October 8, 2024—KB5044273 (OS Builds 19044.5011 and 19045.5011)

Symptom

Workaround

After installing this update, you might experience a black screen when you login to Azure Virtual Desktop (AVD). You might also notice that you are unable to log out of your account and the black screen persists even after disconnecting and reconnecting to AVD. Resulting from this issue, the application event log in Event viewer will show an application error with Event ID:1000 indicating a fault with the application ‘svchost.exe_AppXSvc’.

Please note that AppX Deployment Service (AppxSvc) being in an invalid state could also cause other symptoms like the Start Menu to close unexpectedly due to registration issues.

This issue is resolved by installing the Windows updates released October 22, 2024 (KB5045594) or later updates and by applying one of the options mentioned in the Resolution section in KB5048864. Note that you need to perform both actions to resolve the issue.

After installing this update or later, you might observe that apps such as Quick Assist, Microsoft Teams, Windows Narrator, etc. might fail to start if you are a non-admin user. You might experience this issue on any app that sets UIAccess=true while trying to run the app as a non-admin user. The uiAccess=true attribute in an application's manifest file is used to request that the application be granted higher privileges. Apps using this attribute launch from a secure path, such as:

• %ProgramFiles% (including subdirectories)

• %ProgramFiles(x86)% (including subdirectories for 64-bit versions of Windows)

• %systemroot%\system32

• %systemroot%\syswow64 (for 64-bit versions of Windows)

If you have the Procmon monitoring tool installed in your device, you will observe that the application runs with the wrong integrity level, Integrity:Low instead of the expected Integrity:Medium. You are less likely to encounter this issue if you are running the application as an administrator.

This issue is addressed in KB5046613. ​​

After installing this update, or subsequent updates, a small subset of Azure Virtual Desktop customers using multi-session hosts (AVD) may experience the following issues:  ​​​

• An extended 10-to-30-minute-long hang at a black screen following user logon.

• Office applications including Outlook and Teams experience single sign-on (SSO) failures, preventing users from connecting or synchronizing data.​​​​​​​

This issue is caused by a deadlock in the interactions between the Azure Active Directory (AAD) broker and the underlying AppX deployment service(AppxSvc) and Background tasks infrastructure service. You are more likely to experience this issue if you are using FSLogix user profile containers on multi-session environments. FSLogix is a Microsoft tool that helps manage and speed up user profiles on computers, especially in virtual environments like remote desktops.

This issue is resolved by installing the Windows updates released October 22, 2024 (KB5045594) or later updates and by applying one of the options mentioned in the Resolution section in KB5048864. Note that you need to perform both actions to resolve the issue.

Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. The service fails with no detailed logging, and manual intervention is required to run the sshd.exe process.

This issue is affecting both enterprise, IOT, and education customers, with a limited number of devices impacted. Microsoft is investigating whether consumer customers using Home or Pro editions of Windows are affected. 

Customers can temporarily resolve the issue by updating permissions (ACLs) on the affected directories. Follow these steps:

1. Open PowerShell as an Administrator.

2. Update the permissions for C:\ProgramData\ssh and C:\ProgramData\ssh\logs to allow full control for SYSTEM and the Administrators group, while allowing read access for Authenticated Users. You can restrict read access to specific users or groups by modifying the permissions string if needed.

   Use the following commands to update the permissions:

   $directoryPath = "C:\ProgramData\ssh" $acl = Get-Acl -Path $directoryPath $sddlString = "O:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;AU)" $securityDescriptor = New-Object System.Security.AccessControl.RawSecurityDescriptor $sddlString $acl.SetSecurityDescriptorSddlForm($securityDescriptor.GetSddlForm("All")) Set-Acl -Path $directoryPath -AclObject $acl

3. Repeat the above steps for C:\ProgramData\ssh\logs.

Microsoft is actively investigating the issue and will provide a resolution in an upcoming Windows update. Further communications will be provided when a resolution or additional workarounds are available.