KB5053603: Windows Server 2022 Security Update (OS Build 20348.3328) - March 2025

Summary

KB5053603 is a security quality update for Windows Server 2022, released on March 11, 2025, that advances the OS build to 20348.3328. It addresses several functional issues including an OpenSSH service startup failure, daylight saving time changes for Paraguay, GB18030-2022 encoding support, and an Azure Virtual Network metering bug. See Microsoft Support for the official source.

Highlights

• Paraguay daylight saving time (DST) rule changes are now supported.
• A known OpenSSH service startup failure that blocked SSH connections has been fixed.
• Support for the GB18030-2022 character encoding standard amendment has been added.
• A fix is available to disable the Azure Virtual Network (VNET) metering feature via a registry key.

Improvements and fixes

• Daylight saving time - Paraguay: The update incorporates updated DST rules for Paraguay to keep time calculations accurate.
• OpenSSH service startup failure (known issue fix): Previously, the OpenSSH service could fail to start silently, cutting off SSH connectivity and requiring administrators to run sshd.exe manually. This release resolves that failure.
• GB18030-2022 encoding: The update adds support for the GB18030-2022 amendment, expanding character set coverage for environments that require this standard.
• Azure Virtual Network metering: A fix allows administrators to disable the VNET metering feature by setting the registry key HKLM\CurrentControlSet\Services\NcHostAgent\Parameters\Plugins\Vnet, DWORD value MeteringDisabled, to 1.
• Servicing stack update bundled: This release also incorporates the Windows Server 2022 servicing stack update KB5053666 (version 20348.3320), which improves the reliability of the component responsible for installing Windows updates.

Known issues

Citrix Session Recording Agent blocks update installation

Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 (released December 2024) may fail to complete installation of the January 2025 Windows security update. The update may appear to download and apply correctly, but on restart the device shows a message similar to "Something didn't go as planned. No need to worry - undoing changes" and then reverts to the previously installed updates. This issue is expected to affect only a limited number of organizations, and home users are not expected to be affected.

Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released April 28, 2025, and later versions. Citrix has published additional details in their article "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent."

System Guard Runtime Monitor Broker service error in Event Viewer

Symptom: On devices running Windows updates released January 14, 2025, or later, Windows Event Viewer may log an error for SgrmBroker.exe under Windows Logs > System as Event ID 7023, with text similar to: "The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935." This error is only visible if Event Viewer is actively monitored; it does not appear as a dialog or notification. The service was originally created for Microsoft Defender but is no longer part of its operation. Microsoft states there is no performance, functionality, or security impact. The service has already been disabled in other supported Windows versions, and SgrmBroker.exe currently serves no purpose. Administrators should not manually start, configure, uninstall, or remove this service or its components, as doing so may trigger additional errors unnecessarily.

Workaround: This issue is addressed in KB5055526. No manual action is required in the meantime.

How to get this update

Before installing, note that Microsoft bundles the latest servicing stack update (SSU) with the cumulative update package. For offline OS image servicing, make sure the image already includes KB5030216 (released 09/12/2023) or a later LCU. That update sets the SSU version to 20348.1960, which is the minimum required to avoid error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

This update is available through the following channels:

• Windows Update / Microsoft Update: Downloads and installs automatically.
• Windows Update for Business: Deploys automatically in line with your configured policies.
• Microsoft Update Catalog: Download the standalone package directly from the catalog for manual deployment.
• Windows Server Update Services (WSUS): Syncs automatically when Products and Classifications are configured as Product: Microsoft Server operating system-21H2 and Classification: Security Updates.

If you need to remove the cumulative update after installation, use the DISM /Remove-Package command with the LCU package name as the argument. Use DISM /online /get-packages to locate the package name. Note that using wusa.exe /uninstall on the combined package will not work because the package also contains the SSU, which cannot be removed after installation.

Frequently asked questions

Does this update include a servicing stack update, and do I need to install it separately?

No separate installation is needed. Microsoft bundles the servicing stack update KB5053666 (version 20348.3320) directly into this cumulative package. When you install KB5053603 through any supported channel, the servicing stack improvements are applied at the same time without any additional steps on your part.

What should I do about the SgrmBroker.exe Event ID 7023 errors appearing in Event Viewer?

No action is required. Microsoft confirms that the System Guard Runtime Monitor Broker service no longer serves an active purpose and that this error has no impact on performance, functionality, or device security. Do not attempt to manually start, reconfigure, or remove the service. A future Windows update - specifically KB5055526 - addresses the underlying cause.

We use Citrix Session Recording Agent. Will this update install successfully on our servers?

If your environment is running Citrix SRA version 2411, you may experience installation failures where the update is rolled back on restart. The fix is to upgrade to Citrix SRA version 2503 or later (released April 28, 2025) before applying this update. Consult Citrix documentation for step-by-step guidance on the upgrade process.

How do I disable Azure VNET metering after installing this update?

After applying KB5053603, you can disable the VNET metering feature by adding a DWORD registry value named MeteringDisabled set to 1 under HKLM\CurrentControlSet\Services\NcHostAgent\Parameters\Plugins\Vnet. This capability is made available by this update and was not previously supported via registry control.