Skip to the content
The Update Bureau
Guide · Fix & Manage Updates Mitigation Windows & Server

Known Issue Rollback (KIR), explained

How Windows switches off one faulty change from a non-security update without uninstalling the whole update, and how IT admins apply a KIR with Group Policy or Intune.

All guides Active Known Issues & KIRs →

Known Issue Rollback (KIR) is a Windows servicing feature that turns off one specific change that caused a problem, while keeping everything else in the update, security fixes included. You do not have to uninstall the update.

What a KIR can and cannot do

  • It applies only to non-security changes. Rolling back a security fix could open a vulnerability, so that is never done this way.
  • It is temporary. When Microsoft ships an update that fixes the problem, the KIR is no longer needed.
  • Microsoft announces a KIR in the Known issues section of the update's KB article and on the Windows release health dashboard. This site shows the same information on each update page and in known issues.

On a home or unmanaged PC

You do nothing. Microsoft delivers the KIR through Windows Update to PCs that are not managed by an IT department. In its release-health notes Microsoft says it can take up to 24 hours to reach every affected device and that a restart is required. Restarting after the notice appears is the quickest way to get it.

On managed PCs and servers (IT admins)

The KIR does not reach devices managed by an IT department by itself. Microsoft publishes a KIR policy definition (an .msi file with the policy templates), linked from the known issue. It works on supported Windows client and Windows Server versions.

  1. Download the .msi that matches your Windows version and run it on the machine you manage Group Policy from. It installs the template into C:\Windows\PolicyDefinitions; with a Central Store, copy the .admx and .adml files there.
  2. Create a GPO and open Computer Configuration › Administrative Templates › KB####### Issue ### Rollback › your Windows version. For a single PC, use gpedit.msc.
  3. Set the policy to Disabled. Disabling the policy switches off the faulty change.
  4. Restart the devices. Group Policy usually applies within 90 to 120 minutes; gpupdate speeds it up.

For Intune-managed devices, ingest the .admx file in a custom configuration profile instead (the cumulative update of July 26, 2022 or later is required).

Remove the policy once you have installed the update that fixes the issue.

When there is no KIR

Not every known issue has one. Read the Workaround in the same entry first. Pausing updates or uninstalling are the last resorts. The glossary explains the terms used in the notes.

Sources

Edited by the site editor. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake