A serious bug introduced by Microsoft’s September 2026 Patch Tuesday updates is causing Remote Desktop Services (RDS) failures on Windows Server 2019, 2022, and 2025. System administrators are reporting that server session hosts freeze a few hours after booting, leaving remote login sessions stuck at “Connecting…” and making it impossible to cleanly disconnect or log off users. These issues appear shortly after a user session ends or reconnects.
The trouble stems from three non-optional cumulative updates: KB5122876 for Server 2019, KB5122882 for Server 2022, and KB5122871 for Server 2025—all released in Microsoft’s September security rollout. Reports of these failures came from multiple network environments, confirming that this is not isolated to single configurations but a widespread defect. Symptoms typically emerge after rebooting the server and become noticeable when sessions are disconnected or reconnected. After this point, new Remote Desktop Protocol (RDP) connections hang at the login screen, displaying Event ID 20498 in the TerminalServices-RemoteConnectionManager log.
What Happens During the Failure
Once the bug hits, everything degrades rapidly. Existing sessions can’t log off, applications tied to session state such as Settings freeze, and Task Manager becomes unresponsive because the Local Session Manager can’t be reached. Winlogon logs Event ID 6005, warning that “SessionEnv is taking a long time to handle the notification event (Disconnect)”. Kernel-level analysis by administrators points to a deadlock inside the RDP server base library, in a routine called RDPSERVERBASE!WDLIB_Close during session teardown.
After this deadlock occurs, connection requests pile up. Even a full restart often fails to resolve the freeze—users say only a hard reboot restores functionality, though the issue may recur hours later. Microsoft has not publicly confirmed the root cause as of this writing, and has not responded to press inquiries about it.
Security vs. Stability: The Dilemma for Admins
The September patch rollout fixed nearly 973 vulnerabilities across Microsoft’s ecosystem, including two zero-days added to the CISA Known Exploited Vulnerabilities catalog: one in the Windows Update stack and another in Windows Advanced Local Procedure Call. Among the fixes was a critical remote code execution vulnerability in Remote Desktop Services with a CVSS score of 9.8, plus a vulnerability in the Windows Remote Desktop Client. However, these security patches are bundled with the same updates that are causing the catastrophic instability in RDS environments.
Removing the update via DISM reportedly restores server stability almost immediately—but standalone installers like WUSA won’t do, because the updates include a Servicing Stack Update component that can’t be uninstalled. An alternate temporary workaround involves using a FeatureManagement registry key to disable a specific feature flag linked to audio redirection, which appears to be part of the problem. Some admins also saw less severe issues by forcing RDP over TCP only or disabling UDP-based Universal Rate Control Protocol or WDDM through registry tweaks.
Best practices right now include deploying these updates first on non-critical servers to monitor for Event IDs 20498 and 6005 during session disconnects, and having rollback plans ready. The severity of this incident highlights a harsh trade-off: either accept exposure to serious vulnerabilities or endure frequent RDS failures until Microsoft issues an acknowledged fix or a patch that separates the problematic components from the critical security ones.
This crisis underscores how tightly Windows security and server reliability are intertwined. While patching remains essential, system administrators must balance the urgency of applying security updates with the risk of operational disruptions. What to watch for: if Microsoft confirms the deadlock in RDPSERVERBASE!WDLIB_Close, expect either an out-of-band patch or official guidance distinguishing between core security fixes and optional features. Monitoring server logs now—especially TerminalServices-RemoteConnectionManager and Winlogon—is likely to save hours of downtime in the days ahead.
Analytical Angle: This failure event reveals a warning for enterprise IT teams—patch quality and modularity are becoming as critical as patch speed. When security updates bundle essential fixes with components that can trigger widespread instability, the cost of a blanket patch can be uptime itself. Going forward, Microsoft’s patch strategy may need to pivot toward greater granularity and extra validation for remote session services. Admins should push for transparent change logs and isolated feature flags, especially for high-impact functions like RDS, to avoid being forced into trade-offs between security and usability.
