KB5072033 break remote credential guard to Windows server 2025

Pierre DESTRÉE 70

We are experiencing a reproducible issue with Remote Credential Guard (RCG) when connecting from Windows 11 24H2 clients to a Windows Server 2025 RDP host. Remote Credential Guard works correctly before installing update KB5072033 on the client. Immediately after installing this update, RCG stops functioning.

The issue is fully reproducible and affects only Windows 11 24H2 clients where KB5072033 is installed. The Windows Server 2025 host has also received the December cumulative update, but this does not change the behavior: RCG still fails when the client has KB5072033 installed.

Robert Thunell 20 Reputation points

2026-01-30T10:16:42.81+00:00

Microsoft, any progress in this? it is a showstopper for Server 2025 deployment!!
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Herkt, Krzysztof 0 Reputation points

2026-04-29T08:35:33.1766667+00:00

Sadly April Updates didnt fix it either
Dawid Czyżycki 30 Reputation points

2026-05-04T11:13:21.6733333+00:00
KB5083631

not tested yet but promising :)

*

[Authentication (Kerberos)] This update improves Kerberos authentication in Remote Desktop sessions using Remote Credential Guard addressing error 0xc000009a.

--edit

KB5083631

Installed on a 25H2 Windows 11 client still doesnt fix the issue,

When remoting to Windows Server 2025 - second hop doesnt work for network drives,

When remoting to Windows Server 2022 - second hop works as expected.
Fil 0 Reputation points

2026-05-04T22:04:41.8433333+00:00

if source and target machine have got KB5083631 installed, both web sso and network share access seems fixed during my initial tests.

scenario's tested:
Windows 11 25h2 --> rdp /remoteguard to windows 11 25h2
Windows 11 24h2 --> rdp /remoteguard to windows 11 25h2.

Thank you SteveS :-p
MTG 1,261 Reputation points

2026-06-01T11:51:15.16+00:00

@Fil Yes, between Windows 11 24/25 H2, it's fixed, but for RCG to RD session hosts that run windows server 2025, it's still there since server 2025 didn't get that patch. Anybody here know why not or whether a fix is planned?
Adam Karas 0 Reputation points

2026-06-01T13:50:24.4933333+00:00

I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.

@MTG If the RD Session Host role is installed on the server, RCG must be enabled at the GPO level (client). It does not work with the mstsc.exe -remoteGuard parameter.”
MTG 1,261 Reputation points

2026-06-02T13:33:32.9933333+00:00

Hi Adam.

I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.

Now that puzzles me. That fix is active at my target server, active for months and no, we don't use /remoteguard, but have it required using GPOs. All three KIRs are enabled (for comparison, look at the screenshot, please):

Let's compare: server build is 10.0.26100.32860

Client is 10.0.26200.8457 - same for you???
Adam Karas 0 Reputation points

2026-06-02T18:35:21.9466667+00:00

Hi @MTG , I have only KIR 251003_17001 installed and enabled. My server si same build "10.0.26100.32860", and multiple W11 24/25H2 clients confirmed working. What is your error ?
MTG 1,261 Reputation points

2026-06-02T20:47:46.5433333+00:00

@Adam Karas Are you sure that you use the same client version, please share it. My error? The same as 2 years ago when all this started: Try to access a domain resource from within an RDP session that was initiated from Win11 24/25H2 on server 2025 and you'll get a reauthentication prompt immediately. No error, just the need to reauthenticate which defies the purpose of remote credential guard completely. The KIR was working, but just when Server 2025 was accessed from older OS' like Win11 23H2, it never worked for 25H2. If, like you, I only activate KIR...17001, it doesn't change a thing. Weird. Sure that you get that right? Some people RDP into already authenticated console sessions - then, logically, the problem never surfaces. So please share your client version and proceedings.
Adam Karas 0 Reputation points

2026-06-03T09:37:16.3333333+00:00

@MTG This is/was my error on WSrv 2025 (double hop). Client W11 10.0.26100.7171 or 26220.8474, both working. Ping me on email (should be visible in my MS profile), dont want to spam here, I hope I can help you, spent lot of days troubleshooting RCG issues.
MTG 1,261 Reputation points

2026-06-03T09:59:48.7166667+00:00

Thanks, same error here. However, be aware that your 26220.8474 is no stable release but a preview release and that 10.0.26100.7171 works here, too. So I wonder if you can test with a simple w11 25H2 with may update: 10.0.26200.8457
Adam Karas 0 Reputation points

2026-06-03T10:41:08.2733333+00:00

@MTG Yup, thats my personal insider preview version. I don't have clients updated with May update yet, but I don't think this update will have any effect.
MTG 1,261 Reputation points

2026-06-03T12:58:01.1533333+00:00

Just so that you understand: the versions you use have no problem. I knew that before. But that are not the stable 25H2 versions that we use. Those still have the problem when RDPing to Server 2025!
Adam Karas 0 Reputation points

2026-06-03T13:34:35.33+00:00

@MTG just tested with 26200.8390, working.
MTG 1,261 Reputation points

2026-06-03T13:38:58.8366667+00:00

Then tell me what you might be doing differently. Me and others have observed that it does not work despite the KIR being active. So my steps for reproduction are: Windows domain, join both devices, install may updates, apply KIR - broken. No other GPOs active apart from that that requires remote credential guard.

23 answers

jaltmann 61 Reputation points

2026-05-29T15:39:30.9966667+00:00

Sorry everyone, MS removed my post with the registry fix for the regression that will fix the issue as of 5/29/2026 until they fully patch. I'm not sure exactly what code of conduct was violated as there's no mention of confidentiality of unpublished KIRs from support, but I'm guessing it was removed by automation due to it possibly being a direct registry key command line.

If it's an issue of it being unpublished, you'll have to ask support for "Windows Server 2025 KB5087539 260421_03022 Feature Preview".
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
jaltmann 61 Reputation points

2026-05-28T13:42:57.8+00:00

I've finally gotten somewhere after pressing Microsoft. Microsoft support has provided me with a KIR (Known Issue Rollback) which is an MSI installable on Windows Server 2025 specific to the latest cumulative update (KB5087539) from May. This KIR essentially creates a local item in gpedit.msc that you can enable that rolls back the regression for RCG. We are running the latest patch for Windows 11 24H2 and with the KIR applied to the server, we are able to see Kerberos tickets and double-hop network resources.

More info on KIR's: https://learn.microsoft.com/en-us/troubleshoot/windows-client/group-policy/use-group-policy-to-deploy-known-issue-rollback?wt.mc_id=knowledgesearch_inproduct_windows-update-ai-assistant-(wuai)

They're supposed to be available on https://learn.microsoft.com/en-us/windows/release-health/status-windows-server-2025 and the specific KIR to look for is "Windows Server 2025 KB5087539 260421_03022 Feature Preview"
Was this answer helpful?

1 person found this answer helpful.
Robert Thunell 20 Reputation points

2026-05-28T14:09:56.4666667+00:00

We have hade this KIR for months, this will not solve your problems. Look if you get your User part from GPO's. We also work with Microsoft to get a bluepaper how we should handle it, but it's really like being in mud to your neck.

jaltmann 61 Reputation points

2026-05-28T14:53:51.6166667+00:00

It works for us. We were in a state where we had Windows 11 24H2 clients that if patched with Oct 2025 or newer cumulative updates, were unable to utilize our RDS server with /remoteguard which accessed resources on a back-end application server. From the admin side, we were unable to utilize RDP with server 2025 to access network shares or use management tools like ADUC. This was forcing us to utilize Smart Card certificates with WHfB as a workaround with RCG turned off on workstations for these specific use cases.

We are currently on the latest CU for Windows 11 24H2 and latest CU for Server 2025 (with KIR applied). All of the issue above have been alleviated. We are able to use "mstsc /remoteguard" to launch back-end applications from the RDS server, access network resources, and use management tools that previously were not working. Utilizing "klist", we see service tickets and not just the ticket granting ticket.

Cliff 0 Reputation points

2026-05-28T16:00:55.62+00:00

Hello jaltmann,

I'm pleased to hear that you've had some success. We've been battling with this issue for months, I created a bug report for it myself 5 months ago ... wow (https://aka.ms/AAzqvyy).

We've tried everything and are desperate here. I've looked everywhere for the KIR you mentioned "Windows Server 2025 KB5087539 260421_03022 Feature Preview", in the admin portal, server 2025 release health URL you mentioned, .etc .etc. I can't find it.

Would you be able to provide me with the download link for the MSI? Or the contact from MS support that provided it? Or who i should contact in MS to be able to get the MSI?

Any help is appreciated, thanks very much,

-Cliff

jaltmann 61 Reputation points

2026-05-28T18:22:00.57+00:00

I've reached out to support to see if they have a direct link as I also don't see it publicly in their Windows Server release info. If you open a ticket in parallel, that's the specific name of the file that was provided.

jaltmann 61 Reputation points

2026-05-28T18:34:47.69+00:00

Support is stating that the KIR isn't explicitly published under the Server 2025 health page at this point, but are saying that mitigation is in the Windows 11 24H2 KIR policy package at. https://download.microsoft.com/download/f844fc7e-16cc-4c35-b9fa-4181d8d9777c/Windows%2011%2024H2%2c%20Windows%2011%2025H2%20KB5065789%20251003_17001%20Feature%20Preview.msi I'm thinking it's the same rollback just under a different name. We applied the KIR directly on the Windows Server 2025 side of the house and set it to "enabled" in gpedit.msc on that server (followed by a reboot).

Cliff 0 Reputation points

2026-05-28T21:57:45.5266667+00:00

Ah well thanks anyway. I already tried that KIR around a month ago, but since you mentioned it, i enabled/rebooted my RDS again just to make sure, and still no fix. I'll contact MS for the "Windows Server 2025 KB5087539 260421_03022 Feature Preview" one then.. wish me luck,

jaltmann 61 Reputation points

2026-05-29T13:48:11.06+00:00

I did some digging on how the KIR is applied. All it's doing is enabling a feature override in the registry.

