Skip to the content
The Update Bureau
Windows Server 2022 Windows Server 2022 Security update
Patch Tuesday

KB5034129

KB5034129: Cumulative update for Windows Server, version 2022, January 2024. Critical Kerberos and Hyper-V flaws; sign-in and browser issues addressed

In short

Fixes 36 vulnerabilities, including critical flaws in Kerberos and Hyper-V, and addresses issues affecting sign-in, servers, and other features. Chromium-based browser launch problems are resolved by KB5034770.

Does it affect you? Applies to: Devices running Windows Server 2022, build 20348.2227.

Build
20348.2227
Security
36 fixed · 2 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • This page The Chromium-based browser issue is resolved by KB5034770, not KB5034129.
  • What to do When configured with the specified product and classification, WSUS automatically syncs this update. The page does not say that WSUS automatically installs it.

The official sources are linked at the end of the page.

What changes

Fixes 21 changes

Microsoft Intune

  • An Intune feature that was not working properly is addressed.1
    The page does not identify the feature.

Account lockout event 4625

  • Account lockout event 4625 is addressed when the account name uses UPN format.2
    The event's format in the ForwardedEvents log is wrong when an account name is in user principal name (UPN) format.

Hybrid joined devices

  • Signing in to hybrid-joined devices without an internet connection is addressed for some Windows Hello for Business sign-in methods.3
    Applies to cloud trust deployments using a Windows Hello for Business PIN or biometric credentials.

Trusted Sites Zone logon policy

  • The Trusted Sites Zone logon policy can be managed through mobile device management.4
    Addresses the issue that prevented management of this policy using MDM.

Microsoft Excel

  • Excel no longer stops responding when you try to share a file as a PDF in Outlook.5

Server Manager

  • The Server Manager pop-up text no longer includes the words “Azure Automanage.”6

Event records

  • XPath queries can match values in event records for FileHash and other binary fields.7
    The update addresses XPath queries on FileHash and other binary fields that stopped matching values in event records.

Virtual machines

  • Deployment of certain network functions on virtual machines is addressed.8
    The page does not identify the affected network functions.

Network Controller

  • The Network Controller issue that required extra outbound traffic rules to avoid blocking return traffic is addressed.9

WS_EX_LAYERED window

  • A layered window is addressed when it renders at the wrong size or position after the display is scaled.10
    The issue affects a WS_EX_LAYERED window when the display screen is scaled.

Print to PDF

  • Print to PDF uses your display name, rather than your sign-in username, in the author metadata.11
    Addresses extraction of the sign-in username into the author name metadata box.

Disk partitions

  • The system stopping responding when space from a deleted partition is added to an existing BitLocker partition is addressed.12

Windows Defender Application Control

  • A startup delay caused by AppID Tagging policies is addressed.13
    Addresses WDAC AppID Tagging policies that might greatly increase device startup time.

Smart card authentication

  • The device shutting down after 60 seconds when a smart card is used to authenticate on a remote system is addressed.14

Smart card sign-in

  • The smart card icon appears when you sign in, including when the card has multiple certificates.15

Active Directory domain controllers

  • Creating new users on primary domain controller emulators no longer triggers the described DS_BUSY errors.16
    The issue affects PDCe domain controllers.

Windows LAPS

  • The Windows LAPS account issue is addressed when its password is older than the maximum age allowed by device policy.17
    Addresses a Windows Local Administrator Password Solution (Windows LAPS) account that does not work when its password exceeds the policy's maximum age.

Kerberos Key Distribution Center

  • The incorrect KDC_ERR_S_PRINCIPAL_UNKNOWN error during trust referrals is addressed.18

Active Directory

  • The msDS-KeyCredentialLink attribute is addressed when it is updated in cases where it should not be.19

Local Security Authority Subsystem Service

  • An issue that causes lsass.exe to stop responding and the device to enter a restart loop is addressed.20

Key Distribution Service

  • The Key Distribution Service starts within the required time when LDAP referrals are needed.21
    Addresses KDS startup taking longer than required when LDAP referrals are needed.

Improvement 1 change

Servicing stack

  • The servicing stack, which installs Windows updates, receives quality improvements.22
    Includes the Windows Server 2022 servicing stack update, version 20348.2200.

Known issues

  1. Resolved Affects: Everyone Resolved by KB5034770

    After you install KB5034129, chromium-based internet browsers, such as Microsoft Edge, might not open correctly.

