The Update BureauWindows Server 2025 · Release Health
Known issues in Windows Server 2025
Problems Microsoft has confirmed for this version, from its official release health notes. 20 still open or mitigated.
Active known issues
Open & Mitigated-
SQL Server linked server connections might remain open
SQL Server linked-server queries using OLE DB providers might leave connections to external databases open after queries finish. Connections can build up and slow server performance over time; Oracle and PostgreSQL are among the known affected connections.
How to apply the workaround WorkaroundFor an enterprise mitigation, contact Microsoft Support for business. Closing identified idle connections or restarting the SQL service can temporarily ease the load, but might interrupt active work and the issue can return.
-
Warnings related to Remote Desktop might not display correctly
After installing KB5082063, Remote Desktop file security warnings might show overlapping text or partly hidden buttons when monitors use different scaling settings.
How to apply the workaround WorkaroundKB5087545 addresses this warning display issue.
-
Devices with an unrecommended BitLocker Group Policy configuration might be required to enter their BitLocker recovery key
A limited set of managed devices might ask for the BitLocker recovery key on the first restart after installation. This can happen when BitLocker is on the OS drive, PCR7 is included in the configured profile or equivalent registry setting, System Information reports PCR7 binding as “Not Possible,” the Windows UEFI CA 2023 certificate is in the Secure Boot DB, and the device does not yet use the 2023-signed Windows Boot Manager.
How to apply the workaround Group PolicyRemoving the explicit PCR7 setting lets Windows use its selected default PCR profile. Suspending and resuming BitLocker updates its bindings.
Step-by-step instructions, command & download kitShow steps & kit Hide steps & kit4 steps cmd.exe · Administrator Instructions (.txt)Step-by-step procedure- Before installing the update, open Group Policy Editor or the Group Policy Management Console.
- Go to
Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drivesand setConfigure TPM platform validation profile for native UEFI firmware configurationstoNot Configured. - Run
gpupdate /forceon affected devices. - Where BitLocker is enabled on the C: drive, run the suspend command, then the resume command.
> gpupdate /force> manage-bde -protectors -disable C:> manage-bde -protectors -enable C:
-
Apps might become unresponsive when saving files to cloud-based storage
Some apps may freeze or show errors when opening or saving cloud files. With Outlook data files on OneDrive, Outlook may hang or fail to reopen; sent items may disappear or old emails may download again.
How to apply the workaround WorkaroundContact the app developer about other ways to access the files. For Outlook, move PST files out of OneDrive; webmail is another option if your provider supports it.
Step-by-step workaround instructionsShow steps Hide steps2 stepsStep-by-step procedure- Contact the app developer about other ways to access the files.
- For Outlook, move its PST files out of OneDrive or use webmail if your email provider supports it.
-
RemoteApp sessions might fail to start on Azure Virtual Desktop
RemoteApp connections in Azure Virtual Desktop might fail after KB5072033; full desktop sessions are not affected.
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5072033 on affected systems until a fix is released.
-
Some machines enrolled for Hotpatch might temporarily lose Hotpatch status
A very limited number of Hotpatch-enrolled Windows Server 2025 machines received this update. Those machines temporarily lose Hotpatch updates and get regular monthly updates that require a restart in November and December; the January 2026 baseline restores Hotpatch eligibility.
How to apply the workaround WorkaroundIf the machine installed this update, install the regular monthly updates in November and December, then the January 2026 baseline. If it downloaded but has not installed the update, pause updates, resume them, and scan again.
Step-by-step workaround instructionsShow steps Hide steps2 stepsStep-by-step procedure- For a machine that downloaded but has not installed the update, open Settings > Windows Update and select Pause updates.
- Resume updates, then scan for updates again.
-
Windows Server Update Services (WSUS) does not display error details
Windows Server Update Services (WSUS) does not show synchronization error details in its reports after KB5070881 or later updates.
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5070881 on affected systems until a fix is released.
-
USB mouse and keyboard not working in the Windows Recovery Environment
USB keyboards and mice might not work in the Windows Recovery Environment, preventing navigation of its recovery options. They continue to work normally in Windows.
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5066835 on affected systems until a fix is released.
-
IIS websites might fail to load
Microsoft says the reported IIS website loading issue does not affect Windows Server 2025. Server users do not need to take action.
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5066835 on affected systems until a fix is released.
