KB5058921: Cumulative update for Windows 10, version 1607, April 2025. Audit logon status can appear disabled even when auditing works

The out-of-band update fixes a misleading display of local audit settings: logon auditing can appear disabled even when it is enabled and working.

Does it affect you? Applies to: Devices running Windows 10 Enterprise LTSB 2016, version 1607.

Microsoft publishes separate notes for this KB for Windows Server.

What changes

The local audit policy no longer appears to have logon auditing turned off when it is enabled and working.¹
Addresses the display of Audit Logon/Logoff events in the local policy of Active Directory Group Policy. The Local Group Policy Editor or Local Security Policy might show “Audit logon events” with Security Setting “No auditing” even when auditing is enabled and working.

Data sheet · Security · Downloads · Components Click to collapse or expand

Released: 2025-04-11
Classification: Updates
Type: Cumulative update
Restart: Required
Replaces: KB5055521, KB5053594, KB5052006, KB5049993

+3 earlier
KB5048671, KB5046612, KB5037423
Replaced by: KB5058383

Version	Build	Channel
1607	14393.7973	General availability

No vulnerabilities are listed for this update.

x64 1607

1.6 GB

x86 1607

0.9 GB

292 files changed since the previous update for the same versions.

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (1)

1. It addresses a known issue where Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 1 quoted passage · compared with Microsoft's page on Oct 20, 2026

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake