Windows Server September update breaks Remote Desktop

Microsoft has now confirmed what admins started reporting last week: the September 2026 Windows Server update breaks Remote Desktop Services. It is listed as a known issue on the KB page itself, there is no patch, and the official workaround is to open a support case. That lands in the same month Microsoft shipped its largest Patch Tuesday on record, two exploited zero-days included. You do not get to skip this one, so you have to sequence it.

What actually happened

The affected updates are KB5122876 (Server 2019), KB5122882 (Server 2022, OS Build 20348.5622, released September 8) and KB5122871 (Server 2025). Microsoft's own KB5122882 page carries the known issue: "After installing the September 2026 Windows security update, some organizations might experience issues with Remote Desktop Services (RDS)."

The failure mode is the nasty kind — delayed. BleepingComputer reported that servers run normally for a few hours after the update, then RDP connections start failing. Existing sessions will not disconnect or log off. New connections hang before timing out. Servers stall at "Please wait for the Remote Desktop Configuration." MMC, the RDS Licensing Diagnoser and File Explorer go unresponsive, and the Windows Update page itself spins forever — which is how you end up hard-resetting a box to get back in.

Microsoft's status: "working to address this issue in a future Windows update," with admins who need it now told to contact Support for Business. Rolling the update back restores RDP and gives up the security fixes, including the two elevation-of-privilege flaws already under active exploitation.

Why this matters for your business

If remote desktop is how your team reaches the line-of-business app, this is not an IT inconvenience — it is the whole company locked out on a Tuesday afternoon, several hours after a change everyone had already forgotten about. The delay is what makes it expensive. Nobody connects the outage to the patch, so the first hour goes to the wrong theory.

The wrong lesson is "stop patching." September also shipped a dozen Critical Office bugs that fire from the Outlook Reading Pane with no click. Sitting on this month's update is a worse bet than losing RDP.

The right lesson is that you need more than one ring. Small companies usually patch everything on the same schedule because it is one line in a vendor contract, and that is exactly why a bad update takes the whole estate at once. Pick one non-critical server, patch it first, and let it sit for a full business day — this bug would have surfaced in that window. Then patch the rest. That one-day gap costs nothing and would have caught this.

Two things to do today if you already deployed. Write down which servers got which KB, so when RDP dies at 3pm you are not guessing. And make sure you have an out-of-band path into every Windows Server you own — iDRAC, iLO, a hypervisor console, a cloud provider's serial console. If your only route to the machine is the thing that just broke, your recovery plan is a hard reset and a prayer.

Sources: Microsoft KB5122882, BleepingComputer.