Windows 11 23H2 KB5065431 Sep 2025 Update: NDI, UAC, SMB Fixes

Microsoft has pushed the September 2025 cumulative for Windows 11 version 23H2 — KB5065431 (OS build 22631.5909) — and the update is available both through Windows Update and as an offline .msu installer from the Microsoft Update Catalog. This release is a targeted quality-and-security rollup rather than a feature pack: it addresses recent regressions that affected streaming (NDI), tightens SMB handling, and restores expected behavior for Installer/UAC workflows introduced by the August servicing changes. The timing is notable because Home and Pro editions of Windows 11 23H2 will reach end of updates on November 11, 2025, meaning this will be among the last monthly rollups delivered to consumer devices on that branch; organizations running Enterprise and Education SKU have until November 10, 2026. (learn.microsoft.com)

---

Background / Overview​

Windows servicing over the last several months has been unusually active. Microsoft shipped 24H2 earlier this year and temporarily paused or throttled automatic upgrades for some devices while addressing a cluster of compatibility and reliability problems that surfaced after the initial 24H2 rollout. Many of those issues came from third‑party apps not yet updated for the new runtime behavior, and from new OS checks that exposed previously latent application assumptions. Microsoft says most blocking issues have been addressed and staged upgrades resumed for eligible Home and Pro PCs; the practical result: staying on 23H2 is a short-term security risk because 23H2 consumer support ends this November.
Key timeline and lifecycle points administrators and enthusiasts need to keep front of mind:

• Windows 11 23H2 (Home & Pro): end of updates — November 11, 2025. After that date Home and Pro devices will no longer receive new security updates. (learn.microsoft.com)
• Windows 11 23H2 (Enterprise & Education): end of updates — November 10, 2026 (extended servicing for commercial SKUs). (learn.microsoft.com)

Those deadlines mean the recommended course for most consumer and unmanaged Pro devices is to accept the 24H2 feature update now (or plan a controlled migration) so devices remain eligible for ongoing security updates.

---

What KB5065431 Delivers (summary)​

This cumulative is primarily a security and reliability rollup for the 23H2 servicing stream (build 22631.5909). There are no significant consumer-facing feature additions in this package; the value is in fixes and mitigations for regressions introduced or exposed by recent updates.
Notable fixes and changes called out in reporting and pilot testing include:

• NDI streaming performance: fixes to reduce audio delay and video stutter during network device interface (NDI) workflows used by streamers and production setups. This addresses post‑August reports of degraded capture performance when Display Capture or similar paths were used.
• UAC/Installer behavior: remediation for the side effect of an August security hardening that started forcing a User Account Control (UAC) credential prompt for certain MSI repair and related installer operations executed by non‑admin users. The August change was a security improvement for Windows Installer, but it caused unexpected prompts and app failures; KB5065431 reduces the friction while preserving the security posture (admins can still manage behavior via Group Policy). (tomshardware.com)
• SMB hardening and auditing: tightened SMB share security and the introduction or refinement of an SMB client compatibility audit feature so administrators can detect misconfigured or incompatible clients. This supports smoother troubleshooting for file‑share scenarios.
• Standard security mitigations bundled with the monthly Patch Tuesday rollup (multiple CVE fixes across kernel, networking, graphics, and service layers). External CVE mappings for September show KB linkages across many versions and platforms. (cyberveille.esante.gouv.fr, pureinfotech.com)

A pragmatic way to read this: KB5065431 is a reliability-first patch that fixes real, user‑visible regressions; it is not a vehicle for new consumer features on 23H2.

---

Direct downloads, manual install, and what to verify​

If Windows Update does not automatically install KB5065431, you can download the offline installer (.msu) from the Microsoft Update Catalog and apply it manually. Manual installation is a standard fallback for managed or offline scenarios, but there are operational details you must follow to avoid avoidable trouble.
Important points before you click Download:

• The Update Catalog package is the combined Servicing Stack Update (SSU) plus Latest Cumulative Update (LCU) — manual installs are typically larger and take longer than an incremental delta delivered via Windows Update. Expect a longer install window and a restart when needed.
• Always confirm the target SKU and architecture in the Update Catalog entry (x64 vs ARM64). Applying a package that does not match the OS SKU or architecture will fail or report "not applicable." (support.microsoft.com)
• Verify the file integrity after download using PowerShell: Get‑FileHash -Algorithm SHA256 <filename>. Compare against the published hash (if available) or re-download if hashes differ. (support.microsoft.com)

Where to download:

• Microsoft Update Catalog — search for KB5065431 and select the package that matches your OS line (Windows 11 23H2 x64/ARM64). The Catalog lets you download the .msu for offline installation. (support.microsoft.com)

Step‑by‑step: Manual install (elevated)

