Windows Server 2025 · KB5126646 · Build 26100.33650

Adds opt-in Quick machine recovery and TLS 1.3 ML-KEM, improves Netlogon and Hyper-V TDX, and hardens AD FS DKM ACLs. WSUS sync error details remain unavailable.

What changed

Quick machine recovery is available but disabled by default. October also adds ReFS removable-media auditing, updates cURL, improves SMB NULL-session connections and applies AD FS DKM ACL remediation automatically.

Technical details

Quick machine recovery supported via Group Policy, disabled by default; needs an applicable Windows Update remediation
TLS 1.3 ML-KEM post-quantum key exchange support
Improved: Netlogon secure channels to domain controllers predating Server 2025
Improved: Hyper-V Intel TDX confidential VM reliability and SMB NetUseAdd NULL-session connections
AD FS DKM insecure ACLs automatically remediated for CVE-2026-56155; RemediateDkmAcl=0 opts out
ReFS removable-media audit enabled, enforcement disabled; cURL 8.21.0 and updated time zones
Secure Boot certificate rollout continues; SSU KB5126645, build 26100.33634

Why it matters

Recovery policy, hybrid authentication and AD FS permissions change on managed servers. Test domain connectivity and recovery behavior independently; absent WSUS error details are not proof of a healthy sync.

Known limitations

Open limitation: WSUS synchronization error details remain removed after KB5070881 or later to address CVE-2025-59287. No restoration fix is announced in this KB.
Quick machine recovery is not enabled automatically and cannot recover an outage without an applicable remediation.
October Windows update RPC Endpoint Mapper limit may disrupt on-premises Exchange OWA, mail delivery and replication; Microsoft status Mitigated.

Now check

Validate Netlogon secure channels to older DCs and SMB access after reboot
On AD FS servers verify DKM ACL remediation and service health; do not opt out without security review
Pilot Quick machine recovery policy and WinRE networking before enabling broadly
Check WSUS sync outcome and logs rather than relying on missing error details
For offline media follow checkpoint KB5043080 and matching boot.stl prerequisites
For Exchange workloads review the official Exchange Team EpmapSavedContextCap mitigation, restart under change control, and validate OWA, queues, replication and memory.