KB5127648: Windows 11 October 2026 Update for 26H2, 25H2 and 24H2 (the Last One for 24H2 Home and Pro): Download, Size, Known Issues and Fixes

KB5127648 is the October 13, 2026 Patch Tuesday security update for Windows 11 versions 24H2, 25H2 and 26H2. It takes them to builds 26100.9711, 26200.9711 and 26300.9711, installs automatically, and brings September's optional preview fixes, from the domain trust repair to the camera and File History fixes, to every PC that skipped them. It also fixes a Windows flaw that attackers are already exploiting, so it's not one to postpone. Here's the part most people will miss: for Windows 11 24H2 Home and Pro, this is the last update, ever. Those editions reach end of updates today, and nothing in Microsoft's end-of-updates notices says your PC will be moved to a newer version for you. The same night, Office 2021 and Office LTSC 2021 get their final updates too. This page explains which October update your PC needs, what KB5127648 changes, the known issues, how to install, download and uninstall it, and the small switch that keeps a 24H2 PC protected until 2028.

Jake runs a phone repair shop. The PCs in the shop got sorted out last month, but there's one machine he'd forgotten about: the laptop in the back room where his sister does the invoices, running Windows 11 Pro and Office 2021. On the evening of October 13 it popped up a restart notice for a security update, and Jake, who reads everything twice now, asked his friend Ethan whether this one was safe. Ethan, a developer, checked the laptop's version first. It was 24H2. This page is what Ethan explained at the back-room desk: which update the laptop was getting, why it was the last one for that version, what to do about Office, and how to keep both protected for years without buying anything.

Not sure which Windows 11 version you have? Our guide to finding your build number shows it in ten seconds with winver. You can follow this page without it; every step starts from zero.

Which October 2026 update does your PC need?

Windows 11 has several versions in service at once, and each gets its own update or shares one. KB5127648 covers three of them, because 24H2, 25H2 and 26H2 are built on the same code base. Press Windows + R, type winver and press Enter to see your version and build, then find your row:

If your build already ends in .9711, KB5127648 is installed. This is a "B" release, the one that comes out on Patch Tuesday, the second Tuesday of each month. It includes everything from September's optional preview, KB5124010 (builds .9550), plus this month's security fixes, so PCs that never clicked "optional" catch up in one step.

Windows 11 24H2 end of support: the last update for Home and Pro

For a lot of people, this matters more than anything else in October's update. Windows 11 version 24H2 Home, Pro, Pro Education and Pro for Workstations reach end of updates on October 13, 2026. KB5127648 is the last security update those editions will ever get. After it, a 24H2 Home or Pro PC keeps starting, running your apps and opening your files exactly as before. What stops is the protection: no more monthly security fixes, and no more preview updates either. September's KB5124010 was already 24H2's last preview.

Two things surprise people here. First, the date is about your version, not your PC. The same laptop on 26H2 gets updates until October 10, 2028, with no new hardware and nothing to pay. Second, Microsoft's end-of-updates notices for 24H2 Home and Pro don't say Windows will move your PC to a newer version by itself. They tell you to update. So if nobody in your house has clicked the 26H2 (or 25H2) button, it's worth doing it yourself this week.

Jake: "So the laptop works tomorrow, it just stops getting locks for the doors."

Ethan: "Exactly. Nothing breaks on day one. The risk grows every month after, because every new security hole found in Windows stays open on that machine."

Check whether this affects you

1. Open Settings > System > About.
2. Under Windows specifications, read Edition and Version.
3. If Edition says Home, Pro, Pro Education or Pro for Workstations and Version says 24H2, today's update is your last one. If it says Enterprise or Education, you have until October 12, 2027.

Move to 26H2: the small switch, not a reinstall

Windows 11 26H2 isn't a big download. Its features already arrive inside the monthly updates and stay dormant until a small enablement package turns them on, which is why going from 24H2 to 26H2 takes a short download and a single restart. After installing KB5127648 (or September's KB5124010), your PC already has 26H2's code on disk; the package flips the switch.

1. Install KB5127648 first and restart, if Windows hasn't done that for you already.
2. Open Settings > Windows Update and select Check for updates.
3. When you see "Windows 11, version 26H2 is available," select Download & install.
4. Restart when asked, then run winver. It should show Version 26H2 and a build that starts with 26300.