-
PSDirect connections failing in hotpatched devices
Microsoft lists an open issue where PowerShell Direct connections might fail on hotpatched devices. It can occur when the host and guest virtual machines are not both fully updated.
How to apply the workaround WorkaroundIf connections fail, update both the host and guest virtual machines with the recommended updates.
-
SMBv1 protocol connectivity
Microsoft lists an open issue where shared files and folders might be unreachable over SMBv1 on NetBIOS over TCP/IP. It can occur if either the SMB client or server has the September 2025 security update.
How to apply the workaround WorkaroundThe page names KB5066782 as an update that addresses this issue.
-
Directory synchronization (DirSync)
After the September 2025 security update, apps using the DirSync control for on-premises AD DS can miss members when syncing groups with more than 10,000 members. This remains listed as open here; the page points to KB5068861 as addressing it.
How to apply the workaround WorkaroundThe page points to KB5068861 as addressing the issue.
-
Azure VM with Trusted Launch disabled
A small subset of Generation 2 Azure VMs might not boot after KB5062553. The risk applies when Trusted Launch is disabled and VBS is enforced through a registry key.
How to apply the workaround WorkaroundKB5064489 is listed as addressing this issue.
-
Noto fonts
CJK text might look blurry in Chromium browsers at 96 DPI (100% scaling).
How to apply the workaround WorkaroundIncrease display scaling to improve text clarity. Users can also report Noto CJK font issues through Google's Noto Fonts GitHub repository.
-
Print to PDF might not work
After KB5058411, Microsoft Print to PDF might disappear or fail to install with error 0x800f0922. Microsoft lists this issue here; KB5062553 addresses it.
How to apply the workaround WorkaroundEnable Microsoft Print to PDF in Windows Features, or use the PowerShell commands below.
Step-by-step instructions, command & download kitShow steps & kit Hide steps & kit2 steps powershell.exe · Administrator Instructions (.txt)Step-by-step procedure- Press Windows + R, enter
optional features, and enable Microsoft Print to PDF in the Windows Features dialog, or open PowerShell as administrator. - Run the commands below in order. The final command might return error 0x800f0922.
> Disable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices-Features> Enable-WindowsOptionalFeature -Online -FeatureName Printing-PrintToPDFServices
- Press Windows + R, enter
-
Windows Hello
Microsoft lists an issue that might prevent Windows Hello facial recognition or PIN sign-in after a local reset. It affects devices where Secure Launch or DRTM is enabled after KB5055523.
Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5055523 on affected systems until a fix is released.
-
Active Directory Replication
On Windows Server 2025 domain controllers that hold the schema master role, duplicate schema object entries might cause Active Directory replication to fail with a schema mismatch. The issue can appear during Exchange Server setup forestprep and can affect replication across the enterprise.
How to apply the workaround WorkaroundKB5068861 is listed as addressing this issue.
-
Azure Arc Setup wizard app
The Azure Arc Setup wizard app might stop responding when opened from Start or the taskbar. The application event log might show Event ID 1000 for
AzureArcSetup.exe.Workaround status No workaround yetMicrosoft has not published a manual workaround for this issue yet. Defer KB5051987 on affected systems until a fix is released.
-
Remote desktop
Remote Desktop sessions on Windows Server 2025 might freeze shortly after connection, making mouse and keyboard input unresponsive. Remote Desktop sessions might also disconnect unexpectedly, including Windows 11 version 24H2 clients connecting to Remote Desktop Services on Windows Server 2016 or earlier; Windows Server 2025 is not affected as an RDS host but might disconnect as a client to older servers. KB5055523 resolves the freeze, and KB5053656 addresses the disconnection issue.
How to apply the workaround Group PolicyFor enterprise-managed devices with the disconnection issue and an update older than March 27, 2025, configure the special Group Policy and restart the devices. Devices with the March 27, 2025 update or later do not need this policy or a Known Issue Rollback.
Step-by-step workaround instructionsShow steps Hide steps3 stepsStep-by-step procedure- For affected enterprise-managed devices updated before March 27, 2025, obtain the special Group Policy for Windows 11 version 24H2 and Windows Server 2025.
- Configure it under
Computer Configuration > Administrative Templates. - Restart the affected devices.
-
Citrix
Some devices with Citrix Session Recording Agent version 2411 might fail to install the January 2025 security update and undo the changes. Home users are not expected to be affected.
