Microsoft has confirmed reports that the September 2026 security updates cause Remote Desktop Services (RDS) failures on Windows Server systems.
According to a release health update on Friday, this known issue impacts Windows Server 2012 and later, as well as Windows 10 and Windows 11 devices.
This confirmation follows widespread reports from Windows admins that installing this month’s Patch Tuesday updates prevents users from connecting and, in some cases, requires a hard reset to restore functionality.
“In some environments, RDS might become unstable, resulting in RDP connections failing after several minutes, sign-in issues, or servers hanging at ‘Please wait for the Remote Desktop Configuration’,” Microsoft said on Friday.
“Related tools, including Microsoft Management Console (MMC), RDS Licensing Diagnoser, and File Explorer might also become unresponsive. Additionally, the Windows Update page might stop responding and continuously display a loading indicator.”
Affected users have also found that once a server starts failing, existing Remote Desktop sessions may not disconnect or log off properly, while new connection attempts may also fail after hanging during the connection process.
Mitigation available
Microsoft now provides the following Group Policy (found under Computer Configuration > Administrative Templates), which can be used to mitigate the issue on enterprise-managed devices managed by IT departments:
While it still works to ship a permanent fix for this issue, Microsoft said those who can’t access virtual machines through RDP may be able to temporarily restore RDS connectivity by stopping and restarting the affected virtual machine.
Windows admins have also been able to restore Remote Desktop functionality by rolling back the buggy updates. However, removing them will also remove the security fixes included in this month’s Patch Tuesday release.
Microsoft fixed a similar known issue that triggered Remote Desktop and RDS connection failures in March 2025 after installing Windows updates released since January 2025.
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.