The Update BureauKB5091573: Cumulative update for Windows Server, version 2019, April 2026. Fixes startup failures on multi-domain PAM domain controllers
Fixes startup problems on multi-domain domain controllers that use Privileged Access Management after installing the April 14 update. It is available only from the Microsoft Update Catalog.
Does it affect you? Applies to: Devices running Windows Server 2019.
Review notes Additional details from the official release notes (1) Read note
- In detail If Secure Boot certificates are not updated in time, certain personal and business devices might not be able to boot securely.
The official sources are linked at the end of the page.
Microsoft publishes separate notes for this KB for Windows 10.
What changes
Fix 1 change
Domain controllers (known issue)
For: Domain controllers in multi-domain forests using PAM
-
Startup problems are fixed for domain controllers in multi-domain forests that use Privileged Access Management and might have been affected after installing KB5082123 and restarting.1
The issue could cause LSASS to stop responding, repeated restarts, and authentication and directory services to become unavailable.
Improvement 1 change
Servicing stack
For: Azure-hosted devices
-
The included servicing stack update improves verification of whether a device is hosted on Azure.2
The SSU uses an updated certificate chain for validation.
Known issues
-
Remote Desktop security warnings might not display correctly
Remote Desktop security warnings might display overlapping text or partially hidden buttons when opening RDP files, particularly with multiple monitors using different display scaling. This issue is resolved by updates released on and after May 12, 2026, including KB5087538.3
Resolution Fixed in KB5087538Install KB5087538 (or a later cumulative update) on affected devices. No manual workaround is required after updating.
Technical details
Data sheet · Security · Downloads · Components Click to collapse or expand
Data sheet
- Released
- 2026-04-19
- Classification
- Updates
- Type
- Cumulative update
- Restart
- Required
- Replaces
- KB5082123, KB5078752, KB5075904, KB5078131
- Replaced by
- KB5087538
| Version | Build | Channel |
|---|---|---|
| 2019 | 17763.8647 | General availability |
Security
No vulnerabilities are listed for this update.
Downloads (Microsoft Update Catalog)
Updated components
17 files changed since the previous update for the same versions.
| Top changed components | Files |
|---|---|
| Secure Boot | 3 |
| Remote Desktop | 2 |
| Security and sign-in | 1 |
Sources
Cited passages from Microsoft's official notes (3)
-
1.
Fixed: After installing the April 14, 2026, (KB5082123) Windows security update and restarting, domain controllers with multi-domain forests that use Privileged Access Management (PAM)
support.microsoft.com -
2.
This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation.
support.microsoft.com -
3.
This issue is resolved in Windows updates released on and after May 12, 2026 (such as KB5087538).
support.microsoft.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages · compared with Microsoft's page on Sep 25, 2026
- Quotes found in the official pages: passed
- Numbers found in the sources: passed
- Vulnerabilities from the dossier only: passed
- Links to allowed domains only: passed
- Every official change covered: passed
- Readable plain text: passed
- Changes confirmed by the file list: passed
- Sources agree: passed
A second AI read the text against the sources: correctness 5/5, clarity 4/5, completeness 4/5. How we work
Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake