Recent Discussions
How to check RDP access to the server
Hello, I have a virtual machine running Windows Server 2019 Datacenter with Active Directory, and all users access it via RDP. No specific access configurations have been set up; I wanted to know if it is possible to check how many times a specific user has connected and from which IP address—is that possible? Also, I wanted to ask if it is possible to determine whether a specific user copied files to their local PC using copy/paste during a session. Thank you
Cannot Connect to VMs in Windows Admin Center
Hi all, I have 1 Server Cluster made up of 3 Server 2022 Hosts on which there is a large number of VMs running on Hyper-V. The typical process for accessing the VMs has been through Windows Admin Center, which is hosted on one of the VMs in the cluster. Around 1 week ago, it was no longer possible to connect to the VMs through Windows Admin Center as an infinite loading screen was presented. Sometimes, the following error shows up in VMConnect: The cluster and servers are still connected to WAC and all the VMs that are expected are present on WAC. Since then, the following things have been attempted: - Restart all servers - Rebuild WAC on Current VM - Build WAC on Fresh VM with the same and different network configuration, using current (2606) and previous (2511) versions of WAC - Build WAC on one of the hosts All these attempts result in the same error as seen before. Has anyone experienced this issue before? Or does anyone have any advice? Thank you in advance!
Resize-StorageTier / Expand Volume on Windows Server 2025 Campus Cluster does not work
Hi Insider Community! Want to expand a CSV on an S2D Windows Server 2025 Campus Cluster. (4-nodes) I get an error message. Resize-StorageTier : Not enough available capacity FullyQualifiedErrorId : StorageWMI 40000,Resize-StorageTier Any hint for me? Does Microsoft know about the issue? Best regards Thomas
Users "Status" fields blank on RDS with Windows Server 2025
Hi, we have two RDS Server with Windows Server 2025 installed (In-Place Upgrade from Server 2019). In Task-Manager under the "Users" Tab all fields of the "Status" row are blank. We cant see if a user is connected or disconnected. In cmd with "query user" it works. Someone else discovered this problem?in-place upgrade fails from b29574 to latest vnext b29595
Hi all, is anyone facing the same issue IPU fails on a fresh b29574 upgrading to latest using WU? provided more information in feedback hub. Thanks for sharing your experience. as a next attempt I will mount ISO and upgrade. mind b29574 was the base bare metal installation so no previous IPUs involved. related feedback https://aka.ms/AA11g03n Tested Upgrade Paths Baseline TargetOS Result 29574 29595 fails 29574 29602 fails 29595 29602 fails Installed roles: - Hyper-V Specialities: tried SysWOW64 removal but failed to do so https://aka.ms/AA11eyy5 OS Drive is ReFS, potientially related https://aka.ms/AA11eyy8 <?xml version="1.0" encoding="utf-16"?> <SetupDiag xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="https://docs.microsoft.com/en-us/windows/deployment/upgrade/setupdiag"> <Version>1.7.0.0</Version> <ProfileName>FindRollbackFailure</ProfileName> <ProfileGuid>3A43C9B5-05B3-4F7C-A955-88F991BB5A48</ProfileGuid> <FailureData>0xc1900101-0x20017 Error: SetupDiag reports rollback failure found.Last Phase = FinalizeLast Operation = Cleanup external drivers after installationError = 0xC1900101-0x20017</FailureData> <FailureData>LogEntry: </FailureData> <FailureData>Refer to "https://docs.microsoft.com/en-us/windows/desktop/Debug/system-error-codes" for error information.</FailureData> <FailureDetails>RollbackErrorCode = 0xC1900101, ExtendedCode = 0x20017, LastOperation = Cleanup external drivers after installation, LastPhase = Finalize</FailureDetails> <Setup360Result>0xc1900101</Setup360Result> <Setup360Extended>0x20017</Setup360Extended> <SetupPhaseInfo> <PhaseName>Finalize</PhaseName> <PhaseStartTime>06/06/2026 13:16:53</PhaseStartTime> <PhaseEndTime>06/06/2026 13:17:35</PhaseEndTime> <PhaseTimeDelta>0:00:00:42.0000000</PhaseTimeDelta> <CompletedSuccessfully>true</CompletedSuccessfully> </SetupPhaseInfo> <SetupOperationInfo> <OperationName>Cleanup external drivers after installation</OperationName> <OperationStartTime>06/06/2026 13:17:35</OperationStartTime> <OperationEndTime>06/06/2026 13:17:35</OperationEndTime> <OperationTimeDelta>0:00:00:00.0000000</OperationTimeDelta> <CompletedSuccessfully>true</CompletedSuccessfully> </SetupOperationInfo> </SetupDiag> also noticing uncommon links in root as if I were using FAT32.Issue with winlogon on Remote Desktop Services:
We are investigating intermittent session establishment failures on Windows Server 2019 servers used as CyberArk PSM / RDS hosts. At unspecified intervals, new privileged sessions fail to establish or are disconnected during the initial session/logon phase. The issue is intermittent and affects new sessions. Existing sessions may continue to work. The strongest and most consistent correlation identified so far is: Microsoft-Windows-TerminalServices-LocalSessionManager/Operational – Event ID 36 Application / Microsoft-Windows-Winlogon – Event ID 4005 We observed that TerminalServices-LocalSessionManager Event ID 36 can occur without a subsequent Winlogon Event ID 4005. However, every observed Winlogon Event ID 4005 is correlated with TerminalServices-LocalSessionManager Event ID 36 in the same incident window. This suggests that Event ID 36 is a consistent precursor or required condition for the Winlogon 4005 cases. Environment Operating system: Windows Server 2019 Role: CyberArk PSM / RDS session host Issue type: intermittent failure during new RDP/PSM session initialization Impact: affected users cannot establish privileged sessions or are disconnected during session startup Similar issue exists on previous windows server 2012 R2 and was fixed : August 16, 2016 – KB3179574 (During virtual channel management, a deadlock condition occurs that prevents the RDS service from accepting new connections.) https://support.microsoft.com/en-us/topic/august-2016-update-rollup-for-windows-8-1-and-windows-server-2012-r2-d472b5d5-4b3a-8e6e-c22a-f62fed604caf I'm looking forward for any ideas how to resolve this issue. Many thanks!!
