KB5072033 break remote credential guard to Windows server 2025

Pierre DESTRÉE 70

We are experiencing a reproducible issue with Remote Credential Guard (RCG) when connecting from Windows 11 24H2 clients to a Windows Server 2025 RDP host. Remote Credential Guard works correctly before installing update KB5072033 on the client. Immediately after installing this update, RCG stops functioning.

The issue is fully reproducible and affects only Windows 11 24H2 clients where KB5072033 is installed. The Windows Server 2025 host has also received the December cumulative update, but this does not change the behavior: RCG still fails when the client has KB5072033 installed.

Robert Thunell 20 Reputation points

2026-01-30T10:16:42.81+00:00

Microsoft, any progress in this? it is a showstopper for Server 2025 deployment!!
Deleted

This comment has been deleted due to a violation of our Code of Conduct. The comment was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.
Herkt, Krzysztof 0 Reputation points

2026-04-29T08:35:33.1766667+00:00

Sadly April Updates didnt fix it either
Dawid Czyżycki 30 Reputation points

2026-05-04T11:13:21.6733333+00:00
KB5083631

not tested yet but promising :)

*

[Authentication (Kerberos)] This update improves Kerberos authentication in Remote Desktop sessions using Remote Credential Guard addressing error 0xc000009a.

--edit

KB5083631

Installed on a 25H2 Windows 11 client still doesnt fix the issue,

When remoting to Windows Server 2025 - second hop doesnt work for network drives,

When remoting to Windows Server 2022 - second hop works as expected.
Fil 0 Reputation points

2026-05-04T22:04:41.8433333+00:00

if source and target machine have got KB5083631 installed, both web sso and network share access seems fixed during my initial tests.

scenario's tested:
Windows 11 25h2 --> rdp /remoteguard to windows 11 25h2
Windows 11 24h2 --> rdp /remoteguard to windows 11 25h2.

Thank you SteveS :-p
MTG 1,261 Reputation points

2026-06-01T11:51:15.16+00:00

@Fil Yes, between Windows 11 24/25 H2, it's fixed, but for RCG to RD session hosts that run windows server 2025, it's still there since server 2025 didn't get that patch. Anybody here know why not or whether a fix is planned?
Adam Karas 0 Reputation points

2026-06-01T13:50:24.4933333+00:00

I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.

@MTG If the RD Session Host role is installed on the server, RCG must be enabled at the GPO level (client). It does not work with the mstsc.exe -remoteGuard parameter.”
MTG 1,261 Reputation points

2026-06-02T13:33:32.9933333+00:00

Hi Adam.

I can confirm it works from Windows 11 25H2 to Windows Server 2025 with mentioned KIR fix.

Now that puzzles me. That fix is active at my target server, active for months and no, we don't use /remoteguard, but have it required using GPOs. All three KIRs are enabled (for comparison, look at the screenshot, please):

Let's compare: server build is 10.0.26100.32860

Client is 10.0.26200.8457 - same for you???
Adam Karas 0 Reputation points

2026-06-02T18:35:21.9466667+00:00

Hi @MTG , I have only KIR 251003_17001 installed and enabled. My server si same build "10.0.26100.32860", and multiple W11 24/25H2 clients confirmed working. What is your error ?
MTG 1,261 Reputation points

2026-06-02T20:47:46.5433333+00:00

@Adam Karas Are you sure that you use the same client version, please share it. My error? The same as 2 years ago when all this started: Try to access a domain resource from within an RDP session that was initiated from Win11 24/25H2 on server 2025 and you'll get a reauthentication prompt immediately. No error, just the need to reauthenticate which defies the purpose of remote credential guard completely. The KIR was working, but just when Server 2025 was accessed from older OS' like Win11 23H2, it never worked for 25H2. If, like you, I only activate KIR...17001, it doesn't change a thing. Weird. Sure that you get that right? Some people RDP into already authenticated console sessions - then, logically, the problem never surfaces. So please share your client version and proceedings.
Adam Karas 0 Reputation points

