Windows 10 KB5131096 Reported: ESU Update Fixes Printers, May Break Signed PowerShell Scripts

The numbers: what KB5131096 changes​

Neowin says the update raises builds to 19045.7846 on 22H2 and 19044.7846 on 21H2. Microsoft's official KB article for KB5131096 could not be found while preparing this piece, so treat those build numbers as Neowin's report until Microsoft's update history page lists them.

The previous builds are confirmed. Microsoft's Windows 10 release information page, at last check, listed the 2026-10 OOB update, dated 2026-10-26, as the latest ESU release for 22H2, at build 19045.7811. That same page shows this recent history:

If winver on an ESU machine still shows .7811 after you've checked for updates, you're one release behind.

A note on "21H2": Microsoft's table files the 19044 branch under Enterprise and IoT Enterprise LTSC (Windows 10 Enterprise LTSC 2021). It does not mean the consumer 21H2 release, which stopped getting updates long ago. Microsoft lists LTSC 2021 with a mainstream support end date of 2027-01-12, and an extended date of 2032-01-13 for IoT Enterprise only. Microsoft suggests LTSC 2021 holdouts consider ESU, but it recommends moving to Windows 11 Enterprise LTSC 2024.

Summary: This is a routine monthly ESU update. The build numbers are Neowin's figures and Microsoft hadn't listed them yet. The 21H2 package is aimed at LTSC 2021, not consumer 21H2 machines.

The changelog, item by item​

All of these come from Neowin's listing. None could be checked against an official KB page.

Date and time: Cuba's time zone​

Neowin says the update changes daylight saving time rules for Cuba:

• Cuba stays on UTC-04:00 and skips the November 2026 and March 2027 clock changes.
• It goes back to UTC-05:00 in November 2027.
• Its normal seasonal schedule returns in 2028.

This only matters if your machines, calendars or scheduled jobs use the Cuba time zone. If they do, a missing patch means timestamps one hour off, meetings at the wrong time and confusing logs. That is a lot of trouble from a tiny data change.

Printing: error 87 when adding AD-published printers​

Neowin says the update fixes a problem where adding a printer published in Active Directory failed with error 87, "The parameter is incorrect." The failure happened in Settings > Bluetooth & devices > Printers & scanners > Add device. Neowin says the October 2026 update caused it, and that existing printers and normal printing were generally unaffected.

So the bug hit new printer setups, not printing itself. If your help desk has been telling users to use a workaround to map AD printers since October, they can probably stop once this update is installed.

Remote Desktop: an Intune policy and shadow sessions​

Neowin lists two Remote Desktop fixes:

1. Intune policy: The policy "Specify thumbprints of certificates representing trusted .rdp publishers" can now be configured through Microsoft Intune. Before, it would not apply. This matters to anyone using signed .rdp files to cut down on publisher warnings.
2. Shadow connections: Remote Desktop shadow sessions could fail with an "Unspecified error" on Windows Server 2016 and Windows Server 2012 R2 after the October 14, 2026 update.

That second fix names server products in a Windows 10 changelog. Microsoft often reuses release-note text across its Windows 10-era servicing branches. Admins should take this to mean the fix exists on those server platforms, not that Windows 10 desktops had the shadowing bug.

PowerShell: stricter checks on script encoding​

This is the change most likely to cause trouble. Neowin says the update tightens PowerShell script signing and signature checks by adding stricter encoding validation. Scripts with invalid UTF-8 encoding may now fail signature validation, even if they passed before.

Microsoft's suggested fix, as Neowin reports it, is to review the affected scripts, save them as valid UTF-8 with a byte order mark (BOM), and sign them again.

This only affects scripts that contain invalid UTF-8. A clean, properly encoded signed script shouldn't notice anything. Old scripts edited over the years in different editors are the most likely to fail, especially ones with odd characters or smart quotes pasted in from email.