PowerShell DSC Pullserver stops working with SQL database
After updating Windows Server 2025, our DSC Pull Server stopped communicating with its SQL backend database. The issue was not present before the update, and reverting to the previous version of Microsoft.PowerShell.DesiredStateConfiguration.Service.dll immediately restored normal functionality. With the newer DLL version, the service starts successfully and the endpoint remains available, but no connection is established to the SQL Server database. As a result, database initialization does not occur, required tables are not created or updated, and node registration fails. No database sessions are observed on the SQL Server during registration attempts, indicating that the service does not reach the SQL connection phase. We compared the previous working DLL version with the updated version and confirmed that the regression is introduced by the newer DLL. Replacing the updated DLL with the earlier version consistently restores SQL database connectivity and normal Pull Server Operation.
HLK test failing for a KMDF driver with error “A lower driver failed IRP_MN_QUERY_STOP_DEVICE”
Subject: HLK DF‑PNP Rebalance Fail Restart Device: E: target widens to all volumes; QueryStop fails even without my driver installed. Hi all, I’m trying to pass all HLK tests for my driver. Driver: KMDF PnP volume upper‑filter (attached via UpperFilters to the Volume/Disk class) OS: Windows Server 2016 Datacenter, build 14393 HLK: 10.1.14393.8069 Test: DF - PNP Rebalance Fail Restart Device (Reliability) Target volume: E: (NTFS) Storage: PERC H330 Mini (DELL) (HBA) Observed behavior The DQ initially targets E:, but the test later widens to all STORAGE\Volume devnodes: WDTF_TARGETS : INFO : - Query("IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (IsDevice AND (DriverBinaryNames!='i8042prt.sys') AND (Class!=hdc) AND (Class!=scsiadapter) AND (DsmDevice!=TRUE) AND (DeviceID='STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000'))") WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6.. WDTF_SUPPORT : INFO : - ClearSetupAPILogs() WDTF_TARGETS : INFO : - Query("IsDevice AND (SemiUniqueTargetHardwareIdentifier='STORAGE\Volume')") WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6.. WDTF_TARGETS : INFO : Target: Volume STORAGE\VOLUME{01FEB6.. WDTF_TARGETS : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6.. WDTF_TARGETS : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6.. Failures report A lower driver failed IRP_MN_QUERY_STOP_DEVICE and PNP.RestartDevice() Win32=1 - Incorrect function. For each of the 4 target volumes, it shows this error, DTF_PNP : INFO : - EDTTryStopDeviceFailRestart() WDTF_PNP : INFO : Target: Volume (C:) STORAGE\VOLUME{01FEB6EF-3717-11F1-9707-806E6F6E6963}#000000001F500000 WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed... WDTF_PNP : INFO : - EDTTryStopDeviceFailRestart() WDTF_PNP : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000 WDTF_PNP : INFO : Result: A lower driver failed IRP_MN_QUERY_STOP_DEVICE. Rebalance tests cannot proceed... WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function. WDTF_PNP : ERROR : PNP.RestartDevice() Win32=1 - Incorrect function. Q1. I have tried multiple variations of the DQ query, and each successfully targets the E volume only. Why does this test later widen to all volumes even when DQ targets only E:? How can I force it to stay on E: ? Q2. I also ran this on a physical server client and a VM client, but faced the same issue both times. I understand the system/boot volume may veto QueryStop, but why does each volume report ‘a lower driver failed IRP_MN_QUERY_STOP_DEVICE’ in this test? Q3. I uninstalled my driver completely and still see the same failures when the test is running with only inbox drivers (e.g., msdmfilt.sys, volsnap.sys, volume.sys) listed by Driver Verifier for target E in the logs. That makes me suspect setup/config rather than my driver. Why would only these drivers fail the test as well, what am I missing here? WDTF_DRIVER_VERIFIER : INFO : - EnableOnAllDriversOfDevices() WDTF_DRIVER_VERIFIER : INFO : Target: Volume (E:) STORAGE\VOLUME{01FEB6F1-3717-11F1-9707-806E6F6E6963}#0000000001000000 WDTF_DRIVER_VERIFIER : INFO : Driver: msdmfilt.sys WDTF_DRIVER_VERIFIER : INFO : Driver: volsnap.sys WDTF_DRIVER_VERIFIER : INFO : Driver: volume.sys Thanks for any guidance!Server 2016 Windows Update disabled?
