Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Security update
Patch Tuesday

KB5082063

KB5082063: Cumulative update for Windows Server, version 2025, April 2026. Secure Boot hardening and new recovery-key and Remote Desktop issues

In short

Secure Boot certificate updates reach more eligible devices, while changes to driver blocking and Windows Deployment Services can affect backup apps and Hands-Free Deployment. Some BitLocker, WSUS, and Remote Desktop issues remain listed.

Does it affect you? Applies to: Devices running Windows Server 2025, build 26100.32690. The listed package is for x64.

Build
26100.32690
Security
125 fixed · 3 critical
Restart
Required
Review notes Additional details from the official release notes (2) Read notes
  • Does it affect you? This update applies to Windows Server 2025 and brings it to build 26100.32690. The listed package is for x64.
  • Known issues KB5087539 addresses the Remote Desktop warning display issue.

The official sources are linked at the end of the page.

What changes

Improvements 9 changes

Secure Boot

Gradual rollout Verified in package

For: devices eligible for Secure Boot certificate updates

  • Secure Boot certificates reach more eligible devices through a phased rollout.1
    Windows quality updates include additional high confidence device targeting data. Devices receive certificates only after sufficient successful update signals.

Kerberos protocol

For: domains with accounts lacking an explicit encryption attribute

  • Kerberos uses AES-SHA1 by default for accounts without an explicit encryption setting.2
    Changes the default DefaultDomainSupportedEncTypes value for KDC operations when accounts do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute.

Authentication

Verified in package

For: devices using Kerberos authentication

  • Configured Kerberos encryption policies apply more consistently during sign-in.3
    Windows reads the configured Kerberos encryption policy settings as expected.

Bluetooth

Verified in package
  • Bluetooth devices appear more consistently and are easier to add and manage.4
    Improves Bluetooth device management in Settings and Quick Settings.

Graphics

Verified in package
  • Printed colors look better when printing from desktop apps.5
    Improves color rendering when printing from Win32 desktop apps.

Networking

Verified in package
  • File transfers using SMB compression over QUIC are less likely to time out.6
    Improves reliability when Windows uses SMB compression over QUIC.

Remote Desktop

Verified in package

For: users opening Remote Desktop files

  • Remote Desktop shows requested connection settings before connecting, with each setting off by default.7
    Opening an .rdp file also triggers a one-time security warning the first time on a device.

Vulnerable driver blocklist

Verified in package

For: users of backup apps that rely on blocked drivers

  • Some backup apps might fail to mount or manage disk images if they rely on drivers added to the blocklist.8
    Adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. Affected apps might show VSS_E_BAD_STATE or a VSS timeout error; Microsoft advises updating the app to a version with newer drivers.

Servicing stack

For: devices installing Windows updates

  • The component that installs Windows updates gets quality improvements.9
    The package includes servicing stack update KB5082062, build 26100.32692.

Fixes 2 changes

Secure Boot

Verified in package

For: devices receiving Secure Boot updates

  • A device is less likely to enter BitLocker Recovery after Secure Boot updates.10

PowerShell

For: PowerShell users importing registry preference values

  • Imported registry preference values keep their final character.11
    The Set-GPPrefRegistryValue cmdlet now preserves each imported value in full, including the final character.

New feature 1 change

Texts and Fonts

  • Windows fonts include the new Saudi Riyal currency symbol.12

Removal 1 change

Windows Deployment Services (WDS)

For: IT administrators using WDS Hands-Free Deployment

  • Hands-Free Deployment is disabled by default and is no longer supported.13

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    WSUS does not show synchronization error details after KB5070881 or later updates. Microsoft says this functionality is temporarily removed to address a remote code execution vulnerability.14

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A recovery-key prompt might appear on the first restart only if BitLocker protects the OS drive, the TPM policy includes PCR7, msinfo32 reports PCR7 binding as Not Possible, the Windows UEFI CA 2023 certificate is in the Secure Boot database, and the device does not use the 2023-signed Boot Manager. KB5094125 addresses this by preventing that Boot Manager from installing on affected configurations.15

    How to apply the workaround Group Policy

    Removing the explicit PCR7 setting lets Windows use its selected default PCR profile for BitLocker bindings.15

