April 11, 2023 – KB5025230 (OS Build 20348.1668)
Improvements
This security update includes quality improvements. When you install this KB:
- New! This update adds many new features and improvements to Microsoft Defender for Endpoint. For more information, see Microsoft Defender for Endpoint.
- New! This update implements the new Windows Local Administrator Password Solution (LAPS) as a Windows inbox feature. For more information, see By popular demand: Windows LAPS available now!
- This update addresses an issue that affects inbound remote Component Object Model (COM) activations. They fail. The error code is 0x80010111. This occurs if the client protocol version is less than 5.7.
- This update addresses an issue that affects Microsoft PowerPoint. It stops working on Azure Virtual Desktop (AVD). This occurs when you use Visual Basic for Applications (VBA).
- This update addresses an issue that affects Windows Search. Windows Search fails inside of Windows container images.
- This update affects the Arab Republic of Egypt. The update supports the government’s daylight saving time change order for 2023.
- This update addresses an issue that affects the Key Distribution Center (KDC) service. When the service stops on a local machine, signing in to all local Kerberos fails. The error is STATUS_NETLOGON_NOT_STARTED.
- This update addresses an issue that affects the Windows Remote Management (WinRM) client. The client returns an HTTP server error status (500). This error occurs when it runs a transfer job in the Storage Migration Service.
- This update addresses an issue that affects Desired State Configuration. It loses its previously configured options. This occurs if metaconfig.mof is missing.
- This update addresses compatibility issues that affect some printers. These printers use Windows Graphical Device Interface (GDI) printer drivers. These drivers do not completely adhere to GDI specifications.
- This update addresses a stack overflow condition that causes a device to stop working. This occurs when you call xxxDestroyWindow() in Kernel mode.
- This update addresses a rare issue that might cause an input destination to be null. This issue might occur when you attempt to convert a physical point to a logical point during hit testing. Because of this, the computer raises a stop error.
- This update addresses an issue that affects certain processors that have firmware Trusted Platform Modules (TPM). You cannot use Autopilot to set them up.
- This update addresses an issue that affects the Fast Identity Online 2.0 (FIDO2) PIN credential icon. It does not appear on the credentials screen of an external monitor. This occurs when that monitor is attached to a closed laptop.
- This update addresses an issue that affects a Clustered Shared Volume (CSV). The CSV fails to come online. This occurs if you enable BitLocker and local CSV managed protectors, and the system recently rotated the BitLocker keys.
- This update addresses an issue that affects Windows Server 2022 domain controllers. They stop working. This occurs when they process Lightweight Directory Access Protocol (LDAP) requests.
- This update addresses an issue that affects Administrator Account Lockout policies. GPResult and Resultant Set of Policy did not report them.
- This update addresses an issue that affects MySQL commands. The commands fail on Windows Xenon containers.
- This update addresses an issue that affects Windows Server Failover Clustering. If you configure a cloud witness, both sites think that the other side is down. This is a “split-brain” scenario.
If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.
For more information about security vulnerabilities, please refer to the Security Update Guide and the April 2023 Security Updates.
Windows Server 2022 servicing stack update – 20348.1663
This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates.
Known issues in this update
| Symptom | Workaround |
|---|---|
| Updates released February 14, 2023 or later might not be offered from some Windows Server Update Services (WSUS) servers to Windows 11, version 22H2. The updates will download to the WSUS server but might not propagate further to client devices. Affected WSUS servers are only those running Windows Server 2022 which have been upgraded from Windows Server 2016 or Windows Server 2019. This issue is caused by the accidental removal of required Unified Update Platform (UUP) MIME types during the upgrade to Windows Server 2022 from a previous version of Windows Server. This issue might affect security updates or feature updates for Windows 11, version 22H2. Microsoft Configuration Manager is not affected by this issue.
|
To mitigate this issue, please see Adding file types for Unified Update Platform on premises.
We are working on a resolution and will provide an update in an upcoming release.
|
| After installing this update on guest virtual machines (VMs) running Windows Server 2022 on some versions of VMware ESXi, Windows Server 2022 might not start up. Only Windows Server 2022 VMs with Secure Boot enabled are affected by this issue. Affected versions of VMware ESXi are versions vSphere ESXi 7.0.x and below.
|
Please see VMware’s documentation to mitigate this issue.
Microsoft and VMware are investigating this issue and will provide more information when it is available.
|
How to get this update
Before installing this update
Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.
Install this update
| Release Channel | Available | Next Step |
| Windows Update and Microsoft Update | Yes | None. This update will be downloaded and installed automatically from Windows Update. |
| Windows Update for Business | Yes | None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies. |
| Microsoft Update Catalog | Yes | To get the standalone package for this update, go to the Microsoft Update Catalog website. |
| Windows Server Update Services (WSUS) | Yes | This update will automatically sync with WSUS if you configure Products and Classifications as follows:
Product: Microsoft Server operating system-21H2 Classification: Security Updates |
If you want to remove the LCU
To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.
Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.
File Information
For a list of the files that are provided in this update, download the file information for cumulative update 5025230.
For a list of the files that are provided in the servicing stack update, download the file information for the SSU – version 20348.1663.
Source: https://support.microsoft.com/en-us/topic/april-11-2023-kb5025230-os-build-20348-1668-28a5446e-6389-4a5b-ae3f-e942a604f2d3
