KB5091575: Cumulative update for Windows Server, version 2022, April 2026. PAM-related domain controller startup failures fixed

Domain controllers in multi-domain forests using PAM can start again after restart failures caused by the April 14 update. This out-of-band release is available only from the Microsoft Update Catalog.

Does it affect you? Applies to: Devices running Windows Server 2022 on x64.

Review notes Additional details from the official release notes (1) Read note

Known issues Before installing, set the policy to Not Configured and run gpupdate /force. Then suspend and resume BitLocker on the affected C: drive to update its bindings.

The official sources are linked at the end of the page.

What changes

Fix 1 change

Domain controllers (known issue)

Domain controllers in multi-domain forests using PAM can start again after restart failures caused by the April 14 update.¹
Fixes startup issues that could occur after installing KB5082142 and restarting. In some cases, LSASS could stop responding, causing repeated restarts and blocking authentication and directory services.

Known issues

Open Affects: Organizations and IT administrators

Windows Server Update Services (WSUS) does not display error details

WSUS does not show synchronization error details after KB5070884 or later. Microsoft temporarily removed this reporting to address CVE-2025-59287.²

Workaround status No workaround yet

Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.
Open Affects: Organizations and IT administrators

Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key

On devices with BitLocker enabled on the OS drive, the first restart might ask for the recovery key if all listed conditions apply: the TPM validation profile explicitly includes PCR7, System Information reports PCR7 Binding as “Not Possible,” the Windows UEFI CA 2023 certificate is in the Secure Boot DB, and the device is not using the 2023-signed Windows Boot Manager. Later restarts will not ask again if the policy stays unchanged.³

How to apply the workaround Group Policy

Changing the policy and refreshing it lets the device update its BitLocker bindings to the Windows-selected default PCR profile.³
Step-by-step instructions, command & download kit
5 steps cmd.exe · Administrator Instructions (.txt)

Show steps & kit Hide steps & kit
Step-by-step procedure
1. Open Group Policy Editor or the Group Policy Management Console.
2. Go to Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Set Configure TPM platform validation profile for native UEFI firmware configurations to Not Configured.
4. On affected devices, run gpupdate /force.
5. If BitLocker is enabled on the C: drive, suspend and then resume BitLocker with the commands below.
cmd.exe · Administrator

> gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
Open Affects: Everyone

Warnings related to Remote Desktop might not display correctly

After installing this update, Remote Desktop file security warnings might show overlapping text or partly hidden buttons when monitors use different scaling settings.⁴

How to apply the workaround Workaround

KB5087545 addresses this warning display issue.⁴

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2026-04-19
Classification: Updates
Type: Cumulative update
Restart: Required
Replaces: KB5082142, KB5078766, KB5082314, KB5075906

+35 earlier
KB5078136, KB5077800, KB5073457, KB5071547, KB5068787, KB5070884, KB5066782, KB5065432, KB5063880, KB5062572, KB5060526, KB5061906, KB5058385, KB5059092, KB5058920, KB5055526, KB5053603, KB5051979, KB5052819, KB5049983, KB5048654, KB5046616, KB5047767, KB5044281, KB5042881, KB5041160, KB5040437, KB5041054, KB5039227, KB5037782, KB5036909, KB5037422, KB5035857, KB5034770, KB5034129
Replaced by: KB5087545

Version	Build	Channel
2022	20348.5024	General availability

Security

No vulnerabilities are listed for this update.

Downloads (Microsoft Update Catalog)

x64 2022

516.2 MB

windows10.0-kb5091575-x64.msu Main update · KB5091575 SHA-1: 1325b929…040a90

Updated components

10 files changed since the previous update for the same versions.

Sources

Microsoft Support: KB5091575

Updated Nov 7, 2026

Cited passages from Microsoft's official notes (4)

1. Fixed: After installing the April 14, 2026, (KB5082142) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM), might experience startup issues. support.microsoft.com
2. After installing KB5070884 or later updates, Windows Server Update Services (WSUS) does not display synchronization error details within its error reporting. This functionality is temporarily removed to address the Remote Code Execution Vulnerability, CVE-2025-59287. support.microsoft.com
3. Some devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key on the first restart after installing this update. support.microsoft.com
4. After installing this update, the security warning that appears when opening Remote Desktop (RDP) files might not display correctly in some cases. support.microsoft.com

Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Sep 25, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: passed

A second AI read the text against the sources: correctness 4/5, clarity 3/5, completeness 5/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake