KB5073379 Windows 11: Complete Guide, Fixes & Known Issues

Is your Windows Server or Windows 11 system vulnerable right now? If you haven't yet applied the January 2026 Patch Tuesday updates, the answer might be yes. This month's release patches three zero-day vulnerabilities—including one actively exploited in the wild—so this isn't a routine "install when you get around to it" kind of update.

Here's the catch that's confusing a lot of IT admins: KB5073379 isn't actually for Windows 11 consumer editions at all. It's the Windows Server 2025 cumulative update. Microsoft has decoupled the KB numbering between Server and Client starting this year, which means searching for "kb5073379 windows 11" will lead you down the wrong path if you're managing a mixed environment.

This guide covers everything you need to know: what this update actually applies to, how to install it, how to fix installation failures, known issues (including the Remote Desktop problem Microsoft has acknowledged), and how to roll it back if things go sideways.

---

What is KB5073379? Update Details and System Compatibility

KB5073379 is the January 13, 2026 security update for Windows Server 2025, bringing the OS build to 26100.32230. It's part of the monthly Patch Tuesday release cycle, and it's a cumulative update—meaning it contains all previous security fixes plus the new ones.

This is a significant release. It includes 114 security fixes, of which 8 are rated critical. More importantly, it addresses three zero-day vulnerabilities, one of which (CVE-2026-20805) is already being actively exploited in the wild.

KB5073379 for Windows Server 2025 vs. Windows 11

Let me clear up the confusion that's been generating a lot of search traffic lately.

Starting with the January 2026 Patch Tuesday, Microsoft has decoupled the KB identifiers for Windows Server and Windows 11 client editions. Previously, Server 2025 and Windows 11 24H2 shared the same KB number because they share the same core codebase. That's no longer the case.

Microsoft explained this change in a support document: "This change improves clarity for administrators. Installation and management processes remain the same."

Here's what the January 2026 Patch Tuesday looks like across the Windows ecosystem:

Security Fixes and Vulnerabilities Addressed

The January 2026 Patch Tuesday is a hefty one. Here's the breakdown of the 114 vulnerabilities fixed across Windows products:

• 57 Elevation of Privilege (EoP) vulnerabilities — These allow an attacker with a standard user account to gain admin-level privileges. The most common category this month.
• 22 Remote Code Execution (RCE) vulnerabilities — The most dangerous category. An attacker can execute arbitrary code on your system, potentially without any user interaction.
• 22 Information Disclosure vulnerabilities — These leak sensitive data, which can be used to further compromise a system.
• 5 Spoofing vulnerabilities — Attackers can impersonate trusted entities.
• 3 Security Feature Bypass vulnerabilities — Including the Secure Boot issue mentioned below.
• 2 Denial of Service (DoS) vulnerabilities — These can crash systems.

The three zero-days deserve special attention:

• CVE-2026-20805 (Desktop Window Manager) — An information disclosure vulnerability that's actively exploited. It leaks memory addresses from a remote ALPC port. This is the one you should be most concerned about—it's being used in real attacks right now.
• CVE-2026-21265 (Secure Boot certificates) — A security feature bypass that was publicly disclosed. The 2011 Secure Boot certificates are expiring, which could allow attackers to bypass Secure Boot protections on systems that haven't been updated.
• CVE-2023-31096 (Agere Soft Modem driver) — An elevation of privilege vulnerability that was previously exploited. The vulnerable drivers (agrsm64.sys, agrsm.sys) have now been removed.

Beyond the CVEs, this update also replaces older Secure Boot certificates with new ones and updates the WinSqlite3.dll component with security fixes. If you're running older modem drivers (specifically Motorola Soft Modem drivers), those are being removed as part of this update—though in my experience, the vast majority of systems won't be affected by that change.

---

How to Download and Install KB5073379 on Windows Server 2025

Before you install anything, I strongly recommend creating a system restore point. I've seen too many cases where an update goes wrong and there's no easy way back. It takes two minutes and can save you hours of pain later.

Method 1: Install via Windows Update (Recommended)

For most environments, the simplest path is through Windows Update:

1. Open Settings > Windows Update.
2. Click Check for updates.
3. The update should appear as "2026-01 Security Update for Windows Server 2025 (KB5073379)".
4. Click Download and install.
5. Restart the server when prompted. This isn't optional—the update won't fully apply until the system reboots.

The installation typically takes 10-20 minutes on a standard server, depending on the hardware and the number of pending updates. Plan for a maintenance window.

Method 2: Manual Download from Microsoft Update Catalog

If Windows Update is failing, or you need to install this on multiple offline servers, the Microsoft Update Catalog is your friend:

1. Go to the Microsoft Update Catalog.

2. Search for KB5073379.

3. Look for the file matching your architecture—for Server 2025, that's x64.

4. Download the .msu file.

5. Double-click the downloaded file to launch the Windows Update Standalone Installer, or run it from an elevated command prompt:

   wusa.exe C:\path\to\windows11.0-kb5073379-x64_xxxx.msu
   

6. Follow the prompts and restart when complete.

This method is particularly useful when you're troubleshooting failed updates, since it bypasses the Windows Update service entirely.

---

Troubleshooting KB5073379 Install Failures and Rollbacks

Installation failures are frustrating, but they're usually fixable. Here's what I've found works in practice.