2026-06-03T09:37:16.3333333+00:00

@MTG This is/was my error on WSrv 2025 (double hop). Client W11 10.0.26100.7171 or 26220.8474, both working. Ping me on email (should be visible in my MS profile), dont want to spam here, I hope I can help you, spent lot of days troubleshooting RCG issues.
MTG 1,261 Reputation points

2026-06-03T09:59:48.7166667+00:00

Thanks, same error here. However, be aware that your 26220.8474 is no stable release but a preview release and that 10.0.26100.7171 works here, too. So I wonder if you can test with a simple w11 25H2 with may update: 10.0.26200.8457
Adam Karas 0 Reputation points

2026-06-03T10:41:08.2733333+00:00

@MTG Yup, thats my personal insider preview version. I don't have clients updated with May update yet, but I don't think this update will have any effect.
MTG 1,261 Reputation points

2026-06-03T12:58:01.1533333+00:00

Just so that you understand: the versions you use have no problem. I knew that before. But that are not the stable 25H2 versions that we use. Those still have the problem when RDPing to Server 2025!
Adam Karas 0 Reputation points

2026-06-03T13:34:35.33+00:00

@MTG just tested with 26200.8390, working.
MTG 1,261 Reputation points

2026-06-03T13:38:58.8366667+00:00

Then tell me what you might be doing differently. Me and others have observed that it does not work despite the KIR being active. So my steps for reproduction are: Windows domain, join both devices, install may updates, apply KIR - broken. No other GPOs active apart from that that requires remote credential guard.

23 answers

Eggen, Anders 26 Reputation points

2026-01-19T07:57:07.8166667+00:00

We have faced the same issue at our organization, from both KB5072033 and KB5074109 updates. And we've dealt with it by uninstalling both updates, and hiding them from Windows Update by using the PowerShell command "Hide-WindowsUpdate -KBArticleID KB507xxx -Verbose".

But we may have stumbled across a more permanent fix late last week, without the need to uninstall any updates. In the RD connection window, within the Advanced tab, there's an option to use a web account to sign in to the remote computer.

By activating this option it utilizes the Microsoft 365 credentials instead. We have also SSO active, though I'm not sure how much that affects this sign-in method.

But the strange thing is, prior to the December update this option did not work for us. So something has evidently changed, either the updates have fixed or enabled it, or Microsoft has changed something without notifying us.

I'm not sure if Microsoft would see this as a permanent fix or not, since they have yet to acknowledge the issue at all. But I would recommend trying out enabling this option, or at least looking into it.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
jaltmann 61 Reputation points

2026-01-16T16:12:29.86+00:00

This is beyond infuriating; MS fix your stuff.... Am I supposed to forego two months of security patches just because you can't ever figure out remote credential guard. Remote Credential Guard is an ESSENTIAL security feature. DO BETTER!
Was this answer helpful?

2 people found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Pierre DESTRÉE 70 Reputation points

2026-01-14T14:14:48.6933333+00:00

Hi,

KB5074109 does not fix the issue on Windows 11 24H2. The behavior remains unchanged regardless of whether the destination server has KB5073379 installed.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Dawid Czyżycki 30 Reputation points

2026-01-14T08:36:33.6033333+00:00

Hello,

KB5074109 does not fix the issue for Windows 11 25H2 clients.
Was this answer helpful?

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Fil 0 Reputation points

2026-01-13T10:40:01.4933333+00:00

We have the same issue on both 24h2 and 25h2 Win11 after installing KB5072033.
using rdp /remoteguard breaks sso browser auth. (network shares are still fine ; which is something that also broke in the past when remotecredential guard was broken)

I wonder if @Steve Syfuhs has any more thoughts on this.
Was this answer helpful?

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

KB5072033 break remote credential guard to Windows server 2025

KB5083631

23 answers

Your answer