Microsoft confirms August update causes 0xc0000409 errors on Windows Server 2016

Microsoft has confirmed a known issue in which Windows Server 2016 systems log repeated 0xc0000409 application crashes after installing the August 2026 security update. The failing process is CompatTelRunner.exe, and each failure writes an Application Error entry, Event ID 1000, into the Windows Application log.

The condition is narrow. It appears only where the Compatibility Appraiser diagnostic task is enabled, which is the task that starts CompatTelRunner in the first place. Microsoft says the crashes produce log entries but don't change how the server behaves, and that the warnings can be set aside until a resolution ships.

The originating update is KB5120418, published on 11 August 2026, which moves Windows Server 2016 and Windows 10 version 1607 to OS build 14393.9418. Microsoft's release notes for that build confirm the date and the servicing branch.

0xc0000409 is defined in Windows as STATUS_STACK_BUFFER_OVERRUN, and the name is misleading. Microsoft's own engineering blog noted in 2023 that the code covers fast-fail terminations in general, with a subcode naming the specific check that failed. It isn't restricted to a stack buffer being overrun.

That distinction matters when reading the raw event. The text talks about a stack-based buffer overrun and a malicious user potentially gaining control of the application. On the evidence Microsoft has published, this is a defensive abort inside a telemetry binary.

CompatTelRunner.exe is the Compatibility Appraiser Telemetry Runner. The scheduled task that starts it, Microsoft Compatibility Appraiser, sits under Task Scheduler Library, Microsoft, Windows, Application Experience. It inventories hardware, drivers and installed software so Windows can judge whether a machine is ready for a feature update or a major cumulative update.

Microsoft scopes the issue to Windows Server 2016 and states that physical devices and virtual machines are both affected, calling out VMware and Azure environments specifically. This is not a hypervisor-specific fault.

The gating factor is the Compatibility Appraiser task. Estates that stripped diagnostic and telemetry tasks out of their server build, a common hardening step, won't see the events at all. Servers running close to the default configuration are the ones filling their logs.

Windows 10 version 1607 shares the same servicing branch and the same update. Microsoft's alert names Server 2016 rather than the client LTSB edition, so treat client-side impact as unconfirmed for now.

Microsoft's position is that nothing breaks, so the operational impact is confined to the Application log. That is still work for the teams who watch those logs.

Application Error events carrying a 0xc0000409 code are standard content for SIEM detection rules and RMM alert templates, because the same code shows up in genuine crashes and in some exploitation attempts. A recurring, benign source of that signal degrades the rule, and every ticket it opens has to be closed by hand.

For an MSP running Server 2016 across a client base, that multiplies. The realistic response is a scoped suppression, filtering Event ID 1000 where the faulting process is CompatTelRunner.exe, rather than muting Application Error events outright.

The acknowledgement sits in a Windows release health service alert in the Microsoft 365 admin center, tracked as WI1467310. That surface requires tenant admin sign-in, so it reaches Microsoft 365 administrators and not the general public.

At the time of writing, the issue was not listed on the public Windows release health page for Windows 10 version 1607 and Windows Server 2016. That page was last updated on 19 June 2026 and still shows a single open known issue, the Recycle Bin filename dialog bug from June's KB5094122.

The gap matters. Server 2016 fleets are often managed by teams without a Microsoft 365 admin role, and for them the public page is the reference. A patch review process that reads only that page would have missed this.

Microsoft has not published a workaround. Its guidance is to disregard the event log warnings until a resolution ships, which makes alert tuning the sensible first move.

Don't uninstall KB5120418. It's a security update for a platform in extended support, and trading patch level for log hygiene is a bad exchange on a server that reaches end of support on 12 January 2027.

Disabling the Microsoft Compatibility Appraiser scheduled task does stop CompatTelRunner from running, and some estates disable it already. Microsoft has not offered that as a fix here, so treat it as a local decision with its own cost to upgrade-readiness data, not as vendor guidance.

Microsoft says a resolution will arrive in a future Windows update and has not committed to a date. The realistic checkpoints are the monthly cumulative updates for build 14393, starting with September's.

The wider pattern is worth tracking. Server 2016 has taken repeated servicing hits this year: Microsoft fixed a June 2026 known issue that caused security update installs to fail on systems that weren't already current. Separately, it recently warned that memory management changes on Windows Server 2025 can crash applications using Address Windowing Extensions.

With Server 2016 support ending on 12 January 2027, each of these is a reminder that the migration window is now measured in months. If you hold a Microsoft 365 admin role, follow WI1467310 directly for the fix announcement rather than waiting for the public page to catch up.