Microsoft released a targeted security rollup for Windows 10 on January 13, 2026 — KB5073724 — and is asking eligible systems to take it seriously: the update prepares devices for an imminent Secure Boot certificate renewal, removes four legacy in‑box modem drivers that carry high‑risk baggage, and ships a handful of security and reliability fixes for ESU and LTSC customers. This is a maintenance release, not a feature update, but its operational impact can be meaningful: devices must be enrolled in the Extended Security Updates (ESU) program or be LTSC/Enterprise editions to receive it, and systems that depend on the removed modem drivers or have unusual firmware constraints should plan and test before broad deployment.
Windows 10 reached mainstream end of support in late 2025, and Microsoft moved to a targeted security‑only servicing model for eligible devices through the Extended Security Updates (ESU) program and Long‑Term Servicing Channel (LTSC) branches. ESU lets organizations and qualifying devices receive critical and important security updates beyond the standard lifecycle, but enrollment is required for home and many business machines to keep receiving those patches. Microsoft’s ESU documentation explains the eligibility and enrollment mechanics and clarifies that ESU covers security updates only — not new features. KB5073724 is the January 13, 2026 cumulative update for Windows 10 and advances target builds to 19045.6809 (22H2) and 19044.6809 (21H2 / Enterprise LTSC 2021). The package was published as the first Windows 10 ESU rollup of 2026 and is explicitly described as a security and quality update rather than a functional upgrade.
For externally‑exposed, internet‑facing systems and high‑value endpoints, the security benefits of installing KB5073724 outweigh the known operational risks — provided the install is done thoughtfully. For highly constrained environments that still depend on legacy hardware or run air‑gapped firmware, remediate or isolate affected machines and coordinate with OEMs before applying the update broadly.
Source: Inbox.lv Windows 10 Users Urged to Update Immediately
Background
Windows 10 reached mainstream end of support in late 2025, and Microsoft moved to a targeted security‑only servicing model for eligible devices through the Extended Security Updates (ESU) program and Long‑Term Servicing Channel (LTSC) branches. ESU lets organizations and qualifying devices receive critical and important security updates beyond the standard lifecycle, but enrollment is required for home and many business machines to keep receiving those patches. Microsoft’s ESU documentation explains the eligibility and enrollment mechanics and clarifies that ESU covers security updates only — not new features. KB5073724 is the January 13, 2026 cumulative update for Windows 10 and advances target builds to 19045.6809 (22H2) and 19044.6809 (21H2 / Enterprise LTSC 2021). The package was published as the first Windows 10 ESU rollup of 2026 and is explicitly described as a security and quality update rather than a functional upgrade. What KB5073724 actually changes
KB5073724 bundles a small set of high‑impact changes alongside routine security fixes. The most important items to understand are:- Secure Boot certificate rollout hooks — Windows quality updates now include device‑targeting metadata and a telemetry‑gated mechanism to safely deliver replacement Secure Boot certificates to devices that are proven to accept them without failure. This prepares for certificates that begin expiring in mid‑2026.
- Removal of four legacy modem drivers — Microsoft removed agrsm64.sys (x64), agrsm.sys (x86), smserl64.sys (x64), and smserial.sys (x86) from the in‑box Windows image. Any hardware that relied strictly on these in‑box drivers will stop working unless a vendor‑supplied, signed replacement is available. Microsoft’s release notes list these files explicitly.
- WinSqlite3.dll update and other quality fixes — The package updates Windows‑shipped SQLite components to reduce false positives reported by some security scanners and includes the usual catalog of security patches carried by the January Patch Tuesday cycle.
Why Secure Boot certificate renewal matters now
Secure Boot relies on firmware‑level certificate chains (KEK/DB) to validate pre‑boot components. Microsoft’s documentation and the KB note that the Secure Boot certificates issued earlier in the product lifecycle begin expiring in June 2026, which could affect a device’s ability to verify or accept new pre‑boot binaries or updates if the firmware lacks the updated CA entries. KB5073724 preps Windows to accept and coordinate delivery of the replacement certificates to eligible devices, using telemetry to limit risk. Key operational realities:- Many OEM firmware implementations accept OS‑driven KEK/DB writes, but not all do. Where firmware does not accept these changes automatically, a vendor BIOS/UEFI update will be required. IT teams must confirm OEM guidance for each model.
- The rollout is telemetry‑gated and phased. Microsoft is not forcing one‑time, universal certificate writes; instead, it pushes certificates to devices that have demonstrated reliable update behavior to reduce the chance of mass boot failures. That gating reduces risk but does not remove the need for pre‑deployment planning.
- Because pre‑boot trust intersects with BitLocker and custom pre‑boot environments, testing recovery flows and ensuring BitLocker recovery keys are accessible is essential before wide installation.
The legacy modem driver removals — what they mean in practice
Microsoft removed four historical modem/serial drivers from the Windows image:- agrsm64.sys (x64)
- agrsm.sys (x86)
- smserl64.sys (x64)
- smserial.sys (x86)
- Vertical systems (medical devices, POS terminals, industrial controllers, fax systems) that still use analog modems or modems exposed via serial interfaces could lose connectivity. These environments often rely on long service lifecycles and may not have modern replacements readily available.
- For home users, legacy modem hardware is uncommon, so the majority of consumer systems will see no functional loss. For fleets and specialty environments, inventorying endpoints and searching for the driver filenames beforehand is mandatory.
- Removing vulnerable drivers is a defensive step: many of these drivers were tied to elevation‑of‑privilege and arbitrary memory access vulnerabilities that are attractive to attackers. Microsoft’s reasoning is to avoid shipping signed, unsupported kernel code that attackers can abuse. That security benefit is real — but it comes at the cost of disrupting older hardware.
Who must install KB5073724 and how to get it
Eligibility and distribution:- KB5073724 is targeted at Windows 10 versions 22H2 and 21H2 devices that are enrolled in the ESU program or that are on Enterprise LTSC 2021 servicing. Regular, out‑of‑support Windows 10 consumer devices that have not enrolled in ESU will not receive this update via Windows Update.
- ESU enrollment for consumers and organizations is covered in Microsoft’s ESU guidance; enrollment mechanics and pricing differ for business and consumer scenarios. For many consumer devices Microsoft provided a free ESU pathway contingent on Microsoft account sign‑in and OneDrive sync options, but paid ESU options remain for organizations. Confirm eligibility using the official ESU documentation.
- Confirm prerequisites: check your Windows build with winver and ensure you are on a covered SKU (22H2/21H2 or LTSC) and that you are ESU‑enrolled where necessary.
- Install any required Servicing Stack Update (SSU) first — Microsoft often bundles the SSU with the LCU, but if one is required it must precede a reliable installation.
- Use Settings → Update & Security → Windows Update to check for and apply the update, or download the stand‑alone package from the Microsoft Update Catalog if you manage offline or controlled installs.
- After installation confirm the OS build number updated to 19045.6809 or 19044.6809, and review Update History for a successful install.
Known issues and community reports (what to watch for)
Microsoft’s KB entry for KB5073724 listed no known issues at publication time, but the “no known issues” status is provisional; real‑world telemetry sometimes reveals incompatibilities after broad rollout. Administrators should watch Microsoft’s Release Health and Security Update Guide for any post‑deployment known issues. Community and independent reporting has already flagged a few practical headaches:- Multiple‑monitor / explorer.exe failures tied to third‑party shell/launcher utilities: Some users reported that after applying KB5073724, systems with multiple monitors failed to load Explorer until an offending customization (for example an older StartIsBack version) was upgraded or removed. In at least one community‑reported case the fix was to update the third‑party utility to a compatible version. These are environment‑specific interactions and highlight why a pilot ring is important.
- Broader update fragility in the January 2026 window: Microsoft had to ship rapid follow‑ups for some Windows 11 updates in mid‑January 2026 that impacted shutdown and remote login behavior; telemetry from those incidents reminded IT teams that even small cumulative updates can interact unexpectedly with OEM firmware and third‑party software. While those particular Windows 11 issues were different packages, they reinforce the need for cautious staging and rapid rollback procedures.
