KB5134134 Updates Root Certificates for Offline Windows 11 26H1 PCs

What KB5134134 actually is​

Microsoft describes KB5134134 as a non-security, cumulative out-of-band (OOB) update for Windows 11 version 26H1, all editions. It contains earlier releases plus additional non-security improvements. Devices that already have the earlier updates download only the new parts.

Microsoft is also clear about who the update is for. It's intended for devices that don't receive current CTL updates, including updates to the list of untrusted certificates. Microsoft gives three examples:

• Devices in disconnected environments
• Devices that can't reach Microsoft's certificate-update service
• Devices where automatic CTL updates have been disabled

The one listed improvement, tagged [Certificates], is an updated trusted root certificate payload delivered inside the cumulative update for exactly those devices. The release notes don't name any certificates, list expiration dates, or say which roots were added or removed. Any article claiming to know which CA got added or removed is going beyond what Microsoft has published.

Section summary: This is a certificate-trust maintenance package for systems that can't reach Microsoft's certificate service. It isn't a feature drop or a security emergency.

Part of a wider certificate push​

KB5134134 isn't the only one. Microsoft's own update-history listings show a companion OOB release the same day, KB5134133, with OS Builds 26300.9725, 26200.9725 and 26100.9725 for the 25H2 and 24H2 branches. The listing also includes 26H1's October 13 update, KB5127646 (OS Build 28000.3231), which is the update whose fixes KB5134134 carries forward.

Russian Windows site Comss.ru reports that KB5134130 (Build 22631.7654) was issued for Windows 11 version 23H2 with the same updated trusted root certificates. Comss.ru also reports that the 24H2 package, KB5134133, isn't offered through Windows Update and can only be downloaded manually from the Microsoft Update Catalog. The KB5134134 support page appears to work the same way: its channel table sends the Windows Update and Business entries to the Microsoft Update Catalog, and also lists Windows Server Update Services. So don't wait for this one to show up in Settings on a disconnected machine. Those machines were never going to get it that way.

For a 26H1-only package, the audience is small. According to Microsoft's 26H1 update history, version 26H1 is available only on new devices with select new silicon as they come to market starting early 2026, and devices running earlier versions of Windows 11 will not be offered an update to version 26H1 through Windows Update. Microsoft's release-health page adds that 26H1 is not intended for broad deployment across existing Windows 11 environments. In practice, the people who need KB5134134 are those running new 26H1 hardware on locked-down networks, such as factory floors, secure enclaves or kiosk fleets.

Section summary: Microsoft shipped certificate-payload OOBs across several Windows 11 branches on the same day. For 26H1, the realistic audience is new-silicon devices in disconnected or restricted environments.

What else is in the package​

KB5134134 is cumulative, so it brings more than certificates:

The AI component versions only matter on Copilot+ PCs. Microsoft says these components won't install on other Windows client PCs or on Windows Server. Microsoft also says the latest SSU must be applied before this cumulative update. The combined package handles that for most installs, but people who assemble images by hand should note it.

Known issue: Remote Desktop fails with 0xC000000D​

The first known issue affects anyone using Administrator protection on Remote Desktop hosts. After installing the September 2026 non-security preview KB5124010 or any later update, non-admin users may be unable to open Remote Desktop sessions to remote devices that have Administrator protection enabled. The connection fails with error 0xC000000D and the message "The token that was passed to the function is invalid."

Microsoft says the issue mainly affects enterprise-managed remote devices used as RDP hosts, however Administrator protection was turned on. One point to check: Microsoft notes that Administrator protection is enabled by default in the Windows 11 version 24H2, 25H2 and 26H2 security baselines from the Microsoft Security Compliance Toolkit, unless your organization changed that policy. If you applied those baselines without changes and now get help-desk calls about RDP, this may be why. That baseline note names 24H2, 25H2 and 26H2, not 26H1, even though the known issue is listed on the 26H1 update page.

Microsoft's mitigation:

1. Find the affected RDP host devices.
2. Use your existing policy tool (Microsoft Intune or Group Policy) to temporarily turn off Administrator protection.
3. Do this by resetting the User Account Control Type Of Admin Approval Mode policy.
4. After the policy refreshes, test a non-admin RDP connection again.
5. Keep track of which devices you changed so you can turn the protection back on when Microsoft ships a fix.

The trade-off is real. You're switching off a hardening feature to get remote access working again. Treat it as a short-term workaround, not a permanent setting. Microsoft says a fix is coming in a future Windows update but hasn't given a date.

Known issue: USB Audio Class 1.0 devices​

The second known issue has been around since September. After the September 8, 2026 security update (KB5124012), some USB Audio Class 1.0 devices may fail to start or play sound. Symptoms include:

• Device Manager shows "This device cannot start (Code 10)"
• No audio output
• Volume controls don't respond or stay at zero
• Sound settings don't respond or are unavailable
• Stereo works, but 8-channel or 3D audio modes fail

Some users have restored sound by switching the device to 2-channel mode. The September 14 OOB update, KB5129194, fixed the 8-channel and 3D-audio failures. According to the KB5134134 page, the other symptoms are still under investigation. IT admins who need an immediate workaround should contact Microsoft Support for Business.

There's an inconsistency worth knowing about. Microsoft's 26H1 release-health page labels the same issue with a note saying this behavior is resolved in the out-of-band update released on September 14, 2026, but the KB5134134 page says it's only partially resolved. Go with the more cautious wording: KB5134134 doesn't claim to fix the remaining USB audio symptoms.

Deployment notes for imaging teams​

If you add this update to existing Windows images as a dynamic update, Microsoft warns that your installation media must include boot.stl. That file is used during Secure Boot validation and must match the Windows version and architecture of the image. Without it, devices may fail to boot from the media with error 0xc0430001. Microsoft offers two ways to handle it:

• Recommended: use the Update WinPE script to update the existing image.
• Manual: copy boot.stl from the device's Windows\Boot\EFI folder to the matching folder on your installation media.

If you add other Dynamic Update packages, use ones from the same release month. If that month has no Safe OS or Setup Dynamic Update, use the most recent version.

Microsoft's detailed instructions on the page cover Arm64 only. The target file is windows11.0-KB5134134-arm64.msu, and Microsoft says no checkpoint cumulative update is currently required. To install on a running PC from an elevated Command Prompt:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-KB5134134-arm64.msu

For a mounted image:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-KB5134134-arm64.msu

PowerShell users can run Add-WindowsPackage with -Online, or with -Path and -PreventPending for offline images. Put only the KB5134134 MSU files in the package folder. Comss.ru reports that the update is also available for x64 machines upgraded to 26H1 using official ISO images. Microsoft's page doesn't show x64 file names, though, so check the Catalog listing before scripting anything for x64.

To confirm it worked, run winver after the reboot. It should show Build 28000.3237.

The bottom line​

KB5134134 is a narrow update. It brings the trusted root certificate store up to date on Windows 11 26H1 machines that can't reach Microsoft's certificate service. It also carries forward the October fixes, a newer servicing stack, and AI component updates for Copilot+ PCs. If your 26H1 devices are connected and get automatic root updates, there's no reason to rush it. If they're isolated, this is how they catch up, and keeping certificate trust current on those machines helps prevent TLS failures and validation errors down the line.

Either way, check your RDP hosts for the Administrator protection problem, and don't count the USB audio issue as fixed until Microsoft says so.