Applies ToAzure Local, version 21H2

Release Date:

4/11/2023

Version:

OS Build 20348.1668

NEW 4/17/23 IMPORTANT Azure Stack HCI, version 21H2 will reach end of service on May 9, 2023. After May 9, 2023, these devices will not receive monthly security updates. These updates contain protections from the latest security threats. To continue receiving security and quality updates, we recommend that you update to the latest version of Azure Stack HCI.

For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Azure Stack HCI, version 21H2, see its update history page.     

Improvements 

This security update includes quality improvements.  When you install this KB:    

  • New! This update adds many new features and improvements to Microsoft Defender for Endpoint. For more information, see What's new in Microsoft Defender for Endpoint

  • New! This update implements the new Windows Local Administrator Password Solution (LAPS) as a Windows inbox feature. For more information, see By popular demand: Windows LAPS available now!

  • This update addresses an issue that affects inbound remote Component Object Model (COM) activations. They fail. The error code is 0x80010111. This occurs if the client protocol version is less than 5.7.

  • This update addresses an issue that affects Microsoft PowerPoint. It stops working on Azure Virtual Desktop (AVD). This occurs when you use Visual Basic for Applications (VBA).

  • This update addresses an issue that affects Windows Search. Windows Search fails inside of Windows container images.

  • This update affects the Arab Republic of Egypt. The update supports the government’s daylight saving time change order for 2023.

  • This update addresses an issue that affects the Key Distribution Center (KDC) service. When the service stops on a local machine, signing in to all local Kerberos fails. The error is STATUS_NETLOGON_NOT_STARTED.

  • This update addresses an issue that affects the Windows Remote Management (WinRM) client. The client returns an HTTP server error status (500). This error occurs when it runs a transfer job in the Storage Migration Service.

  • This update addresses an issue that affects Desired State Configuration. It loses its previously configured options. This occurs if metaconfig.mof is missing.

  • This update addresses compatibility issues that affect some printers. These printers use Windows Graphical Device Interface (GDI) printer drivers. These drivers do not completely adhere to GDI specifications.

  • This update addresses a stack overflow condition that causes a device to stop working. This occurs when you call xxxDestroyWindow() in Kernel mode.

  • This update addresses a rare issue that might cause an input destination to be null. This issue might occur when you attempt to convert a physical point to a logical point during hit testing. Because of this, the computer raises a stop error.

  • This update addresses an issue that affects certain processors that have firmware Trusted Platform Modules (TPM). You cannot use Autopilot to set them up.

  • This update addresses an issue that affects the Fast Identity Online 2.0 (FIDO2) PIN credential icon. It does not appear on the credentials screen of an external monitor. This occurs when that monitor is attached to a closed laptop.

  • This update addresses an issue that affects a Clustered Shared Volume (CSV). The CSV fails to come online. This occurs if you enable BitLocker and local CSV managed protectors, and the system recently rotated the BitLocker keys.

  • This update addresses an issue that affects Windows Server 2022 domain controllers. They stop working. This occurs when they process Lightweight Directory Access Protocol (LDAP) requests.

  • This update addresses an issuethat affects Administrator Account Lockout policies. GPResult and Resultant Set of Policy did not report them.

  • This update addresses an issue that affects MySQL commands. The commands fail on Windows Xenon containers.

  • This update addresses an issue that affects Windows Server Failover Clustering. If you configure a cloud witness, both sites think that the other side is down. This is a “split-brain” scenario.

For more information about security vulnerabilities, please refer to the Security Update Guide and the April 2023 Security Updates

To return to the Azure Stack HCI documentation site

Azure Stack HCI, version 21H2 servicing stack update - 20348.1663

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates.

Known issues in this update

Microsoft is not currently aware of any issues with this update.

How to get this update

Before installing this update

Microsoft now combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

To install the LCU on your Azure Stack HCI cluster, see Update Azure Stack HCI clusters.

Install this update

Release Channel

Available

Next Step

Windows Update and Microsoft Update

Yes

None. This update will be downloaded and installed automatically from Windows Update.

Windows Update for Business

Yes

None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies.

Microsoft Update Catalog

Yes

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Windows Server Update Services (WSUS)

Yes

This update will automatically sync with WSUS if you configure Products and Classifications as follows:

Product: Azure Stack HCI

Classification: Security Updates

If you want to remove the LCU

To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.

Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.

File Information

For a list of the files that are provided in this update, download the file information for cumulative update 5025230.

For a list of the files that are provided in the servicing stack update, download the file information for the SSU - version 20348.1663

Need more help?

Want more options?

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.