Risk vs. benefit — a balanced analysis
Strengths and benefits- Reduced kernel attack surface. Removing unmaintained, vulnerable kernel drivers eliminates an entire class of local privilege escalation and BYOVD (bring‑your‑own‑vulnerable‑driver) attack vectors. From a platform‑hardening standpoint, this is a defensible, long‑term benefit.
- Proactive Secure Boot certificate management. Preparing devices to accept updated firmware certificates ahead of a mid‑2026 expiration window reduces the risk of a large‑scale trust break affecting boot and update behaviors. Microsoft’s telemetry‑gated approach lowers the chance of wide disruption.
- Cleaner security signals. Updating bundled components such as WinSqlite3.dll reduces false positives that clutter security monitoring and can obscure real threats, improving detection fidelity for defenders.
- Compatibility loss for legacy hardware. Devices that rely on the removed modem drivers will lose functionality and may require OEM driver installs or hardware refreshes. For specialized industries dependent on legacy modems, this can be a real operational cost.
- Firmware diversity and recovery friction. Because pre‑boot trust touches firmware and BitLocker, misalignment between firmware capability and OS behavior can surface as recovery prompts or, in rare cases, boot failures. Testing and recovery preparedness are mandatory for critical endpoints.
- Edge cases with third‑party software. Custom shell extensions, third‑party boot utilities, or anti‑cheat systems may surface compatibility problems; community reports show these interactions are real if rare. Keep an eye on vendor advisories and update third‑party software where necessary.
For externally‑exposed, internet‑facing systems and high‑value endpoints, the security benefits of installing KB5073724 outweigh the known operational risks — provided the install is done thoughtfully. For highly constrained environments that still depend on legacy hardware or run air‑gapped firmware, remediate or isolate affected machines and coordinate with OEMs before applying the update broadly.
Practical rollout checklist (for admins and power users)
Prioritize and prepare before installing KB5073724:- Inventory: identify ESU eligibility, BIOS/UEFI versions, device models, and whether any endpoints contain the removed driver filenames.
- Backup BitLocker recovery keys: ensure recoverability for any BitLocker‑encrypted device before the update.
- Update SSU and test install on a small pilot ring that matches your hardware diversity.
- Confirm OEM firmware readiness for Secure Boot certificate enrollment; schedule BIOS/UEFI updates where required.
- Validate application behavior and multi‑monitor configurations; update third‑party shell utilities and anti‑cheat/launcher software.
- Monitor update telemetry and Event Viewer for Secure Boot enrollment events and enrollment error registry values.
Final takeaways and guidance
KB5073724 is small in size but strategically important. It’s a focused, security‑first rollup that does three things: remove fragile legacy drivers, prepare devices for a coordinated Secure Boot certificate renewal in June 2026, and tidy up a packaged component that caused false positives. For most modern consumer PCs the update will be uneventful and is a net security gain; for organizations and anyone still running legacy modem hardware or specialized firmware configurations the update must be treated as an operational change requiring inventory, pilot testing, firmware coordination, and clear rollback or remediation plans. Microsoft’s public KB notes the package and the Secure Boot timeline; independent reporting and community diagnostics corroborate the content and amplify the operational guidance. The pragmatic path forward is to plan and patch: enroll eligible devices (or confirm ESU status), stage the update in pilot rings, validate BitLocker and recovery workflows, and track OEM firmware advisories for your device models. Doing so preserves the security benefits while minimizing the risk of unwanted operational surprises. Appendix (quick reference)- Update: KB5073724 — January 13, 2026 — Advances to builds 19045.6809 and 19044.6809.
- Removed drivers: agrsm64.sys, agrsm.sys, smserl64.sys, smserial.sys.
- Key deadline to plan around: Secure Boot certificate expirations beginning June 2026.
Source: Inbox.lv Windows 10 Users Urged to Update Immediately
