September Windows Server updates are breaking RDS session hosts

Windows administrators report that the September 2026 cumulative updates are taking down Remote Desktop Services on Windows Server 2019, 2022 and 2025. The updates went out on 8 September, and reports started building on Reddit and in readers' mail to BleepingComputer within days.

The described pattern repeats across unrelated environments. The session host comes back from the update and works. A few hours later, new RDP connections hang during the connection phase and eventually fail, and users already signed in cannot disconnect or log off cleanly.

Several administrators say a normal restart does not clear the fault and that a hard reset is the only way to get the server back. Others report the service failing specifically after the first user logs out. Rolling back the September cumulative update restores Remote Desktop, according to admins who have done it.

One administrator debugging a Windows Server 2022 host posted a more specific account. According to that analysis, the RDP service stops responding once users begin logging out, and the stack shows it hanging in a close routine inside the RDP server component with no timeout configured. The result is described as a deadlock between the RDP service and the Local Session Manager.

That lines up with what other admins see from the outside. The Local Session Manager is the component that tracks session state, so if it is waiting on a call that never returns, both the teardown of old sessions and the setup of new ones stall behind the same lock. It also explains why the host stays healthy until the first logoff.

This is one administrator's debugging on one machine, not a vendor finding. Microsoft has not confirmed it as the cause, and nothing in the KB documentation points at it.

Reports cover Windows Server 2019, 2022 and 2025, which is every supported release carrying these three updates. That spread is itself a signal, since a fault in one servicing branch would not show up identically across three.

Windows Server 2019  ->  KB5122876
Windows Server 2022  ->  KB5122882  (OS build 20348.5622)
Windows Server 2025  ->  KB5122871

The exposure is anyone running the Remote Desktop Session Host role, whether that is a modern RDS farm or a single Terminal Server that nobody has renamed since 2012. Multi-user hosts are where the failure bites, because the trigger appears to involve users logging off.

MSPs are in an awkward spot here. Patch automation did its job on schedule across a customer base, and the failure lands hours later, often outside the maintenance window and usually on the one server every user connects through.

Microsoft told BleepingComputer that it is aware of the reports, is investigating, and will share guidance when it has some. That is the extent of the official position at the time of writing.

The support pages for the September updates carry no acknowledged Remote Desktop Services defect. There is no entry in the known issues section, no Known Issue Rollback, and no out-of-band fix. Anyone hoping the KB page would quietly gain a line overnight has not seen one yet.

Microsoft's usual route for this class of regression is either a Known Issue Rollback pushed through policy or a fix folded into the next preview update, which would normally land in the last week of September. Neither has appeared so far.

Stop the bleeding first. Pause or block the September cumulative update on RDS session hosts that have not taken it yet, through your patch tool, WSUS approvals or an update ring. Leaving it deployed to everything else is fine; the reports are specific to session hosts.

For hosts already patched and behaving, treat them as suspect rather than clear. Watch for sessions that will not log off, and consider scheduling a nightly reboot as a crude reset while the fault is unexplained.

For hosts already failing, uninstalling the cumulative update is the only reported fix. It is also a security decision, not a free undo. This month's release covers 966 flaws including two zero-days that were already being exploited, so if you roll back, do it with compensating controls: no RDP exposed to the internet, access only through an RD Gateway or VPN, MFA in front of it, and a firm date to reinstall.

September's Patch Tuesday was Microsoft's largest ever: 966 flaws, 105 of them rated critical, against 570 in July and 400 in August. Microsoft has attributed the rising volume to an AI-powered vulnerability discovery system finding more issues across its products.

The two actively exploited zero-days in the set are CVE-2026-81963, an elevation of privilege flaw in the Windows Update Stack, and CVE-2026-85880, a heap-based buffer overflow in Windows ALPC. Both give an attacker who already has a foothold a path to SYSTEM.

Updates this size raise the cost of a single regression. Rolling back to fix Remote Desktop means dropping several hundred fixes to recover one service, and that arithmetic gets worse every month the totals climb.

The precedent is not encouraging either. As betanews recalls, Microsoft pulled the January 2022 Windows Server updates outright after they broke Hyper-V, sent domain controllers into reboot loops and made ReFS volumes inaccessible.

The first thing to watch is the KB pages themselves. A known issue entry would confirm the scope and usually arrives with a Known Issue Rollback or a workaround, which is a far better outcome than uninstalling.

The second is whether Windows Server 2016 joins the list. Coverage so far names 2019, 2022 and 2025, and at least one write-up has pointed at a 2016 update as well without corroboration. If the fault sits in shared session management code, that would not be a surprise.

The third is the September preview update at the end of the month. That is the normal vehicle for a fix of this kind, and if it slips, affected estates are choosing between broken remote access and missing patches for several more weeks.