KB5052819 (OS Build 20348.3095) Out-of-Band Update for Windows Server 2022

Summary

KB5052819 is a non-security, out-of-band quality update for Windows Server 2022, producing OS Build 20348.3095. Released on January 18, 2025, it addresses a critical startup failure affecting servers with two or more NUMA nodes. It also bundles servicing stack update KB5050117 (version 20348.3081). See Microsoft Support for full details.

Improvements and fixes

• NUMA node startup failure: Resolves an issue where servers equipped with two or more Non-Uniform Memory Access (NUMA) nodes fail to start up after applying recent updates.
• Servicing stack quality improvement: Includes servicing stack update KB5050117 (build 20348.3081), which improves the reliability of the component responsible for installing Windows updates on the device.

Known issues

OpenSSH service fails to start after October 2024 security update

Symptom: After installing the October 2024 security update, some devices experience a failure where the OpenSSH (Open Secure Shell) service does not start, blocking all SSH connections. The service fails silently with no detailed log output, and manually running sshd.exe is required as an interim measure. This affects enterprise, IoT, and education customers on a limited number of devices.

Workaround: This issue is addressed in KB5053603.

Citrix Session Recording Agent 2411 blocks January 2025 update installation

Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 (released December 2024) installed may be unable to complete installation of the January 2025 Windows security update. The update may initially download and apply correctly, but on restart the device displays a message similar to "Something didn't go as planned. No need to worry - undoing changes" and reverts to the previously installed Windows update state. Home users are not expected to be affected.

Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. For details, see the documentation provided by Citrix at "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent".

Windows Event Viewer shows SgrmBroker.exe error (Event 7023)

Symptom: On devices that have installed Windows updates released January 14, 2025, or later, the Windows Event Viewer may display Event 7023 under Windows Logs > System with text similar to "The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935". This error is silent - it does not appear as a dialog or notification - and Microsoft states there is no impact to performance, functionality, or device security level. SgrmBroker.exe was originally created for Microsoft Defender but no longer plays a role in its operation, and the service has already been disabled in other supported Windows versions. Microsoft advises against manually starting, uninstalling, or removing this service or its components, as doing so may trigger additional errors.

Workaround: This issue is addressed in KB5055526.

How to get this update

This update is available exclusively through the Microsoft Update Catalog; it is not available via Windows Update, Windows Update for Business, or Windows Server Update Services (WSUS) directly. Administrators should visit the Microsoft Update Catalog website to download the standalone package.

Before installing, ensure that any offline OS image being serviced already includes KB5030216 (released September 12, 2023) or a later cumulative update. This prerequisite brings the SSU version to 20348.1960, which is the minimum required to avoid error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

This update combines the latest servicing stack update (SSU) with the cumulative update in a single package. Because of this, using wusa.exe /uninstall to remove the package will not work - the SSU component cannot be removed after installation. To remove only the LCU portion, use the DISM /Remove-Package command with the LCU package name as the argument; the package name can be found by running DISM /online /get-packages.

Frequently asked questions

Why was this update released out-of-band rather than on Patch Tuesday?

Microsoft released KB5052819 outside the regular monthly update cycle because it addresses a high-impact issue - server startup failure on systems with two or more NUMA nodes - that could not wait until the next scheduled Patch Tuesday. Out-of-band releases are used when a fix is urgent enough to warrant immediate availability rather than bundling it into the next monthly rollup.

Does this update include security fixes?

No. KB5052819 is explicitly a non-security update. It delivers quality improvements only, specifically the NUMA node startup fix and the bundled servicing stack update (KB5050117). Organizations that have already applied the relevant January 2025 security updates do not need this update for security coverage - only for the NUMA startup fix.

Is the servicing stack update (KB5050117) installed separately?

No. Microsoft now combines the SSU with the cumulative update in a single package. KB5050117 (version 20348.3081) is included within KB5052819 and installs automatically alongside it. There is no need to download or apply it separately when installing this update.

What should administrators do about the SgrmBroker.exe Event 7023 errors in Event Viewer?

No action is required. Microsoft confirms the error has no effect on performance, functionality, or security. Administrators should not attempt to manually start, configure, uninstall, or remove SgrmBroker.exe or its components, as doing so may generate additional unnecessary errors. A future Windows update will adjust the components associated with this service.