    After installing KB5034129, Chromium-based browsers, including Microsoft Edge, might open to a white screen and become unresponsive. Devices with browser-specific Image File Execution Options registry entries might be affected. KB5034770 resolves the issue.23

    How to apply the workaround Workaround

    Before KB5034770, remove the browser's Image File Execution Options registry key and restart the device. If the key has values beyond “(Default),” removing it might also remove browser startup configurations.23

    Step-by-step workaround instructions
    5 steps
    Show steps Hide steps
    Step-by-step procedure
    1. Open Registry Editor by searching for regedit in the Start menu.
    2. Go to Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\.
    3. Find the key for the affected browser, such as msedge.exe or chrome.exe, and inspect its values.
    4. If the only value is “(Default),” delete the browser key. If there are additional values, deleting the key might remove browser startup configurations.
    5. Restart the device.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2024-01-09
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaced by
KB5034770
VersionBuildChannel
2022 20348.2227 General availability

Security

36 vulnerabilities fixed
2 critical 34 important
VulnerabilitySeverityCVSS
CVE-2024-20674
Windows Kerberos Security Feature Bypass Vulnerability
 Critical 8.8
CVE-2024-20700
Windows Hyper-V Remote Code Execution Vulnerability
 Critical 7.5

The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 36 vulnerabilities →

Downloads (Microsoft Update Catalog)

x64 2022
369.9 MB
windows10.0-kb5034129-x64.msu Main update · KB5034129 SHA-1: 15b9faad…4adc7f

Sources

Updated
Cited passages from Microsoft's official notes (23)
  1. 1. This update addresses an issue that affects Microsoft Intune. One of its new features does not work properly. support.microsoft.com
  2. 2. This update addresses an issue that affects account lockout event 4625. The format of the event is wrong in the ForwardedEvents log. support.microsoft.com
  3. 3. You cannot sign in to them if they are not connected to the internet. This occurs when you use a Windows Hello for Business PIN or biometric credentials. support.microsoft.com
  4. 4. This update addresses an issue that affects the Trusted Sites Zone logon policy. You cannot manage it using mobile device management (MDM). support.microsoft.com
  5. 5. This update addresses an issue that affects Microsoft Excel. It stops responding when you try to share a file as a PDF in Outlook. support.microsoft.com
  6. 6. This update addresses an issue that affects the Server Manager pop-up text. It removes the words “Azure Automanage.” support.microsoft.com
  7. 7. This update addresses an issue that affects XPath queries on FileHash and other binary fields. It stops them from matching values in event records. support.microsoft.com
  8. 8. This update addresses an issue that affects certain network functions on VMs. Deployment of them fails. support.microsoft.com
  9. 9. This update addresses an issue that affects the Network Controller. The issue makes you create more rules for outbound traffic so that return traffic is not blocked. support.microsoft.com
  10. 10. This update addresses an issue that affects a WS_EX_LAYERED window. The window might render with the wrong dimensions or at the wrong position. support.microsoft.com
  11. 11. Instead, print to PDF should place your display name in that box. support.microsoft.com
  12. 12. Your system might stop responding. This occurs if you add space from a deleted partition to an existing BitLocker partition. support.microsoft.com
  13. 13. AppID Tagging policies might greatly increase how long it takes your device to start up. support.microsoft.com
  14. 14. This update addresses an issue that causes your device to shut down after 60 seconds. This occurs when you use a smart card to authenticate on a remote system. support.microsoft.com
  15. 15. The icon does not appear when you sign in. This occurs when there are multiple certificates on the smart card. support.microsoft.com
  16. 16. They report DS_BUSY errors when you create new users. This only occurs on primary domain controller emulators (PDCe). support.microsoft.com
  17. 17. The LAPS account does not work. This occurs if the password is older than the age that the maximum age device policy allows. support.microsoft.com
  18. 18. It returns a KDC_ERR_S_PRINCIPAL_UNKNOWN error during trust referrals, which is wrong. support.microsoft.com
  19. 19. In some cases, it is updated when it should not be. support.microsoft.com
  20. 20. This update addresses an issue that causes lsass.exe to stop responding. Because of this, a restart loop occurs. support.microsoft.com
  21. 21. It does not start in the time required if LDAP referrals are needed. support.microsoft.com
  22. 22. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  23. 23. This issue is addressed in KB5034770. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 23 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake