After the April 2026 KB5082063 security update, non-GC DCs in PAM-enabled environments experienced LSASS crashes → restart loops. Microsoft released out-of-band fixes on April 19 (KB5091157, KB5091575). Three scenarios: defer if not yet installed; install out-of-band if currently running; safe mode + wusa /uninstall if boot looping. DSRM password recovery included.
Microsoft’s June 2026 Patch Tuesday is the largest ever: 206 CVEs + 3 active zero-days (HTTP/2 Bomb, BitLocker bypass, Windows CTF EoP). IIS HTTP.sys mitigation, DC patching order, BitLocker recovery key security, and VS Code GitHub token rotation. Step-by-step priority list and procedure for sysadmins.