• Confirm your Windows version: run winver and ensure you are on Windows 11 version 23H2 (22631.x series).
• Download the matching .msu from the Microsoft Update Catalog.
• Optionally verify the SHA‑256 hash: Get‑FileHash -Path C:\Users\<you>\Downloads\windows11.0-kb5065431-<arch>.msu -Algorithm SHA256.
• Double‑click the .msu (Windows Update Standalone Installer) or run: wusa.exe C:\path\to\windows11.0-kb5065431-<arch>.msu /quiet /norestart (quiet mode).
• If you prefer DISM for offline servicing or image injection: DISM /Online /Add‑Package /PackagePath:C:\path\to\windows11.0-kb5065431-<arch>.msu.
• Reboot if the installer requires it and validate success by checking the new OS build (winver should report 22631.5909). (support.microsoft.com)

If an MSU install reports “not applicable,” re-check the SKU (Home/Pro vs Enterprise/Education), the architecture, and whether a prerequisite SSU is required. In managed environments use WSUS or Intune/ConfigMgr to coordinate distribution rather than ad-hoc MSU pushes. (support.microsoft.com)

---

Deployment guidance and risk assessment​

This section separates practical steps for home users, power users, and enterprise administrators.

For Home and Pro users​

• Back up any critical data before manual servicing or feature upgrades. A standard full‑image backup or File History/OneDrive sync is recommended.
• If you are still on 23H2, plan to upgrade to 24H2 soon: 23H2 consumer servicing stops on November 11, 2025. Microsoft has restarted staged upgrades to 24H2 for eligible Home and Pro devices after resolving earlier compatibility blockers. Upgrading preserves security update eligibility. (learn.microsoft.com)
• If you must stay on 23H2 (temporary), ensure KB5065431 and preceding monthly rollups are fully applied and that Microsoft Defender and third‑party security software are up to date.

For power users and streamers​

• If your workflow uses NDI, install KB5065431 on streaming rigs to get the performance fixes. After applying the update, re-check capture/NDI Receive settings — some streamers found switching NDI receive mode to TCP/UDP eased symptoms prior to the patch. Test in a controlled session before going live.

For administrators (SCCM/WSUS/Intune)​

• Stage KB5065431 into a pilot ring for 48–72 hours and monitor telemetry, Event Viewer, and application crash logs before broad deployment. Past August servicing cycles produced a set of high‑visibility regressions; conservative staging is wise.
• For large rollouts, sync the Microsoft Update Catalog via WSUS or use Intune Windows Update rings to throttle and monitor acceptance. Avoid pushing the combined SSU+LCU to the entire fleet at once; push to pilot images first and validate rollback procedures.
• Document rollback strategy: because SSUs are persistent and some combined packages include the SSU, full rollback may require image-based recovery or offline servicing via DISM with previously captured images rather than relying on wusa uninstall alone. Plan recovery workflows accordingly.

---

The installer/UAC regression — what happened and how KB5065431 addresses it​

August 2025 brought a security hardening around Windows Installer that attempted to close a privilege‑elevation vector. That hardening caused a side effect: standard (non‑admin) users saw unexpected UAC credential prompts when running MSI repair actions, and some installers and per‑user installation scenarios started failing. Microsoft issued guidance and temporary mitigations (Known Issue Rollbacks, group policy workarounds), and the ecosystem reacted with reports of app crashes and blocked installs for software like AutoCAD and other complex MSI installers. KB5065431 includes adjustments to restore workable behavior while keeping the underlying security improvement in place; administrators retain control through Group Policy if they must enforce stricter prompt behavior. (tomshardware.com)
Operational takeaways:

• If you manage an environment where non‑admin users routinely perform application repairs, test KB5065431 in a pilot group and validate common installers.
• The group policy that temporarily suppressed the prompt for certain environments remains an acceptable short‑term mitigation while the patch propagates; consult Microsoft guidance for the exact policy name and registry keys if you depend on automation. (If you deployed a KIR, follow vendor guidance to remove the temporary change once the fix is confirmed.)

---

SMB security and the compatibility audit feature​

KB5065431 tightens SMB share handling — a sensible follow‑up to recent SMB hardenings across Windows servicing. The update adds or sharpens an SMB client compatibility audit that helps administrators find clients that do not conform to tightened server policies or that present unexpected negotiation characteristics. In practice this helps diagnose share access failures that emerge when servers block deprecated ciphers or legacy dialects.
Practical admin checklist:

• After applying KB5065431, run compatibility checks against NAS or older SMB clients (Linux CIFS/SMB clients, legacy NAS firmwares).
• Confirm Group Policy and server SMB security settings before enabling stricter policies across the domain to avoid mass lockouts.
• Use the SMB audit logs produced by the update to identify and remediate incompatible clients.

