KB5134133 for Windows 11 24H2–26H2: Offline Certificate Trust and Smart App Control Bug

Microsoft's support page says the release is for devices that are not getting current certificate trust list (CTL) updates, including updates to the list of untrusted certificates. Its examples are devices in disconnected environments, devices that cannot reach Microsoft's certificate-update service, and devices where automatic CTL updates have been turned off. If your PCs sit behind an air gap, on a factory floor, in a secure lab or on a locked-down kiosk network, this one is for you.

What KB5134133 actually changes​

Microsoft lists one main improvement, under "Certificates." The update puts an updated trusted root certificate payload inside the Windows cumulative update itself, so devices that cannot use the normal online update path still get it.

Other publications report it the same way. Russian Windows site Comss.ru describes KB5134133 as an out-of-band, non-security cumulative update that delivers an updated set of trusted root certificates to devices that don't receive current CTL updates. Comss.ru also says the release covers Windows 11 version 24H2 and Windows 11 LTSC 2024 on the 26100 branch. Microsoft's own "Applies To" list, as captured here, names only all editions of 24H2, 25H2 and 26H2. LTSC 2024 administrators should check the Catalog listing for their SKU themselves.

Quick reference​

Summary: This update does one specific job: it delivers trust-list content to machines that can't get it online. It is not a feature release.

Why certificate trust lists matter​

Windows decides whether a TLS certificate, a signed driver or a code-signing chain is trustworthy by checking it against lists of trusted and untrusted root certificates. Microsoft Learn explains that these lists are stored as CTLs. By default, Windows downloads them over the internet through a mechanism called the CTL Updater. Microsoft's documentation says computers that can reach Windows Update directly receive updated CTLs daily. You can turn automatic updating off, but Microsoft says that isn't recommended.

On a connected PC, this all happens quietly in the background. A disconnected PC falls behind. Its list of trusted roots slowly goes stale, and so does its list of untrusted certificates. The untrusted list is the more worrying one, because it holds certificates known to be fraudulent or compromised. If a revocation never reaches an isolated machine, that machine has no idea the certificate went bad.

KB5134133 gives those machines a way to catch up using the patching process they already have.

There's already a different route for domain-joined networks​

KB5134133 isn't the only option. Microsoft Learn describes how to redirect the Microsoft Automatic Update URL to a file or web server hosting Certificate Trust Lists (CTLs), untrusted CTLs, or a subset of the trusted CTL files in a disconnected environment. The files you would host include authrootstl.cab, which contains a non-Microsoft CTL, and disallowedcertstl.cab, which contains a CTL with untrusted certificates.

That approach has requirements. Microsoft lists at least one internet-connected machine to run certutil -syncWithWU, client machines joined to an Active Directory domain, and a file or web server to host the files. Organizations already running that setup get continuous updates and may not need this OOB package for CTL purposes. Workgroup machines and fully air-gapped systems can't use the redirect method, and the cumulative-update route is the easier choice for them.

Summary: If you already host CTLs internally, you're covered. If you don't, KB5134133 is the simplest way to refresh certificate trust on isolated Windows 11 machines.

Check whether your devices actually need it​

Before you deploy, find out whether a machine's trust lists are stale. Microsoft Learn documents these certutil checks, run from an elevated prompt:

certutil -verifyCTL AuthRoot
certutil -verifyCTL Disallowed

To see when the trusted and untrusted lists last synced:

certutil -verifyctl AuthRoot | findstr /i "lastsynctime"
certutil -verifyctl Disallowed | findstr /i "lastsynctime"

If the last sync was months ago, the device is in the group Microsoft is aiming at. Microsoft's documentation also says the trusted CTL auto-update can be disabled through the DisableRootAutoUpdate value under HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\AuthRoot, where 1 means disabled. If that value is set to 1, auto-update is intentionally off, and this update was written for that case.

Everything else in the package​

Because the update is cumulative, it includes all the fixes from the October 13, 2026 update, KB5127648. Microsoft says devices that already have earlier updates download only the new content.

• AI components: Image Search, Content Extraction, Semantic Analysis and Settings Model move to version 1.2608.951.0. Microsoft says AI components apply only to Copilot+ PCs and won't install on other Windows client PCs or on Windows Server. On an ordinary desktop, this line does nothing.
• Servicing stack update: KB5127647 (build 26100.9703) is included. Microsoft says it improves the reliability of the update installation process.

