Windows Server 2019 Guest VM on Server 2022 HyperV Host BSODs with CRITICAL_SERVICE_FAILED after installing KB5120238

Broadway, Scott (Entrust) 20 Reputation points
2026-08-20T10:42:39.0933333+00:00

Problem Description:

A Windows Server 2019 guest virtual machine experiences a persistent CRITICAL_SERVICE_FAILED Blue Screen of Death (BSOD) immediately upon the reboot staging phase of the August 2026 Cumulative Update (KB5120238). The VM enters a boot loop until the patch is uninstalled via offline DISM or rolled back via a checkpoint.

Environment and Infrastructure Details:

  • Guest OS: Windows Server 2019 Standard
  • Host OS: Windows Server 2022 (Fully updated with August 2026 patches installed, including KB5120242)
  • Hypervisor: Hyper-V
  • VM Generation: Generation 2
  • VM Configuration Version: 10

Diagnostic Steps Performed and Results:

  1. System Integrity Check: Offline and online passes of sfc /scannow and DISM /RestoreHealth return 100% clean with no file corruption or component store damage.
  2. Secure Boot Toggling: The issue persists even if Secure Boot is unticked or explicitly disabled via the Hyper-V host command Set-VMFirmware -EnableSecureBoot Off.
  3. Boot Logging Analysis: Boot logs trace the crash boundary to a signature handling handoff involving the Microsoft Windows Production PCA 2011 signature profile.
  4. Virtual NVRAM Certificate Audit: Running the Get-SecureBootUEFI command for the db variable within the guest OS confirms that the virtual motherboard's certificate database is fully updated and valid. It successfully contains both keys: Microsoft Windows Production PCA 2011 and Windows UEFI CA 2023.

Conclusion for Triage Engineers:

Because the physical host is fully updated, the VM configuration is at version 10, and the guest virtual UEFI successfully carries the mandatory Windows UEFI CA 2023 certificate, this is not an infrastructure firmware or NVRAM mismatch issue.

Instead, KB5120238 introduces a software execution conflict or a false-positive bootloader revocation block specific to the Server 2019 kernel environment when running under a version 10 Hyper-V framework.

Windows for business | Windows Server | Devices and deployment | Install Windows updates, features, or roles
0 comments
Answer accepted by question author
Hoang Le 4,665 Reputation points Independent Advisor
2026-08-20T15:42:24.23+00:00

Hello Broadway, Scott (Entrust),

The CRITICAL_SERVICE_FAILED error immediately after installing KB5120238 on Windows Server 2019 guest systems indicates a bootloader path conflict triggered by the new signature check in the update. Since your diagnostics have already confirmed that the UEFI certificate database is correct and the host infrastructure is up to date, this is not a firmware mismatch, but rather a regression issue within the patch itself. In similar cases, Microsoft has recommended temporarily reverting the affected VM to its last working state and blocking the update until a corrected build is released.

... A technical workaround is to uninstall the update offline using dism /image:C:\ /remove-package /packageName:Package_for_KB5120238~31bf3856ad364e35~amd64~~<version> and then specifically exclude the patch via WSUS or Windows Update. A permanent solution can only be achieved through a subsequent servicing release from Microsoft, as the signature verification in the kernel cannot be manually overridden. If you absolutely must keep the environment up to date, it is recommended to maintain a test system with an identical configuration and validate the next cumulative updates there before deploying them to the production environment.

If my answer is helpful to you, please click "Accept the answer" to support me.

Thank you,

HL.

Was this answer helpful?

3 people found this answer helpful.
0 comments

0 additional answers

Sort by: Oldest
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.