Windows 11, version 25H2 known issues and notifications

Find information on known issues and the status of the Windows 11, version 25H2 rollout. For immediate help with Windows update issues, click here if you are using a Windows device to open the Get Help app or go to support.microsoft.com. Follow @WindowsUpdate on X for Windows release health updates. If you are an IT administrator and want to programmatically get information from this page, use the Windows Updates API in Microsoft Graph.

• 

  How to get Windows 11, version 25H2

• 

  An IT pro’s guide to Windows 11, version 25H2

Known issues

Issue details

October 2025

Smartcard authentication issues might occur with the October 2025 Windows update

Smart card authentication and other certificate operations might intentionally fail after installing Windows Updates released on or after October 14, 2025 (KB5066835) that contain protections for the security vulnerability, CVE-2024-30098. As part of this cryptography improvement, RSA-based smart card certificates are required to use KSP (Key Storage Provider) instead of CSP (Cryptographic Service Provider).

Common symptoms for certificates that use CSP include:

• ​Smart cards not being recognized as CSP providers (Cryptographic Service Provider) in 32-bit applications
• ​Inability to sign documents
• ​Failures in applications relying on certificate-based authentication
• ​Users might observe error messages such as "invalid provider type specified" and "CryptAcquireCertificatePrivateKey error."

You can detect if your smart card will be affected by this security enforcement if, prior to installing the October 2025 Windows security update (KB5066835), the System log contains Smart Card Service or Microsoft-Windows-Smartcard-Server Event ID: 624 with the message text: "Audit: This system is using CAPI for RSA cryptography operations. Please refer to the following link for more detail: https://go.microsoft.com/fwlink/?linkid=2300823."

Resolution:

For a permanent resolution, developers should update their authenticating app to perform Key Storage Retrieval using Key Storage API documented at Key Storage and Retrieval. Developers should complete this change before Windows updates released in April 2026, at which time the DisableCapiOverrideForRSA workaround listed below is planned to be removed.

Workaround:

If you encounter this issue, you can temporarily resolve it by setting the DisableCapiOverrideForRSA registry key value to 0. This is documented in CVE-2024-30098. Detailed steps to modify the registry key are listed below. Note: This option will be removed in Windows updates, planned for release in April 2026.

Steps to Modify the Registry

⚠️ Important: Editing the registry incorrectly can cause system issues. Always back up the registry before making changes.

1. Open Registry Editor.

• ​Press Win + R, type regedit, and press Enter.
• ​If prompted by User Account Control, click Yes.

2. Navigate to the subkey.

• ​Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Calais

3. Edit the key and set the value.

• ​Inside Calais, check if key DisableCapiOverrideForRSA exists
• ​Double-click DisableCapiOverrideForRSA.
• ​In Value date, enter: 0

Note: The DisableCapiOverrideForRSA registry setting is NOT added by the default OS install or the installation of Windows Updates and must be manually added on each device.

4. Close and restart.

• ​Close Registry Editor.
• ​Restart the computer for changes to take effect.

Affected platforms:

• ​Client: Windows 11, version 25H2; Windows 11, version 24H2; Windows 11, version 23H2; Windows 11, version 22H2; Windows 10, version 22H2
• ​Server: Windows Server 2025; Windows Server 23H2; Windows Server 2022; Windows Server 2019; Windows Server 2016; Windows Server 2012 R2

USB mouse and keyboard not working in the Windows Recovery Environment (WinRE)

After installing the Windows security update released on October 14, 2025 (KB5066835), USB devices, such as keyboards and mice, do not function in the Windows Recovery Environment (WinRE). This issue prevents navigation of any of the recovery options within WinRE. Note that the USB devices continue to work normally within the Windows operating system.

Resolution: This issue was resolved by the Windows out-of-band update, released October 20, 2025 (KB5070773), and updates released after that date. We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.

Workaround: If your device is impacted by this issue and is unable to boot to Windows to install the latest Windows update, you can work around this issue using one of the following methods:

• ​If your PC has a touchscreen, you can use the touchscreen's touch keyboard to navigate within WinRE.
• ​If your PC has a PS/2 port, you can use a PS/2 keyboard or mouse to navigate within WinRE.
• ​If you had previously created a USB recovery drive, you can boot your computer from the recovery drive. This will take you directly to WinRE with restored USB functionality.
• ​OEMs and enterprises can use the Preboot Execution Environment (PXE) in Configuration Manager, or can deploy push-button reset features using the Windows Assessment and Deployment Kit (Windows ADK) and Windows Preinstallation Environment (WinPE) add-on to recover affected devices.

Affected platforms:

• ​Client: Windows 11, version 25H2; Windows 11, version 24H2
• ​Server: Windows Server 2025

IIS websites might fail to load

Following installation of updates releases on or after September 29 (KB5066835), server-side applications that rely on HTTP.sys may experience issues with incoming connections. As a result, IIS websites might fail to load, displaying a message such as "Connection reset - error (ERR_CONNECTION_RESET)", or similar error. This includes websites hosted on http://localhost/, and other IIS connections.

This issue is caused by a variety of conditions which can be influenced by the device's internet connectivity, as well as timing of recent update installation and device restarts. For this reason, it is possible that it may not be observed in some environments despite having installed the update mentioned above. The following steps can help resolve this issue in environments where it's observed:

• ​On the affected device, open "Windows Update" in the "Windows Settings" app. 
  • ​This can be accomplished by opening the start menu, typing "check for updates", and selecting from the results to the right
• ​Click on "Check for updates". Allow any updates to install. 
• ​Restart your device.
  • ​Note: please restart your device even if no updates are installed in the previous step.

Mitigation: This issue is addressed using Known Issue Rollback (KIR) and is resolved automatically for most home users and non-managed business devices. Restarting your Windows device might help the resolution apply to your device faster.

IT admins can resolve this issue for managed devices which have installed the affected update and encountered this issue. It can be fixed by installing and configuring the Group policy listed below. For information on deploying and configuring these special Group Policy, please see How to use Group Policy to deploy a Known Issue Rollback. The special Group Policy can be found in Computer Configuration > Administrative Templates > [Group Policy name].

Group Policy downloads with Group Policy name:

• ​​Download for Windows 11, version 24H2, Windows 11 25H2 and Windows Server, version 2025 - Windows 11 24H2, Windows 11 25H2 and Windows Server 2025 KB5066835 251015_22001 Known Issue Rollback.msi

Next steps: We are working on releasing a resolution for this issue in a future Windows update. We will provide an update when more information is available.

Affected platforms:

• ​Client: Windows 11, version 25H2; Windows 11, version 24H2
• ​Server: Windows Server 2025

September 2025

Problems playing protected content in some BluRay/DVD/Digital TV applications

Some Digital TV and BluRay/DVD applications might experience problems playing protected content. Applications using Enhanced Video Renderer with HDCP enforcement or Digital Rights Management (DRM) for digital audio might experience copyright protection errors, frequent playback interruptions, freezing or black screens. This issue does not impact streaming services.

Resolution: This issue is partially resolved. Problems affecting certain applications that use Enhanced Video Renderer with HDCP enforcement have been addressed in the September 2025 Windows preview update (KB5065789), and later updates. We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one. 

However, some applications using DRM for digital audio might continue to experience problems.

Next steps: We are working on a permanent fix for applications that still experience this issue and will provide more information when it is available.

Affected platforms:

• ​Client: Windows 11, version 25H2; Windows 11, version 24H2
• ​Server: None

August 2025

Updates installed via WUSA might fail if installed from a shared folder

Windows updates installed using the Windows Update Standalone Installer (WUSA) might fail with error ERROR_BAD_PATHNAME, when the update is installed using WUSA or double-clicking a .msu file from a network share that contains multiple .msu files.

WUSA is a method of installing updates using the Windows Update Agent API which is typically only employed in enterprise environments. It is not common in personal or home settings. 

Please note that this issue does not occur when there is only one .msu file in the network share or when the .msu files are stored locally on the device. In addition, after installing an .msu file by double-clicking or using WUSA and restarting Windows, you might notice that the Update History page in Settings continues to indicate that a restart is required to complete the update. This is temporary and should be resolved on its own.

Workaround: To work around this issue, save the .msu files locally on the device and install the update from this location. Also, if you've restarted Windows after installing an .msu file via WUSA, please wait 15 minutes or more before checking the Update History page in Settings. After this short delay, the Settings app should properly indicate if the update installed successfully.

Mitigation: This issue is addressed using Known Issue Rollback (KIR) and is resolved automatically for most home users and non-managed business devices. Restarting your Windows device might help the resolution apply to your device faster.

IT admins can resolve this issue for managed devices which have installed the affected update and encountered this issue. It can be fixed by installing and configuring the Group policy listed below. For information on deploying and configuring these special Group Policy, please see How to use Group Policy to deploy a Known Issue Rollback. The special Group Policy can be found in Computer Configuration > Administrative Templates > [Group Policy name].

Group Policy downloads with Group Policy name:

• ​Download for Windows 11, version 24H2 and Windows Server, version 2025 - Windows 11 24H2 and Windows Server 2025 KB5062660 250806_17201 Known Issue Rollback.msi

Next steps: We are working on releasing a resolution for this issue in a future Windows update. We will provide an update when more information is available.

Affected platforms:

• ​Client: Windows 11, version 25H2; Windows 11, version 24H2
• ​Server: Windows Server 2025

Report a problem with Windows updates

To report an issue to Microsoft at any time, use the Feedback Hub app. To learn more, see Send feedback to Microsoft with the Feedback Hub app.

Need help with Windows updates?

Search, browse, or ask a question on the Microsoft Support Community. If you are an IT pro supporting an organization, visit Windows release health on the Microsoft 365 admin center for additional details.

For direct help with your home PC, use the Get Help app in Windows or contact Microsoft Support. Organizations can request immediate support through Support for business.

View this site in your language

This site is available in 11 languages: English, Chinese Traditional, Chinese Simplified, French (France), German, Italian, Japanese, Korean, Portuguese (Brazil), Russian, and Spanish (Spain). All text will appear in English if your browser default language is not one of the 11 supported languages. To manually change the display language, scroll down to the bottom of this page, click on the current language displayed on the bottom left of the page, and select one of the 11 supported languages from the list.