August 9, 2022—KB5016622 (OS Build 14393.5291)

^{NEW 8/26/22}

IMPORTANT Microsoft released KB5012170 on August 9, 2022. It provides support for Secure Boot Forbidden Signature Database (DBX). This is a standalone, security update. Windows 8.1 and newer clients and Windows Server 2012 and newer servers must install this update regardless of whether BitLocker is enabled or supported on your device. After you install the update, you might receive error “0x800f0922”; see Update might fail to install and you might receive a 0x800f0922 error. After you install the update, your device might start up in BitLocker recovery mode. See Some devices might start up into BitLocker Recovery and Finding your BitLocker recovery key in Windows.

^11/19/20 For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows 10, version 1607, see its update history page.

Highlights

Addresses an issue that prevents certain troubleshooting tools from opening.
Addresses security issues for your Windows operating system.

Improvements

This security update includes quality improvements. Key changes include:

Addresses an issue that prevents certain troubleshooting tools from opening.
Addresses an issue that prevents the Key Distribution Center (KDC) Proxy from properly receiving Kerberos tickets for Key Trust Windows Hello for Business credentials.
Addresses an issue that causes the KDC code to incorrectly return the error message “KDC_ERR_TGT_REVOKED” during domain controller shutdown.
Addresses an issue that might cause the Local Security Authority Server Service (LSASS) to leak tokens. This issue affects devices that have installed Windows updates dated June 14, 2022 or later. This issue occurs when the device performs a specific form of service for user (S4U) in a non-Trusted Computing Base (TCB) Windows service that runs as Network Service.
Enforces a hardening change that requires printers and scanners that use smart cards for authentication to have firmware that complies with section 3.2.1 of RFC 4556. If they do not comply, Active Directory domain controllers will not authenticate them. Mitigations that allowed non-compliant devices to authenticate will not exist after August 9, 2022. For more information about this change, see KB5005408.

If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.

For more information about security vulnerabilities, please refer to the new Security Update Guide website and the August 2022 Security Updates.

Known issues in this update

Symptoms

Workaround

Starting at 12:00 A.M. Saturday, September 10, 2022, the official time in Chile will advance 60 minutes in accordance with the August 9, 2022 official announcement by the Chilean government about a daylight saving time (DST) time zone change. This moves the DST change which was previously September 4 to September 10.

Symptoms if the workaround is not used on devices between September 4, 2022 and September 11, 2022:

Time shown in Windows and apps will not be correct.
Apps and cloud services which use date and time for integral functions, such as Microsoft Teams and Microsoft Outlook, notifications and scheduling of meetings might be 60 minutes off.
Automation that uses date and time, such as Scheduled tasks, might not run at the expected time.
Timestamp on transactions, files, and logs will be 60 minutes off.
Operations that rely on time-dependent protocols such as Kerberos might cause authentication failures when attempting to logon or access resources.
Windows devices and apps outside of Chile might also be affected if they are connecting to servers or devices in Chile or if they are scheduling or attending meetings taking place in Chile from another location or time zone. Windows devices outside of Chile should not use the workaround, as it would change their local time on the device.

To mitigate this issue, please see Possible issues caused by new Daylight Savings Time in Chile.

We are working on a resolution and will provide an update in an upcoming release.

Note We plan to release an update to support this change; however, there might be insufficient time to properly build, test, and release such an update before the change goes into effect. Please use the workaround above.

How to get this update

Before installing this update

Microsoft strongly recommends you install the latest servicing stack update (SSU) for your operating system before installing the latest cumulative update (LCU). SSUs improve the reliability of the update process to mitigate potential issues while installing the LCU and applying Microsoft security updates. For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions.

If you are using Windows Update, the latest SSU (KB5017095) will be offered to you automatically. To get the standalone package for the latest SSU, search for it in the Microsoft Update Catalog.

Install this update

Release Channel	Available	Next Step
Windows Update and Microsoft Update	Yes	None. This update will be downloaded and installed automatically from Windows Update.
Windows Update for Business	Yes	None. This update will be downloaded and installed automatically from Windows Update in accordance with configured policies.
Microsoft Update Catalog	Yes	To get the standalone package for this update, go to the Microsoft Update Catalog website.
Windows Server Update Services (WSUS)	Yes	This update will automatically sync with WSUS if you configure Products and Classifications as follows: Product: Windows 10 Classification: Security Updates

File information

For a list of the files that are provided in this update, download the file information for cumulative update 5016622.

August 9, 2022—KB5016622 (OS Build 14393.5291)

Highlights

Improvements

Known issues in this update

How to get this update

Need more help?

Want more options?

Was this information helpful?

Thank you for your feedback!