---

Cross‑checks and verification of claims​

To make sure readers can trust these statements, the most important facts were cross‑verified against Microsoft lifecycle documentation and multiple independent outlets:

• The end-of-updates date for Windows 11 23H2 Home/Pro is confirmed by Microsoft Lifecycle documentation (Windows Learn). (learn.microsoft.com)
• The KB number, target OS builds (22631.5909 / 22621.5909), and the September 2025 Patch Tuesday timing are referenced in industry reporting and build histories (press coverage and consolidated update histories). Where possible these build mappings are reported by multiple outlets and by community update trackers. Some community summaries and reporting also note the NDI and SMB changes described above. (en.wikipedia.org, pureinfotech.com)
• The UAC/MSI regression and Microsoft’s temporary mitigations were independently reported by technology press and troubleshooting articles, and KB5065431’s role in softening the impact is part of the update’s remediation activity. (tomshardware.com)

Caveat and caution: some editorial statements circulating in social feeds and informal posts (for example, estimates like “a dozen errors” after 24H2) are anecdotal and not publicly enumerated by Microsoft; treat such counts as unverified editorializing unless Microsoft publishes an explicit list or a formal known‑issues advisory with itemized entries. Where precise CVE-to‑KB mapping is important for compliance programs, consult the official Security Update Guide and Microsoft’s KB pages for authoritative CVE lists. (cyberveille.esante.gouv.fr, learn.microsoft.com)

---

Recommended next steps (concise checklist)​

• For consumer/Home users:
• Install KB5065431 via Windows Update or download the .msu and apply it manually if Windows Update fails. Confirm build becomes 22631.5909.
• Schedule and complete an upgrade to Windows 11 24H2 well before November 11, 2025 to stay in the supported security servicing stream. (learn.microsoft.com)
• For streamers and multimedia creators:
• Install KB5065431 and run sample captures to validate NDI/audio/video performance in OBS/NDI Tools. Keep driver and capture‑utility versions up to date.
• For IT admins:
• Pilot KB5065431 on a small set of representative endpoints for 72 hours.
• Monitor event logs, Windows Update logs, and application crash telemetry.
• Validate uninstall/rollback procedures and keep recovery images ready (because combined SSU+LCU packages complicate simple uninstall).
• For organizations still on 23H2 Enterprise/Education:
• Note you have extended servicing through November 10, 2026, but plan now — upgrades should be scheduled and vendor compatibility validated for large fleets to avoid last‑minute scramble. (learn.microsoft.com)

---

Final assessment: strengths, limitations, and lingering risks​

KB5065431 is a pragmatic, engineering‑focused cumulative meant to steady the platform heading into the year-end lifecycle milestones. Its strengths are straightforward:

• Targeted remediation of user‑visible regressions (NDI, UAC prompts) that materially affected power workflows and enterprise app installs. (tomshardware.com)
• Operational safety for admins: Microsoft provides Update Catalog packages, WSUS/Intune distribution paths, and usual DISM tools for image servicing, allowing controlled rollouts. (support.microsoft.com, learn.microsoft.com)

However, there are important limitations and risks:

• Combined SSU+LCU complexity increases rollback difficulty. Admins must treat image recovery as the primary rollback tool rather than assuming simple uninstallability.
• Dependency on third‑party app vendors remains the organizing risk for major feature rollouts (24H2 and beyond). Microsoft can patch OS behavior, but compatibility fixes from ISVs are often necessary to restore seamless experiences. If an organization delays upgrades until every third‑party product is explicitly certified, the risk is falling behind security servicing deadlines.
• Unverified editorial claims about the number of 24H2 issues or the scale of impacted devices should be treated cautiously; operational planning should rely on vendor advisories, telemetry, and staged pilot results rather than anecdotal counts.

---

Conclusion​

KB5065431 (build 22631.5909) is a conventional but important September Patch Tuesday cumulative for Windows 11 23H2. It fixes concrete regressions (especially around NDI streaming and installer/UAC behavior), tightens SMB security diagnostics, and consolidates other monthly security mitigations. For Home and Pro users, the release is a final reminder: Windows 11 23H2 stops receiving consumer security updates on November 11, 2025, so plan and execute upgrades to 24H2 (or later builds) sooner rather than later. Administrators should stage the update carefully, verify rollback plans given SSU persistence, and use the Update Catalog or managed tooling to distribute the .msu packages where automatic delivery lags. The update is not feature‑rich, but its reliability improvements matter — especially for streaming professionals and environments that were affected by August’s installer/UAC hardening. (learn.microsoft.com, tomshardware.com)

---

Source: windowslatest.com Windows 11 KB5065431 23H2 released, direct download links (.msu)