KB5041773: Cumulative update for Windows Server, version 2016, August 2024. Exploited kernel flaws patched; Linux dual-boot issue remains

Patches 43 vulnerabilities, including flaws already exploited in attacks. Some Windows and Linux dual-boot devices might fail to boot Linux, and the update is no longer available.

Does it affect you? Applies to: Devices running Windows Server 2016, build 14393.7259.

Review notes Additional details from the official release notes (1) Read note

What changes The BitLocker recovery screen can occur after the July 9, 2024 update; it is more likely when device encryption is on.

The official sources are linked at the end of the page.

Microsoft publishes separate notes for this KB for Windows 10.

What changes

Improvements 4 changes

Lock screen

For: users connecting to Wi-Fi from the lock screen

The “Use my Windows user account” checkbox is no longer available on the lock screen when connecting to Wi-Fi.¹
This change addresses CVE-2024-38143.

Secure Boot Advanced Targeting (SBAT) and Linux Extensible Firmware Interface (EFI)

For: systems that run Windows

Windows blocks vulnerable Linux EFI boot managers from running. Older Linux ISO images might not boot after the update.²
SBAT applies to systems that run Windows, but not to systems where Windows and Linux dual boot is detected. If an older Linux ISO image does not boot, work with the Linux vendor to get an updated ISO image.

Domain Name System (DNS)

For: DNS administrators

DNS server security is hardened to address CVE-2024-37968. Out-of-date domain configurations might cause a SERVFAIL error or timeout.³

Line Printer Daemon (LPD) protocol

For: devices and clients that use LPD printing

Printing through the deprecated LPD protocol might not work as expected or might fail after the July 9, 2024 updates.⁴
UNIX clients should use the Internet Printing Protocol (IPP). Windows clients can connect to shared UNIX printers using the Windows Standard Port Monitor.

Fix 1 change

BitLocker

For: devices with device encryption enabled

A BitLocker recovery screen might appear when the device starts after the July 9, 2024 update, especially when device encryption is on.⁵
The recovery key from the Microsoft account might be needed to unlock the drive.

Removal 1 change

NetJoinLegacyAccountReuse

The NetJoinLegacyAccountReuse registry key is removed.³
See KB5020276 for information about domain join hardening changes.

Known issues

Resolved Affects: Organizations and IT administrators Resolved by KB5044293

After installing the Windows update released on or after July 9, 2024, Windows Servers might affect Remote Desktop Connectivity across an organization.

Remote Desktop connections across an organization might be interrupted on Windows Servers using Remote Procedure Call over HTTP in Remote Desktop Gateway. The issue can recur about every 30 minutes; KB5044293 addresses it.⁶

Resolution Fixed in KB5044293

Install KB5044293 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Open Affects: Everyone

After installing this security update, you might face issues with booting Linux if you have enabled the dual-boot setup for Windows and Linux in your device.

Some Windows and Linux dual-boot devices might fail to boot Linux and show an SBAT security-policy error.⁷

How to apply the workaround Workaround

September 2024 and later updates omit the settings that caused the issue; additional improvements to resolve it are included in May 2025 and later updates. Dual-boot systems need no additional steps after installing September 2024 or later updates.⁷

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released: 2024-08-13
Type: Cumulative update

Version	Build	Channel
2016	14393.7259	General availability

Security

43 vulnerabilities fixed

4 exploited 5 critical 38 important

Vulnerability	Severity	CVSS
CVE-2024-38107 Exploited Windows Power Dependency Coordinator Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38193 Exploited Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Important	7.8
CVE-2024-38178 Exploited Scripting Engine Memory Corruption Vulnerability	Important	7.5
CVE-2024-38106 Exploited Windows Kernel Elevation of Privilege Vulnerability	Important	7.0
CVE-2024-38063 Windows TCP/IP Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-38140 Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Critical	9.8
CVE-2024-38159 Windows Network Virtualization Remote Code Execution Vulnerability	Critical	9.1
CVE-2024-38160 Windows Network Virtualization Remote Code Execution Vulnerability	Critical	9.1
CVE-2022-3775 Redhat: CVE-2022-3775 grub2 - Heap based out-of-bounds write when rendering certain Unicode sequences	Critical	7.1
CVE-2024-38199 Windows Line Printer Daemon (LPD) Service Remote Code Execution Vulnerability	Important	9.8

The table lists the 10 exploited, publicly disclosed or critical vulnerabilities. See all 43 vulnerabilities →

Sources

Microsoft Support: KB5041773

Updated Oct 27, 2026

Cited passages from Microsoft's official notes (7)

1. This update addresses CVE-2024-38143. Because of this, the “Use my Windows user account” checkbox is not available on the lock screen to connect to Wi-Fi. support.microsoft.com
2. This update applies SBAT to systems that run Windows. This stops vulnerable Linux EFI (Shim bootloaders) from running. support.microsoft.com
3. This update removes this registry key. support.microsoft.com
4. Using this deprecated protocol to print might not work as you expect or fail. This issue occurs after you install the July 9, 2024, and later updates. support.microsoft.com
5. A BitLocker recovery screen shows when you start up your device. This occurs after you install the July 9, 2024, update. support.microsoft.com
6. This issue is addressed in KB5044293. support.microsoft.com
7. Additional improvements to resolve this issue were included in the May 2025 Windows security update (KB5058383) and later updates. support.microsoft.com

Checked automatically: 7 of 8 checks passed, 7 quoted passages · compared with Microsoft's page on Nov 8, 2026

Quotes found in the official pages: passed
Numbers found in the sources: passed
Vulnerabilities from the dossier only: passed
Links to allowed domains only: passed
Every official change covered: passed
Readable plain text: passed
Changes confirmed by the file list: passed
Sources agree: not passed

A second AI read the text against the sources: correctness 3/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake