KB5074976: Windows 10 Out-of-Band Update - OS Builds 19044.6693 and 19045.6693 (December 18, 2025)

Summary

This out-of-band update, KB5074976, released on December 18, 2025, targets Windows 10 version 22H2 and Windows 10 Enterprise LTSC 2021, producing OS builds 19044.6693 and 19045.6693. It is a non-security, out-of-band release that fixes a Message Queuing (MSMQ) regression introduced by the December 9, 2025 cumulative update. Source: Microsoft Support.

Improvements and fixes

• MSMQ regression fix: Resolves a problem introduced by the Windows updates released on December 9, 2025, in which Message Queuing (MSMQ) functionality stopped working correctly. The failure could cause message queues to become inactive, surface errors about insufficient resources, prevent applications from writing to queues, produce errors indicating a message cannot be created, or report insufficient disk space or memory. Clustered MSMQ environments under load were also affected. Windows Home and Pro users on personal devices were very unlikely to encounter this problem; it primarily hits enterprise or managed IT environments.
• Includes all fixes from December 9, 2025 - KB5071546 (OS builds 19045.6691 and 19044.6691). If earlier updates are already installed, only the new content in this package is downloaded and applied.
• Servicing stack update (KB5068780) - builds 19044.6575 and 19045.6575: This release bundles the latest servicing stack update (SSU) with the cumulative update. The SSU adds improved logic to verify whether a device is hosted on Azure, using an updated certificate chain for that validation. Microsoft strongly recommends installing this SSU before applying any additional updates on Azure-hosted devices, and ensuring those devices can reach the required certificate update domains.

Known issues

Microsoft lists no known issues for this update at the time of writing.

How to get this update

Prerequisites: You must have the latest servicing stack update installed before applying this update. Skipping the SSU may result in the update not being offered.

• Offline OS image servicing: If your image does not include the July 25, 2023 (KB5028244) or a later LCU, you must first install the standalone October 13, 2023 SSU (KB5031539).
• WSUS deployment or standalone install from Microsoft Update Catalog: If devices do not have the May 11, 2021 (KB5003173) or a later LCU, you must first install the standalone August 10, 2021 SSU (KB5005260).

Delivery channels:

• Windows Update / Windows Update for Business: Available.
• Microsoft Update Catalog: Available as a standalone package - visit the Microsoft Update Catalog website to download directly.
• Windows Server Update Services (WSUS): Available.

Uninstalling the update: To remove the LCU after installing the combined SSU and LCU package, use the DISM /Remove-Package command with the LCU package name as the argument. You can find the package name by running DISM /online /get-packages. Running wusa.exe with the /uninstall switch will not work on the combined package because it also contains the SSU, which cannot be removed after installation.

Frequently asked questions

Who is most likely to be affected by the MSMQ issue this update fixes?

This fix primarily targets enterprise and managed IT environments that use Message Queuing (MSMQ), including clustered MSMQ setups under load. Microsoft states that individuals running Windows Home or Pro on personal devices are very unlikely to have encountered the problem. If your organization depends on MSMQ for application communication, this update should be prioritized.

Does this update apply to Windows 10 devices that reached end of support?

Windows 10 mainstream support ended October 14, 2025. This update applies to Windows 10 ESU (Extended Security Updates) and Windows 10 Enterprise LTSC 2021. Standard Windows 10 devices no longer receive free updates, technical assistance, or security fixes, and Microsoft recommends migrating to Windows 11.

Is it safe to install this update on Azure-hosted Windows 10 devices?

Yes, and Microsoft specifically recommends it. The bundled SSU (KB5068780) includes updated logic to verify Azure-hosted status using a refreshed certificate chain. Before applying updates on Azure-hosted devices, ensure the device can reach the required certificate update and Azure Certificate Authority domains to successfully download certificate updates.

What should I know about the upcoming Secure Boot certificate expiration?

Secure Boot certificates used by most Windows devices are set to expire starting June 2026. Microsoft has been distributing updated certificates to consumer and non-managed business devices for several months. Devices that have not yet received the newer certificates will continue to start and operate normally, and standard Windows updates will still install. IT administrators should consult the Secure Boot Playbook for Windows clients and Windows Server for guidance.