RDS Sessions Freeze Hours After Patching
Microsoft has confirmed that its September 2026 Patch Tuesday security updates cause Remote Desktop Services (RDS) instability on Windows Server, following widespread admin reports. The company's official Windows Server 2022 release-health page lists the issue as originating from KB5122882 (OS Build 20348.5622, released September 8, 2026) and currently shows the status as "Mitigated" (last updated September 11, 2026, 19:20 PT).
Multiple outlets, including BleepingComputer, independently identify the matching updates for the other affected Long-Term Servicing releases as KB5122876 (Windows Server 2019) and KB5122871 (Windows Server 2025). Microsoft's own affected-platforms list is broader still, spanning Windows Server 2025, 2022, 2019, 2016, 2012 R2, and 2012, plus Windows 11 (23H2 through 26H1) and Windows 10 (21H2, 22H2, and both LTSC branches) on the client side.
Issue Summary
| Field | Details |
|---|---|
| Originating update (Server 2022) | KB5122882, OS Build 20348.5622 |
| Also implicated | KB5122876 (Server 2019), KB5122871 (Server 2025) |
| Affected server versions | Windows Server 2025, 2022, 2019, 2016, 2012 R2, 2012 |
| Affected client versions | Windows 11 23H2–26H1, Windows 10 21H2/22H2 and LTSC builds |
| Onset | Delayed — systems typically run normally for a few hours before failures start |
| Microsoft status | Mitigated (as of September 11, 2026) |
| Confirmed Microsoft workaround | Stop (deallocate) and restart the affected VM |
What Breaks
Microsoft's release-health advisory describes the failure directly: "In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at 'Please wait for the Remote Desktop Configuration.'" The same advisory notes that related tooling — Microsoft Management Console, the RDS Licensing Diagnoser, and File Explorer — can also become unresponsive, and that the Windows Update page itself may hang on a permanent loading indicator.
Admins troubleshooting the issue in the field describe a consistent pattern:
- The server appears healthy immediately after patching and for a few hours afterward.
- Existing Remote Desktop sessions then freeze — connected users can no longer log off or close their session cleanly.
- New connection attempts stall on the sign-in screen before eventually timing out.
- In the worst cases, a hard reboot is the only way to regain control of the host.
One administrator's investigation, reported by BleepingComputer, traced the freeze to a deadlock between the Remote Desktop service and the Local Session Manager (LSM) that triggers when a user logs off — Microsoft has not published its own root-cause explanation, so this should be treated as a community finding rather than an official one.
Mitigation Options — and a Word of Caution
Admins currently have two confirmed paths, each with a trade-off:
- Restart the affected VM/server. This is the only workaround Microsoft's own advisory documents, and it is described as temporary — connectivity returns, but the underlying issue is still present on the host.
- Uninstall the September cumulative update. Several admins report this resolves the RDS freeze, but it also removes every security fix shipped in that update — notably CVE-2026-69525, a CVSS 9.8 unauthenticated remote code execution flaw in RDS itself, patched in the same release. Pulling the update is a particularly risky trade for any RDS host exposed to a network of untrusted clients.
A number of outlets (including a follow-up BleepingComputer report and a third-party support article) describe Microsoft distributing Known Issue Rollback (KIR) Group Policy packages — which reverse only the specific behavior change causing the regression, leaving security fixes intact — with specific rollback IDs for each affected build. We were not able to confirm this directly: Microsoft's own public release-health page for Windows Server 2022 does not list a KIR as of this writing, and a Microsoft Q&A thread on the topic includes a Microsoft-community responder explicitly stating they could not find official documentation for the KIR identifiers circulating online, and cautioning admins against manually creating registry or Group Policy entries based on unverified third-party KIR IDs. Until Microsoft's release-health page or a support KB explicitly documents a KIR for this issue, treat those specific rollback IDs as unconfirmed, and verify directly with Microsoft Support before deploying one.
Microsoft's advisory states it is "working to release a resolution in a future Windows update" — language that has not been removed even though the issue's status was updated to "Mitigated," so admins should watch the official release-health page for updates rather than relying on the status label alone.
Why It Matters
September's Patch Tuesday was one of Microsoft's largest on record by CVE count, and it included several critical, network-exploitable flaws in core Windows infrastructure — CVE-2026-69525 (RDS RCE, CVSS 9.8) among them. That context is what makes this regression awkward: the safest patching advice is normally "don't roll back a security update," but the RDS bug it introduces can itself take down the same service the update was meant to protect. Admins running RDS/RDP-facing Windows Server hosts should prioritize testing this month's update in a staging ring before wide deployment, and confirm Microsoft's official guidance before choosing between a temporary VM restart, a full uninstall, or a KIR.