KB5126868 breaks RDP shadow connections on Windows Server 2016 after October 14 update

Саша Полив 10 Reputation points
2026-10-17T18:38:17.8666667+00:00

After installing the October 2026 cumulative update KB5126868 on October 14, 2026, we began experiencing problems with RDP session shadow connections on Windows Server 2016 x64 servers. Observed result: shadow connections did not work with KB5126868 installed. I uninstalled KB5126868 on an affected server, and shadow connections worked again. This before/after result is the reason I am reporting this update as the trigger in our environment. Expected result: administrators should still be able to shadow existing user RDP sessions after installing the cumulative update. Current temporary workaround: uninstall KB5126868 and hide that specific update to prevent automatic reinstallation. This is a temporary workaround, not a permanent servicing solution. Has anyone else experienced this regression? Is Microsoft aware of an RDS shadowing issue with KB5126868, and is there a supported mitigation or fix that allows us to keep security updates installed? Please investigate this regression and, if confirmed, document it in the update known issues / Windows release health information so other administrators can find it. Please provide an issue tracking reference if available. This report describes our observed behavior; it does not claim Microsoft has already confirmed the root cause.

Windows for business | Windows Server | User experience | Remote desktop services and terminal services

2 answers

Sort by: Oldest
Most helpful Newest Oldest

  1. AI answer

    2026-10-17T18:40:21.5933333+00:00

    Open a Microsoft Support for Business case for the KB5126868 shadowing regression, because as of October 17, 2026 Microsoft has not publicly documented this specific symptom, published a shadowing-specific mitigation, or assigned a public issue reference.

    Current Microsoft status

    • KB5126868 applies to all Windows Server 2016 editions and installs OS build 14393.9612.^1^
    • Its published known issues currently cover Exchange Server and USB audio—not RDS session shadowing.^1^
    • Release health likewise does not list a new KB5126868 shadowing issue. It lists an older, broader September RDS instability issue originating in KB5123099, resolved by KB5129239 and later updates.^2^
    • KB5126868 is later and cumulative, so installing the September OOB update separately is not a supported solution for a regression that occurs with KB5126868 itself.
    • No publicly identified KB5126868 shadowing Known Issue Rollback (KIR) appears in the cited material as of October 17, 2026. KIR can only be deployed when Microsoft publishes the corresponding policy package; it cannot be created locally.^3^

    The September incident therefore should not be treated as confirmation of this newly observed shadowing behavior. There is currently no public tracking reference for the specific report.

    Escalate with a reproducible case

    1. Open Microsoft Support for Business. A support entitlement or paid incident might be required depending on the organization’s agreement.
    2. Select Windows Server → Windows Server 2016 → Remote Desktop Services/Windows Update.
    3. Include:
      • Affected edition and architecture.
      • Working build before installation and failing build 14393.9612.
      • Exact shadow command or administrative UI workflow.
      • Source computer OS/build and RDP client version.
      • Target session ID and whether viewing and remote control both fail.
      • Exact error text, event IDs, and reproduction timestamp.
      • The observed result that removing KB5126868 restored shadowing. Do not describe this as a reinstall test unless the update was installed and tested again.
      • Number of affected and unaffected servers and whether all use the same RDS policies.
    4. Request:
      • Confirmation whether this is a servicing regression.
      • A supported private mitigation, KIR, or replacement update if one exists.
      • A support case number for tracking and linkage to Windows release health if confirmed.

    Export logs immediately after reproducing the failure:

    1. Open Event Viewer → View → Show Analytic and Debug Logs.
    2. Under Applications and Services Logs → Microsoft → Windows, export applicable TerminalServices-* channels.
    3. Export Windows Logs → System and Windows Logs → Application.
    4. Save the logs as .evtx files and record the reproduction time, session ID, source host, and target host. Microsoft’s RDS troubleshooting guidance also recommends exporting Terminal Services and Administrative Events when collecting RDS diagnostics.^4^

    Temporary mitigation and security risk

    Since uninstalling already restored operation, it remains the demonstrated temporary workaround in this environment, but uninstalling or deferring KB5126868 also removes its security fixes. Use that only as a short-term, explicitly risk-accepted exception:

    • Limit network exposure of affected RDS hosts.
    • Restrict administrative and RDP access to trusted management networks.
    • Monitor the exception and affected hosts.
    • Retest and reinstall the current cumulative update as soon as Microsoft supplies a supported mitigation or superseding fix.

