KB5043064: Cumulative update for Windows 10, versions 21H2 and 22H2, September 2024. Windows Installer prompts for credentials; dual-boot Linux may fail

The update changes Windows Installer repairs to prompt for administrator credentials and addresses security issues. A known dual-boot issue can prevent Linux from starting, and some other issues affect profile pictures and Azure Virtual Desktop.

Does it affect you? Applies to: This update applies to Windows 10, version 22H2, and Windows 10, version 21H2 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021. It provides OS builds 19045.4894 and 19044.4894, respectively.

Review notes Additional details from the official release notes (4) Read notes

In detail After this update, automation scripts must be updated because Windows Installer repairs prompt for credentials.
What changes Automation scripts must be updated, and application owners must add the Shield icon to indicate that the process requires full administrator access.
In short The AVD issues are resolved by installing KB5045594 or a later update and applying one of the options in KB5048864; both actions are required.
What changes Linux might fail to start on devices configured to dual-boot Windows and Linux.

The official sources are linked at the end of the page.

What changes

Improvements 3 changes

Windows Installer

For: IT administrators and application owners

When Windows Installer repairs an application, you are now prompted for credentials. Automation scripts may need updating.¹
Application owners should add the Shield icon to indicate that the process requires full administrator access. To turn off the prompt, set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer\DisableLUAInRepair to 1.

Dual boot of Windows and Linux

For: Devices configured to dual-boot Windows and Linux

Linux might fail to start on devices set up to dual-boot Windows and Linux. The failure can show a Secure Boot policy violation message.²
The August 2024 Windows security update applies a Secure Boot Advanced Targeting (SBAT) setting to block old, vulnerable boot managers. Some customized dual-boot methods might not be detected, so the SBAT value can be applied when it should not be.

Servicing stack

The component that installs Windows updates receives quality improvements.³
Includes servicing stack update KB5043935.

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB5045594

After installing this update, or subsequent updates, a small subset of Azure Virtual Desktop customers using multi-session hosts (AVD) may experience the following issues: - An extended 10-to-30-minu…

A small subset of Azure Virtual Desktop customers using multi-session hosts might see a 10-to-30-minute black screen after sign-in or single sign-on failures in Office apps. This issue is resolved by installing KB5045594 or a later update and applying one of the options in KB5048864’s Resolution section; both actions are required.⁴

Resolution Fixed in KB5045594

Install KB5045594 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Resolved Affects: Organizations and IT administrators Resolved by KB5045594

After installing this update, you might experience a black screen when you login to Azure Virtual Desktop (AVD).

Some Azure Virtual Desktop users might see a black screen at sign-in and be unable to log out. This issue is resolved by installing KB5045594 or a later update and applying one of the options in KB5048864’s Resolution section; both actions are required.⁵

Resolution Fixed in KB5045594

Install KB5045594 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Open Affects: Everyone

After installing this update, you might be unable to [change your user account profile picture](https://support.microsoft.com/en-us/windows/change-your-account-picture-3645cdc7-acab-49d2-76a9-4ce7e5e…

After installing this update, changing a user account profile picture might fail with error 0x80070520. Microsoft says the issue has very limited or no impact for this Windows version.⁶

How to apply the workaround Workaround

Contact Windows support for help if you encounter the issue.⁶
Open Affects: Everyone

After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

After installing the security update, Linux might fail to start on a device configured to dual-boot Windows and Linux. The error can say “Verifying shim SBAT data failed: Security Policy Violation.”⁷

How to apply the workaround Workaround

Refer to the workaround guidance on the Windows release health site.⁷

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-09-10
Type: Cumulative update

Version	Build	Channel
21H2	19044.4894	General availability
22H2	19045.4894	General availability

Security

31 vulnerabilities fixed

3 exploited 1 critical 27 important 1 moderate 2 not rated

Vulnerability	Severity	CVSS
CVE-2024-43461 Exploited Windows MSHTML Platform Spoofing Vulnerability	Important	8.8
CVE-2024-38014 Exploited Windows Installer Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38217 Exploited Windows Mark of the Web Security Feature Bypass Vulnerability	Important	5.4
CVE-2024-38119 Windows Network Address Translation (NAT) Remote Code Execution Vulnerability	Critical	7.5

The table lists the 4 exploited, publicly disclosed or critical vulnerabilities. See all 31 vulnerabilities →

Sources

Microsoft Support: KB5043064

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (7)

1. When it repairs an application, the User Account Control (UAC) does not prompt for your credentials. After you install this update, the UAC will prompt for them. support.microsoft.com
2. Linux might fail to start up when you turn on dual-boot setup for Windows and Linux on your device. support.microsoft.com
3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
4. An extended 10-to-30-minute-long hang at a black screen following user logon. support.microsoft.com
5. This issue is resolved by installing the Windows updates released October 22, 2024 (KB5045594) or later updates and by applying one of the options mentioned in the Resolution section in KB5048864. support.microsoft.com
6. After further investigation, we concluded this issue has very limited or no impact for this Windows version. If you encounter this issue on your device, please contact Windows support for help support.microsoft.com
7. Please refer to the workaround mentioned in Windows release health site for this issue. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake