What stops working after updates from Windows, Microsoft 365, Exchange, VMware, Veeam and other major vendors – with status, workaround and fix, continuously from the vendors’ official sources, complemented by reports from forums and the community and by targeted web research. Anything the vendor has not confirmed yet is labelled as a community report.
With the October 13, 2026 Windows security update, Microsoft moved the ACL (access control list) hardening of the AD FS Distributed Key Manager (DKM) container into Enforcement mode. It addresses the elevation of privilege vulnerability CVE-2026-56155. On supported Windows Server versions, AD FS remediates insecure ACLs automatically unless administrators opted out. Windows Server 2012 and 2012 R2 require manual remediation. The change is live.
Since the October 2026 security update (released 2026-10-13), Windows 11 (26H2, 26H1, 25H2, 24H2) and Windows Server 2025 block the generation of NTLMv1-derived credentials for Single Sign-On by default. This applies only to devices with Credential Guard disabled and the BlockNtlmv1SSO registry value not set. Microsoft states this is a planned hardening change, not a known issue. The change is now live.
File History is reported to show a false 'Reconnect your drive' message after the 8 Sep 2026 update, and backups stop working. This is reported by users, not yet confirmed by the vendor. A fix is reported to be available with KB5124010, but one report says part of the problem persists.
Microsoft · Windows 11 23H2, 24H2, 25H2, 26H1 and Windows 10 ESU
After installing KB5127648, Smart App Control can reportedly no longer be turned on. This is reported by users and news sites, not yet confirmed by the vendor in the sources available to us. No fix is known yet.
After installing KB5127648, Windows 11 clients reportedly fail to authenticate on WPA2-Enterprise Wi-Fi and wired 802.1X networks using PEAP (Protected Extensible Authentication Protocol). This is reported by users, not yet confirmed by the vendor. A likely cause, inferred and not listed by Microsoft, is that NTLMv1 single sign-on is now blocked by default. Reported mitigations exist, but no vendor fix is known.
Users report various problems after installing the KB5124010 preview update for Windows 11 24H2/25H2: slow boot, shutdown and search, a boot failure after uninstalling, and games crashing. These are reported by users, not yet confirmed by the vendor. Only 2 independent sources were found. A separate AC-3 (Dolby Digital) app crash is mentioned as resolved by KB5127648 according to the research notes.
If your organization uses Windows security baselines, Administrator protection became enabled by default with the October 2026 Windows security update. This applies to Windows 11 versions 26H2, 25H2 and 24H2. Microsoft recommends reviewing and testing the baseline configuration.
A single user report describes the .NET cumulative update KB5127690 failing with error 0x80070bc9 on Windows Server 24H2 (build 26100.33650, Hyper-V VM). This is reported by users, not yet confirmed by the vendor. Microsoft has published no release-health entry for it; the error looks like a machine-specific servicing fault, not an update defect.
One user reported that systems with Supermicro mainboards and Intel SATA RAID fail to boot after installing KB5122882. This is reported by users, not yet confirmed by the vendor; Microsoft has not documented the issue. The cause and the full scope are unknown.
Users report that File History copies files to the target drive, but the "Last copied on" date does not update and Previous Versions shows no entries. This is reported by users, not yet confirmed by the vendor. A related September 2026 File History bug was reportedly resolved by Microsoft, but no vendor source confirms the remaining problem.
Let's Encrypt is shortening the validity of its certificates in stages, as required by the CA/Browser Forum Baseline Requirements. On 2027-02-10 the default classic profile moves to 64-day certificates. Users see the shorter validity at their next renewal after each date. Staging changes are deployed about one month earlier.
Mozilla moved to a new GPG signing subkey for Firefox RPM packages, Linux tarballs and checksum files and revoked the previous key. On some RPM distributions the package manager cannot replace the key itself, so Firefox updates fail. Mozilla documents a manual workaround.
Microsoft will disable Exchange Web Services (EWS) in Exchange Online in phases starting October 2026 and fully in April 2027. Free/Busy and MailTips from an Exchange Server organization to a different organization's Exchange Online tenant via an EWS-dependent Organization Relationship are affected. Microsoft is still evaluating a replacement path and has asked for feedback.
After installing Windows 11 version 26H2, Credential Guard protected machine accounts may lose their secure channel to an on-premises Active Directory domain. The cause is Machine Identity Isolation (MII), which Windows now honours; it is only supported with Windows Server 2025 domain controllers at Domain Functional Level 2025 or above. Microsoft has resolved the issue with updates released on 2026-09-22 and later.
Microsoft plans to automatically migrate Windows Health Attestation compliance evaluation in Intune from the Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA) in the first half of 2027. It affects Windows 11 devices managed with Intune. Network, firewall, proxy and endpoint access must allow the new endpoints to avoid interruptions. No exact date has been announced.
Three time zone changes affect Windows devices in Alberta, British Columbia and Morocco. Morocco moved to UTC+0 on 2026-09-20; Alberta and most of British Columbia change permanently on 2026-11-01. Microsoft is releasing fixes across September and October 2026 and recommends temporary workarounds for devices that cannot be updated in time.
Exchange Web Services (EWS) changes in Exchange Online start between October 2026 and April 2027. Two on-premises scenarios are affected: hybrid setups with on-premises mailboxes that have online archives, and on-premises organizations with rich coexistence to a different Exchange Online organization. EWS is not deprecated on-premises.
Microsoft plans to begin enforcing stricter logon requirements for the Exchange Online PowerShell module on 31 March 2027. Module versions older than 3.10.1 may fail to authenticate in certain interactive scenarios. Version 3.10.1 and newer continue to work normally.
Microsoft · ExchangeOnlineManagement PowerShell module
On 2027-02-10 Let's Encrypt moves all subscribers to certificates with a 64-day lifetime by default. Certificates issued or renewed on or after that date are affected; valid certificates are not revoked. Renewal jobs with hard-coded timings may fail to renew in time.
Manitoba is permanently moving to UTC-5 and will not set its clocks back on November 1, 2026. Windows devices in Manitoba are affected because their time zone data does not yet reflect this. Microsoft states a fix is releasing in October 2026 and recommends a temporary workaround for devices that cannot be updated in time.
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.
