Loading story…
Microsoft said the Windows security update KB5082063 can cause some Windows domain controllers to enter continuous reboot loops after LSASS crashes during startup. The issue affects non-Global Catalog domain controllers in environments using Privileged Access Management, disrupting Active Directory authentication and directory services and potentially making affected domains unavailable. Impacted platforms include Windows Server 2016, 2019, 2022, 23H2, and 2025, while consumer systems and devices outside IT-managed domains are not affected.
Microsoft has not yet released a fix and is advising affected organizations to contact Microsoft Support for Business for mitigation guidance. The company also acknowledged two other known issues tied to KB5082063: installation failures on some Windows Server 2025 systems and BitLocker recovery key prompts on some Windows Server 2025 devices. The incident adds to a string of recent Windows Server update problems that have affected domain controllers and authentication services in enterprise environments.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
Microsoft issued out-of-band emergency updates to fix problems caused by the April 2026 security updates across multiple Windows Server versions. The Windows Server 2025 OOB update KB5091157 addressed both KB5082063 installation failures and domain controller reboot loops, while OOB updates for other supported server versions fixed the restart-loop issue.
Microsoft said it was still developing a fix for the KB5082063 reboot-loop issue and directed impacted administrators to Microsoft Support for Business for mitigation guidance. The company also noted separate April 2026 problems tied to the same update, including installation failures and BitLocker recovery prompts on some Windows Server 2025 systems.
Microsoft disclosed that the April 2026 Windows security update KB5082063 can trigger LSASS crashes during startup on some non-Global Catalog domain controllers in Privileged Access Management environments, causing continuous reboot loops. The issue affects Windows Server 2016, 2019, 2022, 23H2, and 2025 and can disrupt authentication and directory services.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcego.theregister.com
Open sourcetomshardware.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft confirmed that security update **KB5087537** for **Windows Server 2016** can break domain controller discovery on servers whose names are exactly the 15-character NetBIOS limit. After installing the May 2026 update, affected systems may return `ERROR_INVALID_PARAMETER` during **DCLocator** operations, including domain controller lookups performed by tools and applications, preventing systems from locating a domain controller and disrupting Active Directory-dependent functions such as authentication, Group Policy processing, and **DFS Namespace** administration. Microsoft added the problem to the update’s known issues list and said it remains under investigation, with no fix timeline disclosed. Organizations running impacted domain controllers may need to use shorter hostnames or delay deployment of **KB5087537** where possible until a corrective update is released. The issue adds to a broader history of Microsoft domain and Group Policy-related servicing and security problems, including the critical **JASBUG** flaw tracked as **CVE-2015-0008**, which allowed attackers on malicious networks to compromise domain-joined Windows systems through Group Policy and domain controller interactions.
Jun 29, 2026
A bug in recent Windows security updates has caused some systems to unexpectedly boot into BitLocker recovery mode after installation and reboot. Microsoft confirmed that the issue primarily affects Intel devices with Connected Standby (Modern Standby) support, impacting platforms such as Windows 11 24H2, 25H2, and Windows 10 22H2. Users encountering this problem are required to enter their BitLocker recovery key to regain access, after which the system resumes normal operation without further prompts. Microsoft has acknowledged the problem and advised IT administrators to use a group policy delivered via Known Issue Rollback (KIR) as a mitigation, with further support available through Microsoft Support for business customers. This incident follows similar BitLocker recovery issues triggered by Windows updates in May 2025, August 2024, and August 2022, highlighting a recurring challenge with update compatibility and BitLocker functionality on certain hardware configurations.
Jun 29, 2026
Microsoft is investigating reports that the Windows 11 cumulative security update **KB5124008** can break Active Directory domain trust relationships after affected enterprise endpoints restart. On Windows 11 24H2 and 25H2 systems, the issue reportedly disrupts the machine-account secure channel with domain controllers, preventing valid domain users from signing in; cached offline credentials may remain usable. Administrator reports link the failures to **Machine Identity Isolation** operating in enforcement mode, although Microsoft has not confirmed the root cause, added the problem to its known-issues documentation, or released an official workaround. Organizations should limit deployment, preserve local administrator or LAPS recovery access, and test remediation carefully; reported options include uninstalling the update, repairing or resetting the machine-account password, or rejoining systems to the domain, while disabling Machine Identity Isolation may reduce security protections or itself affect authentication.
Sep 17, 2026