Windows Server 2022 · KB5126655 · Build 20348.5761

Adds enhanced NTLM auditing, fixes offline tiered Storage Spaces Direct and USB Audio Class 1.0, and automatically hardens AD FS DKM ACLs. WSUS error-detail suppression remains.

What changed

October improves NTLM dependency visibility, repairs tiered-storage recovery and USB audio, adds ReFS removable-media auditing and updates cURL to 8.21.0. Server 2022 enters extended support, not end of security updates.

Technical details

Fixed: valid tiered Storage Spaces Direct metadata wrongly rejected during recovery, leaving virtual disks offline
Fixed: USB Audio Class 1.0 devices failing to start or play audio
Enhanced NTLM auditing identifies the user, reason and location of NTLM use
AD FS DKM ACL automatic remediation for CVE-2026-56155; RemediateDkmAcl=0 opts out
ReFS removable-media auditing enabled, enforcement disabled; cURL 8.21.0 and time-zone changes
Secure Boot certificate deployment continues; included SSU KB5126654, build 20348.5739

Why it matters

Storage recovery and AD FS permissions affect service availability; enhanced NTLM evidence supports Kerberos migration. Offline images need the documented minimum servicing stack.

Known limitations

Open limitation: WSUS sync error details remain removed after KB5070884 or later for CVE-2025-59287; this KB does not restore them.
Offline images lacking KB5030216 or a later LCU can fail with 0x800f0823; minimum SSU is 20348.1960.
Mainstream support ends, but monthly security updates continue in extended support through 14 October 2031.
October Windows update RPC Endpoint Mapper limit may disrupt on-premises Exchange OWA, mail delivery and replication; Microsoft status Mitigated.

Now check

Validate S2D virtual disks and dependent clustered services after reboot
Enable/review NTLM audit evidence and map legacy authentication dependencies
Validate USB audio where present and DKM ACL/service health on AD FS
Check WSUS synchronization logs; ensure offline images meet KB5030216/SSU prerequisites and include matching boot.stl
For Exchange workloads review the official Exchange Team EpmapSavedContextCap mitigation, restart under change control, and validate OWA, queues, replication and memory.