Windows Server 2019 · KB5126651 · Build 17763.9376

Adds enhanced NTLM auditing, fixes BitLocker To Go compatibility with older systems, and automatically remediates AD FS DKM ACLs. Some USB audio symptoms remain unresolved.

What changed

October adds NTLM dependency evidence, ReFS removable-media auditing and default AD FS DKM ACL hardening, with Secure Boot certificate and time-zone updates.

Technical details

Fixed: BitLocker To Go drives encrypted on newer systems not recognized by older systems
Enhanced NTLM auditing exposes users, reasons and locations of NTLM authentication
AD FS DKM insecure ACLs automatically remediated for CVE-2026-56155; opt-out RemediateDkmAcl=0
ReFS removable-media audit enabled, enforcement disabled; Secure Boot and time-zone updates

Why it matters

Review AD FS permission changes and collect NTLM evidence before migration. Test encrypted removable media and USB audio on the actual older server platform.

Known limitations

Partially resolved: USB Audio Class 1.0 can show Code 10, no output or nonresponsive volume controls. September OOB KB5129238 addresses multichannel symptoms; other symptoms remain under investigation.
For remaining USB audio symptoms Microsoft directs administrators to Microsoft Support; no complete fix is listed.
October Windows update RPC Endpoint Mapper limit may disrupt on-premises Exchange OWA, mail delivery and replication; Microsoft status Mitigated.

Now check

Test BitLocker To Go media encrypted on a newer device
Collect NTLM audits and validate AD FS DKM ACLs and service health
Test affected USB audio devices; distinguish partial OOB resolution from remaining symptoms
Validate ReFS audit events and time-sensitive workloads after patching
For Exchange workloads review the official Exchange Team EpmapSavedContextCap mitigation, restart under change control, and validate OWA, queues, replication and memory.