How to apply the workaround WorkaroundUpdate Citrix Session Recording Agent to version 2503 or newer.
Recently resolved
Fixed in latest updates-
USB Audio Class 1.0 devices with error Code 10 or no output
Some USB Audio Class 1.0 devices might fail to start, produce no audio, or have unresponsive volume or sound settings. KB5129235 addressed symptoms with 8-channel or 3D audio; KB5131080 addressed the remaining symptoms.
How to apply the workaround WorkaroundSome customers reported restoring audio for multichannel modes by switching to 2-channel mode.
-
Users might be unable to sign in to OWA or send emails on Exchange Server
Some on-premises Exchange servers might have OWA sign-in, email sending, or mailbox replication problems after the October 2026 update. The issue is resolved by KB5131080 and later updates.
How to apply the workaround Registry / GPOFor updates released before November 10, 2026, a registry change can temporarily raise the Endpoint Mapper limit. The mitigation is not needed with KB5131080 or later.
-
Remote Desktop Services might stop responding after September 2026 security update
Some organizations might have Remote Desktop Services connection or sign-in failures, or servers stuck at “Please wait for the Remote Desktop Configuration” after the September update. Updates released on or after September 14, 2026, such as KB5129239, resolve this issue; Windows 365 and Azure Virtual Desktop are not affected.
Resolution Fixed in KB5129239Install KB5129239 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
OneDrive shortcut in file explorer might not work in administrator mode
The OneDrive shortcut in File Explorer might not work when File Explorer runs with administrative privileges. This affects the built-in Administrator account and apps run as administrator. KB5099538 resolves this issue.
Resolution Fixed in KB5099535Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Deleting from recycle bin displays an internal file name
When you permanently delete one item, the confirmation dialog might show its internal Recycle Bin name instead of its original name. KB5099538 resolves this issue.
Resolution Fixed in KB5099535Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Microsoft Office applications might fail to open from certain third-party apps
Some third-party apps that use OLE automation might fail to open Office apps or documents. KB5099538 resolves this issue.
Resolution Fixed in KB5099535Install KB5099535 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Installation of KB5082063 might fail with error 0x800F0983 or 0x80073712
A small number of devices might fail to install with error 0x800F0983 or 0x80073712. KB5091157 addresses this issue.
Resolution Fixed in KB5091157Install KB5091157 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Domain controllers might restart repeatedly after installing KB5082063
In forests with multiple domains that use PAM, domain controllers might crash during startup and restart repeatedly. KB5091575 resolves this; hotpatch devices should use KB5091576.
Resolution Fixed in KB5091572Install KB5091572 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Connection and authentication failures in Azure Virtual Desktop and Windows 365
Some Windows App sign-ins for Remote Desktop connections fail on Windows client devices, affecting Azure Virtual Desktop and Windows 365.
How to apply the workaround WorkaroundMicrosoft lists KB5077793 as the workaround.
-
Unexpected User Account Control (UAC) prompt when doing MSI repair operations
After KB5063871, standard users might see unexpected UAC prompts during MSI repair and related operations. Silent MSI repairs can fail with an error.
How to apply the workaround WorkaroundThe page identifies KB5065432 as the update that addresses this issue.
-
Microsoft Changjie Input Method Editor
After installing KB5062553, some users might have trouble forming or selecting words with the Microsoft Changjie input method for Traditional Chinese. The spacebar might not respond, words might appear incorrectly, or the candidate window might not display properly.
How to apply the workaround WorkaroundInstall KB5063880; Microsoft says it addresses this issue.
-
DHCP Server service
The DHCP Server service might stop responding after KB5060531, affecting IP renewal for clients. KB5062553 resolves this issue.
Resolution Fixed in KB5062572Install KB5062572 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
After installing this security update, you might experience issues with USB audio devices
USB audio devices might stop working, especially when the audio setup uses a USB 1.0 audio-driver-based DAC. KB5052000 addresses the issue.
Resolution Fixed in KB5051979Install KB5051979 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
-
Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update
Devices with Citrix Session Recording Agent version 2411 might fail to complete the January 2025 update installation and revert changes on restart. Citrix Session Recording Agent version 2503 and newer resolve the issue.
Resolution ResolvedMicrosoft has resolved this issue in a subsequent update. No manual workaround is required after updating.
No known issue matches these filters.