I have Windows 2016 and 2019 Servers. All in in the same OU and getting the same Group Policy. This is confirmed via gpresult. I am using GP to disable Automatic Updates. This looks to be working in 2019: But with Server 2016, it says this: Should I expect these servers to update?PS script for moving clustered VMs to another node
Windows Server 2022, Hyper-V, Failover cluster We have a Hyper-V cluster where the hosts reboot once a month. If the host being rebooted has any number of VMs running on it the reboot can take hours. I've proven this by manually moving VM roles off of the host prior to reboot and the host reboots in less than an hour, usually around 15 minutes. Does anyone know of a powershell script that will detect clustered VMs running on the host and move them to another host within the cluster? I'd rather not reinvent this if someone's already done it.
Did Microsoft make a mistake? WinServer 2022 Standard and up.
Microsoft removed functionality of Windows Deployment Service. I know their are ways to to get around this but they either are hackjobs or deploying your own windows with PE. as far as i know of writing this. I know I could go linux. they have a simple cd to follow. Or Mac has their own version for macs. but not microsoft. They THREW it away for some stupid reason. Do I really have to do a VM or worse ditch DNS & DHCP?Windows Server 2022 File Server Cluster | Network Teaming
Hello Microsoft Community, I have a Windows Server 2022 File Server Cluster (all physical nodes) running with SMB shares. At present, it is not configured with NIC teaming. We are planning to setup NIC teaming. I am going to add an additional network adapter to achieve this. Since this is a production file server server. It tried to perform NIC teaming in a test environment. Upon setting up network teaming, File server clustered roles do not come online and fail. It registers an Event ID 1049 about duplicate IPs despite the fact that I have deleted old network adapter via device manager (show hidden devices). New network adapter comes online without any previous knowledge of IPs. When setting up old IP scheme on a new individual network adapter, File server clustered roles come online successfully. However, setting up the old IP scheme on teamed network adapter, it registers Event ID 1049 about duplicate IPs and roles shows a status of Failed instead of Stopped. Duplicate IPs are only registered for clustered file server roles. They are not registered for node IPs and cluster management IPs. What would be a best way to achieve network teaming on an existing file server cluster without setting up the cluster from scratch?
Unable to Build Switchless Storage using Network ATC
3-Node HV/S2D Cluster using Switchless Storage and Network ATC getting Network HUD Error I have a Dell 3-node server cluster being used to host Hyper-V with S2D. Each node is identical and certified to pass S2D requirements. The networking consists of 2 onboard 1 Gbps and 2 quad-port PCI(e) NICs at 10/25 Gbps. The 2 onboard ports are being used for the management intent, 2 ports from each of those NICs are being connected to 2 top-of-rack switches for the compute intent at a total of 12 10 Gbps connections, and the other 2 ports from each of those NICs are being connected directly to the other nodes in a dual mesh method for the storage intent at a total of 6 25 Gbps connections. Very similar to the Microsoft diagram for a three-node storage switchless, dual TOR, dual link deployment network reference pattern for Azure Local, but I am using Windows Server 2025 Datacenter, not Azure Local. The problem I am encountering is when I attempt to create the switchless storage intent, I get an error (shown below) that reads "Failed to fetch physical NIC mapping from the Network HUD service. Please diagnose..." If I leave off the switchless option, it builds without issue. The error only occurs when I attempt to use the switchless option. I tried without configuring the NIC IP addresses first, as well as trying configuring the NIC IP addresses beforehand. I tried without having a cluster built first, as well as building a failover cluster without storage before running the network intent command. The error I posted below shows my last attempt after having the NICs configured with IP addresses and having a failover cluster established before running the command. The error has remained the same throughout the process. Has anyone else run into an issue like this with switchless storage? It seems like everything that I am trying to do is within scope and should be a supported solution. My fallback plan is to use my existing switches, but that drops my connection speeds down from 25 Gbps to 10 Gbps due to hardware limitations.
ntoskrnl.exe and build version not getting updated after applying KB5078740 on server 2025
I have installed the latest March patch kb5078740 on server 2025 which was upgraded from server 2022. the patch is showing installed but the ntoskrnl.exe and build version is still showing 10.0.26100.4652. Qualys is detecting it as patch not installed based on file version which should be 10.0.21600.32522. Please let me know how to fix this issue.
Recent Blogs
- Trusted Launch for virtual machines We are excited to announce Trusted Launch for virtual machines (TVMs) in Windows Server Insider Preview. Trusted Launch is a security feature you can enable whe...Jul 14, 2026
- 5 MIN READFor decades, applying a security fix to core OS components meant swapping files on disk and restarting so the loader could map the new image into memory. Rebooting to patch is a workaround for a limi...Jul 13, 2026
