The Update BureauKB5082198: Cumulative update for Windows Server, version 2016, April 2026. Remote Desktop files get safer defaults; Secure Boot coverage expands
Remote Desktop shows requested connection settings before opening an .rdp file, and Secure Boot certificate targeting expands. The update also changes WDS, Kerberos, and WinCS behavior.
Does it affect you? Applies to: This update applies to Windows Server 2016.
Review notes Additional details from the official release notes (1) Read note
- Known issues On some devices using monitors with different display scaling, Remote Desktop security warnings might show overlapping text or hidden buttons. Windows updates released on and after May 12, 2026 resolve this issue.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Improvements 3 changes
Remote Desktop
For: devices opening .rdp files
-
Before an .rdp file connects, Remote Desktop shows its requested connection settings, with each setting off by default. A one-time security warning appears the first time an .rdp file is opened on a device.1
Improves protection against phishing attacks that use Remote Desktop (.rdp) files.
Kerberos protocol
For: domain environments
-
Kerberos uses AES-SHA1 by default for accounts without an explicit encryption-types setting.2
Changes the default
DefaultDomainSupportedEncTypesvalue for KDC operations when an account has no explicitmsds-SupportedEncryptionTypesActive Directory attribute.
Secure Boot
-
More eligible devices can be targeted to receive new Secure Boot certificates automatically, but certificates are delivered only after sufficient successful update signals.3
Adds high-confidence device-targeting data to Windows quality updates for a controlled, phased rollout of new Secure Boot certificates.
Fix 1 change
Windows Configuration System (WinCS)
-
Secure Boot can be turned on through WinCS again when its components are present.4
Addresses missing Windows Configuration System (WinCS) components on Windows Server 2016 and Windows 10, version 1607.
Removal 1 change
Windows Deployment Services (WDS)
For: IT administrators using WDS
- WDS Hands-Free Deployment is disabled by default and is no longer supported.5
Known issues
-
Domain controllers might restart repeatedly after installing this update
Domain controllers in forests with multiple domains that use Privileged Access Management (PAM) might experience LSASS crashes during startup and restart repeatedly, disrupting authentication and directory services. KB5091572 addresses the issue.6
Resolution Fixed in KB5091572Install KB5091572 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-14
- Classification
- Security Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5078938, KB5075999, KB5073722, KB5074974
- Replaced by
- KB5091572
| Version | Build | Channel |
|---|---|---|
| 2016 | 14393.9060 | General availability |
Security
| Vulnerability | Severity | CVSS |
|---|---|---|
|
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
|
Critical | 9.8 |
|
Windows TCP/IP Remote Code Execution Vulnerability
|
Critical | 8.1 |
|
Windows Active Directory Remote Code Execution Vulnerability
|
Critical | 8.0 |
The table lists the 3 exploited, publicly disclosed or critical vulnerabilities. See all 88 vulnerabilities →
Downloads (Microsoft Update Catalog)
Updated components
705 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Graphics and display | 10 |
| Secure Boot | 8 |
| Hyper-V and virtualization | 7 |
| Networking | 7 |
| WCF | 7 |
| File Explorer and shell | 6 |
| Security and sign-in | 6 |
| Kernel | 5 |
| Settings | 5 |
| Search | 4 |
| Remote Desktop | 2 |
| Storage and file systems | 2 |
Verified in package: changed files confirm Remote Desktop, Secure Boot, Windows Configuration System (WinCS).
Sources
Cited passages from Microsoft's official notes (6)
-
1.
When you open an .rdp file, Remote Desktop shows all requested connection settings before it connects, with each setting turned off by default.
support.microsoft.com -
2.
This update changes the default DefaultDomainSupportedEncTypes value for Kerberos Key Distribution Center (KDC) operations to leverage AES-SHA1 for accounts that do not have an explicit msds-SupportedEncryptionTypes Active Directory attribute defined.
support.microsoft.com -
3.
Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout.
support.microsoft.com -
4.
This update addresses an issue that affects Windows Configuration System (WinCS) on Windows 10, version 1607 and Windows Server 2016. Some WinCS components were missing.
support.microsoft.com -
5.
This update disables the “Hands-Free Deployment” feature in WDS by default and is no longer a supported feature.
support.microsoft.com -
6.
This issue is addressed in out-of-band update KB5091572.
support.microsoft.com
Checked automatically: 7 of 8 checks passed, 6 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: not passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake