Update KB5075899

Hello again Jesús Uriel,

Just following up. Your 40-user configuration on TSplus sits outside the native Remote Desktop Session Host (RDSH) architecture, but they missed the direct correlation between the specific changes in KB5075899 and the breakdown of third-party RDP wrappers.

Cumulative Update KB5075899 (February 2026) introduces critical security changes to the Remote Desktop Services stack, specifically modifying termsrv.dll and the Session Manager to address recent privilege escalation vulnerabilities. Third-party tools like TSplus rely on memory hooks or file modifications to this specific service to enable concurrent sessions. When Windows Update replaces these binaries, the third-party hooks often fail or enter a resource-intensive loop, causing the svchost.exe (hosting Terminal Services) to spike in CPU usage, which manifests as the severe "slowness" and latency you are experiencing.

To restore service stability immediately, you must eliminate the version conflict. First, verify if your third-party vendor has released a "Kernel Update" or compatibility patch specifically for Windows Server 2025 Build 26100.32370 (KB5075899). If they have not, you should uninstall the update to confirm this is a compatibility break rather than a hardware exhaustion issue. Open an elevated Command Prompt and execute wusa /uninstall /kb:5075899 /quiet /norestart, then manually reboot the server during a maintenance window.

While uninstalling the update restores performance, it leaves your server exposed to the critical RCE and privilege escalation vulnerabilities that KB5075899 was designed to patch. This "break-fix" cycle will recur with every future cumulative update because your current architecture fights against the Windows servicing model. The only way to ensure performance stability while keeping your server patched and secure is to migrate to the native Remote Desktop Session Host role with proper CALs, as this uses the official Microsoft multi-session stack that is tested and validated against these updates.

Hope you found something useful in the answer. If it helped you get more insight into the issue, please consider accepting it. Thank you.

VP

Hello Jesús Uriel,

To properly diagnose the severe degradation you are experiencing after installing KB5075899, we need more specifics regarding your environment. Please clarify your exact Windows Server version, the underlying hardware resource allocation, and which specific performance metrics are spiking during these slowdowns, such as CPU queue length or non-paged pool memory exhaustion.

The only officially supported and legally compliant method to handle 40 concurrent remote desktop users on Windows Server is to deploy the native Remote Desktop Session Host role alongside an RD Licensing Server. You should provision this native architecture by executing the PowerShell command Install-WindowsFeature -Name RDS-RD-Server, RDS-Licensing and subsequently installing valid RDS Client Access Licenses. For immediate diagnostic insight into your current session handling rather than degrading your security posture or altering transport protocols, you should inspect the Event Viewer under Applications and Services Logs\Microsoft\Windows\TerminalServices-LocalSessionManager\Operational for explicit connection drop codes.

Do you find this answer useful? Should you have more questions, feel free to leave a comment. If the answer helps you get more insight into the issue, please consider accepting it. Thank you and have a nice day!

VP