If 26H2 isn't offered yet, turn on Get the latest updates as soon as they're available on the same Settings page and check again over the next few days; the rollout is phased, and Microsoft can hold back a PC with a known compatibility problem. Microsoft's end-of-updates notice names 25H2 as the version to move to, because it was written before 26H2 arrived on September 29; either one keeps your PC updated, and 26H2 lasts a year longer. If neither appears for weeks, an in-place upgrade from the official Windows 11 ISO, run from inside Windows, keeps your files and apps.

Jake: "Why didn't the laptop just do this on its own?"

Ethan: "Don't count on it doing that. The end-of-updates notice tells you to update; it doesn't promise to do it for you. And nobody's been looking at this laptop's update page except your sister, who sensibly ignores buttons she didn't ask for."

Office 2021 and Office LTSC 2021 get their last update tonight too

The same date ends support for two Office versions that a lot of small businesses and families bought once and kept:

After October 13, 2026, neither gets security fixes, bug fixes or technical support, and for Office 2021 there's no extension and no paid extended security updates, unlike Windows 10. Your Office 2021 apps can keep working and your documents stay yours, but every security hole found from now on stays open. That matters most for the apps that open files from strangers, like Outlook attachments and Word or Excel files from the internet, because those are how attacks usually arrive.

To check which Office you have, open Word, go to File > Account and look under Product Information. "Office Home and Business 2021" or "Office Professional Plus 2021" means this section is about you. "Microsoft 365" means a subscription, which keeps updating and isn't affected.

Your realistic options, from cheapest:

• Keep Office 2021 for a while, carefully. On a PC that only opens your own files, the risk grows slowly. Be stricter about attachments, and leave Protected View on for files from the internet.
• Use the free web versions of Word, Excel and PowerPoint in a browser with a Microsoft account, if your needs are light.
• Move to a supported Office when you're ready: a Microsoft 365 subscription, or a newer one-time-purchase version. There's no deadline that makes this urgent tonight; just don't leave it for years.

Jake: "My sister's going to ask me if she has to pay for Office again."

Ethan: "Not tonight. The invoices open tomorrow like always. Plan the move this year, the way you'd plan new tires: not an emergency, but not something you ignore."

What's in KB5127648

If you installed September's optional preview, KB5124010, most of this is already on your PC. If you didn't, tonight's update brings all of it, plus the security fixes. Many of the new features arrive gradually, so they can take days or weeks to appear even after the update is installed. Here's what you'll actually notice.

New in tonight's update

On top of September's changes, KB5127648 adds these fixes of its own:

• AC-3 (Dolby Digital) audio fixed. Older games and media players that closed when certain audio started should work again.
• Black screen after sign-in fixed for Azure Virtual Desktop and FSLogix setups, where Explorer failed to start or kept crashing.
• Always On VPN connections that got stuck on Connecting after September's update, sometimes with "The specified port is already in use," connect again.
• Printing works again in apps and on printers using RAW or Generic Text Only drivers, which broke after the August update.
• Games: fixes mouse input that could stutter in some games.
• Windows Hello: fixes fingerprint sign-in that might not work after a cold boot on some PCs.
• Manitoba time zone: adds the new (UTC-05:00) Manitoba time zone for the province's November 1, 2026 change.

Everything below arrived with September's preview and reaches every PC tonight.

New things you can see

• Remap the Copilot key. A new setting turns the Copilot key back into a Right Ctrl or Context Menu key, which is good news if your keyboard shortcuts depended on it.
• Touchpad scrolling with one finger. On precision touchpads, you can scroll by sliding one finger down the left or right edge, and keep scrolling by holding your fingers near the edge. Both are in Settings > Bluetooth & devices > Touchpad.
• Open apps maximized. A new accessibility setting opens every app window full screen. Turn it on in Settings > Accessibility > Visual effects.
• New emoji. Emoji 17.0 arrives, including distorted face, fight cloud and hairy creature. Press Windows + period to find them.
• File Explorer. The preview pane now shows PDFs and other files downloaded from the internet automatically; HTML files get a Preview anyway button. File Explorer Home also remembers which sections you collapsed.
• A Tips widget for the Widgets board and the lock screen, and Camera roll backup to OneDrive, set up from your phone with a QR code.
• Installed apps in Settings now shows the version number of Store apps at a glance.

Something that's gone

PC-to-PC Migration has been removed. The option that copied files and settings straight from your old PC during setup of a new one no longer exists. Windows Backup is now the way to move to a new PC: back up on the old one, sign in with the same Microsoft account on the new one, and restore.

Fixes worth knowing about

• Domain sign-in: fixes PCs losing their trust relationship with an Active Directory domain, where users couldn't sign in with valid credentials. Our trust relationship guide covers the full story.
• File History: fixes backups failing with a "Reconnect your drive" message even though the drive is connected.
• Camera: fixes the built-in camera stopping in the Camera app and other apps.
• Bluetooth audio: fixes a crash with error 0x139 while streaming, improves microphones on some Bluetooth headsets, and makes LE Audio more reliable.
• Laptops: fixes plugged-in laptops that wrongly thought they had switched to battery power.

Jake: "So the new stuff might not show up tonight even after I install it?"

Ethan: "The fixes do. The new features turn on in waves. Install it tonight for the security fixes, and the touchpad trick will show up when it shows up."

The security side: one flaw is already being exploited

KB5127648 is a security update first, and a big one: it fixes 1,008 Windows vulnerabilities, and 25 of them are rated Critical, the highest level. The full list, with a severity rating for each one, is in the Security Update Guide.

One flaw is already being used in attacks. CVE-2026-96951 is a Windows Shell bug that lets a specially crafted file slip past Mark of the Web, the label Windows puts on files from the internet so it can warn you before they open. The attacker sends the file by email or chat, or a link to it, and still has to convince you to open it; once you do, the usual "this file came from the internet" protection doesn't step in. Microsoft rates it Important, with exploitation detected. KB5127648 fixes it, and so does the October update for Windows 10 PCs with Extended Security Updates, KB5126657.

The Critical fixes include flaws in how Windows draws text and images (Text Shaping, GDI+ and the Graphics Component), how it plays media (Media Foundation and the video decoder), and in Hyper-V, Message Queuing and the PostScript printer driver. For most people the advice is simple: let it install tonight and restart, because a fix only protects you once it's on the PC.

Two changes in it are worth knowing about:

• Secure Boot certificates. The rollout of new Secure Boot certificates continues, using updated data to decide which PCs are ready to receive them automatically. PCs that haven't received the new certificates yet still start normally and still get standard updates.
• ReFS on external drives. Windows now audits ReFS volumes on externally attached storage by default, with optional controls for administrators. Nothing is blocked for home users.

On Windows 11 24H2 Home and Pro, there's an extra reason to install it: these are the last security fixes that version will ever get. Every Windows flaw found after tonight stays open on a 24H2 Home or Pro PC, which is why the move to 26H2 matters.

Known issues in KB5127648

Good news first: two of September's known issues are fixed in KB5127648. Apps that closed when they played AC-3 (Dolby Digital) audio work again, and the black screen after sign-in on Azure Virtual Desktop and FSLogix setups is gone. Two issues are still open.

USB audio devices fail with Code 10 or play no sound

Since the September 8 security update, some USB Audio Class 1.0 devices, such as older USB headsets, speakers and audio interfaces, can stop working. You might see:

• "This device cannot start (Code 10)" in Device Manager.
• No sound at all.
• Volume controls stuck at zero or not responding.
• Sound settings that won't open or respond.

Some devices work in plain stereo but fail in 8-channel or 3D audio modes. The September 14 out-of-band update, KB5129195, already fixed those multichannel cases, and since KB5127648 includes it, installing tonight's update brings that fix too. The other symptoms are still being worked on. Some people have restored sound by switching the device to 2-channel mode in Sound settings. Our USB audio Code 10 guide walks through it step by step. In a business, IT admins who need a workaround for the remaining symptoms can contact Microsoft Support for Business.

Remote Desktop fails with error 0xC000000D (Administrator protection)

Since September's preview, KB5124010, non-admin users might be unable to connect with Remote Desktop to a PC that has Administrator protection turned on. The connection fails with error 0xC000000D and the message "The token that was passed to the function is invalid." It mostly hits work PCs used as Remote Desktop hosts, on Windows 11 24H2, 25H2, 26H2 and 26H1, however Administrator protection was turned on. The feature is off by default, so most home PCs aren't affected.

The workaround is for IT to turn Administrator protection off temporarily on the affected hosts, by resetting the User Account Control: Configure type of Admin Approval Mode policy in Microsoft Intune or Group Policy. A permanent fix is promised in a future update. Watch for this one if your organization uses Windows security baselines: they turn Administrator protection on by default from tonight's update (see the IT admin section).