From general PowerShell experience (not from Microsoft's update notes), here's how to prepare:

1. Test before you deploy. Install KB5131096 on a test machine that runs your signed automation, such as logon scripts, scheduled tasks and Intune remediation scripts.
2. Find failures. Run Get-AuthenticodeSignature against your signed scripts on the patched test machine. Any script whose status isn't Valid needs a look.
3. Fix the encoding carefully. Open each flagged script and check for garbled characters before you save it. Saving a file that's already corrupted with a BOM just locks in the corruption. In PowerShell 7, -Encoding utf8BOM writes UTF-8 with a BOM. In Windows PowerShell 5.1, -Encoding UTF8 writes a BOM by default.
4. Sign again. Use Set-AuthenticodeSignature with your code-signing certificate. Changing the encoding changes the file, so the old signature won't be valid anymore.

If your execution policy is AllSigned, a script that fails validation won't run. It doesn't fall back to running unsigned. Do this before the update reaches the whole fleet, not after the first wave of tickets.

Summary: The printing and Remote Desktop fixes are good news. The PowerShell change is the one to test before deploying.

Known issue: USB Audio Class 1.0 devices​

KB5131096 still carries a known issue from September. Neowin says that after the September 8, 2026 security update (KB5122878, based on Microsoft's release table), some USB Audio Class 1.0 devices may fail to start or play sound. Symptoms include:

• Device Manager error "This device cannot start (Code 10)"
• No audio output
• Volume controls that don't respond or stay at zero
• Sound settings that don't respond or won't open

Some devices work in stereo but fail with multichannel features such as 8-channel or 3D audio. Some users report getting sound back by switching to 2-channel mode.

Microsoft's September 14 out-of-band update (KB5129236) partly fixed this. Release notes for that update, as indexed by the Releasebot tracker, say it fixed devices that functioned in standard stereo but failed with multichannel features, including 8-channel or 3D audio modes. Those notes also say other audio symptoms were not resolved in that OOB update.

So two months and a few updates later, the Code 10 and no-audio symptoms on these devices are still open. Microsoft says it's working on them. Neowin reports that admins who need a workaround now should contact Microsoft Support for Business. Home users with a USB audio device that went silent in September can try switching to 2-channel output. Otherwise, they'll have to wait for a fix. This update doesn't change anything for them.

How to get KB5131096​

Neowin says the update is available through Settings > Windows Update and the Microsoft Update Catalog. You only get it if:

• The device is enrolled in ESU, through the consumer program or an organization's license. Microsoft notes that ESU is a paid program that lets individuals and organizations of all sizes keep using Windows 10 devices past end of support more securely.
• The device runs 22H2, or Enterprise LTSC 2021 (19044).

If an unenrolled Windows 10 22H2 PC doesn't get KB5131096, nothing is wrong. That's what end of support means. Organizations should also make sure ESU activation is in place. Microsoft has put out separate ESU licensing preparation packages for Windows 10 21H2 and 22H2, so it's worth checking that the licensing side is done before blaming Windows Update.

For managed fleets, Microsoft says the Windows release health page in the Microsoft 365 admin center can be searched by KB number, build number or keyword. Its statuses run from Reported and Confirmed to Mitigated and Resolved. Watch the USB audio entry there for a change to Resolved.

The bottom line​

KB5131096 is a small update that mostly fixes October's leftovers:

• Adding AD-published printers works again.
• The Intune .rdp publisher policy applies.
• Cuba's clocks follow the new rules.

The two things to watch are the PowerShell encoding check, which can stop signed scripts with bad UTF-8 from running, and the USB audio bug, which still isn't fully fixed.

For ESU customers, the plan is the usual one:

• Read Microsoft's official notes when they're published.
• Test your signed scripts.
• Deploy in rings.

ESU buys time but doesn't fix updates any faster. If your Windows 10 PCs still have the September audio bug, that's one more reason to plan the move to Windows 11.