Remote Desktop hangs
after the September patches: the fix

Updated on 14 October 2026

The symptom

The session host works normally for a few hours, then stops accepting new connections. Open sessions do not close, qwinsta does not respond and the administration tools hang. Microsoft describes the same effects: RDP connections failing after a few minutes, sign-ins that do not complete, servers stuck at “Please wait for the Remote Desktop Configuration”, Microsoft Management Console, RDS Licensing Diagnoser and File Explorer becoming unresponsive, and the Windows Update page spinning indefinitely.

The detail that matters for anyone running a production environment: the defect is triggered by closing sessions. It therefore shows up during working hours, when users sign in and out, and not during idle periods. A server that spends a quiet night can hang twice in the same working day.

The cause and the timeline

It is a regression introduced by the cumulative security updates of 8 September 2026, the month’s Patch Tuesday. It affects every supported version of Windows Server and Windows 10 and 11 clients with Remote Desktop enabled. The sequence of the following days explains why many administrators were left without a clean solution for almost a week.

• 18 September. The cumulative updates are released. Within hours the first session hosts start hanging.
• 211 September, evening. Microsoft opens the known issue on Windows release health with status “Mitigated”. The suggested workaround is to deallocate and restart the virtual machine: not a fix, a way to buy a few hours. The same day the Known Issue Rollback is packaged, recognisable by the timestamp in the file name, but it is not linked from the KB page or from the dashboard. We found it through Citrix advisory CTX697101.
• 314 September, 10:00 Pacific Time. Microsoft releases the out-of-band updates and moves the issue to “Resolved”. For Windows Server they are available only in the Microsoft Update Catalog; for Windows 11 24H2, 25H2 and 26H1 they also arrive through Windows Update and WSUS. The same out-of-band update also fixes a Hyper-V defect with folders shared to Linux virtual machines and, only partly, one affecting multichannel USB audio devices.
• 422 September. The optional Windows 11 previews are released (KB5124010 for 24H2, 25H2 and 26H2, KB5124006 for 26H1): they are cumulative and already contain the fix. Nothing new is released for Windows Server.
• 513 October. October Patch Tuesday: the cumulative updates KB5126646 (Server 2025), KB5126655 (Server 2022), KB5126651 (Server 2019) and KB5126868 (Server 2016) include the fix and arrive through Windows Update and WSUS; the KB articles list no known issue on Remote Desktop. For Windows Server 2022 it is also the last update of mainstream support.

What to do today

The right path is to install the 13 October cumulative update, which contains the fix and arrives through Windows Update and WSUS; anyone who cannot wait for the monthly cycle installs the out-of-band update for their version. Four points to keep in mind:

• On servers, look for it in the Microsoft Update Catalog using the KB number from the table above: Windows Update does not offer it and WSUS does not synchronise it, so in managed environments it has to be imported into WSUS by hand or deployed with Configuration Manager or Intune. On Windows 11 24H2, 25H2 and 26H1 clients it arrives through Windows Update and WSUS like any other update; on 23H2 it has to be installed from the optional updates in Windows Update or imported from the Catalog.
• It is cumulative. It contains every security fix from the September Patch Tuesday plus the updated servicing stack. Anyone who has not yet installed the 8 September update can install the out-of-band update directly and skip the faulty step.
• If the Known Issue Rollback is already active, Microsoft confirms that nothing needs to be done before installing. After the restart, set the policy back to Not configured and remove the MSI: KIR definitions have a limited lifespan and should not stay in the policies.
• Restart and verify with real users. The defect is triggered by closing sessions: it does not show up on an idle machine, so a server that survives the night proves nothing. It takes a full working day.

If the server is already hung

A hung machine does not accept connections even from administrators: the Remote Desktop service does not respond to anyone, administrative session included. It cannot be fixed remotely over RDP.

• 1Go in through the console. The virtual machine console in Hyper-V, VMware or Proxmox; the serial console or a restart from the portal for a machine in Azure; the server’s remote management console (iLO, iDRAC, IPMI) for a physical server.
• 2Restart the machine. The restart unlocks it, but does not fix it.
• 3Right after, install the patch. Before users log back in, install the out-of-band update or, if you cannot, apply the Known Issue Rollback described below. Without a fix the hang comes back with the first round of closed sessions.

If the installation looks stuck

On servers the package is heavy: around 560 MB for Windows Server 2022, because besides the cumulative update it contains servicing stack update KB5122881. Installed as an MSU downloaded from the Catalog it works for a long time before showing any progress, and on restart it goes through several “Working on updates” phases where the percentage sits still for minutes. That is the normal behaviour of a package combining a servicing stack update and a cumulative update, not a hang.

To find out whether it is still working, open a second session and follow the Component Based Servicing log: if it is writing, the installation is progressing.

Get-Content C:\Windows\Logs\CBS\CBS.log -Tail 20 -Wait

A second signal is CPU usage by the TiWorker and TrustedInstaller processes. Treat it as a real problem only if the log stays frozen for half an hour and those processes are at zero. In the meantime do not close the installer window, do not force a restart and do not power off the machine: interrupting a servicing stack update halfway is the quickest way to end up repairing the component store.

After the restart, confirm you reached the right build. On Windows Server 2022 you should read 20348 and 5631.

(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion') |
  Select-Object CurrentBuild, UBR

If you cannot install the out-of-band update right away: the Known Issue Rollback

The Known Issue Rollback (KIR) is the mechanism Microsoft uses to switch off a single faulty change without uninstalling the update, which stays in production with all its security fixes. For organisations it comes as an MSI package that adds a Group Policy setting. It is the right choice when the out-of-band update has to go through a maintenance window or a test cycle and the server has to stay up in the meantime. For Windows Server 2022 the package is KB5122882_260911_1847_1_KnownIssueRollback.msi.

• 1Download the package for your version and verify the signature before installing it. It must return Valid with signer CN=Microsoft Corporation; otherwise do not install it.

Get-AuthenticodeSignature .\KB5122882_260911_1847_1_KnownIssueRollback.msi | fl Status, SignerCertificate

• 2Install the MSI. It changes nothing in the system: it only copies the ADMX and ADML files into C:\Windows\PolicyDefinitions. If you use a Central Store for domain policies, copy the two files there.
• 3Set the policy to Disabled. Open the Local Group Policy Editor, or create the domain GPO, and under Computer Configuration, Administrative Templates find the Known Issue Rollback entry with the KB number. It must be set to Disabled, not Enabled: disabling the policy means disabling the faulty change, which is the rollback. There is a lot of wrong advice about this point.
• 4Restart. Without a restart the change has no effect.

Alternative without the MSI, with a warning

The policy does nothing more than write a DWORD value in the registry. It can be written directly, but only on Windows Server 2022 build 20348.5622, because the numeric identifier of the override changes from build to build:

$k = 'HKLM:\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides'
New-ItemProperty -Path $k -Name '1300465806' -Value 0 -PropertyType DWord -Force

Then restart. On any other build, install the MSI and read the identifier inside the matching ADMX file instead of copying the one shown here. The identifier 1501792398 circulating in forums is not the Server 2022 one.

Verification and rollback

After the restart the value must be present under the FeatureManagement\Overrides key. That is not the effectiveness check, though: that requires a full working day with real users opening and closing sessions. On an idle machine the defect is not triggered and the result is meaningless.

To go back, delete the registry value or set the policy back to Not configured, and restart. It is also the step to take, calmly, after installing the out-of-band update.

Other open September issues

The September updates have other known issues that are still open, and Microsoft lists them in the out-of-band articles too. They are not the Remote Desktop hang, but they can be mistaken for it:

• Black screen after sign-in on Azure Virtual Desktop with FSLogix. It affects Windows 11 24H2, 25H2, 26H1 and 26H2 from the 27 August preview (KB5120998) onwards; opened on 25 September, Microsoft mitigated it with its own Known Issue Rollback. It is a different issue from this one.
• USB audio. Since 25 September Microsoft considers the USB Audio Class 1.0 defect only partly resolved: the out-of-band update fixed multichannel audio, but Code 10 errors, no audio and unresponsive volume settings remain, on clients and servers.
• File History. It can stop working and ask you to reconnect the drive. There is no fix yet.
• Credential Guard. On Windows 11 24H2 and later it can break the trust relationship with the domain; Microsoft gives a workaround through the registry or policies and repair of the secure channel. It does not affect servers.

From the field

We applied the Known Issue Rollback on 14 September at 15:02 Italian time on a Windows Server 2022 session host that was hanging twice a day, in the middle of working hours. As of 17 September, after three full working days with users signing in and out, not a single hang has recurred: on a machine that was hanging twice a day, that is solid data, not an impression. Four hours after we applied it, Microsoft published the out-of-band update, which we are now installing across the affected servers: where the policy is active, you install the update first and remove the policy after the restart.

The detail no guide mentions: the package works for a very long time before showing any sign of progress, and the Component Based Servicing log is the only reliable way to tell a slow installation from a stuck one. It is worth opening it before you start worrying.

The lesson, for anyone running virtualised servers and Remote Desktop environments, is always the same: Patch Tuesday has to be installed, but with an observation window and a rollback plan ready in advance. The KIR exists precisely for this, provided you know where to find it and how it is activated. It is the kind of work we cover with our support and operations service.