GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Microsoft
  • Support
  • Microsoft 365
  • Office
  • Microsoft 365
  • Outlook
  • Microsoft Teams
  • OneDrive
  • Microsoft Copilot
  • OneNote
  • Windows
  • more ...
  • Surface
  • PC Accessories

This view

  • Original page
  • New address

GeezerVison is showing support.microsoft.com — November 10, 2026—KB5131096 (OS Builds 19045.7846 and 19044.7846) | Microsoft Support

November 10, 2026—KB5131096 (OS Builds 19045.7846 and 19044.7846)

Applies To
Windows 10 ESU Windows 10 Enterprise LTSC 2021 Windows 10 IoT Enterprise LTSC 2021

Important

Free support for Windows 10 Enterprise LTSC 2021 ends on January 12, 2027. To learn about continuing support, see Plan for Windows 10 Enterprise LTSC 2021 end of support.

Commercial devices running Windows 10, version 22H2 require a Windows 10 Extended Security Updates (ESU) Year 2 license to continue receiving security updates. For more information, see Extended Security Updates (ESU) program for Windows 10.

Summary

This article lists the security issues and quality improvements included in this cumulative security update.

  • Windows 10, version 22H2
  • Windows 10, version 21H2

Applies to: Windows 10 ESU

Important

Use EKB KB5015684 to update to Windows 10, version 22H2.

This security update includes fixes and quality improvements that are part of the following updates:

  • October 26, 2026—KB5134125 (OS Builds 19045.7811 and 19044.7811) Out-of-band

  • October 13, 2026—KB5126657 (OS Builds 19045.7807 and 19044.7807)

  • Extended Security Updates (ESU) Licensing Preparation Package for Windows 10

The following is a summary of the issues that this update addresses when you install this update. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

    • For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.

  • [Printing] - Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.

  • [Remote Desktop]

    • Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
    • Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.

  • [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

  • [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.

  • [Audio (known issue)] Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.

Known issues in this update

Windows activation and licensing commands might fail with error 0x80041008

Symptoms

After installing the November 2026 Windows security update, certain Windows activation and licensing operations performed using the Software Licensing Management Tool might fail.

Affected devices might encounter error 0x80041008, Invalid parameter (SWbemObjectEx), when running commands to activate Windows, configure Key Management Service (KMS), or manage product keys. The failure has been observed while executing the following commands:

  • slmgr.vbs /skms-domain <domain>
  • slmgr.vbs /ipk <key>

This issue primarily affects organizations that use command-line tools or automated processes to manage Windows activation and licensing.

Devices that are already activated remain activated. Customers whose devices already have the appropriate KMS client key and KMS configuration, and who do not need to run the affected Slmgr.vbs commands, are not expected to be affected.

Devices that are being configured to use KMS activation might encounter errors when attempting to initiate their activation. KMS-activated devices typically remain activated for up to 180 days following successful activation. Customers who have the KMS client key already installed in their image and do not use slmgr for further configurations are unaffected.

Workaround

A workaround is available for organizations that need an immediate mitigation. Please contact Microsoft Support for business. We are working on a resolution that will be available in the coming days. We will update this documentation when it becomes available

Applies to: Windows 10 Enterprise LTSC 2021 and Windows 10 IoT Enterprise LTSC 2021

Important

Use EKB KB5003791 to update to Windows 10, version 21H2 on supported editions.

This security update includes fixes and quality improvements that are part of the following updates:

  • October 26, 2026—KB5134125 (OS Builds 19045.7811 and 19044.7811) Out-of-band

  • October 13, 2026—KB5126657 (OS Builds 19045.7807 and 19044.7807

  • Extended Security Updates (ESU) Licensing Preparation Package for Windows 10

The following is a summary of the issues that this update addresses when you install this update. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

  • [Date and Time] This update adjusts daylight saving time (DST) rules for Cuba for the extended 2026-2027 DST period. Cuba remains on UTC-04:00 and doesn't observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.

    • For the latest DST and time zone guidance, see the Daylight Saving Time & Time Zone Blog.

  • [Printing] - Fixed: Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device might fail with error 87, "The parameter is incorrect." This issue was introduced by the October 2026 update and does not generally affect existing printers or printing.

  • [Remote Desktop]

    • Fixed: The “Specify thumbprints of certificates representing trusted .rdp publishers” policy could not be configured successfully through Microsoft Intune.
    • Fixed: Remote Desktop shadow connections might fail with an “Unspecified error” on Windows Server 2016 and Windows Server 2012 R2 after installing the October 14, 2026, update.

  • [Windows PowerShell] This update strengthens security for PowerShell script signing and signature verification by introducing stricter encoding validation. As a result, scripts containing invalid UTF-8 encoding might fail signature validation, even if they were previously accepted. To resolve this issue, review the affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again. For further guidance, see Encoding Guidance for Signed PowerShell Scripts.

  • [Security] This update improves NTLM security by enabling clients to offer NTLM message signing by default for non-anonymous connections. This change helps reduce exposure to NTLM relay attacks and provides auditing to identify connections that are not using signing. To learn more, see NTLM signing security improvements in Windows.

