Windows Server 2016 · KB5126868 · Build 14393.9612

Introduces ReFS removable-media auditing and default AD FS DKM ACL hardening, plus Secure Boot and time-zone updates. USB Audio Class 1.0 remains partially unresolved.

What changed

October activates ReFS auditing without enforcement and automatically remediates insecure AD FS DKM container ACLs. It includes prior September security and out-of-band improvements.

Technical details

AD FS DKM insecure ACLs automatically remediated for CVE-2026-56155; RemediateDkmAcl=0 opts out
ReFS removable-media auditing enabled; enforcement disabled
Secure Boot certificate deployment continues
Updated British Columbia/Alberta DST and Manitoba time-zone data

Why it matters

AD FS ACL changes require service validation; removable-media audit events can support hardening readiness. Server 2016 lifecycle planning remains separate from Windows 10 LTSB support.

Known limitations

Partially resolved: USB Audio Class 1.0 Code 10, no audio or nonresponsive controls can persist. September OOB KB5129239 fixes multichannel symptoms, not every symptom.
Microsoft Support is the documented escalation for remaining USB audio symptoms.
Windows Server 2016 support ends 12 January 2027; do not confuse this with the 13 October 2026 Windows 10 LTSB end date.
October Windows update RPC Endpoint Mapper limit may disrupt on-premises Exchange OWA, mail delivery and replication; Microsoft status Mitigated.

Now check

Verify AD FS DKM ACLs and federation service health after installation
Retest affected USB audio devices and capture Code 10/output/volume behavior
Validate ReFS audit events and time-sensitive services
Confirm applicable servicing-stack prerequisites in the KB and document the Server 2016 upgrade plan
For Exchange workloads review the official Exchange Team EpmapSavedContextCap mitigation, restart under change control, and validate OWA, queues, replication and memory.