Remote Desktop hangs
after the September patches: the fix

The symptom

The session host works normally for a few hours, then stops accepting new connections. Open sessions do not close, qwinsta does not respond and the administration tools hang. Microsoft describes the same effects: RDP connections failing after a few minutes, sign-ins that do not complete, servers stuck at “Please wait for the Remote Desktop Configuration”, Microsoft Management Console, RDS Licensing Diagnoser and File Explorer becoming unresponsive, and the Windows Update page spinning indefinitely.

The detail that matters for anyone running a production environment: the defect is triggered by closing sessions. It therefore shows up during working hours, when users sign in and out, and not during idle periods. A server that spends a quiet night can hang twice in the same working day.

The cause and the timeline

It is a regression introduced by the cumulative security updates of 8 September 2026, the month’s Patch Tuesday. It affects every supported version of Windows Server and Windows 10 and 11 clients with Remote Desktop enabled. The sequence of the following days explains why many administrators were left without a clean solution for almost a week.

• 18 September. The cumulative updates are released. Within hours the first session hosts start hanging.
• 211 September, evening. Microsoft opens the known issue on Windows release health with status “Mitigated”. The suggested workaround is to deallocate and restart the virtual machine: not a fix, a way to buy a few hours. The same day the Known Issue Rollback is packaged, recognisable by the timestamp in the file name, but it is not linked from the KB page or from the dashboard. We found it through Citrix advisory CTX697101.
• 314 September, 10:00 Pacific Time. Microsoft releases the out-of-band updates and moves the issue to “Resolved”. Available only in the Microsoft Update Catalog.

What to do today

The right path is to install the out-of-band update for your version. Four points to keep in mind:

• Look for it in the Microsoft Update Catalog using the KB number from the table above. Windows Update does not offer it and WSUS does not synchronise it: in managed environments it has to be imported into WSUS by hand or deployed with Configuration Manager or Intune.
• It is cumulative. It contains every security fix from the September Patch Tuesday plus the updated servicing stack. Anyone who has not yet installed the 8 September update can install the out-of-band update directly and skip the faulty step.
• If the Known Issue Rollback is already active, Microsoft confirms that nothing needs to be done before installing. After the restart, set the policy back to Not configured and remove the MSI: KIR definitions have a limited lifespan and should not stay in the policies.
• Restart and verify with real users. The defect is triggered by closing sessions: it does not show up on an idle machine, so a server that survives the night proves nothing. It takes a full working day.

If you cannot install the out-of-band update right away: the Known Issue Rollback

The Known Issue Rollback (KIR) is the mechanism Microsoft uses to switch off a single faulty change without uninstalling the update, which stays in production with all its security fixes. For organisations it comes as an MSI package that adds a Group Policy setting. It is the right choice when the out-of-band update has to go through a maintenance window or a test cycle and the server has to stay up in the meantime. For Windows Server 2022 the package is KB5122882_260911_1847_1_KnownIssueRollback.msi.

• 1Download the package for your version and verify the signature before installing it. It must return Valid with signer CN=Microsoft Corporation; otherwise do not install it.

Get-AuthenticodeSignature .\KB5122882_260911_1847_1_KnownIssueRollback.msi | fl Status, SignerCertificate

• 2Install the MSI. It changes nothing in the system: it only copies the ADMX and ADML files into C:\Windows\PolicyDefinitions. If you use a Central Store for domain policies, copy the two files there.
• 3Set the policy to Disabled. Open the Local Group Policy Editor, or create the domain GPO, and under Computer Configuration, Administrative Templates find the Known Issue Rollback entry with the KB number. It must be set to Disabled, not Enabled: disabling the policy means disabling the faulty change, which is the rollback. There is a lot of wrong advice about this point.
• 4Restart. Without a restart the change has no effect.

Alternative without the MSI, with a warning

The policy does nothing more than write a DWORD value in the registry. It can be written directly, but only on Windows Server 2022 build 20348.5622, because the numeric identifier of the override changes from build to build:

$k = 'HKLM:\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides'
New-ItemProperty -Path $k -Name '1300465806' -Value 0 -PropertyType DWord -Force

Then restart. On any other build, install the MSI and read the identifier inside the matching ADMX file instead of copying the one shown here. The identifier 1501792398 circulating in forums is not the Server 2022 one.

Verification and rollback

After the restart the value must be present under the FeatureManagement\Overrides key. That is not the effectiveness check, though: that requires a full working day with real users opening and closing sessions. On an idle machine the defect is not triggered and the result is meaningless.

To go back, delete the registry value or set the policy back to Not configured, and restart. It is also the step to take, calmly, after installing the out-of-band update.

From the field

We applied the Known Issue Rollback on 14 September at 15:02 Italian time on a Windows Server 2022 session host that was hanging twice a day, in the middle of working hours. No episodes since, but the observation period is still too short to consider the matter closed. Four hours later Microsoft published the out-of-band update: the next step is to install it in the next maintenance window and remove the policy.

The lesson, for anyone running virtualised servers and Remote Desktop environments, is always the same: Patch Tuesday has to be installed, but with an observation window and a rollback plan ready in advance. The KIR exists precisely for this, provided you know where to find it and how it is activated. It is the kind of work we cover with our support and operations service.