Windows Server for IT Pro topics

How to check RDP access to the server

MC2026 — Wed, 15 Jul 2026 13:26:35 GMT

Hello,

I have a virtual machine running Windows Server 2019 Datacenter with Active Directory, and all users access it via RDP. No specific access configurations have been set up; I wanted to know if it is possible to check how many times a specific user has connected and from which IP address—is that possible? Also, I wanted to ask if it is possible to determine whether a specific user copied files to their local PC using copy/paste during a session.

Thank you

Unable to Build Switchless Storage using Network ATC

Slivers — Fri, 10 Jul 2026 15:12:37 GMT

3-Node HV/S2D Cluster using Switchless Storage and Network ATC getting Network HUD Error

I have a Dell 3-node server cluster being used to host Hyper-V with S2D. Each node is identical and certified to pass S2D requirements. The networking consists of 2 onboard 1 Gbps and 2 quad-port PCI(e) NICs at 10/25 Gbps. The 2 onboard ports are being used for the management intent, 2 ports from each of those NICs are being connected to 2 top-of-rack switches for the compute intent at a total of 12 10 Gbps connections, and the other 2 ports from each of those NICs are being connected directly to the other nodes in a dual mesh method for the storage intent at a total of 6 25 Gbps connections. Very similar to the Microsoft diagram for a three-node storage switchless, dual TOR, dual link deployment network reference pattern for Azure Local, but I am using Windows Server 2025 Datacenter, not Azure Local.

The problem I am encountering is when I attempt to create the switchless storage intent, I get an error (shown below) that reads "Failed to fetch physical NIC mapping from the Network HUD service. Please diagnose..." If I leave off the switchless option, it builds without issue. The error only occurs when I attempt to use the switchless option.

I tried without configuring the NIC IP addresses first, as well as trying configuring the NIC IP addresses beforehand. I tried without having a cluster built first, as well as building a failover cluster without storage before running the network intent command. The error I posted below shows my last attempt after having the NICs configured with IP addresses and having a failover cluster established before running the command. The error has remained the same throughout the process.

Has anyone else run into an issue like this with switchless storage? It seems like everything that I am trying to do is within scope and should be a supported solution. My fallback plan is to use my existing switches, but that drops my connection speeds down from 25 Gbps to 10 Gbps due to hardware limitations.

PowerShell DSC Pullserver stops working with SQL database

PatHel — Thu, 09 Jul 2026 07:10:23 GMT

After updating Windows Server 2025, our DSC Pull Server stopped communicating with its SQL backend database. The issue was not present before the update, and reverting to the previous version of Microsoft.PowerShell.DesiredStateConfiguration.Service.dll immediately restored normal functionality.

With the newer DLL version, the service starts successfully and the endpoint remains available, but no connection is established to the SQL Server database. As a result, database initialization does not occur, required tables are not created or updated, and node registration fails. No database sessions are observed on the SQL Server during registration attempts, indicating that the service does not reach the SQL connection phase.

We compared the previous working DLL version with the updated version and confirmed that the regression is introduced by the newer DLL. Replacing the updated DLL with the earlier version consistently restores SQL database connectivity and normal Pull Server Operation.

Installing NDES on Windows 2025, Virtual Directories "CertSrv\mscep" and "mscep_admin" are missing.

IbTornoee — Wed, 08 Jul 2026 06:54:33 GMT

Installing NDES on Windows 2025 the installation ends with no errors, but Virtual Directories "CertSrv\mscep" and "mscep_admin" is missing.

Any ideas?

Regards Ib Tornøe

Windows Server 2022 File Server Cluster | Network Teaming

aleemsyed12 — Wed, 08 Jul 2026 02:59:01 GMT

Hello Microsoft Community,

I have a Windows Server 2022 File Server Cluster (all physical nodes) running with SMB shares. At present, it is not configured with NIC teaming.

We are planning to setup NIC teaming. I am going to add an additional network adapter to achieve this.

Since this is a production file server server. It tried to perform NIC teaming in a test environment. Upon setting up network teaming, File server clustered roles do not come online and fail. It registers an Event ID 1049 about duplicate IPs despite the fact that I have deleted old network adapter via device manager (show hidden devices). New network adapter comes online without any previous knowledge of IPs. When setting up old IP scheme on a new individual network adapter, File server clustered roles come online successfully. However, setting up the old IP scheme on teamed network adapter, it registers Event ID 1049 about duplicate IPs and roles shows a status of Failed instead of Stopped. Duplicate IPs are only registered for clustered file server roles. They are not registered for node IPs and cluster management IPs.

What would be a best way to achieve network teaming on an existing file server cluster without setting up the cluster from scratch?

Issue with winlogon on Remote Desktop Services:

kris1975 — Tue, 30 Jun 2026 09:14:49 GMT

We are investigating intermittent session establishment failures on Windows Server 2019 servers used as CyberArk PSM / RDS hosts.

At unspecified intervals, new privileged sessions fail to establish or are disconnected during the initial session/logon phase. The issue is intermittent and affects new sessions. Existing sessions may continue to work.

The strongest and most consistent correlation identified so far is:

Microsoft-Windows-TerminalServices-LocalSessionManager/Operational – Event ID 36

Application / Microsoft-Windows-Winlogon – Event ID 4005

We observed that TerminalServices-LocalSessionManager Event ID 36 can occur without a subsequent Winlogon Event ID 4005. However, every observed Winlogon Event ID 4005 is correlated with TerminalServices-LocalSessionManager Event ID 36 in the same incident window.

This suggests that Event ID 36 is a consistent precursor or required condition for the Winlogon 4005 cases.

Environment

Operating system: Windows Server 2019

Role: CyberArk PSM / RDS session host

Issue type: intermittent failure during new RDP/PSM session initialization

Impact: affected users cannot establish privileged sessions or are disconnected during session startup

Similar issue exists on previous windows server 2012 R2 and was fixed : August 16, 2016 – KB3179574 (During virtual channel management, a deadlock condition occurs that prevents the RDS service from accepting new connections.)

https://support.microsoft.com/en-us/topic/august-2016-update-rollup-for-windows-8-1-and-windows-server-2012-r2-d472b5d5-4b3a-8e6e-c22a-f62fed604caf

I'm looking forward for any ideas how to resolve this issue. Many thanks!!

Server 2025 to server 2022 downgrade keys

Tonyams — Mon, 29 Jun 2026 22:56:09 GMT

Hello,

We bought licenses with these part #'s MFR# P73-08495 and MFR# EP2-25187 which, according to searches on the internet, have downgrade rights.

We need to get downgrade keys for server 2022 standard.

Our reseller referred us to Microsoft for this.

Could someone help? The activation portal does not give us an option to do this and a microsoft support agent told us to make a post here which seems weird to us. We don't know why they couldn't help us via the phone.

Thanks

Windows Server 2025 Failover Cluster Live Migration Issue

madushan_gunarathne — Sat, 27 Jun 2026 03:06:15 GMT

Hi Everyone,

I am facing an issue in a Hyper-V Failover Cluster environment where Live Migration intermittently fails due to a service logon-related problem. The environment was previously working normally, but now whenever we attempt to Live Migrate a VM between cluster nodes, the migration fails unless we manually run “gpupdate /force” on the Hyper-V host first.

After running gpupdate /force, the migration works temporarily, but the issue returns again during the next migration attempt. This makes it appear that some policy or permission is not being applied consistently on the cluster nodes.

During troubleshooting, I attempted to add “NT VIRTUAL MACHINE\Virtual Machines” to the “Log on as a service” policy under Local Security Policy > Local Policies > User Rights Assignment. However, the account does not appear or resolve in the Object Picker when trying to add it manually.

At this stage, I am trying to understand whether this is related to a domain GPO overwriting local policy settings, a Failover Cluster permission issue, or something specific to Hyper-V virtual machine accounts.

Has anyone encountered a similar issue where Live Migration only works after running gpupdate /force? Also, is there a correct method to add “NT VIRTUAL MACHINE\Virtual Machines” to the “Log on as a service” policy, or should this permission already exist by default on Hyper-V hosts?

Any guidance or recommendations would be greatly appreciated.

Secure Boot update still pending on deadline day

LouisT — Wed, 24 Jun 2026 13:54:32 GMT

After checking the registry keys on 2x VMs which run services for a number of important customers I found they both have:

UEFICA2023Error 2147942750

Apparently this means they're pending a reboot.

https://blog.mindcore.dk/2026/04/secure-boot-certificate-update-intune/

I can't reboot the VM inside working hours, can they be rebooted after the deadline or do I need to disable Secure Boot on the VMs?

I'm concerned I'll have to disable Secure Boot before they're next rebooted for Windows updates.

Save the date: Secure Boot Q&A in July

Heather_Poulsen — Tue, 23 Jun 2026 23:44:27 GMT

To help, Microsoft is continuing its Q&A series with several opportunities to connect directly with Microsoft experts. Whether you're managing physical servers, virtualized workloads, or working with your hardware partners on firmware readiness, you can get answers to the questions that matter most to your environment.

Learn more and add the events to your calendar:

8:00 AM PDT July 1 - Windows Server Secure Boot AMA
8:00 AM PDT July 8 - Secure Boot Office Hours for virtualized environments
7:00 AM - 7:00 PM PDT July 15 - OEM Secure Boot Office Hours

If there's a question that's been holding up your rollout—or one you simply want to validate before moving forward—this is a great opportunity to ask. Feel free to post questions ahead of time or join the conversation live. We look forward to seeing you there.

Event 4768 for one user

justletmelogin50 — Tue, 23 Jun 2026 23:39:31 GMT

Hi all,

We have two domain controllers running server 2019 with Domain Functional Level 2016.

We have one user who has been with us for almost a year, and they were suddenly getting a message in the last week that username or password were incorrect even though we confimed they were not. They were able to initally switch to another user and re-enter their username and log in, but now it won't allow that.

On the domain controller I see events for the user Audit Failure 4768 with Result Code 0x6. This result suggests the username doesn't exist which isn't true. The account isn't being locked.

Has anyone seen this before and know what the issue might be?

thanks

Out of Band Cumulative Updates Question

akertis — Fri, 12 Jun 2026 15:08:31 GMT

I installed March 2026 Cumulative Update on a new server instead of April due to some RC4 changes to test something. I noticed that after the update installed in the event viewer it thinks the June 2026 update was installed. I don't see the June update under installed updates but shows up in update history. The build version of the server matches with the March 2026 update. Is this a weird side effect of installing a superceded update? I'm having trouble understanding what is going on.

KB5094128 ntoskrnl.exe version wrong?

BasP — Fri, 12 Jun 2026 10:04:47 GMT

For update KB5094128 The list of updated files contains an ntoskrnl.exe with file version 10.0.20348.5257 which in my opinion should be 10.0.20348.5256.
https://go.microsoft.com/fwlink/?LinkId=2368532

We use scanning tools which rely on this list of updated files. But the installed file version is different and therefore our scanning tools report these installations as "vulnerable"
After applying patch KB5094128 the version of \windows\system32\ntoskrnl.exe is 10.0.20348.5256

Does anybody know if the information in this .csv is wrong?

SCCM- Upgrade from 2409 to 2509 WSUS timeout issue

cidk2000 — Sat, 06 Jun 2026 17:14:41 GMT

Had a working task sequence on 2409 that performed software updates at the end of the task sequence.

Upgraded to 2509 - I get a timeout issue when getting to that point on the task sequence.

Ive performed maintenance on the WSUS Server, (obsolete, expired etc)

I removed the Software Update Point - and re installed it selected the Products of Server 2016,2019, server operating system 21h2 , Windows 10 1903 or later and Windows 11.

rebooted both the SCCM and SQL Server. after doing the above but the HRESULT 0x80244010 still persists. "Exceeded max server round trips" — client couldn't retrieve all updates in one cycle.

Software centre updates in the OS seem to be unaffected or unknown if clients are affected, only in a task sequence this occurs.

Blog posts refer to older items, what would cause this to fail after a upgrade from 2409 to 2509?

AI help repeats about reducing metadata and updates but for weird reason i keep getting 700+ updates for the above categories!

RDP Client - incorrect keyboard shortcut action in German localization

KnuthKonrad — Fri, 05 Jun 2026 09:30:11 GMT

In the above dialog, when any of the checkbox controls has the focus, ALT+V toggles the state of the checkbox. ALT+V obviously should trigger "Verbinden" (Connect) instead. But not when the dialog first appears, i.e. none of the controls has the focus. Then ALT+V does nothing. As long as any chekbox control has the focus, ALT-V toggles its state. If the command button "Abbrechen" has the focus, ALT-V does nothing, i.e. ALT-V never triggers "Verbinden" except the command button "Verbinden" itself has the focus.

Steps to reproduce:

Start RDP client to connect to a remote machine
Press ALT-Z -> "Zwischenablage" will be checked as expected
Press ALT-Z again -> "Zwischenablage" will be unchecked as expected
After any of the two steps above, press ALT-V -> "Zwischenablage" will be toggled instead of triggering "Verbinden"
Same goes for "WebAuthn".

Depending on the devices on the local machine an the RDP settings for sharing those, their might be more options with checkbox. I suspect those to behave similarly wrong when pressing ALT-V. The OS doesn't seem to make a difference. I see the same behavior on both Windows 11 and Windows Server 2022.

RDP client version:

Windows server 2025 Application Crashing Events

efpan — Thu, 04 Jun 2026 11:39:39 GMT

I have installed a Windows Server 2025 and after starting it in about 30 minutes the following error appears in the Windows application log .

=======================================

Log Name: Application

Source: Application Error

Date: 4/6/2026 1:51:06 μμ

Event ID: 1000

Task Category: Application Crashing Events

Level: Error

Keywords:

User: SERVER\Administrator

Computer: SERVER.efarmacy.internal

Description:

Faulting application name: backgroundTaskHost.exe, version: 10.0.26100.1, time stamp: 0x5bc61463

Faulting module name: biwinrt.dll, version: 10.0.26100.32230, time stamp: 0xb950595a

Exception code: 0xc000027b

Fault offset: 0x0000000000012713

Faulting process id: 0x1964

Faulting application start time: 0x1DCF4100B5B371A

Faulting application path: C:\WINDOWS\system32\backgroundTaskHost.exe

Faulting module path: C:\Windows\System32\biwinrt.dll

Report Id: a0fa5d15-b026-4d12-a047-d965195ac338

Faulting package full name: MicrosoftWindows.Client.CBS_1000.26100.275.0_x64__cw5n1h2txyewy

Faulting package-relative application ID: Global.Accounts

Event Xml:

<Channel>Application</Channel>

<Computer>SERVER.efarmacy.internal</Computer>

</System>

<Data Name="AppName">backgroundTaskHost.exe</Data>

<Data Name="ModuleName">biwinrt.dll</Data>

<Data Name="AppPath">C:\WINDOWS\system32\backgroundTaskHost.exe</Data>

<Data Name="ModulePath">C:\Windows\System32\biwinrt.dll</Data>

<Data Name="PackageFullName">MicrosoftWindows.Client.CBS_1000.26100.275.0_x64__cw5n1h2txyewy</Data>

<Data Name="PackageRelativeAppId">Global.Accounts</Data>

</EventData>

</Event>

===========================================

I have already done the actions to check the files. The check does not find any problems but the problem continues to appear.

"DISM.exe /Online /Cleanup-image /Restorehealth"

"sfc /scannow".

I would like to know if anyone else has faced this problem and if there is a solution for it.

Thanks in advance .

Remote desktop app hangs when opening a new process

ClayFrie — Mon, 01 Jun 2026 14:42:00 GMT

I have a windows remote desktop server, windows server 2022. We have a few programs we allow access to people published as remote apps. One of the programs exports to Excel by opening excel, creates the workbook/worksheet, but the window does not show and the program hangs waiting for excel to close. The user can't see excel and therefore can't close excel so they are stuck. as an admin, I can connect to the remote desktop server and end task on their excel instance and then they can continue working.

Is there a way to allow the excel window to show when opened by a remote app?

We prefer to only allow our users access to the one app they need to run instead of a desktop.

