September Windows Updates Cause Widespread Remote Desktop Services Failures

Windows administrators are facing significant disruption following Microsoft's September 2026 Patch Tuesday cumulative updates, which have introduced a critical bug impacting Remote Desktop Services (RDS) on Windows Server 2019, 2022, and 2025. The updates, specifically KB5122876 for Server 2019, KB5122882 for Server 2022, and KB5122871 for Server 2025, are causing session hosts to freeze after a few hours of operation, rendering RDP connections unusable and preventing logged-in users from disconnecting or logging off.

Reports of the issue began surfacing on platforms like Reddit's r/sysadmin, where numerous administrators described identical failure patterns across diverse environments. This widespread reporting indicates a systemic problem rather than an isolated configuration issue. The symptoms typically emerge a few hours after a reboot, often triggered by a user session disconnecting or reconnecting. Once the freeze occurs, new RDP connection attempts hang indefinitely at the login screen, accompanied by Event ID 20498 in the TerminalServices-RemoteConnectionManager log, which states that "Remote Desktop Services has taken too long to complete the client connection."

Existing sessions on affected hosts become unresponsive, and the paralysis extends to critical system tools. Task Manager freezes, unable to reach the Local Session Manager, and applications reliant on Windows session state, such as Settings, become inoperable. Simultaneously, Winlogon logs Event 6005, warning that "SessionEnv is taking a long time to handle the notification event (Disconnect)."

Independent analysis by affected administrators, including kernel-level debugging, suggests a deadlock within the RDP server base library, specifically in the RDPSERVERBASE!WDLIB_Close routine during session teardown. This deadlock causes requests to queue up, leading to system paralysis. In severe cases, even a standard restart may hang, requiring a hard reset to restore functionality, though the issue often recurs later the same day.

Microsoft has not yet officially confirmed the root cause of this deadlock or provided a timeline for a fix. The affected cumulative updates are not optional, as they contain critical security patches. This month's Patch Tuesday addressed approximately 973 vulnerabilities, including two zero-days (CVE-2026-81963 and CVE-2026-85880) already under active exploitation and added to CISA's Known Exploited Vulnerabilities (KEV) catalog. The same update also patched a critical Remote Desktop Services remote code execution flaw (CVE-2026-69525) and a Windows Remote Desktop Client vulnerability (CVE-2026-69485).

Organizations heavily reliant on RDS are in a difficult position. Rolling back the September updates would restore stability but would also remove crucial security fixes, including those for actively exploited zero-days. Administrators who have successfully removed the problematic updates using DISM have reported immediate stabilization, as the standalone WUSA installer cannot detach the cumulative update from its bundled Servicing Stack Update.

Unofficial workarounds are circulating among affected users. One method involves modifying the FeatureManagement registry key to disable the faulting audio-redirection code path, which is believed to be responsible for the deadlock, without uninstalling the security patch. Other administrators have reported partial success by forcing RDP transport to TCP only and disabling UDP-based Universal Rate Control Protocol via registry changes.

Given the widespread impact across multiple Windows Server versions, security teams are advised to pilot the September updates on non-critical hosts, closely monitor for the specific event IDs (20498 and 6005), and prepare a rollback plan. Organizations should await an official acknowledgment from Microsoft or an out-of-band fix to fully resolve this disruptive issue.