Jake: "So 'known issues' doesn't mean the update is bad."

Ethan: "It means Microsoft has written down what it knows so far. Read the list, and if none of it touches what you use, install and move on."

How to install KB5127648, or download it as an .msu file

From Windows Update (the normal way)

1. Open Settings > Windows Update and select Check for updates.
2. KB5127648 appears in the list with its KB number and downloads by itself.
3. Restart when asked, then run winver to confirm the build ends in .9711.

From the Microsoft Update Catalog (offline or for several PCs)

Search the catalog for KB5127648 and download the package for your processor. The files are big because each one holds the whole cumulative update:

The catalog also lists a required checkpoint update, KB5043080 (windows11.0-kb5043080-x64.msu or -arm64.msu), which has to go on first; if your PC already has it, the installer simply says so. Download the packages into one folder, for example C:\packages, then install them in order. You can double-click each .msu (it opens the Windows Update Standalone Installer, wusa.exe), or install from an elevated prompt:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5127648-x64.msu

Or in PowerShell, run as administrator:

Add-WindowsPackage -Online -PackagePath "c:\packages\windows11.0-kb5127648-x64.msu"

Jake: "Do I need to download that giant file?"

Ethan: "Not for one laptop. Windows Update fetches only the pieces your PC is missing. The catalog file is for people patching a room full of machines, or a PC with no internet."

Through WSUS

As a Patch Tuesday security update, KB5127648 is published to WSUS automatically, under the Security Updates classification for Windows 11. Approve it for your test group first, then broadly once your pilot machines restart cleanly.

KB5127648 not installing or stuck at 99%? Work through these

When an update fails, Windows Update usually shows an error code, and a handful of causes explain most of them. These steps fix them in order of effort:

1. Restart and try again. A pending restart from an earlier update blocks the next one more often than anything else.
2. Free up space on drive C:. The standalone package alone is several gigabytes, and installing needs working room on top of that. Settings > System > Storage shows what you can clear.
3. Repair the system files. Open Terminal as administrator and run DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow, then restart and try again.
4. Install the .msu files by hand, as in the section above. A manual install often succeeds when Windows Update's download keeps failing.
5. Look up your exact code. 0x800f0922, 0x80073712, 0x80070005 and 0x800f081f each have a specific fix.

If none of that works, an in-place repair (reinstalling the same version of Windows over itself, keeping your files and apps) resets the update components completely. On 24H2 Home or Pro, that's also a good moment to go to 26H2 instead, since the repair and the move are the same amount of work.

How to uninstall KB5127648

On Windows 11 24H2 and 25H2 you can remove the update from Settings:

1. Open Settings > Windows Update > Update history.
2. Scroll to Related settings and select Uninstall updates.
3. Find the entry for KB5127648, select Uninstall, then restart.

Think twice before you do. Removing a security update removes its security fixes, and on 24H2 Home or Pro there's no later update coming to put them back: you'd be left on September's code for good. If a specific app broke, uninstalling buys you time, but the lasting fix there is to move to 26H2 and get that app updated. Pause updates afterward if you don't want KB5127648 reinstalled before you've sorted the problem out. Our guide to uninstalling Windows updates covers the command-line methods too.

No Uninstall button, or Settings fails: remove it with DISM

KB5127648 arrives as one combined package: the servicing stack update (the part of Windows that installs updates) plus the cumulative update itself. That's why the old wusa /uninstall /kb: command doesn't work on it. DISM can still remove the cumulative update part by its package name. Open Terminal (Admin) or an elevated Command Prompt:

DISM /Online /Get-Packages /Format:Table | findstr RollupFix

Find the line whose name contains tonight's revision number, 9711, copy its full package name, and remove it:

DISM /Online /Remove-Package /PackageName:<the package name you copied>

Restart when DISM asks. The servicing stack part stays: once installed, it can't be removed by any supported method, and that's by design, because it's what installs every future update.

"Uninstall failed" with 0x800F0825, or the update is marked permanent

Error 0x800F0825 (CBS_E_CANNOT_UNINSTALL) means Windows' servicing engine refused to remove the package. Before anything drastic, work through the safe steps in order:

1. Restart once and try the uninstall again; a pending update operation can block it.
2. Repair the component store, then the system files, from an elevated Command Prompt, restart, and try again:

   DISM /Online /Cleanup-Image /RestoreHealth
   sfc /scannow

3. Still failing? Open C:\Windows\Logs\CBS\CBS.log in Notepad and search for 0x800f0825. The lines just before it usually name what's in the way, such as an extra display language, Windows Sandbox or .NET Framework 3.5. Removing that feature temporarily often lets the uninstall go through.

