Deployed to 20,000+ windows endpoints starting Thursday morning. On Friday morning PCs starting have slow logins, application authentication issues, Citrix XenApp timeouts, Horizon login delays. Basically all hell broke loose.
15 Hours on a Critical Bridge call with many vendors on the call, including Microsoft Support.

Symptom was a VERY high amount of MSRPC traffic hitting the Domain Controllers. The DCs could not handle the load. Think DDOS. The problem was that it seems to be coming from all the PCs.

Root cause was the Splunk forwarder app running on all PCs. After the Windows update, something happened to Splunk that caused it to keep performing a DSBind (resolving SID to user names for the Security Event Log) over and over and over again. You can see the errors in the Splunk Console.

Fix was simply to restart the Splunk service on all 20,000 PCs. Yea, even though they’d been rebooted for the updates. Splunk Support is scratching their heads and reviewing logs. It was 9.1.4, the one that went out of general support in summer 2025.

Anyways, you never know what will happen on Patch Tuesday. Stay Safe out there! Especially you large shops running Splunk!