Applies ToWindows 11 version 21H2, all editions

Release Date:

9/26/2023

Version:

OS Build 22000.2482

UPDATED 9/26/23 IMPORTANT After today, September 26, 2023, there will no longer be optional, non-security preview releases  for Windows 11, version 21H2.  Only cumulative monthly security updates will continue for the supported versions of Windows 11, version 21H2.

8/8/23 IMPORTANT Some versions of Windows 11, version 21H2 will reach end of service on October 10, 2023.  These are Home, Pro, Pro Education, and Pro for Workstation.  After October 10, 2023, these devices will not receive monthly security and quality updates. These updates contain protections from the latest security threats.

We will continue to support the remaining editions of Windows 11, version 21H2. 

For information about Windows update terminology, see the article about the types of Windows updates and the monthly quality update types. For an overview of Windows 11, version 21H2, see its update history page.

Note Follow @WindowsUpdate to find out when new content is published to the Windows release health dashboard.   

Highlights

  • This update addresses an issue that affects Microsoft Excel. It stops responding when you try to share a file as a PDF in Outlook.

Improvements

This non-security update includes quality improvements. When you install this KB:

  • New! This update completes the work to comply with the GB18030-2022 requirements. It removes and remaps characters for Microsoft Wubi input and Microsoft Pinyin U-mode input. You can no longer enter character codepoints that are not supported. All the required codepoints are up to date.

  • This update supports daylight saving time (DST) changes in Greenland.

  • This update changes the spelling of Ukraine's capital from Kiev to Kyiv.

  • This update addresses an issue that affects account lockout event 4625. The format of the event is wrong in the ForwardedEvents log. This occurs when an account name is in the user principal name (UPN) format.

  • This update affects the Key Distribution Center (KDC) and user security identifiers (SID). KDC now reads the user SID from the Subject Alternative Name (SAN) of a certificate. Because of this, mobile device management (MDM) providers can use offline templates to fill in the user SID. To learn more, see KB5014754.

  • This update addresses an issue that is related to changes in the forwarding of events.

  • This update addresses an issue that affects XPath queries on FileHash and other binary fields. It stops them from matching values in event records.

  • This update addresses an issue that affects an Application Virtualization (App-V) environment. Copy operations within it stop working. This occurs after you install the April 2023 update.

  • This update addresses an issue that affects the Simple Certificate Enrollment Protocol (SCEP) certificate. The system reports some SCEP certificate installations as failed. Instead, the system should report them as pending.

  • This update addresses an issue that affects Microsoft Print to PDF. It uses the metadata for the name you sign in with as the author of a printed PDF. It should use the display name instead.

  • This update addresses an issue that affects some USB printers. Microsoft Defender stops them from printing.

  • This update addresses an issue that affects Windows Defender Application Control (WDAC). AppID Tagging policies might greatly increase how long it takes your device to start up.

  • This update addresses an issue that affects IMEPad. It stops working. This occurs when you enter end-user-defined characters (EUDC).

  • This update addresses an issue that affects application compatibility. It is related to Microsoft Defender for Endpoint.

  • This update addresses an issue that affects Remote Apps. The display of some elements is not aligned correctly.

  • This update addresses an issue that affects the Microsoft Distributed Transaction Coordinator (DTC). It has a handle leak. Because of this, the system runs out of memory.

  • This update addresses an issue that might make Windows stop responding. This might occur if you use Microsoft OneDrive files that are compressed by NTFS.

  • This update addresses an issue that might cause a user-mode memory leak. It might occur when you call CopyFile() or MoveFile().

  • This update addresses an issue that affects external binding. It fails. This occurs after you install Windows updates dated May 2023 or later. Because of this, there are issues that affect LDAP queries and authentication.

If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.

Windows 11 servicing stack update - 22000.2474

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates. 

Known issues in this update

Applies to

Symptom

Workaround

IT admins

Using the FixedDrivesEncryptionType or SystemDrivesEncryptionType policy settings in the BitLocker configuration service provider (CSP) node in mobile device management (MDM) apps might incorrectly show a 65000 error in the "Require Device Encryption" setting for some devices in your environment. Affected environments are those with the “Enforce drive encryption type on operating system drives” or "Enforce drive encryption on fixed drives" policies set to enabled and selecting either "full encryption" or "used space only". Microsoft Intune is affected by this issue but third-party MDMs might also pe affected.

Important This issue is a reporting issue only and does not affect drive encryption or the reporting of other issues on the device, including other BitLocker issues.

This issue is addressed in KB5034121.

How to get this update

Before installing this update

Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates and Servicing Stack Updates (SSU): Frequently Asked Questions. 

Install this update

Release Channel

Available

Next Step

Windows Update or Microsoft Update

Yes

Go to Settings > Update & Security > Windows Update. In the Optional updates available area, you’ll find the link to download and install the update.

Windows Update for Business

No

None. These changes will be included in the next security update to this channel.

Microsoft Update Catalog

Yes

To get the standalone package for this update, go to the Microsoft Update Catalog website.

Windows Server Update Services (WSUS)

No

You can import this update into WSUS manually. See the Microsoft Update Catalog for instructions.

If you want to remove the LCU

To remove the LCU after installing the combined SSU and LCU package, use the DISM/Remove-Package command line option with the LCU package name as the argument. You can find the package name by using this command: DISM /online /get-packages.

Running Windows Update Standalone Installer (wusa.exe) with the /uninstall switch on the combined package will not work because the combined package contains the SSU. You cannot remove the SSU from the system after installation.

File information

For a list of the files that are provided in this update, download the file information for cumulative update 5030301. 

For a list of the files that are provided in the servicing stack update, download the file information for the SSU - version 22000.2474. 

Facebook LinkedIn Email
SUBSCRIBE RSS FEEDS

Need more help?

Want more options?

Discover Community

Explore subscription benefits, browse training courses, learn how to secure your device, and more.

Microsoft 365 subscription benefits

Microsoft 365 training

Microsoft security

Accessibility center

Communities help you ask and answer questions, give feedback, and hear from experts with rich knowledge.

Ask the Microsoft Community

Microsoft Tech Community

Windows Insiders

Microsoft 365 Insiders