  • [Audio (known issue)] Fixed: USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update.

Known issues in this update

Windows activation and licensing commands might fail with error 0x80041008

Symptoms

After installing the November 2026 Windows security update, certain Windows activation and licensing operations performed using the Software Licensing Management Tool might fail.

Affected devices might encounter error 0x80041008, Invalid parameter (SWbemObjectEx), when running commands to activate Windows, configure Key Management Service (KMS), or manage product keys. The failure has been observed while executing the following commands:

  • slmgr.vbs /skms-domain <domain>
  • slmgr.vbs /ipk <key>

This issue primarily affects organizations that use command-line tools or automated processes to manage Windows activation and licensing.

Devices that are already activated remain activated. Customers whose devices already have the appropriate KMS client key and KMS configuration, and who do not need to run the affected Slmgr.vbs commands, are not expected to be affected.

Devices that are being configured to use KMS activation might encounter errors when attempting to initiate their activation. KMS-activated devices typically remain activated for up to 180 days following successful activation. Customers who have the KMS client key already installed in their image and do not use slmgr for further configurations are unaffected.

Workaround

A workaround is available for organizations that need an immediate mitigation. Please contact Microsoft Support for business. We are working on a resolution that will be available in the coming days. We will update this documentation when it becomes available

Windows 10 servicing stack update (KB5132689) - version 19041.7838

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). SSUs improves the reliability of the update process and includes fixes to the servicing stack, the component that installs Windows updates.

Note: This servicing stack update (SSU) includes enhanced logic to verify whether a device is hosted on Azure, leveraging an updated certificate chain for validation. To ensure that the device can access the required certificate update domains to successfully download and install certificate updates, see Certificate downloads and revocation lists and Azure Certificate Authority details. To learn more about SSUs, see Servicing stack updates.

How to get this update

Before you install this update

  • For Windows Update: You must have the Windows update released on or after July 8, 2025 (such as KB5062554) installed before installing this update.

  • For Windows Server Update Services (WSUS) deployment or when installing the standalone package from Microsoft Update Catalog: You must have the Windows update released on or after July 8, 2025 (such as KB5062554) installed before installing this update.

  • For offline OS image servicing: If your image does not have the July 25, 2023 (KB5028244) or later LCU, you must install the special standalone November 10, 2023 SSU (KB5031539) before installing this update.

  • Servicing Stack Update (SSU): You must have installed servicing stack update version 19044.6088 or later before installing this update. To determine the latest SSU installed on your device, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt. The Package Identity line returned must be version 19044.6088 or later.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

  • Use the Update WinPE script to update an existing Windows image. (Recommended)
  • Manually copy the boot.stl file from the devices Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Get and install this update

To get and install this update, use one of the following Windows and Microsoft release channels.

  • Windows Update
  • Business
  • Microsoft Update Catalog
  • Windows Server Update Services
Available Next Step
Available This update will be downloaded and installed automatically from Windows Update.
Available Next Step
Available This update will be downloaded and installed automatically from Windows Update for Business in accordance with configured policies.
Available Next Step
Available To get the standalone package for this update, go to the Microsoft Update Catalog website.

For information about how to download and install updates from the Update Catalog, see How to download updates that include drivers and hotfixes from the Windows Update Catalog.
Available Next Step
Available This update will automatically sync with Windows Server Update Services (WSUS) if you configure Products and Classifications as follows:

For Windows 10, version 22H2:
  • Product: Windows 10, version 1903 and later
  • Classification: Security Updates
For Windows 10, version 21H2
  • Product: Windows 10 LTSB
  • Classification: Security Updates
To set up your WSUS server to sync based on products and classifications, see Synchronizing Update by Product and Classification.

To manually import updates into WSUS, see Import updates into WSUS by using PowerShell.

File information

A list of the files that are included in this update are provided in a CSV (Comma delimited) (*.csv) file. The file can be opened in a text editor such as Notepad or in Microsoft Excel.

Note The English (United States) version of this software update might contain files for additional languages.

Download Download the file information for cumulative update KB5131096.

Download Download the file information for update SSU (KB5132689) - version 19041.7838.

References

  • For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types.

  • For an overview of Windows 10, version 21H2 or Windows 10, version 22H2, see its update history page.

Related topics

  • Microsoft Store application updates

    Windows updates do not install Microsoft Store application updates. If you are an enterprise user, see Microsoft Store apps - Configuration Manager. If you are a consumer user, see Get updates for apps and games in Microsoft Store.

  • Secure Boot certificate updates remain in progress as Microsoft transitions devices from certificates that began expiring in 2026 to newer certificates. Devices that have not yet received the newer certificates can continue to start and receive standard Windows updates. Microsoft will continue delivering the newer Secure Boot certificates to eligible devices through Windows Update.

Change log
Change date Change description
November 12, 2026 Known issue fixed: "USB Audio 1.0 devices might fail to start and display error code 10 in Device Manager after installing a recent security update".
November 11, 2026 Added a known issue for Windows activation and licensing commands that might fail with error 0x80041008 after installing the November 2026 Windows security update.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.