Microsoft has confirmed a fresh wave of regressions tied to the January Patch Day security updates: some applications may stop responding or report errors when opening or saving files stored in cloud-synced locations such as OneDrive or Dropbox, Outlook Classic profiles that store PSTs on OneDrive can hang or refuse to reopen, and a set of related problems (Remote Desktop sign‑in failures and Secure Launch shutdown/hibernate regressions) prompted emergency out‑of‑band fixes within days of the monthly rollup. .
The January servicing wave was distributed on Patch Tuesday, January 13, 2026, as cumulative security updates across Windows servicing branches. In the days following the rollouts, telemetry and customer reports converged on multiple, distinct regressions: (1) credential and authentication failures that blocked Remote Desktop and cloud‑PC sign‑ins; (2) a configuration‑dependent power‑state regression on some Windows 11, version 23H2 machines with System Guard Secure Launch enabled (devices restarted instead of shutting down or entering hibernation); and (3) application hangs and file‑I/O errors affecting apps that operate on cloud‑synced storage (for example Outlook PSTs in OneDrive). Microsoft acknowledged its Release Health notes and issued emergency out‑of‑band (OOB) cumulative updates on January 17, 2026 to address the most severe regressions. These incidents highlight the tension between rapid security delivery and operational stability across an extremely diverse installed base. The January rollup patched a broad slate of vulnerabilities, but interactions between new servid platform features (like Secure Launch), authentication flows used by the modern Windows Remote Desktop App, and apps that rely on cloud‑backed storage produced the visible failures. Multiple independent community threads and industry outlets tracked the sequence of events and the fixes Microsoft supplied.
easures and recommended actions
Short, actionable guidance — split for end users and IT admins.
For end users and power users:
Microsoft continues to refine the fixes and monitoring; administrators should watch the Windows Release Health dashboard and the Microsoft Update Catalog for successive updates and confirm resolutions in their own test environments before broad deployment.
Source: heise online More problems with Windows updates from January
Background / Overview
The January servicing wave was distributed on Patch Tuesday, January 13, 2026, as cumulative security updates across Windows servicing branches. In the days following the rollouts, telemetry and customer reports converged on multiple, distinct regressions: (1) credential and authentication failures that blocked Remote Desktop and cloud‑PC sign‑ins; (2) a configuration‑dependent power‑state regression on some Windows 11, version 23H2 machines with System Guard Secure Launch enabled (devices restarted instead of shutting down or entering hibernation); and (3) application hangs and file‑I/O errors affecting apps that operate on cloud‑synced storage (for example Outlook PSTs in OneDrive). Microsoft acknowledged its Release Health notes and issued emergency out‑of‑band (OOB) cumulative updates on January 17, 2026 to address the most severe regressions. These incidents highlight the tension between rapid security delivery and operational stability across an extremely diverse installed base. The January rollup patched a broad slate of vulnerabilities, but interactions between new servid platform features (like Secure Launch), authentication flows used by the modern Windows Remote Desktop App, and apps that rely on cloud‑backed storage produced the visible failures. Multiple independent community threads and industry outlets tracked the sequence of events and the fixes Microsoft supplied. What Microsoft says (and which versions are affected)
Microsoft has documented the issues and the subsequent OOB remediation packages on its Release Health dashboard and support pages. The Remote Desktop / Cloud PC credential prompt failures and related Remote Desktop authentication problems were resolved via out‑of‑band updates released January 17, 2026 (for example, KB5077793 and KB5077797 / KB5077744 depending on the branch). The Secure Launch shutdown/hibernate regression in Windows 11, version 23H2 (Enterprise / IoT SKUs where Secure Launch is typically enabled) was fixed by the OOB update KB5077797 for 23H2. Microsoft’s Outlook team also published guidance for Classic Outlook profiles (POP + PST) that may hang after the January updates and recommended mitigations such as moving PSTs out of OneDrive until a permanent fix is available. Affected platforms called out in vendor advisories include:- Windows 11 versions 25H2, 24H2, 23H2 (various editions).
