KB5071544 - Windows Server 2019 / Win 10 LTSC 2019 Security Update (OS Build 17763.8146)

Summary

This is a security update for Windows Server 2019 and Windows 10 Enterprise LTSC 2019, released on December 9, 2025, producing OS Build 17763.8146. It delivers quality improvements and security fixes, and bundles the latest servicing stack update (KB5070248, version 17763.8020). See Microsoft Support for full details.

Improvements and fixes

• PowerShell 5.1 - Invoke-WebRequest security change: The Invoke-WebRequest command now presents a confirmation prompt that includes a security warning about the risk of executing scripts retrieved from the web. Administrators and users can choose to proceed or cancel. This change addresses CVE-2025-54100; additional guidance is available in KB5074596.
• People app deprecation: Following installation of this update, the People icon on the taskbar will stop responding. Microsoft is deprecating this feature in Windows Server 2019 and Windows 10, version 1809.

Known issues

Message Queuing (MSMQ) failures

Symptom: After installing this update, environments using Message Queuing (MSMQ) - including clustered MSMQ environments under load - may encounter several problems. Reported symptoms include: MSMQ queues becoming inactive; IIS sites failing with "Insufficient resources to perform operation" errors; applications being unable to write to queues; errors such as "The message file 'C:\Windows\System32\msmq\storage*.mq' cannot be created" when the service tries to create message files; and misleading log entries stating "There is insufficient disk space or memory" even when sufficient disk space and memory are available. The root cause is a change to the MSMQ security model and NTFS permissions on the C:\Windows\System32\MSMQ\storage folder. MSMQ users now require write access to that folder, which is normally restricted to administrators, so attempts to send messages via MSMQ APIs may fail with resource errors. Users on Windows Home or Pro editions on personal devices are very unlikely to be affected; the issue primarily affects enterprise or managed IT environments.

Resolution: This issue was resolved by the Windows out-of-band update released on and after December 18, 2025 (such as KB5074975). Microsoft recommends installing the latest available update for your device.

How to get this update

Prerequisite: You must have installed the August 10, 2021 servicing stack update (KB5005112) before applying this cumulative update.

This update is available through the following channels:

• Windows Update / Microsoft Update - Downloaded and installed automatically.
• Windows Update for Business - Deployed automatically in accordance with your configured policies.
• Microsoft Update Catalog - Download the standalone package directly from the Microsoft Update Catalog website.
• Windows Server Update Services (WSUS) - Syncs automatically when Products is set to Windows 10 and Classification is set to Security Updates.

A combined servicing stack update (SSU KB5070248, version 17763.8020) is bundled with this cumulative update. To remove the cumulative update portion after installation, use the DISM /Remove-Package command with the LCU package name as the argument. Running wusa.exe /uninstall against the combined package will not work because the SSU is included, and the SSU cannot be removed after installation.

Frequently asked questions

Does this update replace a previous cumulative update?

Yes. KB5071544 builds on the November 11, 2025 cumulative update KB5068791 (OS Build 17763.8027). If you have already installed that or any earlier update, only the new components in this package will be downloaded and applied to your device.

What is the Secure Boot certificate situation administrators should know about?

Secure Boot certificates used by most Windows devices are set to expire starting in June 2026. Microsoft has been deploying updated certificates to consumer and non-managed business devices for several months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. IT administrators should consult the Secure Boot Playbook for Windows clients and Windows Server for managed-environment guidance.

When does support for Windows Server 2019 and Windows 10 Enterprise LTSC 2019 end?

Microsoft will end free software updates from Windows Update, technical assistance, and security fixes for both Windows Server 2019 and Windows 10 Enterprise LTSC 2019 on January 9, 2029. Microsoft recommends upgrading to a later version of Windows Server before that date.

Do Windows updates install Microsoft Store application updates?

No. Windows updates do not install Microsoft Store application updates. Enterprise users should refer to Microsoft Store apps documentation in Configuration Manager, while consumer users can find app updates directly through the Microsoft Store application on their device.