Windows 11: After Installing KB5065426 I Can No Longer RDC Into Machine

Mike-E 181 Reputation points
2025-09-11T06:35:51.23+00:00

After installing Windows Update KB5065426 I cannot log into the machine via RDC. This is what I see in Event Viewer -> Security:

An account failed to log on.
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: <USER>
Account Domain: -
Failure Information:
Failure Reason: An Error occured during Logon.
Status: 0xC000006D
Sub Status: 0x0
Process Information:
Caller Process ID: 0x0
Caller Process Name: -
Network Information:
Workstation Name: <NAME>
Source Network Address: <IP>
Source Port: 0
Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0
This event is generated when a logon request fails. It is generated on the computer where access was attempted.
The Subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.
The Logon Type field indicates the kind of logon that was requested. The most common types are 2 (interactive) and 3 (network).
The Process Information fields indicate which account and process on the system requested the logon.
The Network Information fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.
The authentication information fields provide detailed information about this specific logon request.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.

I have to rollback the install or restore my PC to a point previous to the install to fix this issue.

Windows Insider program | Windows Insider preview | Internet and connectivity

6 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mary Kay Cassidy 6 Reputation points
    2025-09-17T18:35:17.9766667+00:00

    This RDC issue started with the preview update KB5064081, which is also rolled into the September cumulative update KB5065426. If you have two machines that were cloned/imaged and the image wasn't sysprep'd, both machines will have the same SID. This update changed RD authentication so that it now uses the SID instead of the machine name. When two machines have the same SID, authentication fails. It will also affect SMB 1.0 authentication, if anyone still has SMB 1.0 enabled (eeek!). I've been able to uninstall the update, restart and Remote Desktop Connection works again.

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  2. James Imray 10 Reputation points
    2025-10-07T22:15:53.6+00:00

    This same update (KB5065426) stopped our machines RDC/RDPing to each other. Similarly, the issue was found to be that the machines had all been built and supplied to us with the same machine SSID. I found the easiest way to look up the machine SSIDs was in Powershell with the command "Get-LocalUser | Select-Object Name,SID" (without quotes and ignore the result from the last dash onwards).

    Uninstalling KB5065426 and pausing updates has worked as an interim solution. We are evaluating the implications of using a SID-changing tool like SIDCHG to change the machine SIDs. I understand it has less implications than running sysprep /generalize which "resets a lot of things".

    Can anyone from Microsoft please advise if this RDC/RDP problem will be fixed in a rollback/future update or do we need to live with the fact that going forwards we must ensure we don’t have any machines sharing the same machine SID?

    Was this answer helpful?

    0 comments
  3. BYRON VINK 0 Reputation points
    2025-10-03T20:26:56.4+00:00

    We have verified unique SIDs and GUIDs in our environment. The issue persists. We are not able to create a remote PowerShell session or map C$ drives between Win11 24H2 systems as well. Removing the patch fixes these issues but leaves the systems vulnerable. Win11 24H2 to Win 11 24H2 systems exhibit these issues. Win 10 and Win11 23H2 can communicate fine to systems running Win11 24H2 systems even when the Win 11 24H2 systems were patched.

    Suggestions?

    Was this answer helpful?

    0 comments
  4. CrazyKats 19,240 Reputation points Volunteer Moderator
    2025-09-17T19:29:28.2966667+00:00

    https://learn.microsoft.com/en-us/answers/questions/5545056/(24h2)-build-26100-5074-(kb5064081)-release-previe

    There is already another thread about this.

    This is not a Microsoft issue. It's a cloning SID issue.

    Solvable per this other thread.

    Was this answer helpful?

    0 comments
  5. Pauli O 16,380 Reputation points Volunteer Moderator
    2025-09-11T07:26:51.27+00:00

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.