Windows 11 26H2 · KB5127648 · Build 26300.9711

Fixes AVD/FSLogix black screens, AC-3 playback and RAW printing. Microsoft withdrew the Always On VPN fix claim on 20 October; a VPN fix is still pending.

What changed

KB5127648 includes October security and quality improvements. On 20 October 2026 Microsoft removed the previously listed Always On VPN fix and stated that this change will be included in a future release. Do not count VPN protocol fallback as repaired by this KB.

Technical details

Fixed: Explorer failing to start or repeatedly crashing after sign-in on AVD/FSLogix multi-user hosts
Fixed: AC-3 playback in affected applications
Fixed: RAW/Generic Text Only printing failures after the August update
Fixed: tiered Storage Spaces Direct virtual disks remaining offline
Fixed: fingerprint sign-in after a cold boot; mouse stutter in some games
ReFS removable-media auditing on by default; enforcement off
Secure Boot certificate rollout continues; AI components 1.2608.951.0 on applicable PCs
Included SSU KB5127647, build 26100.9703
Microsoft added on 15 October: NTLMv1-derived SSO credentials are blocked by default when Credential Guard is disabled and BlockNtlmv1SSO is unset (Enforce 1 replaces Audit 0).

Why it matters

AVD session availability, remote VPN access, printing and standard-user RDP can directly affect business access. Validate fixes and remaining regressions separately before expanding deployment.

Known limitations

Open, mitigated: non-admin RDP can fail with 0xC000000D when Administrator protection is enabled. Temporarily reset User Account Control Type Of Admin Approval Mode through Intune/GPO on affected hosts; permanent fix pending.
Partially resolved: USB Audio Class 1.0 can show Code 10, no sound or broken volume controls. KB5129195 fixes the documented multichannel symptoms, not every remaining symptom; Microsoft Support is the documented escalation.
Community-reported, not Microsoft-confirmed: 802.1X PEAP failures after this KB. See the separate Critical advisory; do not treat its suspected cause or workaround as official guidance.
This authentication hardening may affect MS-CHAPv2-based Wi-Fi, Ethernet and VPN. Smart App Control may also be impossible to turn back on; already enabled devices remain protected.
Always On VPN: the fix claim was withdrawn by Microsoft on 20 October 2026. A corrective change is planned for a future release.

Now check

Retest existing FSLogix profiles and Explorer startup on AVD hosts
Test Always On VPN auto-protocol selection and fallback, then RAW printing and fingerprint cold-boot sign-in
Test standard-user RDP on hosts with Administrator protection; apply the scoped Microsoft mitigation only if affected
Test representative USB Audio Class 1.0 and PEAP-dependent Ethernet/Wi-Fi devices separately
For offline media, include required checkpoint KB5043080 and version/architecture-matched boot.stl; validate boot and target build
Inventory Credential Guard, BlockNtlmv1SSO and MS-CHAPv2 dependencies; test wired, wireless and VPN authentication against KB5066470 guidance.
For affected Smart App Control devices follow the KB guidance: install and enable both published special Group Policies, then restart; a permanent resolution is pending.
Do not assume KB5127648 resolves Always On VPN fallback or Connecting failures; validate affected VPN configurations and follow the Microsoft KB for the future fix.