Windows 10 Aug 2025 KB5063709 Update: ESU, Secure Boot, and Fixes

Microsoft has pushed out the August 12, 2025 cumulative update KB5063709 for supported Windows 10 channels, raising affected machines to OS Builds 19044.6216 and 19045.6216 and delivering a mix of security hardening, bug fixes and a handful of platform-level changes that matter to both consumers and enterprises.

Background​

Windows 10 continues to receive monthly cumulative updates as Microsoft winds down mainstream servicing ahead of the announced end-of-support date. The KB5063709 release is a standard Patch Tuesday cumulative update for Windows 10 (21H2/22H2 and LTSC variants) that includes the latest combined Servicing Stack Update (SSU) and the latest cumulative LCU (Latest Cumulative Update). Microsoft lists the release date as August 12, 2025 and the update applies to Windows 10 versions that are still within support, including Enterprise LTSC 2021 and IoT Enterprise LTSC 2021.
Support for Windows 10 non-LTSC editions is scheduled to end after October 14, 2025; organizations still running Windows 10 should use this window to finalize migration plans to Windows 11 or to purchase Extended Security Updates (ESU) where applicable.

---

What KB5063709 includes — quick summary​

• Applies to: Windows 10, version 21H2/22H2 and the LTSC 2021 SKUs.
• Builds: 19044.6216 (21H2 lanes) and 19045.6216 (22H2 lanes) after install.
• Focus: security improvements, reliability fixes, input/emoji panel corrections, ESU enrollment bug repairs and Secure Boot / VBS anti-rollback manageability improvements. (support.microsoft.com, neowin.net)
• Delivery: via Windows Update, Microsoft Update Catalog and business channels (WSUS/ConfigMgr). SSU is combined with the LCU in Microsoft’s modern servicing packages.

---

Deep dive: Key changes and why they matter​

ESU enrollment wizard crash fixed​

A notable customer-facing fix in KB5063709 addresses an issue with the Extended Security Updates (ESU) enrollment wizard, where clicking “Enroll now” caused the wizard to open and then immediately close in some environments due to incomplete app registration. This prevented eligible devices from completing ESU enrollment and created friction for organizations relying on paid ESU coverage to extend security support. Microsoft states that the update resolves that registration and loading problem, restoring the enrollment flow.
Why this matters: as Windows 10 nears end-of-support, ESU is the backstop for many enterprises that still require more time to migrate. Enrollment glitches can delay critical protections or cause confusion in large deployments; the KB fix eliminates one such obvious blocker. The patch’s ESU-related wording is corroborated by independent reporting and community write-ups. (neowin.net, windowsforum.com)

Secure Boot: SKUSiPolicy and VBS anti-rollback deployment controls​

KB5063709 adds the ability to deploy SKUSiPolicy VBS anti-rollback protections through the Secure Boot AvailableUpdates registry key (sometimes referenced as the SkuSiPolicy mechanism). The change lets administrators deploy Microsoft-signed revocation and anti-rollback policies that lock down older binaries to prevent rollback attacks that could undermine Virtualization-Based Security (VBS) protections.
Why this matters: VBS and Secure Launch rely on a chain of trust that, if rolled back to older, vulnerable components, can be bypassed. Deploying an anti-rollback policy into the UEFI/Secure Boot flow is powerful, but also carries operational risk: once a device’s UEFI lock policy has been applied, reverting it is non-trivial and may require disabling Secure Boot or manual removal of the policy from the EFI partition. Microsoft’s guidance explicitly warns that applying such policies can prevent booting from external media that is not updated to the same patch level and recommends testing before deployment.

Core file system / stability fix for post-May 2025 regression​

Microsoft documents a fix for a rare stability problem that appeared after installing the May 2025 security update and subsequent rollups. In affected edge cases, some devices could become unresponsive or stop responding in particular scenarios; KB5063709 addresses that regression. This is the type of hotfix that prioritizes reliability for systems that saw adverse behavior after earlier monthly updates.
Why this matters: cumulative updates are layered; an earlier monthly release can introduce regressions that show up only on specific hardware/driver combinations or usage patterns. Fixing regressions quickly is necessary to maintain trust in the servicing pipeline, especially on workstations and servers in production. Independent outlets and scanning vendors flagged the update as part of Patch Tuesday security coverage. (neowin.net, tenable.com)

Input methods, emoji panel and language keyboard fixes​

KB5063709 resolves a set of user-facing input issues:

• A fix for the Microsoft Changjie Input Method where users could not select words after a previous update.
• A corrected behavior for the emoji panel search, which previously returned no results in some cases.
• Repairs to phonetic input methods such as Hindi and Marathi phonetic keyboards that were malfunctioning.

Why this matters: while not security-related, input and IME (Input Method Editor) fixes significantly affect usability in multilingual environments and for users in specific markets. These are high-impact to small user segments and worth applying where those users are present.

---

Security context — CVEs and vulnerability coverage​

Microsoft characterizes the update as containing “miscellaneous security improvements to internal Windows OS functionality,” which indicates multiple vulnerability fixes across components. External vulnerability scanning and security tooling flagged KB5063709 as closing several high-severity issues; for example, third-party vulnerability scanners list CVE-class items associated with GDI+, Hyper-V synchronization flaws and race-condition elevation paths that are mitigated by the update. Organizations should treat KB5063709 as a security install for relevant CVEs and apply it accordingly. (support.microsoft.com, tenable.com)
Operational note: security scanners and Nessus/Tenable-style plugins map the KB to CVEs and will mark systems as vulnerable until the cumulative patch is applied—this makes KB5063709 a priority for security teams that track compliance with external scanning tools.

---

Deployment and installation guidance​

How it’s delivered​

• The update is distributed through Windows Update, Microsoft Update Catalog, and enterprise channels (WSUS/Intune/ConfigMgr). Microsoft now commonly delivers the latest SSU combined with the LCU so installation reliability is improved and manual SSU pre-installation is frequently not required.

Before you install — checklist​

• Confirm the device build and version using Settings > System > About or by running: winver or systeminfo. Confirm expected build (19044.x / 19045.x) before and after updates.
• For offline image servicing, validate that prerequisite SSUs are present. Microsoft’s KB notes special SSU requirements for certain offline scenarios—refer to the KB text if building images.
• For devices where SKUSiPolicy/VBS anti-rollback will be deployed, thoroughly test in a lab. Understand the recovery path for your hardware and external boot scenarios; Microsoft warns that applying anti-rollback policy can prevent external media from booting until it is updated too.

Manual installation (high level)​

• Check Windows Update for the combined update and install normally.
• If manual installation is required, download the standalone packages from the Microsoft Update Catalog and install the SSU first if Microsoft’s combined package requires it. The Update Catalog provides .msu or .cab files for offline installation.

Caveat: if the KB is combined with an SSU in the package you download, removing the LCU via wusa.exe /uninstall will not remove SSU components; Microsoft documents that SSUs cannot be removed after installation via standard wusa uninstall. Use DISM remove-package if you need to surgically remove a particular LCU; SSUs are persistent.

---

Enterprise considerations and risk analysis​

ESU operators​

• The ESU enrollment wizard fix included in KB5063709 is vital for customers buying ESU to maintain protection after mainstream support ends. Applying this update fixes an enrollment failure that could otherwise prevent ESU activation. Enterprises that planned ESU purchases should prioritize this patch and verify enrollment end-to-end.

SKUSiPolicy / VBS anti-rollback​

• Deploying SkuSiPolicy.p7b via Secure Boot changes the firmware-level policy; this can create irreversible operational changes unless an explicit removal procedure is followed. Microsoft warns that reformatting the disk will not remove the UEFI lock once the mitigation is applied, and WinRE or PXE boot behavior may be impacted unless those environments are updated equivalently. Testing and coordination with hardware vendors and imaging teams is essential before mass deployment.

Regressions and rollback complexity​

• Because cumulative updates are layered and SSUs can be fused into packages, rolling back a problematic update can be more complex than before. SSUs are not uninstalled via standard wusa uninstall flows; removing a problematic LCU might require DISM and knowledge of the exact package name. For critical systems, maintain tested recovery images and ensure Boot/WinRE media are up-to-date with the same servicing level where anti-rollback policies are planned.