Common Error Codes and Their Meanings

Step-by-Step Fixes: From Windows Update Troubleshooter to DISM

Step 1: Run the Windows Update Troubleshooter

This built-in tool catches a surprising number of issues. Go to Settings > System > Troubleshoot > Other troubleshooters > Windows Update and run it. It's not a silver bullet, but it's a good first step.

Step 2: Run an SFC Scan

Open an elevated Command Prompt and run:

sfc /scannow

This checks for corrupted system files and repairs them. It takes a while—sometimes 15-20 minutes—so don't interrupt it.

Step 3: Use DISM to Repair the System Image

If SFC finds issues it can't fix, DISM is the next step:

DISM /Online /Cleanup-Image /RestoreHealth

This repairs the Windows system image itself. In my experience, this resolves the majority of persistent update failures.

Step 4: Manual Download from the Catalog

If you've tried all the above and the update still fails, download the .msu file directly from the Microsoft Update Catalog and install it manually. This bypasses the Windows Update service entirely and often works when nothing else does.

---

Known Issues After Installing KB5073379 and How to Fix Them

No update is perfect, and KB5073379 has its share of reported issues. Here's what you need to know.

Remote Desktop Connection Failures (Azure Virtual Desktop & Windows 365)

Microsoft has officially acknowledged a known issue with this update: Remote Desktop connections can fail when using the Windows App (formerly Remote Desktop) to connect to Azure Virtual Desktop or Windows 365.

The official release notes state:

"After installing the January 2026 Windows security update, some users experienced sign-in failures during Remote Desktop connections. This issue affected authentication steps for different Remote Desktop applications on Windows such as the Windows App."

If you're affected, you might not be able to sign in and access your desktop via Remote Desktop. Microsoft is working on a permanent fix, but in the meantime, here's a workaround that's been working for me:

Use the legacy Remote Desktop Connection client (mstsc.exe) instead of the Windows App. It's still included with Windows Server 2025, and it doesn't seem to be affected by this issue.

Performance Issues and Blue Screen Errors

There are community reports—mostly on Reddit and Microsoft's own forums—of performance degradation and occasional blue screen errors after installing this update. I want to be clear: Microsoft has not officially confirmed widespread issues, and in my testing, I haven't encountered any problems.

That said, if you're experiencing issues, here's what to check:

1. Driver compatibility — This is the most common culprit. Check for updated drivers, especially for older hardware. The modem driver removal mentioned earlier could cause issues if you're running legacy hardware.
2. Event Viewer — Check the Windows Event Viewer for specific error logs. Look under Windows Logs > System for errors around the time of the crash.
3. Roll back the update — If issues persist and you can't identify the cause, uninstalling the update is a reasonable option (see below).

---

How to Uninstall KB5073379 from Windows Server 2025

If the update is causing serious problems and you need to roll back, here's how to do it.

Step-by-Step Uninstall Process

1. Open Settings > Windows Update > Update History.
2. Scroll down and click Uninstall updates.
3. Locate KB5073379 in the list.
4. Select it and click Uninstall.
5. Restart the server to complete the rollback.

Alternatively, you can use the command line:

wusa /uninstall /kb:5073379

Run this from an elevated Command Prompt. Note that this method doesn't work if the update package includes a servicing stack update (SSU)—in that case, you'll need to use the Settings method.

---

FAQ

Is KB5073379 applicable to Windows 11?

No. KB5073379 is specifically for Windows Server 2025. Consumer versions of Windows 11 receive different updates: KB5074109 for versions 25H2 and 24H2, and KB5073455 for version 23H2. This is a common point of confusion because Microsoft previously used the same KB number for both Server and Client editions. Starting January 2026, they've been decoupled.

How to fix KB5073379 install failure with error 0x800f081f?

Error 0x800f081f typically indicates corrupted system files. Here's the troubleshooting path:

1. Run the Windows Update Troubleshooter from Settings > System > Troubleshoot.
2. Run SFC scan (sfc /scannow) from an elevated Command Prompt.
3. Run DISM (DISM /Online /Cleanup-Image /RestoreHealth) to repair the system image.
4. If the issue persists, download the update manually from the Microsoft Update Catalog and install it with wusa.exe.

Does KB5073379 cause performance issues or blue screens?

There are community reports of performance issues and blue screens, but Microsoft has not officially confirmed widespread problems. In my testing, the update installed cleanly and I didn't notice any performance degradation. If you're experiencing issues, check driver compatibility first—especially for older hardware. If problems are severe, consider uninstalling the update (see the uninstall section above).

Can I uninstall KB5073379 if it causes problems?

Yes. Go to Settings > Windows Update > Update History > Uninstall updates, locate KB5073379, and select Uninstall. Alternatively, use the command line: wusa /uninstall /kb:5073379. Restart the server to complete the rollback.

---

Final Thoughts

KB5073379 is a critical security update for Windows Server 2025, and the three zero-day vulnerabilities it patches make it a priority. The actively exploited CVE-2026-20805 alone is reason enough to expedite deployment.

The confusion around "kb5073379 windows 11" is understandable—Microsoft's KB numbering change caught a lot of people off guard. But now you know: if you're managing Windows 11 clients, look for KB5074109 or KB5073455 instead.

I'll be updating this page as Microsoft releases fixes for the Remote Desktop known issue and as more information becomes available. If you've encountered any issues with this update—or if you've found a workaround that worked for you—leave a comment below. Your experience could help another admin who's stuck.