Month: September 2026

Sept 2026 Security Update BUG Affecting RDS and User Logon Sessions for Windows

Posted on by David Florey

Just a quick post here – Microslop at it again with bugs in seemingly un-tested security updates for Windows OSes…

This time, its September 2026’s security hotfix that introduces a bug – affecting mainly RDS session hosts, but also affects ALL Windows server and desktop versions going as far back as Server 2012 right up to the insider pre-release of Windows 11 26H2.

From what I’ve seen in the wild so far is:

  • RDS session host boots, allows users to login for a while
  • RDS session host starts to deny new connections, while existing connection remain
  • RDS session host also denies login at the console, often rendering the console completely unusable – can’t even get to the login screen
  • Existing sessions start to become increasingly slow, to the point of almost unusable
  • Server cannot be rebooted cleanly from the console, from a remote PC using task scheduler, or from a remote PC using commands such as: 
    shutdown /f /r /t 1 /m \\RDShostName
  • Server must be reset or power cycled
  • Server returns to normal for a couple of hours before returning back to a troubled state described in this list

Also have seen this affect a domain controller – denying administrator login over RDP, however this domain controller did allow the administrator logon session from the console.

To verify from a remote PC if the affected system has applied the security hotfix with the bug, I used the PowerShell command:

Get-HotFix -ComputerName "RemoteServerName"

This will return all the hotfixes applied to the specified computer, use this to locate the affected hotfix based on the Windows version and the hotfix KB number from this list:

  • Server 2016 – KB5123099
  • Server 2019 – KB5122876
  • Server 2022 – KB5122882
  • Server 2025 – KB5122871
  • Windows 11 – KB5124008
  • Windows 11 – KB5120998

I then download the required KB patch for the Windows version using the below with the direct link to the catalog:

Citrix has also picked up on this issue and published findings here: https://support.citrix.com/external/article/CTX697101/issues-with-microsoft-windows-september.html

Happy microslapping away, Microslop!

Renew Exchange Backend SSL Certificate

Posted on by David Florey

The Microsoft Exchange Server backend services SSL certificate occassionally expires and needs to be renewed. This certificate is not signed by a third party trusted signing authority and is generated locally.

The renewal process is pretty simple. Launch the Exchange PowerShell with administrative rights

Once the PS session has loaded, we need to list all the certificates with the Subject containing CN=Microsoft Exchange.

Get-ExchangeCertificate | Where-Object {$_.Subject -eq "CN=Microsoft Exchange"}

Locate the thumbprint and use it in the next command:

Get-ExchangeCertificate -Thumbprint "<Old_Thumbprint>" | New-ExchangeCertificate -Force -PrivateKeyExportable $true

Rerun the first command and now you should see an additional certificate listed

Now return to IIS and edit the bindings of the Exchange BackEnd site

In the SSL certificate dropdown, the currently selected certificate will still be the old certificate.

Select the other certificate from the list with the same name: Microsoft Exchange

Once selected, click View to confirm this is the newly generated certificate by checking the validity period

Click OK and restart the BackEnd site