Advisories
Microsoft Patch Tuesday September 2026 Breaks Remote Desktop on Windows Server – Quick Fixes
The September 2026 security update for Windows Server and Windows 10/11 has a known bug that crashes Remote Desktop Services (RDS). Admins report RDP sessions timing out, servers hanging at “Please wait for the Remote Desktop Configuration,” and tools like MMC and File Explorer freezing. Microsoft has issued a Group Policy workaround for all affected builds, and a temporary fix involves restarting the VM or rolling back the update—though that removes the new security patches.
Microsoft’s September 2026 Patch Tuesday release has a known issue that breaks Remote Desktop Services (RDS) on Windows Server 2012 and newer, as well as Windows 10 and Windows 11 machines. After applying the updates, admins report that RDP connections fail after a few minutes, servers hang at the “Please wait for the Remote Desktop Configuration” screen, and tools such as MMC, RDS Licensing Diagnoser, and File Explorer become unresponsive.
Symptoms
- RDP sessions time out after several minutes
- Servers stuck in a “Please wait for the Remote Desktop Configuration” loop
- MMC, RDS Licensing Diagnoser, and File Explorer freeze
- Windows Update page hangs with a perpetual loading indicator
- Existing sessions fail to disconnect or log off properly
Mitigation
Microsoft has released a Group Policy setting that can be applied to enterprise‑managed devices to bypass the faulty code. The policy is available for the following builds:
- Windows Server 2012: KB5123065
- Windows Server 2012 R2: KB5123066
- Windows Server 2016: KB5123099
- Windows Server 2019: KB5122876
- Windows Server 2022: KB5122882
- Windows Server 2025: KB5122871
- Windows 10 1809, 21H1, 21H2, 22H2: KB5122878
- Windows 10 1607: KB5123099
- Windows 10 21H2, 22H2: KB5122878
- Windows 11 22H2, 23H2, 24H2, 25H2: KB5122880, KB5124008, KB5124012
IT teams can enable the policy under Computer Configuration → Administrative Templates. For immediate relief, admins can stop and restart the affected virtual machine. Rolling back the update will restore RDS functionality but removes the security fixes included in this month’s Patch Tuesday.
Next Steps
Apply the Group Policy as soon as possible and monitor Microsoft’s advisory for a permanent fix. If you’re running a virtualized environment, consider restarting the VM as a stop‑gap measure while you wait for the official patch.
Microsoft previously fixed a similar RDS issue in March 2025 after installing updates released since January 2025.
Related vulnerabilities
Microsoft Patch Tuesday: 972 CVEs, 113 Critical, 2 Zero‑Day Exploits – Immediate Patching Urgently Needed
Microsoft’s September 2026 Patch Tuesday saw a massive rollout of 972 security fixes, including 113 critical issues and two zero‑day vulnerabilities that have already been leveraged by threat actors. The patches cover a broad range of products, from Windows Server and Office to Azure services. The most dangerous flaws affect remote desktop, SMB, and kernel components, enabling remote code execution and privilege escalation. Organizations must apply the updates without delay, verify integrity, and monitor for suspicious activity. Failure to patch exposes systems to active exploitation and could
Read briefing
Microsoft Patch Tuesday 2026: 972 CVEs, 113 Critical, 2 Exploited Zero‑Days
Microsoft’s September 2026 Patch Tuesday saw the release of 972 security fixes, including 113 critical issues and two zero‑days that had already been weaponized. The updates span Windows, Office, and other key Microsoft products, underscoring the urgency for rapid patch deployment across all environments.
Read briefing
September Windows Server Security Updates Trigger Critical Remote Desktop Deadlocks
Microsoft's September 2026 cumulative updates for Windows Server are causing severe stability issues across Remote Desktop Services. System administrators report that installations on Windows Server 2019, 2022, and 2025 lead to frozen RDP sessions, failed logins, and full system hangs requiring hard reboots. Preliminary technical analysis points to a service deadlock during user logouts. While Microsoft is actively investigating, removing the updates restores functionality at the cost of leaving systems exposed to unpatched security vulnerabilities.
Read briefing
Microsoft Unleashes 972 CVE Fixes on Patch Tuesday, Including 2 Exploited Zero‑Days and 113 Critical Flaws
Microsoft’s September 2026 Patch Tuesday update tackles 972 CVEs—two of which are actively exploited zero‑days and 113 critical vulnerabilities. The patch covers Windows, Office, and other Microsoft components, tightening defenses across the ecosystem. Security teams should apply the fixes immediately and monitor for any lingering exploitation attempts.
Read briefing