The last resort: edit the update's .mum file. Some packages are marked permanent, and Windows simply won't remove them. The flag lives in the update's manifest, a small XML file with a .mum extension in C:\Windows\servicing\Packages. Changing permanency="permanent" to permanency="removable" lets DISM remove the package. This is unsupported, it edits files only Windows' own TrustedInstaller account is meant to touch, and a mistake can leave Windows Update unable to install anything. Do it only with a full system image backup, because System Restore may not be able to undo it. Never do it to a servicing stack package (a name containing ServicingStack): that's the part that installs every future update.

1. Make a full image backup of the PC first.
2. In an elevated Command Prompt, list the package's .mum files. For tonight's update, that's the RollupFix file whose name contains tonight's revision number, 9711; for any other update, search for its KB number instead:

   dir C:\Windows\servicing\Packages\*RollupFix*.mum

3. Take ownership of each file and give Administrators full access (replace the file name with yours):

   takeown /f "C:\Windows\servicing\Packages\FILE-NAME.mum" /a
   icacls "C:\Windows\servicing\Packages\FILE-NAME.mum" /grant Administrators:F

4. Open Notepad as administrator, open the file, change permanency="permanent" to permanency="removable", and save. Repeat for every .mum file of that update.
5. Remove the package with the DISM command in the section above, then restart.
6. Give each file back to Windows if it's still there:

   icacls "C:\Windows\servicing\Packages\FILE-NAME.mum" /setowner "NT SERVICE\TrustedInstaller"

Even then, DISM sometimes still refuses, especially for packages that newer updates have already replaced. If it does, stop there: restoring your image backup or moving forward to the next update is safer than pushing harder.

Windows won't start after the update: uninstall it from recovery

Try one more restart first. On 24H2 and later with quick machine recovery turned on, Windows detects repeated start-up failures and can pull a fix from Windows Update by itself. If the PC still won't start, use the Windows Recovery Environment (WinRE):

1. In WinRE, select Troubleshoot > Advanced options > Uninstall updates.
2. Follow the prompts to remove the most recent update, KB5127648.
3. Restart. Your files, apps and settings are kept; only the update's changes are removed.

If BitLocker is on, most recovery options ask for your BitLocker recovery key, so find it on another device before you start. And some updates can't be uninstalled this way at all; if that happens, Point-in-time restore or Reset this PC (keeping your files) are the next options on the same screen.

Jake: "So there's always a way back, even when Windows won't open?"

Ethan: "For the update itself, yes. Just remember that going back also takes away the security fixes, so it's a pause button, not a fix."

On 26H2, the 26H2 features depend on this update's code, so the route back is different: Settings > System > Recovery offers a way back to your previous version for a limited time after a feature update.

Every end date that matters this fall, in one table

October 13 is a crowded day for Microsoft's support calendar. Here's everything ending now and soon, so you can see where each of your machines stands:

Installing 26H2 resets your support clock: 24 months for Home and Pro, 36 months for Enterprise and Education. That's why the switch matters more than any single update.

The next Patch Tuesday dates

Security updates come out on the second Tuesday of each month, typically at 10:00 AM Pacific Time. Once daylight saving time ends in the US on November 1, that's 18:00 UTC (11:30 PM in India) instead of tonight's 17:00 UTC. The next ones:

Between them, an optional preview update usually arrives in the fourth week of each month, carrying the non-security fixes that the next Patch Tuesday makes automatic.

For IT admins: October 2026 Patch Tuesday in a managed fleet

A few points for managed fleets this month:

