KB5072033 break remote credential guard to Windows server 2025

Pierre DESTRÉE 70 Reputation points
2025-12-11T13:50:14.7433333+00:00

We are experiencing a reproducible issue with Remote Credential Guard (RCG) when connecting from Windows 11 24H2 clients to a Windows Server 2025 RDP host. Remote Credential Guard works correctly before installing update KB5072033 on the client. Immediately after installing this update, RCG stops functioning.

The issue is fully reproducible and affects only Windows 11 24H2 clients where KB5072033 is installed. The Windows Server 2025 host has also received the December cumulative update, but this does not change the behavior: RCG still fails when the client has KB5072033 installed.

Windows for business | Windows Client for IT Pros | Directory services | User logon and profiles

23 answers

Sort by: Oldest
Most helpful Newest Oldest
  1. Pierre DESTRÉE 70 Reputation points
    2026-01-14T14:14:48.6933333+00:00

    Hi,

    KB5074109 does not fix the issue on Windows 11 24H2. The behavior remains unchanged regardless of whether the destination server has KB5073379 installed.

    Was this answer helpful?

    1 person found this answer helpful.
    0 comments
  2. jaltmann 61 Reputation points
    2026-01-16T16:12:29.86+00:00

    This is beyond infuriating; MS fix your stuff.... Am I supposed to forego two months of security patches just because you can't ever figure out remote credential guard. Remote Credential Guard is an ESSENTIAL security feature. DO BETTER!

    Was this answer helpful?

    2 people found this answer helpful.
    0 comments
  3. Eggen, Anders 26 Reputation points
    2026-01-19T07:57:07.8166667+00:00

    We have faced the same issue at our organization, from both KB5072033 and KB5074109 updates. And we've dealt with it by uninstalling both updates, and hiding them from Windows Update by using the PowerShell command "Hide-WindowsUpdate -KBArticleID KB507xxx -Verbose".

    But we may have stumbled across a more permanent fix late last week, without the need to uninstall any updates. In the RD connection window, within the Advanced tab, there's an option to use a web account to sign in to the remote computer.

    Skjermbilde 2026-01-19 084005

    By activating this option it utilizes the Microsoft 365 credentials instead. We have also SSO active, though I'm not sure how much that affects this sign-in method.

    But the strange thing is, prior to the December update this option did not work for us. So something has evidently changed, either the updates have fixed or enabled it, or Microsoft has changed something without notifying us.

    I'm not sure if Microsoft would see this as a permanent fix or not, since they have yet to acknowledge the issue at all. But I would recommend trying out enabling this option, or at least looking into it.

    Was this answer helpful?

    0 comments
  4. Dawid Czyżycki 30 Reputation points
    2026-01-19T13:34:58.44+00:00

    Hello,

    Most recent out-of-band update KB5077744

    while promising to fix remote desktop authentication errors,

    doesnt fix Remote Credential Guard scenario

    Was this answer helpful?

    1 person found this answer helpful.
  5. Fil 0 Reputation points
    2026-01-22T12:13:08.4266667+00:00

    We are specifically talking about passwordless RDP by utilizing /remoteguard option.
    mstsc /v:<fqdn> /remoteguard

    Why they keep braking this over and over ... and is there a fix on the way? @Steve Syfuhs

    Was this answer helpful?

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.