KB5041773: Cumulative update for Windows 10, version 1607, August 2024. Exploited Windows flaws addressed; Linux dual-boot booting can fail

The update addresses security issues, including four exploited vulnerabilities, and changes Secure Boot behavior that can prevent Linux from starting on some dual-boot devices.

Does it affect you? Applies to: This update is for Windows 10 Enterprise LTSB 2016, version 1607 (OS Build 14393.7259).

Review notes Additional details from the official release notes (1) Read note

Known issues For Windows-only systems, the official page documents setting a registry key to ensure the SBAT security update is applied. It does not provide a GPO workaround.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

Improvements 4 changes

Lock screen

The “Use my Windows user account” checkbox is not available on the lock screen when connecting to Wi-Fi.¹
This change addresses CVE-2024-38143.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

For: Windows devices, including some dual-boot devices

Windows blocks vulnerable Linux boot managers. Older Linux installation images might not boot after this change.²
SBAT applies to systems that run Windows and is not applied when Windows and Linux dual-booting is detected. If an older Linux ISO image does not boot, work with the Linux vendor to get an updated image.

Domain Name System (DNS)

For: organizations with DNS servers

DNS server security is hardened. If domain configurations are not up to date, DNS requests might return SERVFAIL or time out.³
This change addresses CVE-2024-37968.

Line Printer Daemon (LPD) protocol

For: devices that use LPD printing

Printing through the deprecated LPD protocol might not work as expected or might fail.⁴
This can occur after the July 9, 2024 update and later updates. UNIX clients should use Internet Printing Protocol (IPP); Windows clients can connect to shared UNIX printers using Windows Standard Port Monitor.

Fix 1 change

BitLocker (known issue)

For: devices with device encryption enabled

The update addresses a startup issue that can show a BitLocker recovery screen after the July 9, 2024 update. It is more likely to happen when device encryption is on, and Windows might ask for the recovery key.⁵

Removal 1 change

NetJoinLegacyAccountReuse

The NetJoinLegacyAccountReuse registry key is removed.⁶
See KB5020276 for information about domain join hardening changes.

Known issues

Open Affects: Everyone

After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

On some customized Windows and Linux dual-boot setups, Linux might fail to start with an SBAT security-policy error. The September 2024 security update (KB5043051) and later updates do not contain the settings that caused this issue; KB5058383 and later updates include additional improvements to resolve it.⁷

How to apply the workaround Registry / GPO

Install the September 2024 security update or a later update. Dual-boot systems need no additional steps afterward; Windows-only systems can set the registry key documented for CVE-2022-2601 and CVE-2023-40547 to ensure the SBAT security update is applied.⁷
Step-by-step workaround instructions
2 steps

Show steps Hide steps
Step-by-step procedure
1. Install KB5043051 or a later update.
2. On Windows-only systems, set the registry key documented for CVE-2022-2601 and CVE-2023-40547.
Resolved Affects: Organizations and IT administrators Resolved by KB5044293

After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

On Windows Servers using legacy Remote Procedure Call over HTTP in Remote Desktop Gateway, Remote Desktop connections across an organization might be interrupted intermittently. Users might need to reconnect; administrators can see the TSGateway service become unresponsive with exception code 0xc0000005. KB5044293 addresses this issue.⁸

Resolution Fixed in KB5044293

Install KB5044293 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-08-13
Type: Cumulative update

Version	Build	Channel
1607	14393.7259	General availability

Security

38 vulnerabilities fixed

4 exploited 5 critical 32 important 1 not rated

Vulnerability	Severity	CVSS
CVE-2024-38107 Exploited Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38193 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38178 Exploited Scripting Engine Memory Corruption Vulnerability	Important	7.5
CVE-2024-38106 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-38063 Windows TCP/IP Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-38140 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-38159 Windows Network Virtualization Remote Code Execution Vulnerability	Critical	9.1
CVE-2024-38160 Windows Network Virtualization Remote Code Execution Vulnerability	Critical	9.1
CVE-2022-3775 Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences	Critical	7.1
CVE-2024-38199 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability	Important	9.8

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 38 vulnerabilities →

Sources

Microsoft Support: KB5041773

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (8)

1. This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
2. This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. support.microsoft.com
3. This update hardens DNS server security to address CVE-2024-37968. If the configurations of your domains are not up to date, you might get the SERVFAIL error or time out. support.microsoft.com
4. Using this deprecated protocol to print might not work as you expect or fail. support.microsoft.com
5. A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
6. This update removes this registry key. support.microsoft.com
7. After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device. support.microsoft.com
8. This issue is addressed in KB5044293. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 8 quoted passages · compared with Microsoft's page on Oct 20, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake