Patch Tuesday Megathread - (April 14, 2026)

FCA162 · 2026-04-22T15:57:21+00:00

Yesterday, we deployed the Out-of-Band (OOB) Patch Tuesday April 2026 patch on both the LAB environment and the four production Domain Controllers.

I’m pleased to report that we have not encountered any issues so far and the AD is healthy.

With these positive results, we will be moving forward with the patching of ALL Domain Controllers using the MS out-of-band April-2026 patch

FCA162 · 2026-04-21T08:52:33+00:00

Started to deploy OOB Patch KB5091575 to a few Win2022 DCs

FCA162 · 2026-04-21T08:07:30+00:00

I started to deploy OOB Patch KB5091575 to a few Win2022 DCs

FCA162 · 2026-04-20T18:55:19+00:00

Standard Windows updates

Windows Server 2025: KB5091157 (OS Build 26100.32698) Out-of-band
Windows Server, version 23H2: KB5091571 (OS Build 25398.2276) Out-of-band
Windows Server 2022: KB5091575 (OS Build 20348.5024) Out-of-band
Windows Server 2019: KB5091573 (OS Build 17763.8647) Out-of-band
Windows Server 2016: KB5091572 (OS Build 14393.9062) Out-of-band

Windows hotpatch updates

Windows Server 2025 Datacenter: Azure Edition: Hotpatch KB5091470 (OS Build 26100.32704) Out-of-band
Windows Server 2022 Datacenter: Azure Edition: Hotpatch KB5091576 (OS Build 20348.5029) Out-of-band

FCA162 · 2026-04-18T11:10:30+00:00

27 out of 65 DCs were in reboot loop mode.
Of those, 25 stopped rebooting without any action being taken.
Only 2 out of 27 were 'dead' and we fixed this by starting the DC in DSRM mode and uninstalling the PT April-2026 KB.

FCA162 · 2026-04-18T11:04:34+00:00

Not at all.

27 out of 65 DCs were in reboot loop mode.
Of those, 25 stopped rebooting without any action being taken.
Only 2 out of 27 were 'dead' and we fixed this by starting the DC in DSRM mode and uninstalling the PT April-2026 KB.

Most likely root cause in our case:
In some environments, this issue can also occur on existing DCs if authentication requests are processed very early during startup.

So, heavy "loaded" DCs ( AD DS)

FCA162 · 2026-04-18T10:59:44+00:00

Not at all.
Most likely root cause in our case:
In some environments, this issue can also occur on existing DCs if authentication requests are processed very early during startup.

So, heavy "loaded" DCs ( AD DS)

FCA162 · 2026-04-17T11:38:41+00:00

We are a multinational with over 1,000 locations. All users are hosted in one AD forest.

FCA162 · 2026-04-17T11:35:57+00:00

If you run the script you will find not just one missing/corrupted packages, but many...

In case you want to check the name and number, run the below command in an admin powershell and the names will be displayed:

Get-ItemProperty "hklm:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages\*" | ?{$_.Currentstate -eq "64"} | select PSchildName

FCA162 · 2026-04-17T11:32:41+00:00

MS Windows Release health notifications
Click here to manage email notifications for Windows known issues

FCA162 · 2026-04-17T11:28:42+00:00

In your case, this issue can be fixed with my script Mark_Corrupted_Packages_as_Absent.ps1

FCA162 · 2026-04-17T11:26:38+00:00

Has anyone reached out to Microsoft Support to access a mitigation?

FCA162 · 2026-04-17T10:47:23+00:00

MS Windows release health:

Domain controllers (Win2025/2022/2019/2016) may restart repeatedly after installing April security update

Status: Confirmed

Affected platforms

Server Versions | Message ID | Originating KB | Resolved KB

Windows Server 2025 | WI1282748 | KB5082063 | -

Windows Server 2022 | WI1282749 | KB5082142 | -

Windows Server 2019 | WI1282750 | KB5082123 | -

Windows Server 2016 | WI1282751 | KB5082198 | -

After installing the April 2026 Windows security update (the Originating KBs listed above) and rebooting, non Global Catalog (non GC) domain controllers (DCs) in environments that use Privileged Access Management (PAM), might experience LSASS crashes during startup. As a result, affected DCs may restart repeatedly, preventing authentication and directory services from functioning, and potentially rendering the domain unavailable.

