices where automatic CTL updates are disabled.

Improvements

This update includes fixes and quality improvements that were part of the following update:

October 13, 2026—KB5127646 (OS Build 28000.3231)

The following summary outlines key quality improvements addressed by this update. The bold text within the brackets indicates the item or area of the change.

[Certificates] This update includes an updated trusted root certificate payload in the Windows cumulative update for devices that cannot access Microsoft’s certificate-update service and devices where automatic certificate trust list (CTL) updates are disabled. To learn more, see Certificates and trust in Windows.

If you've already installed previous updates, your device will download and install only the new updates included in this package.

Component updates

AI components

This release updates the following AI components to version 1.2608.951.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model.

To learn more, see Release information for AI components.

Servicing stack update

Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). This Windows update includes KB5127645 (Build 28000.3225), which improves the reliability of the Windows update installation process. To learn more about SSUs, see Servicing stack updates.

Known issues in this update

Remote Desktop connections might fail for non-admin users with error 0xC000000D

Symptoms

After installing the September 2026 non-security preview update KB5124010, or later updates, non-admin users might be unable to establish Remote Desktop connections to remote devices that have Administrator protection enabled. Attempts to connect might fail with error 0xC000000D and display the message, “The token that was passed to the function is invalid.” This issue primarily affects enterprise-managed remote devices used as Remote Desktop hosts with Administrator protection enabled, regardless of how the feature was enabled.

Note: If your organization uses Windows security baselines, published through the Microsoft Security Compliance Toolkit, Administrator protection is enabled by default in Windows 11, version 24H2, 25H2, and 26H2 security baselines, unless your organization has configured the policy differently.

Resolution

IT administrators can mitigate this issue on devices affected by the Remote Desktop connection failure by using their existing policy management method to temporarily turn off Administrator protection. Reset the User Account Control Type Of Admin Approval Mode policy in Microsoft Intune or Group Policy. For more information, see Administrator protection on Windows 11.

Next steps: Microsoft is working to address this issue in a future Windows update and will provide more information when it is available.

USB audio devices might fail to start or produce no sound

Symptoms

After installing the September 8, 2026, Windows security update (KB5124012), some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:

The device displays an error in Device Manager: "This device cannot start (Code 10).”
No audio output.
Volume controls are unresponsive or remain at zero.
Sound settings are unresponsive or unavailable.
Some devices might function in standard stereo configurations but fail when using multichannel audio features, including 8-channel or 3D audio modes. Some customers have reported that they're able to restore audio in these cases by switching to 2-channel mode.

This issue is limited to USB Audio Class 1.0 devices.

Resolution

This issue is partially resolved in the out-of-band (OOB) update released on September 14, 2026, (KB5129194). This OOB update resolves the symptoms experienced on devices using 8-channel or 3D audio modes. Microsoft is working to address the other symptoms and will provide more information when it is available.

IT administrators who need an immediate workaround for the symptoms not addressed yet by the OOB update should contact Microsoft Support for Business for assistance.

How to get this update

Before you install this update

The latest servicing stack update (SSU) must be applied before installing this cumulative update.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available	Next Step
	This update is available from the Microsoft Update Catalog.

Available	Next Step
	To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions. If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version. Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Available

Next Step

To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions.

If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.

Note This latest cumulative update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Arm64 installation instructions

Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.

Download all MSU files for update KB5134134 from the Microsoft Update Catalog and place them in the same folder (for example, C:/Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	Currently, there is no required checkpoint cumulative update
Target cumulative update	windows11.0-KB5134134-arm64.msu

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

windows11.0-KB5134134-arm64.msu

Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.

Method 2: Install all MSU files together

Use Deployment Image Servicing and Management (DISM.exe) to install the target update. DISM will use the folder specified in PackagePath to discover and install one or more prerequisite MSU files as needed.

Updating a Windows PC

To apply this update to a running Windows PC, run the following command from an elevated Command Prompt:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5134134-arm64.msu

Or, run the following command from an elevated Windows PowerShell prompt:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-KB5134134-arm64.msu"

Or use Windows Update Standalone Installer to install the target update.

Updating Windows Installation media

To apply this update to Windows Installation media, see Update Windows installation media with Dynamic Update.

Note: When downloading other Dynamic Update packages, ensure they match the same month as this KB. If the SafeOS Dynamic Update or Setup Dynamic Update is not available for the same month as this KB, use the most recently published version of each.

To add this update to a mounted image, run the following command from an elevated Command Prompt:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5134134-arm64.msu

Or, run the following command from an elevated Windows PowerShell prompt:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-KB5134134-arm64.msu" -PreventPending

File information

A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download the file information for out-of-band update KB5134134.