- Windows 10 22H2 (and certain ESU branches noted in some advisories).
- Windows Server servicing branches (Windows Server 2025, 2022, 2019) where Remote Desktop brokered clients were impacted.
Symptoms witnessed in the field
Short, practical symptom list (what administrators and users reported):- Outlook Classic (POP) profiles and any Outlook profile with PSTs stored on OneDrive: Outlook may hang with “Not Responding,” fail to reopen (requiring Task Manager termination or a reboot), sent messages not appearing in Sent Items, and previously downloaded messages being downloaded again. Moving PST files out of OneDrive is a documented temporary port . microsoft.
- Remote Desktop / Azure Virtual Desktop / Windows 365: credential prompt failures, repeated authentication prompts, or immediate sign‑in errors in the Windows App and some other Remote Desktop client experiences, preventing Microsoft recommended using the classic Remote Desktop client or the AVD web client as a fallback. ([learn.microsoft.com](Resolved issues in Windows 11, version 23H2 Launch shutdown/hibernate regression (Windows 11 23H2): devices with System Guard Secure Launch enabled could restart instead of powering off or entering hibernation after applying the January update. The symptom produced a brief black screen followed by a restart, undermining battery and maintenance expectations for affected endpoints. Microsoft issued an interim mitigation and an OOB update for 23H2.
- Other community‑reported oddities: brief black screens during boot, wallpaper resets, File Explorer quirks, and occasional servicing errors during installation. Many of these remain community signals rather than vendor‑confirmed issues and should be treated with caution until Microsoft publishes definitive guidance.
Timeline: concise chronology
- January 13, 2026 — Microsoft publishes the January cumulative updates (Patch Tuesday). Key packages include KB5073455 (Windows 11 23H2) and KB5074109 (Windows 11 24H2/25H2).
- January 13–16, 2026 — Telemetry and user reports surface: Remote Desktop authentication failures, Secure Launch shutdown regression on 23H2, and application hangs (notably Classic Outlook with PSTs in OneDrive).
- January 16–17, 2026 — Microsoft logs the incidents in Release Health, publishes interim guidance, and on January 17 releases emergency out‑of‑band (OOB) updates (for example KB5077797 for 23H2 and KB5077744 / KB5077793 for other branches). Known Issue Ros and Group Policy mitigations are also made available to enterprise customers.
- January 17–20, 2026 — OOB packages circulate; Microsoft continues investigating Outlook POP/PST hang behavior and updates support pages with workarounds (move PSTs out of OneDrive, use webmail). Some customers report the OOB fixes resolve main issues; others report lingering behavior on devices with Secure Launch enforced at firmware level.
Technical anatomy — why these regressions happened
The visible faults have different technical roots but share a common root: complex interactions between servicing changes and platform/component semantics.- Secure Launch + offline servicing: Secure Launch is a virtualization‑rooted early‑boot hardening feature that changes how the OS and firmware coordinate during offline servicing (the staged LCU/SSU commit phase that often occurs across reboot/shutdown). In some hardware/firmware/service sequencing combinations, the servicing orchestration failed to preserve the user’s final power intent, causing the system to fall back to a conservative restart rather than power off or enter hibernation. This pendent regression — Enterprise/IoT images with Secure Launch enabled were the most affected.
- Authentication handshake changes: The Windows App and certain remote client flows use a modern authentication handshake and brokered token exchange. The January update altered a client‑side component used in the credential prompt/authentication sequence. That change broke the handshake for some Remote Desktop/Cloud PC scenarios, producing repeated credential prompts or immediate failures. Because backend cloud services were not the primary cause, Microsoft remedied the client with OOB updates and offered KIR/artifacts to revert the problematic change for managed fleets.