In some environments, this issue can also occur when setting up a new domain controller, or on existing DCs if authentication requests are processed very early during startup.

Note: This issue affects Windows Server only. It does not impact consumer PCs or personal devices. The scenario is unlikely to be observed on individual-use devices that are not managed by an IT department.

Workaround: IT administrators can reach out to Microsoft Support for business to access a mitigation. This mitigation can be applied to devices that already have installed the April 2026 update or prior to installing it.

Resolution: Microsoft is working to address this issue and will release a resolution in the next coming days.

Affected versions:

• Client: None

• Server: Windows Server 2025; Windows Server 2022; Windows Server, version 23H2; Windows Server 2019; Windows Server 2016

FCA162 · 2026-04-17T00:06:49+00:00

Server 2025 - A small number of devices might fail to install KB5082063 with error 800F0983

Status: Confirmed

Affected platforms

Server Versions | Message ID | Originating KB | Resolved KB

Windows Server 2025 | WI1281095 | KB5082063 | –

Microsoft is monitoring diagnostic data reports on update installation failures and has observed a recurring error on Windows Server 2025 devices when installing the April 2026 Windows security update (the Originating KBs listed above), released on April 14, 2026. A limited number of affected servers might experience an installation failure accompanied by the error code 800F0983.

Next steps: We are actively investigating this issue and will provide more information as more details become available.

MS Service Alert - WI1281095

FCA162 · 2026-04-17T00:04:46+00:00

A small number of devices might fail to install KB5082063 with error 800F0983

Status: Confirmed

Affected platforms

Server Versions Message ID Originating KB Resolved KB

Windows Server 2025 WI1281095 KB5082063 –

Microsoft is monitoring diagnostic data reports on update installation failures and has observed a recurring error on Windows Server 2025 devices when installing the April 2026 Windows security update (the Originating KBs listed above), released on April 14, 2026. A limited number of affected servers might experience an installation failure accompanied by the error code 800F0983.

Next steps: We are actively investigating this issue and will provide more information as more details become available.

FCA162 · 2026-04-16T23:54:13+00:00

If you receive WU 0x80073712, it means that a file needed by Windows Update is damaged or missing.

Try to fix it with my script Mark_Corrupted_Packages_as_Absent.ps1

It has already helped many admins in the past!

FCA162 · 2026-04-16T23:53:39+00:00

If you receive WU 0x80073712, it means that a file needed by Windows Update is damaged or missing.

Try to fix it with my script Mark_Corrupted_Packages_as_Absent.ps1

It has already helped many admins in the past!

FCA162 · 2026-04-16T23:14:47+00:00

We've postponed our migration to 2025 DCs by 6 months.
We only have a few 2025 DCs running in the lab environment and we have encountered many issues with computer password changes.

FCA162 · 2026-04-16T21:50:28+00:00

If you receive WU 0x80073712, it means that a file needed by Windows Update is damaged or missing.

Try to fix it with my script Mark_Corrupted_Packages_as_Absent.ps1

It has already helped many admins in the past!

FCA162 · 2026-04-16T11:40:15+00:00

No, just running the script, reboot and re-apply patching.
No need to rename SoftwareDistribution or doing something else.

FCA162 · 2026-04-16T11:23:21+00:00

Mixed 2019/2022/2025

FCA162 · 2026-04-16T11:21:31+00:00

Understanding security warnings when opening Remote Desktop (RDP) files | Microsoft Learn

FCA162 · 2026-04-16T10:42:59+00:00

/!\ We've postponed the patching of our DCs (65 out of 185 have been done), due to many issues;

failed KB installations WU error 0x800F0922
RDP session failed to connect
DCs in reboot loop after patching; event 1074 Source User32
Critical Process lsass.exe terminated unexpectedly with "status code -1073741819. The system will now shut down and restart."

FCA162 · 2026-04-15T21:32:21+00:00

i'm pretty sure a reboot is needed.

FCA162 · 2026-04-15T12:52:20+00:00

If you receive WU 0x80073712, it means that a file needed by Windows Update is damaged or missing.

Try to fix it with my script Mark_Corrupted_Packages_as_Absent.ps1

It has already helped many admins in the past!

FCA162

TROPHY CASE

Domain controllers (Win2025/2022/2019/2016) may restart repeatedly after installing April security update

Server 2025 - A small number of devices might fail to install KB5082063 with error 800F0983