• 24H2 Home and Pro devices in the fleet. Small offices often run Pro without Enterprise licensing, which puts them on the Home and Pro lifecycle: KB5127648 is their final update. Target them with the 26H2 enablement package (Windows Update, or WSUS under Classification "Upgrades," titled "Windows 11, version 26H2"). It needs KB5124010 or a later cumulative update, which KB5127648 satisfies. 24H2 Enterprise and Education continue until October 12, 2027.
• Windows 10 Enterprise LTSB 2016 reaches end of updates on the same day. The supported path is Windows 11 Enterprise LTSC 2024; Extended Security Updates are available for organizations that need more time.
• Windows Server 2022 leaves mainstream support today. October's update is its last mainstream support update; security updates continue through extended support.
• Windows 11 23H2 Enterprise and Education get their last update on November 10, 2026. Plan those moves now.
• AD FS. With the October 2026 security update, supported Windows Server versions run the AD FS DKM container ACL remediation by default unless you've explicitly opted out. Windows Server 2012 and 2012 R2 still need manual remediation.
• Manitoba time zone. Manitoba moves permanently to UTC-5 and won't set its clocks back on November 1, 2026. KB5127648 adds the new (UTC-05:00) Manitoba time zone, so install it on PCs in Manitoba before November 1.
• Windows Update certificate rotation. Certificates used to connect to Windows Update expire on May 17, 2027 and June 19, 2027. 25H2 and later need no action; 24H2 and Windows Server 2025 need the September 2025 security update or later before June 19, 2027, which any currently patched device already has.
• RD Web Access. Chromium-based browsers are disabling the XSLT functionality RD Web Access relies on, so the page can fail to render. If you publish RD Web Access from Windows Server, take action before your users' browsers update.
• Office LTSC 2021 fleets. Support, bug fixes and security updates end today. The supported on-premises path is Office LTSC 2024, supported until October 2029; Microsoft 365 Apps is the cloud path. Inventory LTSC 2021 installs, including standalone Project and Visio, and schedule replacements.
• Administrator protection is on by default in the security baselines. If you deploy Windows security baselines, the Windows 11 26H2, 25H2 and 24H2 baselines turn Administrator protection on with the October update. Review and test before rolling out: the policies are "User Account Control: Configure type of Admin Approval Mode" and "User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection." Remote Desktop hosts need extra care because of the 0xC000000D known issue.
• ReFS on external drives. KB5127648 adds auditing and optional policy controls for ReFS volumes on externally attached storage. Auditing is on by default; enforcement is off by default, giving you time to evaluate before future hardening. Details are in KB5130741.
• Fixes worth flagging to your team: Always On VPN connections stuck on Connecting with automatic protocol selection or fallback, tiered Storage Spaces Direct virtual disks that failed to come online, printing with RAW or Generic Text Only drivers, and the Explorer black screen on Azure Virtual Desktop with FSLogix.
• Dynamic Update media. If you add dynamic updates to an existing Windows image, include the matching boot.stl file, or devices may fail to start from the media with error 0xc0430001.
• WSUS: KB5127648 syncs under Product: Windows 11, Classification: Security Updates.

Still stuck? Troubleshooting by symptom

My 24H2 laptop doesn't offer 26H2

The rollout is phased, and some devices are on compatibility holds. Install KB5127648 first, turn on "Get the latest updates as soon as they're available," and check again over a few days. On Home or Pro, don't let it drift for months: after today, 24H2 doesn't get security fixes.

I can't tell if I have Office 2021 or Microsoft 365

Open Word, then File > Account. Under Product Information, a version with "2021" in the name is Office 2021; "Microsoft 365" is a subscription that keeps updating.

The update downloaded but is stuck at a percentage

Large cumulative updates can sit at one percentage for a long time while they prepare. Give it an hour on a slow disk before you restart. If it fails afterward, follow the install steps above in order.

An older game or media player closes when audio starts

That matches the AC-3 (Dolby Digital) known issue that began with September's preview. KB5127648 fixes it, so install tonight's update and restart.

My USB headset stopped working

If Device Manager shows Code 10 on a USB audio device, it's the USB Audio Class 1.0 issue that started with the September 8 update. Our USB audio Code 10 guide covers the current options.

Domain users can't sign in on a Credential Guard PC

Install KB5127648 or September's KB5124010, which disable Machine Identity Isolation enforcement, then repair the secure channel with Test-ComputerSecureChannel -Repair; our trust relationship guide has the steps.

KB5127648: frequently asked questions

The back-room laptop restarted twice that evening: once for KB5127648, and once for the 26H2 switch, which moved its end-of-updates date from October 13, 2026 to October 10, 2028. Office stayed as it was; Jake added "replace Office 2021" to next year's shop budget, between the new display stand and the van's insurance, and his sister went back to her invoices without noticing anything had changed. Ethan wrote the line below on a sticky note and stuck it on the laptop's lid.

Revision note. Written October 13, 2026, for every forgotten laptop in a back room that still runs 24H2. "A stitch in time saves nine," says the old proverb; one restart tonight saves two years of worry.