I have unconfigured the local GPO, removed the KIR from Programs and Features and have rebooted and confirmed the problem comes back. After which, I have set the following registry key that the KIR applies to enable the override, rebooted, and confirmed that I'm able to receive Kerberos tickets and access network resources.

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 393858191 /t REG_DWORD /d 1 /f

The key above is enables the override for the specific regression in RCG. This should be run on Windows Server 2025 itself, not the workstation. I'd like to note that in my environment, I'm currently on CU KB5087539 for Server 2025 and Windows 11 24H2 KB5089549.

Pierre DESTRÉE 70 Reputation points

2026-05-29T14:15:37.0933333+00:00

I’ve just tested the KIR registry key, and Kerberos is working again when using Remote Credential Guard.

It’s a pity that Microsoft doesn’t provide the KIR publicly, considering this has been a major security issue for more than six months.

Cliff 0 Reputation points

2026-05-29T14:48:01.69+00:00

OMG @jaltmann you are an absolute legend!! it works, i can't believe it, it actually works (until MS break it yet again, touch wood they don't). You've made my weekend. Wow. You are amazing my friend, thank you. Good job on digging into how the KIRs work, i didn't think of that. incredible. I truly appreciate all the effort you went to, thanks again!

For info, server 2025 is on 26100.32860 & my client is on 26200.8457

Dawid Czyżycki 30 Reputation points

2026-06-15T14:44:14.4633333+00:00

@jaltmann would you mind reposting the 'reg add' solution as an answer? so it would be easier for new comers to find if we vote it.

MTG 1,261 Reputation points

2026-06-15T15:19:43.49+00:00

This reg key works. So good to see a solution after all. June 26 patches applied here FYI on server 2025 and Win11 25H2.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Chris-7747 0 Reputation points

2025-12-29T14:39:18.2933333+00:00

Can anyone official from Microsoft confirm this? We also seeing this issue @Customers with Windows 11 24H2 and 25H2 after the KB5072033 update.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Pierre DESTRÉE 70 Reputation points

2025-12-12T10:13:49.3233333+00:00
I would also like to highlight an additional point that further confirms this is a regression introduced by KB5072033.

Before installing KB5072033 on Windows 11 24H2 clients:
- RCG worked correctly when connecting to Windows Server 2025
RCG did not work when connecting to Windows Server 2022

After installing KB5072033:

RCG no longer works with Windows Server 2025

RCG now works correctly with Windows Server 2022

This is the exact opposite behavior compared to before the update. No configuration changes were made on either the clients or the servers. The only change was the installation of KB5072033 on the Windows 11 24H2 clients.

This inversion strongly suggests that the update modifies the internal behavior of the RDP/CredSSP/Kerberos stack in a way that breaks compatibility with Windows Server 2025, even though the server is fully updated (including the December cumulative update).
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Quinnie Quoc 11,840 Reputation points Independent Advisor

2025-12-11T14:44:48.1566667+00:00

Hello Pierre DESTRÉE,

Thank you for sharing the detailed findings regarding Remote Credential Guard (RCG) behavior between Windows 11 24H2 clients and a Windows Server 2025 RDP host. Based on your description, the issue appears directly linked to the installation of update KB5072033, as RCG functions normally prior to applying this update and fails consistently afterward. At this time, the behavior you are seeing aligns with a known regression introduced in the update, and Microsoft is actively investigating the impact on RDP authentication and RCG negotiation. While the Server 2025 cumulative update does not resolve the issue, the current recommended workaround is to temporarily uninstall KB5072033 on affected clients or pause updates until a corrective patch is released.

You may also monitor the Windows Release Health dashboard for official status updates, as fixes for authentication‑related regressions are typically delivered through subsequent cumulative updates.

I hope this information helps you stabilize your environment while Microsoft works on a permanent resolution. If this guidance addresses your question, please consider clicking “Accept the Answer” so that others in the community can benefit from the findings as well.

Thank you so much!!

Best regards,

QQ.
Was this answer helpful?
Pierre DESTRÉE 70 Reputation points

2025-12-12T09:51:40.0833333+00:00

Thank you for your response.

If this behavior is expected or already known internally, could you please clarify why it is not documented anywhere, including:

the Windows release health,

the Known Issues section of KB5072033,

and the "Windows 11, version 24H2 known issues and notifications" page

Remote Credential Guard is a critical security feature, and this update clearly changes its behavior in a way that breaks TGT forwarding between Windows 11 24H2 clients and Windows Server 2025, even when both sides are fully updated (including the December cumulative update on the server).

Kevin Cooke 5 Reputation points

2025-12-17T13:29:27.24+00:00

Are you able to provide a link to the known issue rollback for this? https://learn.microsoft.com/en-us/troubleshoot/windows-server/installing-updates-features-roles/known-issue-rollback
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

KB5072033 break remote credential guard to Windows server 2025

KB5083631

23 answers

Your answer