Creating parent reverse lookup zone when child zones already exist — what happens?

pa5424847 — Tue, 26 May 2026 00:09:52 GMT

We have an AD-integrated DNS environment that has accumulated a large number of reverse lookup zones over time, created without any parent zone — essentially DNS sprawl from years of admins creating individual subnet zones rather than working from a parent.

We currently have approximately 80+ reverse lookup zones including:

Dozens of x.10.in-addr.arpa zones covering various 10.x.x.x subnets
Multiple x.172.in-addr.arpa zones
A handful of others including 100.192.10.in-addr.arpa, 168.192.in-addr.arpa, 204.167.in-addr.arpa, 215.204.167.in-addr.arpa, 135.7.in-addr.arpa

None of these were ever delegated from a parent zone — they were just created independently. The 10.in-addr.arpa zone does not exist.

Domain controllers are a mix of Windows Server 2019 Standard (majority) and Windows Server 2025 Standard.

Our goal is to create 10.in-addr.arpa as the consolidation point going forward — new registrations go there, and we migrate existing child zones into it one at a time, deleting old ones as we go at a pace we're comfortable with.

Before touching anything, we need to understand what creating 10.in-addr.arpa will actually do to the existing child zones.

Specifically:

Will existing records in the child zones be deleted? We've seen the TechNet article documenting records vanishing when creating a child zone under an existing parent — does the same destructive behaviour occur in the reverse direction?
Will auto-delegations be created in the new parent zone pointing to the existing child zones, and if so how quickly?
Will the child zones continue to function normally for queries while the parent exists alongside them?
Will dynamic registration start hitting the parent zone for subnets not covered by an existing child zone, or will something unexpected happen?

We can't test this in a lab as we don't have a replica environment available, and can't risk touching production without understanding the behaviour first. Pointers to any documentation covering this specific scenario would also be appreciated — we've been unable to find anything that addresses creating the parent after the children already exist independently.

Windows Server 2025 DC — LSASS handle leak identified via WinDbg — authz!AuthzpDeQueueThreadWorker

RugAmin1 — Sat, 09 May 2026 00:47:09 GMT

Hello All!! Im having a problem, LSASS crashes on a Windows Server 2025 Domain Controller, I identified what appears to be the root cause using WinDbg memory dump analysis. Sharing this hoping someone else has seen it or Microsoft can confirm.

The Problem

LSASS handle count grows continuously over time and eventually crashes with a 0xC0000005 access violation (Event ID 1015). After a reboot the cycle repeats. The growth rate correlates with authentication load and faster during peak hours, slower overnight.

WinDbg Dump Analysis

Captured LSASS dump at high handle count and ran !handle 0 f:

Token handles: overwhelmingly dominant Everything else: negligible

Every leaked token shows:

GrantedAccess: 0x8 (TOKEN_QUERY only) PointerCount: overflowed to negative integer

Running !findstack authz 2 shows multiple worker threads all sitting in:

authz!AuthzpDeQueueThreadWorker

What Was Tested And Eliminated

Stopped or disabled each individually and measured handle growth rate — zero meaningful difference from any:

- Antivirus (all components) - Backup software - Application services - VSS snapshots - Hardware management agents etc..

Environment

OS: Windows Server 2025, fully patched with the latest updates including April LSASS update. Role: Domain Controller DNS PAM: Not active.

Conclusion

Token handles are opened with TOKEN_QUERY access inside authz!AuthzpDeQueueThreadWorker and never released. Reference counter overflows to negative integer. Growth rate scales directly with authentication load.

Current workaround: reboots during off hours.

Has anyone else seen this pattern on Windows Server 2025? Is there a known fix or Microsoft acknowledgment for this specific authz token handle leak?

Windows Server 2025 update with error 0x80073712

madurantia — Thu, 30 Apr 2026 19:46:44 GMT

Hello

Can I have some help?

Windows Server 2025 Std, V 24H2, OS build: 26100.32522

The 2026-04 Security Update (KB5082063) (26100.32690) fails with the following error:

Installation failed: Windows failed to install the following update with error 0x80073712: 2026-04 Security Update (KB5082063) (26100.32690).

Thanks in advance

MadUrantia