Title: What you need to know about August 12, 2025 — KB5063875 (OS Builds 22621.5768 / 22631.5768)
Summary (TL;DR)
- Microsoft released the August 12, 2025 cumulative security update KB5063875 for Windows 11 (builds 22621.5768 for 22H2/23H2 servicing branch and 22631.5768 for the 23H2 ring). This is a monthly security-quality rollup that includes the July fixes and servicing-stack improvements; Microsoft lists no known issues at time of release. (support.microsoft.com)
- The package is delivered as a combined Servicing Stack Update (SSU) + LCU (cumulative) and will be pushed via Windows Update, Windows Update for Business and WSUS; standalone MSU installers are available from the Microsoft Update Catalog. (support.microsoft.com, learn.microsoft.com)
- If you must remove the LCU after installing a combined package, Microsoft instructs administrators to use DISM /Remove-Package and explains that wusa /uninstall will not work because the SSU is combined with the LCU. (support.microsoft.com)
- Recommended action: Home users should allow Windows Update to install the update automatically (or check for updates in Settings). Enterprises should test (rings/pilot), stage via WSUS/SCCM/Intune and only push broadly after verification. See the checklist and troubleshooting tips below.
KB5063875 is the August 12, 2025 monthly cumulative update for the supported Windows 11 servicing branches named in the title. Microsoft describes it as a security update that “includes quality improvements” and explicitly calls out that the build incorporates the fixes shipped in the previous July 22 release (KB5062663). For Windows 11 version 23H2 Microsoft points to the same collection of changes and highlights the servicing-stack update (KB5062686) included with the package. At the time of publishing Microsoft reports no known issues for this release. (support.microsoft.com)
What’s inside (high-level)
- Security fixes: Microsoft lists this as a security update; the Security Update Guide has the vulnerability details for the month (link referenced inside the KB). (support.microsoft.com)
- Quality fixes: The KB specifically notes this build includes the improvements from the July 22, 2025 update (KB5062663) — as an example Microsoft called out a reliability fix for the Copilot key. (support.microsoft.com)
- Servicing Stack Update: An SSU (KB5062686) is included to improve the reliability of the update pipeline itself. SSUs are important because they ensure future Windows updates can be delivered and installed cleanly. (support.microsoft.com)
The KB emphasizes security and quality improvements rather than brand-new consumer features. Some of the consumer-facing August 2025 rollups (for other servicing branches such as 24H2) included new UI/AI feature deployments, and coverage of those feature rollouts appeared in press reporting around the same timeframe — for example Windows Central outlined a slate of new/rolling features arriving for Windows 11 in August 2025, though many features roll out gradually and may not be in every device immediately. If you are watching for new AI or UI changes, expect gradual feature enablement separate from this security-quality KB. (support.microsoft.com, windowscentral.com)
How the update is delivered (channels & files)
- Automatic: Windows Update and Microsoft Update (consumer and managed devices) — the update will download and install automatically according to your update policy. (support.microsoft.com)
- Windows Update for Business: The same package, subject to configured deferrals and rings. (support.microsoft.com)
- WSUS: The update will sync through WSUS for organizations that use it (Products = Windows 11, Classification = Security Updates). (support.microsoft.com)
- Microsoft Update Catalog: Standalone MSU packages are available for admins who prefer to download and stage packages manually (or apply with DISM). Microsoft’s guidance about Catalog usage and “checkpoint” cumulative updates is useful for imaging and disconnected scenarios. (support.microsoft.com, learn.microsoft.com)
- Test first: Deploy to a pilot ring (representative hardware + apps). Confirm logon, critical apps, networking, printing, and custom drivers behave as expected.
- Verify prerequisites: Because the combined package includes an SSU, check that your servicing stack is current; the KB bundles the SSU with the LCU but older inventories can behave differently.
- Catalog / offline images: If you update images or air-gapped devices, use the Microsoft Update Catalog to download MSU files (the Catalog also surfaces any preceding checkpoint cumulative updates you may need). (learn.microsoft.com)
- SCCM/Intune: Stage the package in a pilot collection. Monitor telemetry (update compliance, telemetry logs, event logs).