Known issue #1: Smart App Control may be stuck off​

This is the problem most likely to cause support calls. Microsoft says that after installing KB5134133, some devices can't turn Smart App Control back on in the Windows Security app if it was turned off. The toggle may appear grayed out. Devices that already have Smart App Control turned on are not affected and stay protected.

Option 1: Registry workaround. Microsoft warns you to back up the registry and know how to restore it before making changes.

1. Type cmd in the Search box.
2. Select Run as administrator.
3. Enter both commands:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

1. Restart the device.

If it worked, the Smart App Control option is no longer grayed out in Windows Security.

Option 2: Group Policy for managed devices. Microsoft offers two special policies, "KB5074105 261015_19222 Feature Preview" and "KB5074105 261015_19221 Feature Preview." Each download is labeled for 24H2, 25H2 and 26H2. Install and configure both. The first turns Smart App Control back on, and the second enables logging for troubleshooting. Microsoft gives the location as Computer Configuration > Administrative Templates > {Group Policy name} > Windows 11, version 24H2, 25H2. Note that the path label leaves out 26H2 even though the downloads include it. Set both settings to Enabled and restart. Microsoft says a permanent fix will come in an upcoming release.

Known issue #2: Remote Desktop error 0xC000000D​

Microsoft says that after the September 2026 non-security preview KB5124010, or any later update, non-admin users may fail to connect to Remote Desktop hosts that have Administrator protection enabled. The error is 0xC000000D, with the message "The token that was passed to the function is invalid." Enterprise-managed hosts are mainly affected, no matter how Administrator protection was enabled.

Microsoft adds that Administrator protection is turned on by default in its Security Compliance Toolkit baselines for 24H2, 25H2 and 26H2, unless your organization has configured the policy differently. Organizations that adopted those baselines as shipped are likely affected.

The temporary mitigation is to turn Administrator protection off by resetting the User Account Control Type Of Admin Approval Mode policy in Intune or Group Policy. That weakens a security control, so limit it to the hosts that actually serve non-admin RDP users. Microsoft has not said this update fixes the issue.

Known issue #3: USB Audio Class 1.0 devices​

The September 8, 2026 security update KB5124012 broke some USB Audio Class 1.0 devices. Symptoms include Code 10 in Device Manager, no audio, volume controls stuck at zero, and sound settings that are unavailable or unresponsive. Some devices work in stereo but fail in 8-channel or 3D modes, and some users report that switching to 2-channel mode restores sound. The September 14 OOB update KB5129195 fixed the multichannel symptoms. The other symptoms are still open, and Microsoft directs administrators who need a workaround to Microsoft Support for Business.

How to install KB5134133​

Prerequisites (as Microsoft states them): For Windows Update, WSUS and Catalog installs, 24H2 and 25H2 devices must already have an update released on or after June 10, 2025 (for example, KB5060842). The latest SSU must also be installed.

The package comes from the Microsoft Update Catalog as MSU files that must be installed in order. On x64 the files are a checkpoint update, windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu, followed by windows11.0-kb5134133-x64.msu. Arm64 uses the matching arm64 files.

1. Download all the MSU files into one folder (for example, C:\Packages) that contains nothing else.
2. Either double-click each file in order, or let DISM install the checkpoint automatically:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5134133-x64.msu

The PowerShell equivalent is Add-WindowsPackage -Online -PackagePath "c:\packages\windows11.0-kb5134133-x64.msu". If the checkpoint update is already installed, Windows tells you so, which is harmless.

Servicing images? Microsoft warns that if you add dynamic updates like this one to an existing image, the installation media must include boot.stl. Without it, devices may fail to boot from the media with error 0xc0430001. The file is used for Secure Boot validation and must match the image's Windows version and architecture. Microsoft recommends the Update WinPE script. The alternative is to copy boot.stl from the device's Windows\Boot\EFI folder to the matching folder on your installation media.

Who should install it​

Install KB5134133 if your Windows 11 machines are offline, can't reach Microsoft's certificate endpoints, or have CTL auto-update disabled, and you don't host CTLs internally. Test the Smart App Control behavior first if your images ship with that feature turned off.

If your PCs are on the internet and certutil shows recent sync times, Windows has already been refreshing these lists daily, and your regular monthly updates cover the rest.