KB5051989: Windows 11 Security Update - OS Builds 22621.4890 and 22631.4890 (February 2025)

Summary

KB5051989 is a mandatory security update for Windows 11 versions 22H2 and 23H2, released on February 11, 2025. It advances affected devices to OS builds 22621.4890 and 22631.4890, addresses security issues across the Windows operating system, and includes a fix for a Hyper-V backup delay. A servicing stack update (KB5053488) is bundled in the same package. See Microsoft Support for the official page.

Highlights

• This update addresses security issues for the Windows operating system.

Improvements and fixes

• Hyper-V (Windows 11 version 22H2): A delay that occurred during backup scenarios - which could prevent backups from completing normally - has been resolved.
• Windows 11 version 23H2: This build carries all improvements present in Windows 11 version 22H2. No additional issues are separately documented for the 23H2 release.
• Servicing stack (KB5053488): Quality improvements have been made to the servicing stack component that handles Windows update installation, covering both build 22621.4890 and 22631.4890.
• The package incorporates improvements previously delivered in KB5050092, released January 28, 2025. Devices that already have earlier updates installed will download and apply only the new changes.

Known issues

OpenSSH service fails to start

Symptom: After installing the October 2024 security update, some devices find that the OpenSSH (Open Secure Shell) service will not start, blocking all SSH connections. The failure produces no detailed log output, and manually running sshd.exe is required. The problem affects enterprise, IoT, and education customers on a limited number of devices. Microsoft is still investigating whether Home and Pro consumers are also affected.

Workaround: This issue is addressed in KB5052094.

Citrix Session Recording Agent blocks update installation

Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 - released December 2024 - may be unable to complete installation of the January 2025 Windows security update. The update may appear to download and apply correctly, but upon restarting to finish installation, an error similar to "Something didn't go as planned. No need to worry - undoing changes" appears and the device reverts to its previous Windows update state. Home users are not expected to be affected.

Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released April 28, 2025, and in newer versions. Citrix documentation titled "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent" provides further detail.

USB dual-mode printer prints random text

Symptom: Enterprise users may find that USB-connected dual-mode printers supporting both USB Print and IPP Over USB protocols unexpectedly print random text, network commands, and unusual characters after this update is installed. Printed output frequently begins with the header "POST /ipp/print HTTP/1.1" followed by additional IPP-related headers. The problem occurs most often when the printer is powered on or reconnected after being disconnected.

Workaround: This issue is addressed in KB5053657.

How to get this update

Microsoft bundles the latest servicing stack update (SSU) for the operating system together with the latest cumulative update (LCU) in a single package, so no separate SSU prerequisite step is required before installation.

• Windows Update and Microsoft Update: The update downloads and installs automatically. No manual steps are needed.
• Windows Update for Business: The update is available and deploys automatically according to configured policies.
• Microsoft Update Catalog: A standalone package can be downloaded directly from the Microsoft Update Catalog website.
• Windows Server Update Services (WSUS): The update syncs automatically when Products is set to Windows 11 and Classification is set to Security Updates.

To remove only the LCU after installing the combined package, use the DISM /online /remove-package command with the LCU package name as the argument. Running wusa.exe /uninstall against the combined package will not work because the SSU is embedded and cannot be removed after installation.

Frequently asked questions

Does this update apply to both Windows 11 22H2 and 23H2?

Yes. KB5051989 targets Windows 11 Enterprise and Education version 22H2, as well as all editions of Windows 11 version 23H2. Both builds advance to 22621.4890 and 22631.4890 respectively. The 23H2 build carries all improvements from 22H2, with no additional separately documented changes for that version.

Is the servicing stack update separate from KB5051989?

No. Microsoft now bundles the servicing stack update (KB5053488) directly with the cumulative update package. You do not need to install an SSU independently before applying KB5051989. Note, however, that the SSU portion cannot be uninstalled after the combined package is applied.

Will this update also install or update Microsoft Store apps?

No. Windows updates delivered through this KB do not install or update Microsoft Store applications. Enterprise administrators should consult Microsoft Store apps - Configuration Manager documentation, and consumer users should check for app updates from within the Microsoft Store app directly.

How should sysadmins handle the OpenSSH and Citrix known issues before deploying broadly?

For the OpenSSH issue, apply KB5052094, which resolves the problem. For Citrix environments running Session Recording Agent version 2411, upgrade the SRA to version 2503 or later before deploying this update, or consult Citrix guidance. For the USB printer issue, apply KB5053657 to affected enterprise devices.