    Step-by-step instructions, command & download kit
    5 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check the System event log for Event ID 1032.
    2. Open Group Policy Editor or Group Policy Management Console and go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    4. Run gpupdate /force to apply the policy change.
    5. If BitLocker is enabled on C:, run the suspend command, then the resume command.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  3. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    Microsoft lists an issue where Remote Desktop security warnings might show overlapping text or partly hidden buttons on multi-monitor setups with different display scaling.16

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  4. Resolved Affects: Organizations and IT administrators Resolved by KB5091157

    Domain controllers might restart repeatedly after installing this update

    Domain controllers in forests with multiple domains using Privileged Access Management might crash during startup and restart repeatedly. KB5091157 addresses this issue.17

    Resolution Fixed in KB5091157

    Install KB5091157 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

  5. Resolved Affects: Everyone Resolved by KB5091157

    Installation of this update might fail with error 0x800F0983 or 0x80073712

    A small number of devices might fail to install with error 0x800F0983 or 0x80073712. KB5091157 addresses this issue.18

    Resolution Fixed in KB5091157

    Install KB5091157 (or a later cumulative update) on affected devices. No manual workaround is required after updating.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-14
Classification
Security Updates
Type
Cumulative update
Restart
Required
Replaces
KB5078740, KB5075899, KB5078135, KB5077793
+22 earlier KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5091157
VersionBuildChannel
2025 26100.32690 General availability

Security

125 vulnerabilities fixed
3 critical 119 important 1 moderate 2 not rated
VulnerabilitySeverityCVSS
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
 Critical 9.8
CVE-2026-33827
Windows TCP/IP Remote Code Execution Vulnerability
 Critical 8.1
CVE-2026-33826
Windows Active Directory Remote Code Execution Vulnerability
 Critical 8.0

The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 125 vulnerabilities →

Updated components

5,359 files changed since the previous update for the same versions.

Top changed componentsFiles
Settings61
Graphics and display48
Networking41
Security and sign-in29
Remote Desktop28
Audio27
Printing27
File Explorer and shell22
Hyper-V and virtualization21
Bluetooth19
Secure Boot17
Search14

Verified in package: changed files confirm Secure Boot, Authentication, Bluetooth, Graphics, Networking, Remote Desktop, Vulnerable driver blocklist.

Sources

Updated
Cited passages from Microsoft's official notes (18)
  1. 1. With this update, Windows quality updates include additional high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. support.microsoft.com
  2. 2. This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that don't have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined. support.microsoft.com
  3. 3. After you install this update, Windows reads the configured policy settings as expected, which helps ensure encryption behavior is applied consistently across the domain. support.microsoft.com
  4. 4. This update improves Bluetooth device management in Settings and Quick Settings, helping connected devices appear consistently and making them easier to add and manage. support.microsoft.com
  5. 5. This update improves color rendering when printing from Win32 desktop apps. support.microsoft.com
  6. 6. After you install this update, SMB compression requests over QUIC complete more consistently, reducing the likelihood of timeouts and supporting smoother, more dependable performance. support.microsoft.com
  7. 7. When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default. support.microsoft.com
  8. 8. This update introduces a security hardening change that adds known vulnerable kernel drivers to the Microsoft vulnerable driver blocklist. support.microsoft.com
  9. 9. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  10. 10. This update addresses an issue where the device might enter BitLocker Recovery after the Secure Boot updates. support.microsoft.com
  11. 11. The cmdlet now preserves each imported value in full, including the final character. support.microsoft.com
  12. 12. This update improves Windows fonts by adding the new Saudi Riyal currency symbol. support.microsoft.com
  13. 13. This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature. support.microsoft.com
  14. 14. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
  15. 15. Enterprises are recommended to audit their BitLocker group policies for explicit PCR7 inclusion and check msinfo32.exe for their PCR7 binding status before installing this update. support.microsoft.com
  16. 16. When this happens, the warning window might show overlapping text or partially hidden buttons, which can make the message difficult to read or interact with. support.microsoft.com
  17. 17. This issue is addressed in out-of-band update KB5091157. support.microsoft.com
  18. 18. This issue is addressed in out-of-band update KB5091157. support.microsoft.com
Checked automatically: 7 of 8 checks passed, 18 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 3/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake