Microsoft's September 8 security updates, KB5124008 for Windows 11 24H2 and 25H2 and KB5124012 for 26H1, fixed August's Teams and Outlook crashes on ARM PCs and then broke Remote Desktop badly enough that Microsoft shipped an out-of-band fix six days later (KB5129195 and KB5129194). Here is every issue Microsoft has confirmed for the August and September updates, the exact symptom, and the KB that resolves it, with a source and a date on every claim. Current builds as of this update: 26200.9457 (25H2) and 26100.9457 (24H2) after the out-of-band update, 28000.2956 (26H1).
After the September 8, 2026 security update (KB5124008 on 24H2 and 25H2, KB5124012 on 26H1), Remote Desktop Services can become unstable: RDP connections fail after several minutes, sign-ins fail, and servers hang at "Please wait for the Remote Desktop Configuration". Microsoft Management Console, the RDS Licensing Diagnoser, File Explorer, and even the Windows Update page can stop responding on the affected machine.
Microsoft opened the issue on September 11 and resolved it with out-of-band updates on September 14: KB5129195 for Windows 11 24H2 and 25H2, KB5129194 for 26H1, and KB5129241 for devices enrolled in hotpatching. The affected list covers every supported Windows client and Windows Server 2012 through 2025; Windows 365 and Azure Virtual Desktop are not affected.
A regression in the September cumulative update's Remote Desktop components. Microsoft has not published a deeper root cause; the fix is the out-of-band update, which is cumulative and carries all of September's security protections plus a fix for CVE-2026-62721, a User-Mode Power Service elevation-of-privilege vulnerability.
winver. 25H2 should show 26200.9457, 24H2 26100.9457, 26H1 28000.2956 or later.After the August 11, 2026 security updates (KB5121003 on 24H2 and 25H2, KB5121000 on 26H1), Microsoft Teams and the new Outlook for Windows fail to launch or close unexpectedly on ARM-based PCs such as the Surface Pro 11 and Surface Laptop 7. Classic Outlook, Word, Excel, and other apps are not affected. Microsoft says the failure is most likely on new or freshly imaged PCs that have not yet installed any Microsoft Store updates, which is exactly the state of a laptop you just unboxed for a new hire.
After KB5124008 (and KB5124012 on 26H1), some USB Audio Class 1.0 devices fail to start or produce no audio. Symptoms Microsoft lists: "This device cannot start (Code 10)" in Device Manager, no output, volume controls stuck at zero or unresponsive, Sound settings that will not open, and devices that work in stereo but fail in 8-channel or 3D audio modes. The issue is limited to USB Audio Class 1.0 devices, which describes a lot of older headsets, USB speakerphones, and DACs still sitting on small-office desks. It affects every supported Windows client and Windows Server 2012 through 2025.
usbaudio.sys is the tell. Devices with vendor drivers are not in scope.After the August 11, 2026 .NET Framework cumulative updates (KB5120710 on Windows 11 24H2, KB5120708 on 25H2, KB5120713 on 23H2, KB5120705 on Windows Server 2022, and the matching packages for Windows 10 and Server 2019), applications built on Windows Presentation Foundation fail with a System.IO.FileFormatException when printing or generating PDF or XPS output that uses certain fonts, Calibri among them.
That is not Word or Edge; it is the line-of-business software small businesses print from every day, invoicing, reporting, and practice-management apps. BleepingComputer's readers named a veterinary practice system whose report printing broke, and Crystal Reports-based tools share the same pipeline.
Switch.MS.Internal.TtfDelta.DisableCmapAndSbitOverflowProtection=true, added to the application's .exe.config file under the runtime element. It disables security protections from the August update, so remove it once the September .NET update is on.From late August 2026, Windows and Windows Server machines running the latest Defender Antivirus updates showed notifications that Defender is turned off, at startup and intermittently afterward, while every setting reported it active. The notifications persisted even with notifications disabled. Microsoft confirmed the antivirus was working the whole time and resolved it in the Defender Antivirus platform update version 4.18.26080.4 on September 17, 2026.
After KB5124008 (or KB5124012) and later updates, some domain-joined Windows 11 PCs lose their secure channel with an on-premises Active Directory domain. Users cannot sign in with valid domain credentials and see the trust relationship error; cached sign-in may still work, and the domain controllers themselves are fine.
The trigger is narrow: the update makes Windows honor an existing Machine Identity Isolation setting, a Credential Guard feature that is only supported when the domain controllers run at the Windows Server 2025 functional level. If nobody in your office has turned that feature on, this does not apply to you. If a consultant enabled it on a Server 2019 or 2022 domain, it does.