- App behavior with cloud‑backed storage: Applications that treat cloud‑synced folders as local storage (PSTs saved to OneDrive, D rely on file system semantics that can be affected by changes in file caching, opportunistic file locking, or the interaction between cloud sync clients and the OS update. In this case, Outlook Classic profiles storing PSTs in OneDrive sometimes hung on file open/save operations after the update. Microsoft’s immediate workaround was to remove PSTs from cloud‑sync locations and use webmail access where possible.
What Microsoft shipped and how it addresses the problems
Microsoft’s response combined several mechanisms:- Out‑of‑band cumulative updates (OOB) that include fixes and often a combined Servicing Stack Update (SSU) + Latest Cumulative Update (LCU) package to accelerate delivery (e.g., KB5077797 for Windows 11 23H2; KB5077744 and KB5077793 for other branches). These packages restored Remote Desktop authentication flows and corrected the Secure Launch shutdown regression for many customers.
- Known Issue Rollback (KIR) and Group Policy artifacts to temporarily disable the change causing the regression for managed fleets, allowing administrators to preserve the security content while disabling the problematic behavioral change. The KIR approach reduces the need to uninstall critical security updates and is therefore safer for enterprise fleets.
- Workarounds and per‑app guidance: Outlook guidance to move PST files out of OneDrive, use webmail, or contact app vendors for alternative file access methods. Microsoft also recommended alternate Remote Desktop clients (classic mstsc.exe or the AVD web client) as fallbacks.
- Ongoing investigation: Microsoft continues to investigate residual reports, particularly where OOB updates did not fully resolve symptoms on systems with Secure Launch enforced via firmware or where vendor firmware/driver baselines are outdated. In such cases, Microsoft has flagges or temporarily disabling Secure Launch may be necessary as a last resort — a mitigation with security tradeoffs.
easures and recommended actions
Short, actionable guidance — split for end users and IT admins.
For end users and power users:
- If Outlook hangs and your PST is stored in OneDrive, move the PST out of OneDrive to aonfigure Outlook to use the local PST. Microsoft documents this as a practical workaround.
- If Outlook refuses to reopen, terminate the lingerom Task Manager or restart the system. Saved emails may appear missing from Sent Items until the PSTs are properly relocated.
- If Remote Desktop connections fail after the January updates, use the classic Remote Desktop client (mstsc.exe) or the AVD / Windows App web client as a temporary path to connect.
- Check affected build numbers and align with Microsoft’s Release Health guidance before broad deployment; apply OOB fixes where needed (KB5077797, KB5077744, KB5077793). ([learn.microsoft.com](Resolved issues in Windows 11, version 23H2 Rollback (KIR) artifacts or the Group Policy mitigations Microsoft published when you must retain the January security content but avoid the behavioral change causing authentication regressions. Documentation and KIR downloads are available via Microsoft guidance pages.
- Validate that firmware and driver baselines are current on devices running Secure Launch; some firmware combinations can prevent the OOB patch from fully resolving the restart-on-shutdown symptom. If necessary, plan coordinated firmware/driver remediation or, as a last resort and with awareness of the security tradeoffs, consider disabling Secure Launch to restore deterministic shutdown behavior while awaiting a codate.
- Expand pilot rings to include hardened configurations (Secure Launch, virtualization, enterprise images) before future Patch Tuesday rollouts; prioritize teleworkers and Cloud PC users in remote access testing.
- Microsoft suggests that urgent, business‑critical incidents be escalated through Microsoft Business Support for targeted assistance. This remains the recommended channel for enterprise customers facing production outages.
- Force a power‑off when shutdown options fail: run `shutdown /s /t mmand Prompt. Microsoft documented this as an interim workaround while patches were prepared.
Risks, tradeoffs, and what this episode means for patch management
Strengths of Microsoft’s response:- Rapid turnaround: Microsoft produced OOB fixes within four days of the Patch Tuesday rollout for the most critical regressions affecting remote access and platform power semantics. This reduced the window of widespread disruption for many organizations.
- Use of KIR: Publishing Known Issue Rollbacks allowed many organizations to retain security patches while turning off the change that caused the regression—al tool.
- Bundled SSU + LCU packaging: The OOB updates often combined the Servicing Stack Update with the Latest Cumulative Update, which changes uninstall and rollback semantics and complicates emergency rollback strategies for admins whon LCU. Operations teams must understand this packaging nuance before attempting large‑scale rollbacks.
- Configuration blind spots in test rings: The regression’s narrow dependence on Secure Launch exposes the difficulty of fully representing enterprise firmware/BIOS configurations in broad testing pipelines. Enterprise/IoT features are less prevalent in consumer rings, meaning some regressions will surface predominately in managed fleets.
- Partial fixes and firmware dependencies: Because the OOB patch does not always fully resolve symptoms on systems where Secure Launch is enforced in firmware, administrators may face a prolonged remediation path that involves firmware updates or temporarily reducing boot‑time protections—both of which carry operational and security implications.
- Balancing security vs availability: The central tradeoff is stark—uninstalling January security updates improves immediate availability for some customers but leaves devices exposed to the vulnerabilities the updates closed. Using KIR, targeted OOB fixes, and timed deployments in controlled pilot rings offers a way to reduce both security and availability risk simultaneously.
- Need for deeper telemetry and configuration coverage: Enterprises should expand their update-validation matrices to include Secure Launch, virtualization, remote‑access clients (Windows App), Cloud PC/AVD patterns, and common cloud sync agents (OneDrive, Dropbox) to catch these crosearlier.
Critical analysis — what vendors and admins should learn
- Increase test coverage for hardened configurations. Features such as Secure Launch, Secure Boot, virtualization‑based security, and enterprise image customizations need to be part of pilot rings. The January incidents show how configuration‑dependent behaviors can create high operational risk even when affecting a minority of endpoints.
- Preserve rollback clarity. The practice of bundling SSUs with LCUs speeds delivery but complicates rollback and uninstallation; organizations should update their remediation runbooks to address combined‑package semantics and plan for recovery in both directions.
- Invest in app‑aware update testing. Many enterprise and power‑user applications (Outlook with local PSTs, Citrix agents, cloud sync clients) are sensitive to subtle file‑system or authentication changes. Test matrices should include representative third‑party agents and legacy app configurations, not only modern, vanilla builds.
- Treat OOB patches as part of normal operations. The frequency of emergency, out‑of‑cycle updates has increased in recent years. Organizations must operationalize OOB package validation and deployment as part of their standard patch processes rather than as ad‑hoc exceptions.
- Communication and rapid guidance matter. Microsoft published clear interim mitigations and fallback options (KIR, alternate clients, PST relocation), which reduced the blast radius; vendors should continue to prioritize clear, actionable guidance when regressions occur.
Final verdict — practical takeaway for Windows users and admins
- For most consumers: if your device is stable, avoid knee‑jerk uninstalls; apply vendor OOB updates as they arrive and follow Microsoft’s guidance for affected apps (move PSTs out of OneDrive, use webmail). If you are impacted (Outlook hangs, RDP failures), adopt the recommended workarounds and install the OOB packages targeted to your OS build.
- For IT administrators: prioritize detection and remediation of affected build numbers (check winver), deploy OOB patches selectively in pilot rings that include hardened configurations (Secure Launch, Cloud PC users), use Known Issue Rollback where appropriate, and coordinate firmware/driver updates where Secure Launch behavior persists after the Windows patch. Escalate critical outages to Microsoft Business Support when needed.
Microsoft continues to refine the fixes and monitoring; administrators should watch the Windows Release Health dashboard and the Microsoft Update Catalog for successive updates and confirm resolutions in their own test environments before broad deployment.
Source: heise online More problems with Windows updates from January





