Microsoft Issues Emergency Fixes Following Disruptive September Patch Tuesday Updates

For organizations that rely on remote work or centralized server management, these hangs were more than a minor annoyance; they prevented administrators from accessing critical infrastructure and stopped employees from reaching their virtual workstations. Microsoft responded to these connectivity failures with the release of update KB5129194. This fix was designed to resolve the underlying service deadlocks that occurred during the configuration phase of the remote session, allowing for the stable re-establishment of RDP connections.

The complications extended into the realm of identity management and security architecture as well. A particularly complex issue emerged involving machine accounts protected by Credential Guard. Credential Guard is a vital security feature in Windows that uses virtualization-based security to isolate secrets, such as hashed passwords, so that only privileged system software can access them. This is a primary defense against "pass-the-hash" attacks.

However, after the September update, some users discovered a degradation in security within Active Directory environments. Specifically, some devices were no longer being recognized correctly by the network, leading to authentication failures and a loss of secure identity verification. The root cause was linked to the way the update handled Machine Identity Isolation. To address this, Microsoft suggested a multi-stage approach: administrators must temporarily prevent the enforcement of Machine Identity Isolation before they can successfully install the corrective fix. The company has clarified that this is a transitional solution and that a more permanent, seamless fix will be integrated into a future scheduled update.

Virtualization and developer-centric features were also caught in the crossfire of the September update. Applications that utilize Host Compute Service (HCS) managed virtual machines experienced significant regressions. This was particularly evident for users of Plan9, a protocol often used to facilitate communication and file sharing between a host operating system and a guest virtual environment.

In various scenarios, users found they were unable to access folders shared from the Windows host. Applications depending on these shared directories would frequently throw errors indicating that no Plan9 drive shares were mounted. Microsoft identified the Windows Subsystem for Linux (WSL) and Claude Cowork as two of the primary applications affected by this breakdown in file system bridging. Notably, the issue appeared to be specific to the Plan9 feature set; Hyper-V virtual machines that did not utilize Plan9 for sharing remained unaffected, suggesting the bug was localized to the specific communication protocol used by HCS-managed environments.