Microsoft pushed out KB5129195 as an out-of-band update to contain the fallout from the September 2026 Patch Tuesday release, KB5124008. The emergency patch repairs several of the issues that update caused, but it leaves a few serious problems untouched, including the domain login failures that started this whole mess. It also closes a gap in CVE-2026-62721, a vulnerability in the Windows User-Mode Power Service that could let an attacker with access to a machine gain SYSTEM-level privileges by manipulating power-management requests. Microsoft’s original fix for that flaw was incomplete, and today’s update finishes the job.
Why Microsoft rushed out an emergency patch
KB5124008 shipped on September 8, 2026, carrying hundreds of security fixes along with feature changes like the return of the movable taskbar. Within days, reports piled up describing broken Remote Desktop connections, silent USB audio, inaccessible WSL shares, and domain-joined machines that could no longer authenticate. Microsoft confirmed several of these problems and released KB5129195 to address them without forcing a rollback of the security fixes already deployed.
KB5129195 does not fix domain login failures
The most damaging issue KB5124008 introduced still isn’t resolved. Every computer joined to a company network maintains a secure channel, an encrypted connection that proves the device’s identity to Active Directory and lets sign-ins go through. KB5124008 broke that connection on many machines, and KB5129195 does not repair it. Administrators on Windows 11 25H2 machines connecting to Windows Server 2019 or certain Windows Server 2022 domain controllers continue to see logon failures, and Microsoft has not shipped a fix for this in the emergency update.
If your organization runs domain-joined Windows 11 devices, check for Event ID 4625 in the Security log on your domain controllers and run Test-ComputerSecureChannel on suspect machines. A result of False confirms the secure channel is broken. Until Microsoft ships a working correction, pausing wider KB5124008 deployment and using the registry-based workaround to repair the secure channel remains the safest path.
Remote Desktop Services is fixed
KB5129195 resolves the Remote Desktop Services outage that followed the September update. Affected PCs previously got stuck at the “Please wait for the Remote Desktop Configuration” screen or couldn’t establish a connection at all. That failure, along with related freezes in File Explorer and the Microsoft Management Console, no longer occurs after installing the emergency update.
Audio problems are only partially resolved
The update restores multichannel audio, such as 8-channel and 3D audio modes, on USB devices that had reverted to basic stereo output. It does not fix the separate and more severe bug where some PCs lose sound entirely. On systems hit by that issue, the audio devices still appear in Device Manager but throw a “This device cannot start (Code 10)” error, and the Settings sound page crashes before you can troubleshoot it.
Switching to Bluetooth headphones is currently the only workaround for that specific failure, and microphone issues on affected devices remain unaddressed as well.
Claude Cowork and WSL storage access work again
Windows Subsystem for Linux (WSL) runs a lightweight Linux virtual machine so Windows apps can share folders with it. KB5124008 broke that folder-sharing link, which meant tools like Claude Cowork could no longer read or write to local storage even after the user granted permission. Anthropic was the first to publicly trace the breakage to the Windows update, and Microsoft later confirmed the root cause: a bug in how affected virtual machines shared host folders. KB5129195 fixes this, and custom WSL-based tools that lost storage access should work normally again after installing it.
What KB5129195 still leaves broken
Not everything made this release. A handful of problems tracked since the September update carry over with no fix listed.
- Explorer.exe crashes: Some PCs, mostly in enterprise environments running Citrix UPM, FSLogix, Horizon, or ProfileUnity ProfileDisks, still hit a black screen with no desktop or taskbar after sign-in. Restarting Explorer.exe through Task Manager remains the only workaround.
- File History: The backup feature still fails to detect connected external drives on affected systems, and KB5129195 doesn’t change that.
- AMD Radeon GPU errors: PCs with Radeon RX 6600, RX 7700 XT, RX 7800 XT, RX 7900 GRE, RX 7900 XTX, and RX 9070 XT GPUs can still experience black screens, freezes, or driver timeouts. Microsoft has not attributed a fix to this in the emergency update, and rolling back GPU drivers hasn’t helped affected users.
How to check if KB5129195 is installed
Open Settings > System > About and look at the OS build number. Windows 11 25H2 should show Build 26200.9457, and 24H2 should show Build 26100.9457. The update installs automatically for most devices and typically needs a single restart, though PCs with a pending Secure Boot certificate update may reboot more than once to finish applying it.
What to do if you’re still affected
KB5129195 is worth installing regardless, since it patches a real privilege-escalation flaw on top of the other fixes. For the issues it doesn’t resolve, the practical options are limited: use the domain trust workaround for login failures, switch to Bluetooth audio if USB sound has stopped working, and hold off on wider KB5124008 rollout across enterprise fleets until Microsoft addresses the Explorer, File History, and AMD GPU problems in a future update.
Frequently Asked Questions
Should I uninstall KB5124008 if I’m hit by one of these bugs?
Removing KB5124008 does resolve the domain trust and secure channel failures, based on admin reports, but it also removes the security fixes that update carries. Installing KB5129195 on top of KB5124008 is the safer path for most users, since it keeps the security patches while resolving RDS, Claude Cowork, and partial audio issues. Only roll back if you’re blocked from signing in entirely and have no other workaround available.
Do I need to do anything extra after installing KB5129195?
No manual steps are required for most PCs. The update installs automatically and applies with a single restart, though it may trigger a second reboot if a Secure Boot certificate update is pending on your device.
Is KB5129195 the same for Windows 11 24H2 and 25H2?
It’s a single cumulative package that applies to both versions, but the resulting build numbers differ: 25H2 lands on Build 26200.9457, while 24H2 lands on Build 26100.9457.
Will a future update fix the AMD GPU and Explorer crash issues?
Microsoft has not committed to a timeline for either issue. Both remain under investigation, and no dedicated known-issue entry with a fix date has been published for them yet.
