KB5058920 (OS Build 20348.3561) Out-of-Band Update for Windows Server 2022 - April 11, 2025

Summary

This is an out-of-band, non-security quality update for Windows Server 2022, bringing the OS to build 20348.3561. Released on April 11, 2025, it targets a specific display bug in Active Directory Group Policy audit logon settings. It also bundles the servicing stack update KB5055668 (version 20348.3440). See the Microsoft Support page for full details.

Improvements and fixes

• Resolves a known issue where Audit Logon/Logoff events configured through the local Active Directory Group Policy were not displayed as enabled in the Local Group Policy Editor or Local Security Policy - even when the settings were actually active and functioning correctly. Affected systems showed the "Audit logon events" policy with a Security Setting of "No auditing," which did not reflect the true enforcement state. Note: home users are unlikely to be affected, as logon auditing is primarily an enterprise requirement.
• Includes the Windows Server 2022 servicing stack update (KB5055668, version 20348.3440), which improves the reliability and stability of the component responsible for installing Windows updates.

Known issues

Citrix Session Recording Agent blocks update installation

Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 (released December 2024) installed may fail to complete installation of the January 2025 Windows security update. The update may appear to download and apply correctly, but on restart the system displays an error similar to "Something didn't go as planned. No need to worry - undoing changes" and reverts to the previously installed Windows updates. This issue is expected to affect only a limited number of organizations, and home users are not expected to be affected.

Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. For details, refer to the Citrix documentation titled "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent."

SgrmBroker.exe error in Windows Event Viewer

Symptom: On devices with Windows updates released January 14, 2025, or later installed, Windows Event Viewer may log an error under Windows Logs > System as Event 7023, with text similar to "The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935." This error is only visible if Event Viewer is actively monitored; it does not appear as a dialog box or notification and has no impact on device performance, functionality, or security level. The SgrmBroker.exe service was originally created for Microsoft Defender but has not been part of its operation for a long time, and the service is already disabled in other supported Windows versions. Microsoft advises against manually starting, configuring, uninstalling, or removing this service or its components, as future updates will adjust the relevant components.

Workaround: This issue is addressed in KB5055526.

How to get this update

Before installing, note that Microsoft combines the latest servicing stack update (SSU) with the latest cumulative update (LCU) in a single package. For offline OS image servicing, confirm that your image includes KB5030216 (released 09/12/2023) or a later LCU. Without it, install that update on your offline media first - it sets the minimum required SSU version (20348.1960) and prevents error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

This update is available through the following channels:

• Windows Update - available for eligible devices automatically.
• Windows Update for Business - available through standard Windows Update for Business policies.
• Microsoft Update Catalog - download the standalone package directly from the Microsoft Update Catalog.
• Windows Server Update Services (WSUS) - available for deployment through WSUS.

To remove only the LCU after installing the combined SSU and LCU package, use the DISM /Remove-Package command with the LCU package name. Locate the package name first with DISM /online /get-packages. Running wusa.exe with the /uninstall switch against the combined package will not work because the package includes the SSU, and the SSU cannot be removed after installation.

Frequently asked questions

Why was this update released out-of-band rather than on Patch Tuesday?

Out-of-band updates address specific issues that are significant enough to warrant an immediate fix rather than waiting for the next scheduled monthly release. In this case, Microsoft released KB5058920 to correct a Group Policy audit logon display problem that could mislead administrators into thinking audit policies were not applied when they actually were.

Does the audit logon display bug mean audit events were never actually logged?

No. According to Microsoft, the Audit Logon/Logoff events were enabled and working as expected on affected devices. The problem was purely a display issue in the Local Group Policy Editor and Local Security Policy - the Security Setting appeared as "No auditing" even though the policy was enforced and events were being captured.

Is the SgrmBroker.exe Event 7023 error a security risk?

Microsoft states that there is no change to the security level of a device resulting from this issue. The System Guard Runtime Monitor Broker Service no longer serves a functional purpose and is already disabled in other supported Windows versions. Administrators should not manually modify or remove the service, as future Windows updates will handle the necessary component adjustments.

Do I need to install the servicing stack update separately before applying KB5058920?

No. The servicing stack update KB5055668 (version 20348.3440) is bundled directly into this cumulative update package. The only prerequisite to be aware of applies to offline OS image servicing: your image must include KB5030216 or a later LCU before applying this update offline.