Skip to the content
The Update Bureau
Windows Server 2025 Windows Server 2025 Out-of-band update
Out-of-band

KB5068221

KB5068221: Cumulative update for Windows Server, version 2025, September 2025. App-V Office app failures fixed

In short

Microsoft Office apps in App-V environments no longer fail because of a double handle closure. Plan for a restart after installing the update.

Does it affect you? Applies to: Devices running Windows Server 2025. The update package listed for this release is for x64 systems.

Build
26100.6588
Restart
Required

Microsoft publishes separate notes for this KB for Windows 11.

What changes

Fix 1 change

Virtualization and platform compatibility

For: Organizations using App-V

  • Office apps in App-V environments no longer fail because of a double handle closure.1
    Addresses a double handle closure in AppVEntSubsystems32 or AppVEntSubsystems64.

Known issues

  1. Open Affects: Organizations and IT administrators

    Active Directory Replication

    Active Directory replication can fail when a Windows Server 2025 domain controller with the schema master role has duplicate schema entries. Microsoft says the issue existed since the initial release; recent Exchange Server SE updates exposed it.2

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  2. Open Affects: Organizations and IT administrators

    Directory synchronization (DirSync)

    Apps using DirSync for on-premises Active Directory might not fully sync security groups with more than 10,000 members after the September 2025 security update.3

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

  3. Open Affects: Organizations and IT administrators

    SMBv1 protocol connectivity

    SMBv1 connections to shared files and folders over NetBT might fail if either the client or server has the September 2025 security update.4

    Workaround status No workaround yet

    Microsoft has not published a manual workaround for this issue yet. Monitor release health until a resolving update is available.

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2025-09-22
Classification
Updates
Type
Cumulative update
Restart
Required
Replaces
KB5065426, KB5063878, KB5064489, KB5062553
+10 earlier KB5060842, KB5058411, KB5055523, KB5053598, KB5051987, KB5050009, KB5048667, KB5046617, KB5043080, KB5044284
Replaced by
KB5066835
VersionBuildChannel
2025 26100.6588 General availability

Security

No vulnerabilities are listed for this update.

Updated components

33 files changed since the previous update for the same versions.

Sources

Updated
Cited passages from Microsoft's official notes (4)
  1. 1. Fixed: This update addresses an issue that affects Microsoft Office applications running in Microsoft Application Virtualization (App-V) environments. The failure occurred due to a double handle closure support.microsoft.com
  2. 2. This issue appears to have existed since the initial release of Windows Server 2025, but recent Exchange Server cumulative updates (for Exchange Server SE) have exposed it. support.microsoft.com
  3. 3. After installing September 2025 security update (KB5065426), applications that use the Active Directory directory synchronization (DirSync) control for on-premises Active Directory Domain Services (AD DS), such as when using Microsoft Entra Connect Sync, can result in incomplete synchronization of large AD security groups exceeding 10,000 members. support.microsoft.com
  4. 4. After installing the Windows update released on or after September 9, 2025, you might fail to connect to shared files and folders using the Server Message Block (SMB) v1 protocol on NetBIOS over TCP/IP support.microsoft.com
Checked automatically: 8 of 8 checks passed, 4 quoted passages · compared with Microsoft's page on Oct 20, 2026
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake