Windows 10 Build 14393.2097 is out with KB4077525

Microsoft today released Windows 10 Build 14393.2097 to stable branch users. The package KB4077525 is now available for everyone. This cumulative update is applicable to Windows 10 version 1607 "Anniversary Update". Let's see what has changed.

Key changes include:

• Addresses issue where users of Citrix XenApp are unable to change passwords by pressing Ctrl+F1.

• Addresses issue where members of the Performance Log Users group receive the error “Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))”. The error appears while trying to schedule logging of performance counters, enable trace providers, or collect trace information.
• Addresses issue where the WinRM event query returns the error "0x6c6 (RPC_S_INVALID_BOUND)" from the target server. The error appears when servers are configured to push their security event logs to a central server for analysis using a subscription.
• Addresses issue where authentication to Microsoft Outlook fails when using conditional access.
• Addresses issue where smart card logons fail with the error "Signing in with a smart card isn’t supported for your account...." after the authenticating DC has been restarted. Authenticating DCs log KDC Event 19 and Kerberos Distribution Event 29 in the System event log. The log states that a suitable certificate cannot be found for smart card logons.
• Addresses issue where the certutil.exe -MergePfx command could not produce a merged EPF file for multiple V1 certificates.
• Addresses issue where the SM3 cryptographic hash algorithm was not supported on TPM devices. Customers experiencing this issue noticed that their TPM failed to initialize.
• Addresses issue where a 0x06d9 failure occurs when a user attempts an OS upgrade or an LCU update. The system automatically reverts to a previous version of the upgrade or update.
• Addresses issue where a server error occurs occasionally during file transfer. The error is “Stop D1 in tcpip!TcpSegmentTcbSend”.
• Addresses issue where the Remote Authentication Dial-In User Service (RADIUS) server name is not authenticated while connecting to a wireless network.
• Addresses issue where iSCSI target redirection during login may lead to stop error 9f.
• Addresses issue in MPIO where pass-through SCSI requests may lead to a stop error if the disk is pending removal.
• Updates MPIO path selection algorithm to match the documentation when all paths are Active or Unoptimized.
• Addresses issue where a delay function in StorNVMe may cause a small CPU usage increase when launching applications.
• Improves ReFS performance by more thoroughly unmapping multiple views of a file. See KB4090104for additional tunable registry parameters to address large ReFS metadata streams.
• Improves ReFS performance by removing idle containers from its hash table.
• Addresses issue where booting with Unified Write Filter and a connected USB hub may lead to stop error E1.
• Addresses issue where the Internet connection service (ICS) connections don't persist across OS restarts or ICS service restarts. You can also activate this solution using an optional EnableRebootPersistConnection registry key described in KB4055559.
• Cleans the public IP with the correct information for the SDN Network Manager.
• Adds ADCS support for Certificate Transparency (CT) that's compatible with the updated Google Chrome requirements. CT is a technology used by certificate authorities to log and publish certificate metadata for improved security.
• Adds ADCS support for Certificate Transparency for publicly trusted SSL/TLS certificates.
• Addresses issue where there is missing information in the Value field of audit event 5136 for Directory Service Changes. This occurs when you modify an attribute of an object on Windows Server 2016 Domain Controllers. This problem may occur if you use PowerShell commands (Add-ADGroupMember or Set-ADGroup) to add someone to a group using the user’s SID instead of the Distinguished Name.
• Addresses issue where an HTTP 500 error occurs when an ADFS farm has at least two servers using Windows Internal Database (WID). In this scenario, HTTP basic pre-authentication on the Web Application Proxy (WAP) server fails to authenticate some users. When the error occurs, you might also see the Microsoft Windows Web Application Proxy warning Event ID 13039 in the WAP event log. The description reads, “Web Application Proxy failed to authenticate the user. Pre-authentication is 'ADFS For Rich Clients'. The given user is not authorized to access the given relying party. The authorization rules of either the target relying party or the WAP relying party are needed to be modified.”
• Addresses issue in which AD FS can no longer ignore prompt=login during authentication. A Disabled option was added to support scenarios in which password authentication is not used. For more information, see AD FS ignores the "prompt=login" parameter during an authentication in Windows Server 2016 RTM.
• Addresses issue in AD FS where Authorized Customers (and relying parties) who select Certificate as an authentication option will fail to connect. The failure occurs when using prompt=login if Windows Integrated Authentication (WIA) is enabled and the request can do WIA.
• Addresses issue where AD FS incorrectly displays the Home Realm Discovery (HRD) page when an identity provider (IDP) is associated with a relying party (RP) in an OAuth Group. Unless multiple IDPs are associated with the RP in the OAuth Group, the user will not be shown the HRD page. Instead, the user will go directly to the associated IDP for authentication.
• Addresses issue where some Remote Desktop Protocol (RDP) clients that used an absolute URI (instead of a relative URI) were blocked by the Web Application Proxy (WAP) server from connecting to the Remote Desktop Gateway. This affected RDP clients on iOS, Mac, Android, and the Windows modern RDP client app. The error is "We couldn't connect to the gateway because of an error. If this keeps happening, ask your admin or tech support for help. Error code: 0x03000008."
• Addresses issue where GPMS reports are not showing content when you select links in the report with one of these errors:
  • Error: 'XMLSerializer' is undefined.
  • ‘DOMParser’ is undefined.
  • Server execution failed.
• Addresses issue where Dedup may cause data corruption to a file when you:
  • Create a file smaller than 2.2 TB.
  • Optimize the file.
  • Add data to the file that increases it to more than 2.2 TB.
• Addresses issue where a file is always marked as corrupted—even though it isn't—when running a full Dedup scrub on a file larger than 2.2 TB.
• Addresses issue where, after installing .NET 4.7, creating a new DFS-Replication group or adding a member to an existing replication group in the DFS Management snap-in leads to an error. The error is “The value does not fall within the expected range”.
• Addresses issue where, after installing .NET 4.7, the Create Cluster wizard in the Failover Cluster Management UI may unexpectedly close upon selecting Browse on the Select Servers page.
• Addresses issue where the Japanese keyboard layout didn't work properly during a Remote Assistance session.
• Addresses issue where logons to a Remote Desktop VDI collection start to fail after a period of server uptime. The Performance Counter Remote Desktop Connection Broker Redirector Counterset/RPC Contexts will show incremental growth during logon hours. When the value reaches 40, new connections to the farm fail or time out.

Known issues

Issue #1

Due to an issue with some versions of antivirus software, this fix only applies to the machines where the antivirus ISV has updated the ALLOW REGKEY.

The solution is as follows.

Contact your antivirus AV to confirm that its software is compatible and have set the following REGKEY on the machine
Key="HKEY_LOCAL_MACHINE"Subkey="SOFTWARE\Microsoft\Windows\CurrentVersion\QualityCompat"
Value Name="cadca5fe-87d3-4b96-b7fb-a231484277cc"
Type="REG_DWORD”
Data="0x00000000”

Issue #2

After installing this update, servers where Credential Guard is enabled may restart unexpectedly. The error is "The system process lsass.exe terminated unexpectedly with status code -1073740791. The system will now shut down and restart."

Event ID 1000 in the application log shows:

"C:\windows\system32\lsass.exe' terminated unexpectedly with status code -1073740791

Faulting application: lsass.exe, Version: 10.0.14393.1770, Time Stamp: 0x59bf2fb2

Faulting module: ntdll.dll, Version: 10.0.14393.1715, Time Stamp: 0x59b0d03e

Exception: 0xc0000409

Solution

See Disable Windows Defender Credential Guard.

Microsoft is working on a resolution and will provide an update in an upcoming release.

You can get the update using Windows Update in Settings.

Source: Microsoft.