Microsoft Releases Out-of-Band Windows Updates to Fix Cloud PC Sign-In Failures and Windows 11 23H2 Shutdown Bug

Why this matters for admins right now

Out-of-band updates are Microsoft's "break glass" mechanism, and these fixes land in the middle of January's patch cycle when many orgs are still staging deployments. The practical risk is twofold:

Remote access reliability: If your environment relies on Windows App to reach Windows 365 or Azure Virtual Desktop, credential prompt failures can turn into widespread support load and blocked business access.

Endpoint operability: On Windows 11 23H2 with Secure Launch, a shutdown/hibernate failure can look like a minor annoyance but becomes a lifecycle and compliance headache in enterprise images where Secure Launch is commonly enabled.

What changed after January Patch Tuesday

Microsoft documented a Remote Desktop authentication issue where credential prompts could fail in certain remote connection applications. The symptom is especially visible when using Windows App on Windows client devices to connect to Azure Virtual Desktop and Windows 365 Cloud PCs.

Separately, Windows 11 version 23H2 devices with Secure Launch enabled could fail to shut down or enter hibernation. In affected cases, the device restarts instead of completing the power transition. Microsoft also previously shared a workaround using a direct shutdown command for impacted devices.

The OOB updates Microsoft released (KB list)

The following OOB updates were released to address the regressions. Use the package that matches your OS and servicing baseline.

Deployment notes (what to do and what to avoid)

1) Prioritize based on impact, not "latest available"

If you are not seeing either issue, there is little value in rushing emergency updates into stable rings. If you are impacted, the fastest path is to deploy the relevant OOB package to the affected populations only.

2) Expect manual distribution for many environments

These OOB updates are positioned as standalone packages (commonly pulled from Microsoft Update Catalog and deployed via your normal tooling). In controlled enterprise environments, treat them like targeted hotfixes: test, pilot, then expand.

3) Use KIR if you need the least disruptive enterprise mitigation

For organizations that cannot immediately install the OOB package, Microsoft also provided Known Issue Rollback options for enterprise-managed devices to address the Remote Desktop issue via Group Policy. This is often the lowest-risk mitigation when you need rapid relief without changing servicing baselines mid-cycle.

Known Issue Rollback packages mentioned by Microsoft

Microsoft published KIR downloads that map to the originating January 2026 security updates for each affected Windows version and Server build. These are intended for enterprise-managed devices and deployed using a special Group Policy.

• Windows Server 2022 KIR (KB5073457)
• Windows Server 2025 KIR (KB5073379)
• Windows Server 2019 and Windows 10 Enterprise LTSC 2019 KIR (KB5073723)
• Windows 11 25H2 and Windows 11 24H2 KIR (KB5074109)
• Windows 11 23H2 KIR (KB5073455)
• Windows 10 version 22H2 KIR (KB5073724)