KB5066189: Windows 11 Out-of-Band Update Fixes Reset and Recovery Failures (Builds 22621.5771 & 22631.5771)
Out-of-band update for Windows 11 22H2 and 23H2 fixing device reset and recovery failures introduced by the August 2025 security update KB5063874.
Summary
This is an optional out-of-band (OOB), non-security update for Windows 11 versions 22H2 and 23H2, bringing OS builds to 22621.5771 and 22631.5771. Released on August 19, 2025, it addresses a device reset and recovery failure introduced by the August 2025 security update. See the Microsoft Support page for full details.
Improvements and fixes
- Resolves a regression introduced by the August 2025 security update (KB5063874) that caused device reset and recovery operations to fail. Affected workflows include: Settings > System > Recovery > Reset my PC, System Recovery > Fix problems using Windows Update, and RemoteWipe CSP.
- Incorporates all quality improvements already shipped in KB5063874 (released August 12, 2025).
- Includes a servicing stack update (KB5062686, versions 22621.5690 and 22631.5690) that improves the reliability and quality of the component responsible for installing Windows updates.
Known issues
Unexpected User Account Control (UAC) prompt during MSI repair operations
Symptom: The August 2025 security update and later updates enforce a requirement that UAC prompt for administrator credentials when performing Windows Installer (MSI) repair and related operations, addressing CVE-2025-50173. After installing, standard users may encounter UAC prompts or outright failures in these scenarios:
- Running MSI repair commands such as
msiexec /fu. - Opening Autodesk applications, including certain versions of AutoCAD, Civil 3D, and Inventor CAM, or when installing an MSI file after a user signs into the app for the first time.
- Installing apps configured on a per-user basis.
- Running Windows Installer during Active Setup.
- Deploying packages through Configuration Manager (ConfigMgr) that rely on user-specific advertising configurations.
- Enabling Secure Desktop.
If a non-admin user runs an app that initiates an MSI repair operation without displaying UI, it will fail with an error. For example, installing and running Office Professional Plus 2010 as a standard user will fail with Error 1730 during the configuration process.
Workaround: This issue is addressed in KB5065431.
How to get this update
Microsoft combines the latest servicing stack update (SSU) with the latest cumulative update (LCU) in a single package. No separate SSU installation is required before applying this update.
- Windows Update: Go to Settings > Update & Security > Windows Update. The update appears under the Optional updates available area.
- Windows Update for Business: Available as an optional update, delivered in accordance with your configured policies.
- Microsoft Update Catalog: Download the standalone package directly from the Microsoft Update Catalog.
- WSUS: See the Microsoft Update Catalog option as an alternative delivery path.
Removal note: To remove only the LCU after installing the combined SSU and LCU package, use the DISM /Remove-Package command with the LCU package name as the argument. Running wusa.exe with the /uninstall switch will not work on the combined package because it contains the SSU, and the SSU cannot be removed after installation.
Frequently asked questions
Is this update mandatory?
No. Microsoft describes KB5066189 as an optional out-of-band update. It is recommended only for devices that have encountered the reset or recovery failure introduced by KB5063874, or for environments that plan to use Reset my PC, System Recovery via Windows Update, or the RemoteWipe CSP. Devices not affected by those workflows can skip it.
What caused the reset and recovery failure this update fixes?
The failure was a regression introduced by the August 12, 2025 security update, KB5063874. That update inadvertently broke the reset and recovery pathways - specifically Reset my PC, Fix problems using Windows Update, and RemoteWipe CSP - on Windows 11 version 22H2 and 23H2 devices.
Does the Secure Boot certificate expiration affect this update?
Microsoft notes that Secure Boot certificates used by most Windows devices are set to expire starting June 2026. Consumer and non-managed business devices have been receiving updated certificates through Windows Update over recent months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install in the meantime.
How do I handle the UAC prompt issue affecting MSI repair operations?
The UAC prompt behavior is an intentional security improvement tied to CVE-2025-50173, not a bug in KB5066189 itself. If the behavior is causing problems in your environment - such as ConfigMgr deployments or Autodesk application launches failing for standard users - Microsoft has addressed the issue in KB5065431. Applying that update resolves the problem.
