TL;DR: The April 2026 security update KB5082063 caused LSASS crashes → infinite restart loops on non-Global-Catalog (non-GC) DCs in environments with PAM (Privileged Access Management) enabled, on Windows Server 2016 through 2025. Microsoft released out-of-band fixes on April 19, 2026: KB5091157 (Server 2025) and KB5091575 (Server 2022). If you haven’t installed KB5082063 yet, you can defer it; if installed and looping, wusa /uninstall via safe mode or apply the out-of-band update.

Affected environments

OS Version	Affected?	Out-of-Band Fix	Build
Windows Server 2016	✅ Yes	KB5091577	14393.7632
Windows Server 2019	✅ Yes	KB5091578	17763.6996
Windows Server 2022	✅ Yes	KB5091575	20348.5024
Windows Server 2025	✅ Yes	KB5091157	26100.32698

Two conditions for impact:

• DC is non-GC (Global Catalog) — common in multi-domain forests
• Environment has Privileged Access Management (PAM) enabled (time-bound roles, Just-in-Time admin)

Scenario 1 — I haven’t installed the update yet

1. Decline KB5082063 in WSUS/Intune — critical step, otherwise it installs automatically
2. Push out-of-band update directly (table above)
3. The out-of-band update includes KB5082063 fixes + LSASS fix

# WSUS decline (PowerShell)
$Wsus = Get-WsusServer
$Update = $Wsus.SearchUpdates("KB5082063") | Where-Object Title -Match "Cumulative Update"
$Update | ForEach-Object { $_.Decline() }

Scenario 2 — Installed, affected, still running (no loop)

1. Download out-of-band MSU from Microsoft Update Catalog
2. RDP to DC, open elevated cmd
3. wusa.exe C:UpdatesKB5091575.msu /quiet /norestart
4. Reboot: shutdown /r /t 60
5. Verify post-restart: Get-HotFix -Id KB5091575
6. Health check: dcdiag /v and repadmin /replsummary

Scenario 3 — In a boot loop, can’t log in

1. During boot, press F8 or Shift+F10 for boot menu (for VMs, use ESXi/Hyper-V console)
2. After 3 failed boots, Recovery menu often opens automatically — “Troubleshoot → Advanced Options → Startup Settings → Restart”
3. Select 4 — Safe Mode (not “with Networking” — LSASS-less networking risk)
4. Login as Administrator (DSRM password may be required on DCs)
5. Remove KB5082063:

wusa.exe /uninstall /kb:5082063 /quiet /norestart
shutdown /r /t 60

6. Boot normally, system should come up
7. Apply out-of-band update immediately (Scenario 2 steps)

If you forgot DSRM password

• Reset DSRM password remotely from a working DC: ntdsutil → set dsrm password → reset password on server <DCName>
• All DCs down: Windows Server installation media → “Repair → Command Prompt” → offline registry edit (advanced, risky)
• Last resort: Authoritative restore from System State backup

Post-patch verification

Get-HotFix | Where-Object HotFixID -in @("KB5082063","KB5091575","KB5091578")
Get-Process lsass
Get-WinEvent -LogName System -MaxEvents 100 | Where-Object Id -in @(1015, 7034)
dcdiag /v
repadmin /replsummary

Common issues

• “Can’t enter Safe Mode, DSRM password doesn’t work.” Password not set or DSRM sync disabled at forest level. Reset via ntdsutil from another DC.
• “wusa /uninstall says ‘update not found’.” KB5082063 is Cumulative Update, can’t be uninstalled directly. Use DISM: dism /online /remove-package /packagename:Package_for_KB5082063
• “Out-of-band installed but LSASS still crashes.” PAM settings may be protected. Review with Get-PAMRolesByPolicy; temporarily disable PAM feature.
• “All my DCs are down, replication lost.” Last resort: authoritative restore from System State backup.

Preventive recommendations

• Never patch all DCs simultaneously — 50% per-site rule
• Define a Pilot group in WSUS/Intune: 1 test DC, 1 week observation, then production
• Run System State backup weekly (at least 2 different media)
• Store DSRM password in password manager, rotate yearly
• Follow Microsoft Release Health Dashboard via RSS

Sources: Microsoft Q&A, BleepingComputer, Tom’s Hardware, Microsoft Learn release-health. Tested environments: Windows Server 2019 / 2022 / 2025 multi-domain forest. Last updated: 2026-06-15.