KB5055523: Windows 11 24H2 Security Update (OS Build 26100.3775) - April 8, 2025
April 8, 2025 cumulative security update for Windows 11 version 24H2, bringing OS build to 26100.3775 with authentication, DST, and security fixes.
Summary
This is the April 8, 2025 cumulative security update for Windows 11 version 24H2, lifting the OS build to 26100.3775. Released on April 8, 2025, it is a mandatory monthly security update that addresses authentication issues, daylight saving time changes, OS security hardening, and Windows Hello improvements. Source: Microsoft Support.
Highlights
- This update addresses security issues for the Windows operating system.
Improvements and fixes
This update incorporates all improvements from KB5053656, released March 27, 2025. Key areas addressed include:
- Authentication: Fixes an issue with machine password rotation in the Identity Update Manager certificate/PKNIT path. The problem occurred when Kerberos was in use and Credential Guard was enabled, potentially breaking user authentication. The Machine Accounts in Credential Guard feature, which depends on password rotation via Kerberos, has been disabled until a permanent fix is available.
- Daylight Saving Time (DST): Adds a DST update for the Aysen region in Chile to reflect the government DST change order for 2025.
- OS Security: Installing this update or any later Windows update creates a new
%systemdrive%\inetpubfolder on the device. This folder must not be deleted, even if Internet Information Services (IIS) is not enabled. This behavior is part of protections related to CVE-2025-21204 and requires no action from IT admins or end users. - Windows Hello: After installing this update, Windows Hello facial recognition requires color cameras to detect a visible face at sign-in, as a security enhancement related to CVE-2025-26644.
- AI Components updated: Image Search, Content Extraction, and Semantic Analysis components are all updated to version 1.7.820.0.
- Servicing stack update included: A bundled servicing stack update (KB5058538, version 26100.3764) improves the reliability of the Windows update installation component.
Known issues
Citrix Session Recording Agent blocks update installation
Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 - released December 2024 - may download and begin applying the January 2025 Windows security update, then fail to complete installation after restart. An error message similar to "Something didn't go as planned. No need to worry - undoing changes" appears, and the device reverts to its previous update state. Home users are not expected to be affected.
Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released April 28, 2025, and newer versions. See Citrix documentation titled "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent" for details.
Windows Hello facial recognition and PIN unavailable after Reset this PC
Symptom: This issue only affects devices where System Guard Secure Launch or Dynamic Root of Trust for Measurement (DRTM) is enabled after installing this update. Devices with Secure Launch or DRTM enabled before this update, or those with these features disabled, are not impacted. After installing this update and performing a Push button reset or Reset this PC via Settings > System > Recovery using "Keep my Files" and "Local install", some users may be unable to sign in with Windows Hello facial recognition or PIN. Error messages may include "Something happened and your PIN isn't available. Click to set up your PIN again" or "Sorry something went wrong with face setup".
Note: Inability to sign in using Windows Hello facial recognition in low light or with a covered camera lens is a deliberate security design change, not this known issue.
Workaround: This issue is addressed in KB5055627.
Blue screen error code 0x18B (SECURE_KERNEL_ERROR)
Symptom: After installing this update and restarting, some devices may encounter a blue screen exception with error code 0x18B, indicating a SECURE_KERNEL_ERROR.
Workaround: This issue is addressed in KB5055627.
Blurry CJK text in Chromium-based browsers at 96 DPI
Symptom: There are reports of blurry or unclear CJK (Chinese, Japanese, Korean) text when displayed at 96 DPI (100% scaling) in Chromium-based browsers such as Microsoft Edge and Google Chrome. The March 2025 Preview Update introduced Noto fonts for CJK languages as fallbacks to improve text rendering. The issue is caused by limited pixel density at 96 DPI, which can reduce the clarity and alignment of CJK characters. Increasing display scaling improves clarity.
Workaround: Microsoft has shared its findings and potential solutions with Google for further discussion. Users can report issues related to Noto CJK fonts through the official Google Noto Fonts GitHub repository.
How to get this update
Microsoft bundles the latest servicing stack update (SSU) with the latest cumulative update (LCU) in a single package. No separate SSU installation step is required.
- Windows Update / Microsoft Update: The update downloads and installs automatically.
- Windows Update for Business: Deploys automatically in line with configured policies.
- Microsoft Update Catalog: Download the standalone package manually. For WSUS catalog installs, two MSU files must be installed in order: first
windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu, thenwindows11.0-kb5055523-x64_b1df8c7b11308991a9c45ae3fba6caa0e2996157.msu. Alternatively, place all MSU files in a single folder and use DISM with the/PackagePathswitch to install them together. - WSUS: Syncs automatically when Product is set to Windows 11 and Classification is set to Security Updates.
To remove the LCU after installation, use DISM /online /remove-package with the LCU package name. Running wusa.exe /uninstall against the combined package will not work because the SSU is embedded and cannot be removed after installation.
Frequently asked questions
Why was the inetpub folder created on my device after this update?
Installing this update or any later Windows update creates a %systemdrive%\inetpub folder as a security measure tied to CVE-2025-21204. This applies whether or not IIS is enabled on the device. The folder must not be deleted, and no administrative action is required.
Does the new Windows Hello facial recognition requirement break existing sign-ins?
After installing this update, Windows Hello facial recognition requires color cameras to detect a visible face. Microsoft notes that failures to sign in due to low light or a covered camera lens are a deliberate security design change, not a defect. This behavior is related to CVE-2025-26644 and is separate from the known PIN/face issue affecting devices with DRTM enabled.
How do I apply this update offline or to installation media using DISM?
Download the MSU files from the Microsoft Update Catalog. For a running PC, run DISM /Online /Add-Package /PackagePath: pointing to the MSU. For offline media, use DISM /Image:mountdir /Add-Package /PackagePath: against a mounted image, or use Add-WindowsPackage in PowerShell with the -PreventPending flag when targeting an offline image.
What should I do if my organization uses Citrix Session Recording Agent version 2411?
Devices running Citrix SRA version 2411 may fail to complete Windows security update installation and roll back. The resolution is to upgrade to Citrix Session Recording Agent version 2503 or later, released April 28, 2025. Consult Citrix documentation for upgrade guidance before deploying this update to affected endpoints.