---

Known issues and community reports​

Microsoft indicates it is currently not aware of issues with KB5063709 in the primary KB notes, but community channels and third-party reporting historically surface localized problems after monthly rollouts—ranging from input regressions to device stability issues that only appear under specific drivers or hardware. Independent tech press covered the update as this month’s Patch Tuesday and community threads noted various post-update symptoms across earlier rollouts, reinforcing the need for staged deployments in enterprises. (support.microsoft.com, neowin.net, windowsforum.com)
Practical guidance: stage the update to pilot rings first, watch key telemetry (boot times, app crashes, network connectivity), and have a rollback/recovery plan ready if a pilot reveals systemic issues.

---

Verification and cross-references​

Key claims in this article were verified against Microsoft’s official KB article for KB5063709 and corroborated with independent coverage and scanning vendor data:

• Microsoft KB5063709 (official release notes and file information).
• Patch Tuesday coverage and reporting that confirmed builds and distribution channels.
• Vulnerability scanner / Nessus plugin mapping that links KB5063709 to critical CVE mitigations.
• Microsoft guidance on SkuSiPolicy and anti-rollback implications for Secure Boot, used to highlight the operational risks of applying these policies.

Any claim tied to undocumented internal telemetry or to long-term behavioral changes beyond the KB text has been flagged and limited to the official KB wording or reputable third-party reporting.

---

Practical checklist (recommended for admins and power users)​

• Confirm device build/version (winver).
• Stage KB5063709 to a small pilot group; monitor for regressions for at least 48–72 hours.
• If you plan to apply SkuSiPolicy anti-rollback protections, update WinRE/PE and PXE boot images first and validate recovery workflows in lab hardware. Follow Microsoft’s removal/recovery procedure if needed.
• If a pilot reveals issues, collect Update Catalog package names and use DISM to target uninstall of the LCU if a clean rollback is required; SSUs cannot be removed via wusa uninstall in combined packages.
• For ESU-bound machines, apply KB5063709 to resolve enrollment wizard failures and re-validate ESU activation.

---

Caveats, corrections and unverifiable points​

• The user-provided summary incorrectly mentioned a Windows 11 KB number (KB5062554) as a download link for KB5063709. This appears to be an editorial mismatch—KB5063709 is a Windows 10 cumulative update, and any reference to KB5062554 as a Windows 11 download should be treated as inaccurate or contextually confused unless the publisher clarifies. Always confirm the KB number and OS target in Microsoft’s Update Catalog or the official KB article before downloading.
• The KB text uses general phrasing like “miscellaneous security improvements”; where Microsoft does not enumerate specific CVEs in the KB doc, the exact list of vulnerabilities is published through Security Update Guides and CVE listings. Vulnerability scanners may attribute CVEs to the KB; validate against the Security Update Guide for authoritative CVE mapping. (support.microsoft.com, tenable.com)
• Any claim about widespread or platform-breaking regressions should be treated cautiously until corroborated by multiple independent reports or by Microsoft issuing a known-issues advisory for KB5063709. At publication time Microsoft reports no known issues for this specific update, but independent pilot deployments remain the recommended way to proceed. (support.microsoft.com, neowin.net)

---

Conclusion and recommendation​

KB5063709 is a standard August 2025 cumulative update for supported Windows 10 branches that packs important reliability fixes, ESU enrollment remediation and a notable addition to Secure Boot/VBS anti-rollback manageability. The update also addresses a rare post-May 2025 stability regression and several input/IME-related user experience issues.
For most environments: apply the update through a staged rollout—pilot first, then broad deployment—especially where Secure Boot anti-rollback policies or ESU enrollment are in scope. Organizations planning to use SkuSiPolicy-based anti-rollback protections should carefully update recovery media and PXE/WinRE images before applying policies and validate rollback and recovery procedures under controlled conditions. Security teams should treat this update as a priority for CVE remediation mapping via normal patch management workflows. (support.microsoft.com, tenable.com)
Administrators and advanced users can get the standalone packages from the Microsoft Update Catalog or wait for Windows Update to deliver the combined SSU+LCU package automatically; either route should provide the same fixes, but manual deployment gives control for offline and image servicing scenarios.
Apply the update prudently, verify ESU enrollment post-installation if relevant, and treat Secure Boot anti-rollback deployment as a firmware-impacting change that requires cross-team coordination.

---

Source: thewincentral.com Cumulative Update KB5063709 Windows 10 21H2, Download Link