    Do not apply unrelated registry changes, disable NLA, or deploy the September RDS workaround: none is documented for this shadowing symptom.

    Monitor the public Windows Server 2016 release-health page for status changes.^2^ If the organization has an eligible Windows Enterprise/Education license and an appropriate administrator role, additional Windows release-health details and email notifications are available at Microsoft 365 admin center → Health → Windows release health.^5^

    References

    1. October 13, 2026—KB5126868 (OS Build 14393.9612) | Microsoft Support
    2. Windows 10, version 1607 and Windows Server 2016 known issues and notifications
    3. Known Issue Rollback (KIR)
    4. Useful log files for troubleshooting RDS issues
    5. How to check Windows release health
    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

  2. Daphne Huynh (WICLOUD CORPORATION) 2,540 Reputation points Microsoft External Staff Moderator
    2026-10-19T06:59:10.8666667+00:00

    Welcome to Microsoft Q&A!

    Thank you for taking the time to share such detailed information. Especially, for documenting the before-and-after testing

    The behavior you described, where RDP session shadowing fails with KB5126868 installed and starts working again after the update is removed, is valuable troubleshooting information and suggests a possible update-related regression in your environment.

    However, based on the currently published Microsoft information, RDP session shadowing is not listed as a known issue for KB5126868. The Windows Server 2016 release health page currently documents a separate issue associated with KB5126868 affecting Exchange Server.

    An RDS issue affecting Windows Server 2016 after the September 2026 security update KB5123099 and that issue could cause RDS instability, RDP connection and sign-in failures, servers to become unresponsive during Remote Desktop configuration, and related management tools to stop responding.

    That earlier issue was resolved with the out-of-band update KB5129239 and later cumulative updates. However, the symptoms documented by Microsoft are different from the RDP session shadowing issue you are currently experiencing with KB5126868.

    At this time, the available public documentation does not provide a shadowing-specific workaround, Known Issue Rollback (KIR), corrective update, or public tracking reference for this particular symptom.

    I understand that uninstalling KB5126868 has restored shadowing in your testing.

    However, since this is a security update, I would consider removal only a temporary workaround while the issue is being investigated, rather than a permanent servicing solution.

    Because you have a reproducible scenario, I recommend opening a Microsoft Support for Business case for further investigation. It is a recommendation to contact Microsoft Support when an RDS issue continues after the applicable corrective updates have been installed.

    A support case will allow the appropriate support team to review the diagnostic information from the affected environment and determine whether this represents a new servicing regression.

    For now, I think it is appropriate to describe this as a possible KB5126868-related regression based on your testing, but the currently available public documentation is not sufficient to say that Microsoft has officially confirmed the root cause.

    I realize this may not be the immediate fix you were hoping for, especially since your testing shows such a clear correlation with the update.

    However, Microsoft Q&A is a public community forum, so I need to rely on information that has been officially published through Microsoft documentation and supported channels.

    I don't have visibility into internal engineering investigations or unpublished issue-tracking information. If Microsoft confirms this as a known issue, the Windows release health page and the corresponding update documentation would be the appropriate places to monitor for an official mitigation or resolution.

    References:

    Windows 10, version 1607 and Windows Server 2016 known issues and notifications | Microsoft Learn

    Troubleshoot Remote Desktop Services instability after September 2026 Windows security updates - Virtual Machines | Microsoft Learn

    Windows Server 2025 known issues and notifications | Microsoft Learn

    Windows Server 2022 known issues and notifications | Microsoft Learn

    Windows 10, version 1809 and Windows Server 2019 known issues and notifications | Microsoft Learn

    Resolved issues in Windows Server 2025 | Microsoft Learn

    If you find it useful, please click Accept Answer.

    Thank you for choosing Microsoft Q&A.

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.