Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Out-of-band update
Out-of-band

KB5091157

KB5091157: Cumulative update for Windows Server, version 2025, April 2026. Domain controller startup and update installation problems fixed

In short

Domain controllers in some multi-domain forests can start again, and affected Server 2025 devices can install the April security update. The out-of-band release also includes open BitLocker, WSUS, and Remote Desktop issues.

Does it affect you? Applies to: Devices running Windows Server 2025, x64. The update is a non-security cumulative update.

Build
26100.32698
Restart
Required

What changes

Fixes 2 changes

Active Directory

For: Domain controllers in multi-domain forests using PAM

  • Some domain controllers in multi-domain forests could have startup problems after the April security update. This release fixes the problem.1
    The forests use Privileged Access Management (PAM). In some cases, Local Security Authority Subsystem Service (LSASS) stopped responding. This could cause repeated restarts and block authentication and directory services.

Windows update installation

For: A small number of Windows Server 2025 devices

  • Some Windows Server 2025 devices could not install the April 14 security update. This release fixes that problem.2
    Affected devices might show error 0x800F0983 or 0x80073712 while installing KB5082063.

Improvement 1 change

Servicing stack update (SSU)

For: Windows Server 2025 devices

  • The component that installs Windows updates gets quality improvements.3
    Includes servicing stack update KB5082062, build 26100.32692.

Known issues

  1. Open Affects: Organizations and IT administrators

    Windows Server Update Services (WSUS) does not display error details

    After KB5070881 or later updates, WSUS does not show synchronization error details. Microsoft says this behavior was temporarily removed to address CVE-2025-59287.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

    A small number of managed devices might ask for the BitLocker recovery key after the first restart. The OS drive must use BitLocker, and the TPM policy must include PCR7. System Information must show PCR7 binding as “Not Possible.” The 2023 Windows UEFI certificate must be present, while the 2023-signed boot manager is not installed. Microsoft lists this issue for this update and says KB5094125 addresses it.5

    How to apply the workaround Group Policy

    Removing the explicit PCR7 setting lets Windows use its default PCR profile and updates BitLocker bindings.5

    Step-by-step instructions, command & download kit
    6 steps cmd.exe · Administrator Instructions (.txt)
    Show steps & kit Hide steps & kit
    Step-by-step procedure
    1. Check the System event log for Event ID 1032.
    2. Open gpedit.msc or Group Policy Management Console and go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
    3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
    4. Run gpupdate /force.
    5. If BitLocker is enabled on C:, run the suspend and resume commands below, in that order.
    6. Alternatively, keep the policy, suspend BitLocker, start the \Microsoft\Windows\PI\Secure-Boot-Update scheduled task, restart the device, and re-enable BitLocker.
    cmd.exe · Administrator 
    > gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
  3. Open Affects: Everyone

    Warnings related to Remote Desktop might not display correctly

    Remote Desktop warnings might show overlapping text or partly hidden buttons on monitors with different scaling settings. Microsoft lists this issue for this update and says KB5087539 addresses it.6

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-04-19
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5082063, KB5078740, KB5075899, KB5078135
+23 earlier KB5077793, KB5073379, KB5072033, KB5072359, KB5068861, KB5070881, KB5070773, KB5066835, KB5068221, KB5065426, KB5063878, KB5064489, KB5062553, KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5044284, KB5043080
Replaced by
KB5087539
VersionBuildChannel
2025 26100.32698 General availability

Security

No vulnerabilities are listed for this update.

Sources

Updated
Cited passages from Microsoft's official notes (6)
  1. 1. Fixed: After installing the April 2026 Windows security update and restarting, domain controllers (DCs) with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. support.microsoft.com
  2. 2. A small number of Windows Server 2025 devices might fail to install the April 14, 2026, Windows security update support.microsoft.com
  3. 3. This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. support.microsoft.com
  4. 4. After installing KB5070881 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. support.microsoft.com
  5. 5. Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. support.microsoft.com
  6. 6. After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. support.microsoft.com
Checked automatically: 8 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake