KB5059092 (OS Build 20348.3566): Windows Server 2022 Out-of-Band Update - April 16, 2025

Summary

This is a non-security, out-of-band quality update for Windows Server 2022, bringing the OS to build 20348.3566. Released on April 16, 2025, it addresses a container startup failure introduced by the April 8, 2025 container images running in Hyper-V isolation mode. See the full release notes at Microsoft Support.

Improvements and fixes

• Fixes a container startup failure introduced by the 2025.04 B container images released on April 8, 2025. Windows containers running in Hyper-V isolation mode could fail to start when the container's update level did not match that of the hosting utility virtual machine (UVM), causing incompatibilities between system files. After this update, containers correctly access the required system files from the host, improving reliability and compatibility across different Windows versions.

Known issues

Citrix Session Recording Agent blocks January 2025 update installation

Symptom: Devices with Citrix Session Recording Agent (SRA) version 2411 - released in December 2024 - may be unable to complete installation of the January 2025 Windows security update. Affected devices may initially download and apply the update correctly, but when restarting to finish installation, an error similar to "Something didn't go as planned. No need to worry - undoing changes" appears and the device reverts to its previous update state. Microsoft notes this likely affects a limited number of organizations, and home users are not expected to be impacted.

Workaround: The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions. For details, refer to Citrix documentation titled "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent."

How to get this update

Before installing, note that Microsoft combines the latest servicing stack update (SSU) with the latest cumulative update (LCU) into a single package. For offline OS image servicing, you must ensure your image includes KB5030216 (released 09/12/2023) or a later LCU. If it does not, install that update on your offline media first. That LCU brings the SSU to version 20348.1960, which is the minimum required to avoid error 0x800f0823 (CBS_E_NEW_SERVICING_STACK_REQUIRED).

This update is available through the following channels:

• Windows Update - available now.
• Windows Update for Business - available now.
• Windows Server Update Services (WSUS) - available now.
• Microsoft Update Catalog - download the standalone package directly from the Catalog.

If you need to remove the LCU after installing the combined SSU and LCU package, use the DISM /Remove-Package command with the LCU package name as the argument. You can retrieve the package name by running DISM /online /get-packages. Running wusa.exe with the /uninstall switch on the combined package will not work because the package contains the SSU, and the SSU cannot be removed from the system after installation.

The bundled servicing stack update is KB5055668, version 20348.3440.

Frequently asked questions

What problem does this update specifically fix?

This update resolves a startup failure affecting Windows containers running in Hyper-V isolation mode. The root cause was a version mismatch between the container's update level and the hosting utility virtual machine (UVM), introduced by the 2025.04 B container images released on April 8, 2025. After installing this update, containers correctly access necessary system files from the host.

Is this a security update, and do I need to install it on all Server 2022 systems?

No, KB5059092 is a non-security, out-of-band quality update. It is targeted primarily at environments running Windows containers in Hyper-V isolation mode. If your organization does not use Windows containers in that configuration, the urgency is lower, though applying quality updates is still recommended practice.

What do I need to do before installing this update on an offline OS image?

Before applying this update to an offline OS image, confirm that your image already contains KB5030216 (dated 09/12/2023) or a later LCU. If the image does not include it, install that LCU on your offline media first. This ensures the servicing stack is at version 20348.1960 or higher, preventing error 0x800f0823 during installation.

Can I uninstall this update if it causes problems?

You can remove the LCU portion of the package using DISM /Remove-Package with the appropriate package name, found by running DISM /online /get-packages. However, the servicing stack update (SSU) bundled in this package cannot be removed after installation. Using wusa.exe /uninstall on the combined package will not work for this reason.