- WSUS: Ensure “Windows 11” product classification and “Security Updates” classification are enabled so the update will sync. (support.microsoft.com)
Because the KB is delivered as a combined SSU + LCU, Microsoft explicitly warns that running wusa.exe /uninstall on the combined package will not work — the SSU portion prevents simple wusa-based uninstalls. Instead, admins who must remove the LCU are instructed to use DISM’s Remove-Package command with the exact package name (you can enumerate installed packages with DISM /online /get-packages). In short:
- To list packages: DISM /online /get-packages
- To remove the LCU portion: DISM /Online /Remove-Package /PackageName:<exact-package-name>
Microsoft documents this flow and it’s restated in the KB. Plan rollbacks carefully and test them in your lab because the SSU itself cannot be removed once installed. (support.microsoft.com, learn.microsoft.com)
- Winver: Press Win+R → winver → check OS Build (should show the new build number such as 22621.5768 or 22631.5768 when installed).
- Settings → Windows Update → Update history: will list the KB number after successful install.
- PowerShell: Get-HotFix | Where-Object {$_.HotFixID -eq 'KB5063875'} (note: the hotfix list varies by packaging; use winver for builds).
- DISM: DISM /online /get-packages to see installed package names and package states.
If you or users see problems after the update, follow structured steps:
- Reboot and check Windows Update history (Settings > Windows Update > Update history).
- Look at Event Viewer (System and Application) and Setup logs (%windir%\logs\CBS\CBS.log and %windir%\windowsupdate.log).
- Driver checks: Update or roll back device drivers (Graphics/Chipset are common culprits).
- Safe Mode: Boot to Safe Mode to check whether third-party drivers or services are causing crashes.
- Uninstall only the LCU (if absolutely necessary): enumerate packages and remove using DISM /Online /Remove-Package /PackageName:... (see the KB for the exact guidance and note that you cannot remove the SSU). Test the remove process in a lab first — it requires care. (support.microsoft.com, learn.microsoft.com)
- If the system is unbootable, use WinRE / System Restore / recovery options. For enterprise environments have your recovery image and offline patching plan ready.
- Update schedule: If you rely on the PC, schedule the reboot for a convenient time (Windows Update will often require one).
- Backup: Create a System Restore point or a full file backup (recommended for critical machines).
- Drivers: Ensure your graphics drivers are up to date from vendor sites (NVIDIA/AMD/Intel) before or immediately after the update if you rely on multimedia/gaming.
- If you see issues: Pause updates (Settings > Windows Update > Pause updates) and wait for Microsoft/driver vendors to release any fixes. The KB for this release initially reports “no known issues,” but telemetry from the field sometimes surfaces problems after wider rollout — see the “what to watch” notes below. (support.microsoft.com)
Historically, cumulative updates occasionally generate driver or OEM-specific issues on certain hardware combinations. Microsoft’s KB lists “no known issues” for KB5063875 at publication time, but community forums and sysadmin boards can show issues emerging as the patch reaches more device variants. If your environment includes older or highly customized drivers, test thoroughly before broad deployment and monitor community threads and Microsoft’s Windows Release Health Dashboard for emerging problems. (support.microsoft.com)
Best practices for organizations
- Use phased rings: pilot → broad pilot → production.
- Maintain a rollback plan: have a tested DISM rollback script and offline images for recovery.
- Keep driver inventories: check vendors for new driver releases that match the updated OS build.
- Monitor update compliance and crash telemetry immediately after each ring placement.
- Consider deferring automatic installation for non-critical endpoints until the pilot ring reports green.
- Microsoft KB release note for August 12, 2025 — KB5063875 (official KB page with the release notes and file information). (support.microsoft.com)
- Microsoft Update Catalog (download standalone MSU files, and see checkpoint guidance for imaging). (learn.microsoft.com, support.microsoft.com)
- Windows Central coverage of August 2025 rollouts (context on features that are rolling out around the same timeframe). (windowscentral.com)
- Windows Insider blog (context for recent Dev-channel builds and simultaneous feature experimentation). (blogs.windows.com)
- Home users: Let Windows Update install KB5063875 automatically (or check for updates and install). Back up critical files or create a restore point if you have mission-critical work pending. If you experience issues after the update, pause updates and follow the troubleshooting plan above. (support.microsoft.com)
- Small business / IT admins: Test in a pilot group and deploy gradually via WSUS/SCCM/Intune. Keep the DISM-based rollback procedure ready before broad deployment because the package is combined (SSU+LCU). (support.microsoft.com, learn.microsoft.com)
- Produce a one-page printable checklist your admins can use for pilot testing and rollback (includes exact DISM commands and logging pointers).
- Draft a short set of user-facing instructions to send to end users explaining when their device will restart and what to expect.
- Monitor community threads for the next 48–72 hours and compile any emerging, verified compatibility problems and vendor driver updates relevant to KB5063875.
Source: Microsoft Support August 12, 2025—KB5063875 (OS Builds 22621.5768 and 22631.5768) - Microsoft Support
