The Update BureauKB5035849: Cumulative update for Windows Server, version 2019, March 2024. Touch keyboard fix; LSASS leak can reboot domain controllers
The update addresses a touch keyboard problem and includes 35 security fixes, including two critical Hyper-V flaws. A separate LSASS memory leak on domain controllers is addressed by KB5037425.
Does it affect you? Applies to: Devices running Windows Server 2019.
Review notes Additional details from the official release notes (1) Read note
- This page LSASS may leak memory on domain controllers handling Kerberos requests. Only extreme memory leaks may crash LSASS and trigger an unscheduled reboot.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Improvements 2 changes
Active Directory
-
Domains hosting mobile device management providers can transition from Compatibility mode to Enforcement mode for stronger certificate mapping.1
The update allows an Active Directory Key Distribution Center (KDC) to read user security identifiers (SID) from the Subject Alternative Name (SAN), so providers can populate those values.
Servicing stack
-
The component that installs Windows updates receives quality improvements.2
Includes the Windows 10 servicing stack update, build 17763.5568.
Fix 1 change
Touch keyboard
- Addresses a problem that sometimes prevents the touch keyboard from opening.3
Known issues
-
Following installation of this update, Local Security Authority Subsystem Service (LSASS) may experience a memory leak on domain controllers (DCs).
After installing this update, LSASS might leak memory on domain controllers handling Kerberos authentication requests from on-premises and cloud-based Active Directory. Extreme leaks might crash LSASS and trigger an unscheduled domain controller reboot. KB5037425 addresses this issue.4
Resolution Fixed in KB5037425Install KB5037425 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2024-03-12
- Type
- Cumulative update
| Version | Build | Channel |
|---|---|---|
| 2019 | 17763.5576 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Hyper-V Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Hyper-V Denial of Service Vulnerability
|
Critical | 5.5 |
The table lists the 2 exploited, publicly disclosed or critical vulnerabilities. See all 35 vulnerabilities →
Sources
Cited passages from Microsoft's official notes (4)
-
1.
The update affects Active Directory domains that host mobile device management (MDM) providers. They can transition from “Compatibility mode” to the strong certificate mapping “Enforcement mode.”
support.microsoft.com -
2.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
3.
This update addresses an issue that affects the touch keyboard. Sometimes it does not open.
support.microsoft.com -
4.
Following installation of this update, Local Security Authority Subsystem Service (LSASS) may experience a memory leak on domain controllers (DCs).
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Nov 8, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 4/5, clarity 4/5, completeness 5/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake