September 2026 Windows Updates Breaking Remote Desktop (RDP) — How to Fix It

Microsoft’s September 8, 2026 Patch Tuesday security updates are causing failures in Remote Desktop Services (RDS) on Windows Server 2019, 2022, and 2025, as well as on Windows 10/11 endpoints. Connections typically work fine at first, but after a few hours RDP sessions start hanging, users can’t log off properly, and the server can become completely unresponsive, sometimes requiring a hard reset.

What’s actually happening?

• RDP connections get stuck at “Connecting…” and never complete.
• Servers freeze on the message “Please wait for the Remote Desktop Configuration.”
• Logged-in users can’t disconnect or log off cleanly.
• MMC, File Explorer, and even the Windows Update page can also hang.

Which updates are responsible?

Important: don’t uninstall these updates as a permanent fix. They also patch a critical, actively exploited vulnerability (CVE-2026-69525, CVSS 9.8). Removing them fixes the RDP issue but reopens a serious security hole.

How to fix it — step by step

1. Install Microsoft’s emergency out-of-band update released on September 14, 2026.
   This is the official, complete fix. Note: these updates are currently distributed primarily through the Microsoft Update Catalog rather than standard Windows Update/WSUS, so you may need to download and install the package manually. They are cumulative, so there’s no need to remove the September 8 update first. Find your OS below:
   • Windows Server 2019: KB5129238 — release notes
   • Windows Server 2022: KB5129237 — release notes
   • Windows Server 2025: KB5129235 — release notes
   • Windows 11 24H2 / 25H2: KB5129195 — release notes
2. If you can’t install the out-of-band update right away, enable the Known Issue Rollback (KIR) via Group Policy.
   Microsoft published an official KIR on September 13, 2026, marking the issue as “Mitigated.” This rolls back only the problematic change (a feature flag), while keeping the rest of the September security update — including its security fixes — intact. It requires Windows Server / Microsoft 365 enterprise licensing that supports Group Policy-based KIR deployment.
   
   KIR rollback IDs by OS:
   • Windows Server 2019 / Windows 10 1809 (KB5122876): rollback ID 260911_18474
   • Windows Server 2022 (KB5122882): rollback ID 260911_18471
   • Windows Server 2025 (KB5122871): rollback ID 260911_18472
   Step-by-step deployment:
   1. Download the KIR policy definition .msi package that matches your exact OS version (available from Microsoft Support / the release health dashboard entry for this issue). Confirm the filename matches your OS build before proceeding.
   2. Run the .msi on a management workstation (or your GPO central store host). This installs the new Administrative Template (ADMX/ADML) files for the policy.
   3. Copy the extracted ADMX and ADML files into your domain’s central store: \\<yourdomain>\SYSVOL\<yourdomain>\Policies\PolicyDefinitions\ (for a single, non-domain-joined server, you can instead run the MSI locally and use gpedit.msc).
   4. Open Group Policy Management Console and create a new GPO (or edit an existing one) scoped to an OU containing your affected RDS servers.
   5. Edit the GPO and navigate to: Computer Configuration → Administrative Templates → KB<number> Issue <XXX> Rollback → <your Windows version> (the exact folder name includes the KB number and rollback ID above, e.g. “KB5122882 260911_18471 Known Issue Rollback”).
   6. Right-click the policy setting and choose Edit → Disabled → OK. Setting it to Disabled is correct — it disables the problematic feature flag (technically, it clears a DWORD value under HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides), which is what rolls back the bug.
   7. Link the GPO to the correct OU, then on each affected server run gpupdate /force to apply it immediately (or wait for the normal background refresh cycle).
   8. Restart each server. RDS/TermService restarts as part of the reboot and the deadlock condition should no longer occur.
   Reference: Microsoft’s official guide to deploying a Known Issue Rollback via Group Policy.
3. If KIR isn’t available either, you can try the temporary registry feature-flag workaround.
   Note: this has been reported as unreliable and doesn’t prevent the issue in all cases — treat it as a last resort only.
4. Test before wide deployment.
   Run the update first on a test server or a non-critical RDS group, including licensing servers and jump servers, and make sure you have an alternate management path (e.g. a cloud console or hypervisor interface) in case something goes wrong.
5. Watch Microsoft’s Release Health dashboard for further updates, especially if you manage Windows Server 2016 / 2012 R2 / 2012, which have also been reported as affected.

Bottom line: if your RDS servers haven’t been patched yet, install the September 14 out-of-band update directly and skip the intermediate steps. If you’ve already hit the issue, use KIR as an immediate fix until the full update is installed.