MachineIdentityIsolation value under HKLM\SYSTEM\CurrentControlSet\Control\Lsa or HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard, changed from 2 to 0. Back up the registry first.Test-ComputerSecureChannel -Repair -Credential (Get-Credential), entering domain admin credentials when prompted.The optional August 27 preview update KB5120998 caused two cosmetic but alarming failures on 24H2 and 25H2: desktop backgrounds reverting to solid black, with slideshow and contrast settings possibly affected, and mouse cursor customizations reverting on non-English Windows installations. Setting them again did not stick, because the bug stopped the values loading at all. Both were resolved by KB5124008 on September 8.
Buried in the KB5124008 release notes: Windows 11, version 24H2 Home and Pro editions reach end of updates on October 13, 2026. After that they receive no security updates, no fixes for known issues, and no support; Enterprise and Education editions of 24H2 run until October 12, 2027.
On the same day, the first year of the commercial Windows 10 Extended Security Updates program ends. Businesses that bought ESU year one and have not bought year two stop receiving Windows 10 security updates on October 13; consumer ESU enrollments were quietly extended to October 12, 2027, but that extension does not apply to the commercial program.
winver. If it says version 24H2, open Settings, Windows Update, and install Windows 11, version 25H2. It is an enablement package on 24H2, so it installs like a monthly update and restarts once. If 25H2 is not offered, the PC is under a safeguard hold; it will appear when the hold clears, and the hold is listed on Microsoft's release health page.Yes, with the September 14 out-of-band update KB5129195 alongside it. KB5124008 fixes August's Teams and Outlook crashes on ARM PCs and the black-desktop bug, and it carries September's security fixes. Its own regressions, Remote Desktop instability and multichannel USB audio failures, are fixed by KB5129195, available through Windows Update and the Microsoft Update Catalog.
The September 14, 2026 out-of-band cumulative update for Windows 11 24H2 and 25H2 (builds 26100.9457 and 26200.9457). It resolves the Remote Desktop Services instability introduced by KB5124008, fixes Plan9 folder sharing for WSL and Hyper-V Linux VMs, fixes 8-channel and 3D USB audio modes, and adds protection for CVE-2026-62721. KB5129194 is the same fix for Windows 11 26H1, and KB5129241 is the hotpatch version.
The August 2026 security updates broke Teams and the new Outlook on ARM-based PCs, mostly new or freshly imaged ones that had not run Microsoft Store updates yet. Install the September 8 update (KB5124008) or later, or update the Auto Super Resolution Package from the Microsoft Store as a workaround.
The August 2026 .NET Framework update broke printing and PDF export in WPF-based applications that use fonts like Calibri, throwing System.IO.FileFormatException. The September 2026 .NET Framework cumulative update fixes it; install it through Windows Update and check Update history to confirm.
If any PC runs Windows 11 24H2 Home or Pro, move it to 25H2 through Windows Update before October 13, when 24H2 Home and Pro stop receiving updates. If any PC runs Windows 10 under the business Extended Security Updates program, year one ends the same day; buy year two or replace the PC.
Three honest exclusions. If Remote Desktop fails from every client to a machine that has the September 14 out-of-band update installed, look at the network or the VPN before Windows.
If one user cannot sign in and the domain trust message is absent, it is far more likely a lapsed license, an MFA change, or a lockout than anything on this page, so check whether Microsoft 365 is down and the account before the PC. And a PC that started crashing across every application after an update usually has a failing drive or bad memory; the update just made it visible.
Everything on this page is work Anthony AI performs autonomously through Vision remote support, inside the Microsoft Teams chat your company already uses: checking the build, installing the out-of-band update, confirming the .NET package landed, moving a 24H2 PC to 25H2. You paste a one-time code generated on your own PC, you watch every click and keystroke live, every action is logged back to the chat, and the session caps at 20 minutes. Windows and macOS parity, so the same chat covers the office Macs too.
Pricing: Core is $24.99 per seat per month with 200 chats and 20 Vision minutes ($0.99 per minute after). Pro is $49.99 per seat per month with 400 chats and 60 Vision minutes ($0.89 per minute after). Every new user starts with 25 chats and 10 Vision minutes free, no credit card. Details on the pricing page.
Start free: 25 chats and 10 Vision minutes, no credit card. No contract. Cancel anytime.
Get Anthony AIMore fixes in the fix library · On a Mac? See the macOS 27 Golden Gate guide · Not sure if Microsoft 365 is down or it's just you · See what IT support costs in 2026 · How Vision remote support works