The Update BureauKB5064489: Cumulative update for Windows Server, version 2025, July 2025. Azure VM startup issue addressed; Active Directory replication risk remains
Some Azure virtual machines with Virtualization-Based Security enabled could not start; this update addresses that issue. Active Directory replication can still fail on affected domain controllers.
Does it affect you? Applies to: Devices running Windows Server 2025, x64. The virtual machine fix concerns certain Azure General Enterprise VMs without Trusted Launch, on older VM SKUs.
Microsoft publishes separate notes for this KB for Windows 11.
What changes
Improvements 2 changes
General
For: Windows Server 2025 devices
-
Includes the security fixes and improvements from the July 8, 2025 security update.1
Includes the fixes and improvements from KB5062553.
Servicing stack
For: Windows Server 2025 devices
-
The servicing stack update improves the component that installs Windows updates.2
Includes servicing stack update KB5063666, build 26100.4651.
Fix 1 change
Azure Virtual Machines
-
Some Azure virtual machines could not start when Virtualization-Based Security was enabled. This update addresses the issue.3
Applies to standard (non-Trusted Launch) General Enterprise VMs on older VM SKUs, using non-default version 8.0 where VBS is offered by the host. The issue was caused by secure kernel initialization.
Known issues
-
Active Directory Replication
Microsoft lists an Active Directory replication issue for this update. A domain controller running Windows Server 2025 with the schema master role can allow duplicate schema entries, which can cause replication to fail across the enterprise.4
How to apply the workaround WorkaroundMicrosoft identifies KB5068861 as addressing this issue.4
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2025-07-13
- Classification
- Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5062553, KB5060842, KB5058411, KB5055523
- Replaced by
- KB5063878
| Version | Build | Channel |
|---|---|---|
| 2025 | 26100.4656 | General availability |
Security
No vulnerabilities are listed for this update.
Downloads (Microsoft Update Catalog)
Updated components
144 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Kernel | 3 |
| File Explorer and shell | 2 |
| Graphics and display | 2 |
| Hyper-V and virtualization | 2 |
| Secure Boot | 2 |
| Printing | 1 |
Verified in package: changed files confirm Azure Virtual Machines.
Sources
Cited passages from Microsoft's official notes (4)
-
1.
This update is cumulative and includes security fixes and improvements from the July 8, 2025, security update (KB5062553), in addition to the following:
support.microsoft.com -
2.
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates.
support.microsoft.com -
3.
This update addresses an issue that prevented some virtual machines (VMs) from starting when Virtualization-Based Security (VBS) was enabled.
support.microsoft.com -
4.
Active Directory domain controllers (DC) running on Windows Server 2025 and also running the schema master Flexible Single Master Operation (FSMO) role, will allow duplicate entries in attributes of schema objects.
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 3/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake