Microsoft September 2026 Updates Cause RDS Failures on Windows Server — Detection, Rollback, and Recovery Guide

---
title: Remote Desktop Services Unexpected Termination
description: Detects the Remote Desktop Services (TermService) service terminating unexpectedly, a hallmark of the September 2026 Windows Server update regression. Correlates with Service Control Manager crash events in the System log.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-september-updates-cause-rds-failures-on-windows-server/
author: Security Arsenal
date: 2026/09/12
status: experimental
tags:
  - attack.impact
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    Message|contains:
      - 'Remote Desktop Services'
      - 'terminated unexpectedly'
falsepositives:
  - Occasional service crashes unrelated to patching; investigate when clustered post-update
level: high
---
title: Surge of Failed Remote Interactive Logons Post-Patch
description: Detects failed remote interactive (RDP) logons, which spike when the September 2026 update breaks session negotiation. Deploy as a baseline-deviation alert rather than a raw threshold.
references:
  - https://www.bleepingcomputer.com/news/microsoft/microsoft-september-updates-cause-rds-failures-on-windows-server/
author: Security Arsenal
date: 2026/09/12
status: experimental
tags:
  - attack.impact
logsource:
  product: windows
  service: security
detection:
  selection:
    LogonType: 10
    Keywords|contains: 'Audit Failure'
falsepositives:
  - Brute-force attempts and password-spray activity also produce this signature; correlate with recent patch installation before attributing to the regression
level: medium

// Scope: Identify servers with a post-patch surge in failed RDP logons (LogonType 10)
// Compare failure counts in the 24h after patch installation vs. the prior 7-day baseline
let patchWindow = 1d;
let baselineWindow = 7d;
let patchedHosts =
    DeviceEvents
    | where TimeGenerated > ago(patchWindow + baselineWindow)
    | where ActionType == "WindowsUpdateInstalled" or AdditionalFields has "KB"
    | summarize LastPatchTime = max(TimeGenerated) by DeviceName;
let failures =
    SecurityEvent
    | where TimeGenerated > ago(patchWindow + baselineWindow)
    | where EventID == 4625 and LogonType == 10
    | summarize FailedLogons = count(), FirstFailure = min(TimeGenerated), LastFailure = max(TimeGenerated) by Computer;
patchedHosts
| join kind=inner failures on $left.DeviceName == $right.Computer
| where LastFailure > LastPatchTime
| project DeviceName, LastPatchTime, FailedLogons, FirstFailure, LastFailure
| order by FailedLogons desc;

// Scope: Find September 2026 cumulative updates installed across the fleet via Defender TVM inventory
DeviceTvmSoftwareInventory
| where TimeGenerated > ago(2d)
| where SoftwareName has "Windows Server"
| summarize by DeviceName, SoftwareName, SoftwareVersion
| order by DeviceName asc;

-- Artifact: Hunt for September 2026 updates and RDS service health across Windows Server endpoints
-- Identifies recently installed hotfixes (candidate regression) and the current state of TermService

-- Installed hotfixes with install dates in September 2026
SELECT HotFixID, Description, InstalledOn, InstalledBy
FROM wmi(query="SELECT HotFixID, Description, InstalledOn, InstalledBy FROM Win32_QuickFixEngineering",
         namespace="ROOT\\CIMV2")
WHERE InstalledOn =~ "2026-09" OR InstalledOn =~ "9/.*2026"

-- Current state and start mode of the Remote Desktop Services service
SELECT Name, DisplayName, State, StartMode, ProcessId, PathName
FROM wmi(query="SELECT Name, DisplayName, State, StartMode, ProcessId, PathName FROM Win32_Service WHERE Name = 'TermService'",
         namespace="ROOT\\CIMV2")

-- Confirm whether the RDP listener is actually bound on TCP 3389
SELECT Pid, Name, Family, Type, Status, Laddr, Lport
FROM netstat()
WHERE Lport = 3389

#Requires -RunAsAdministrator
# Security Arsenal — September 2026 RDS Regression Triage & Recovery Script
# 1) Identify recently installed September 2026 updates
# 2) Verify TermService health and RDP listener state
# 3) Optionally uninstall the suspect KB (requires -RemoveKB with explicit KB number from Microsoft's advisory)

param(
    [string]$RemoveKB = "",
    [switch]$RestartRDSService
)

Write-Host "=== Step 1: September 2026 installed updates ===" -ForegroundColor Cyan
$recentUpdates = Get-HotFix | Where-Object { $_.InstalledOn -ge (Get-Date "2026-09-01") } | Sort-Object InstalledOn -Descending
$recentUpdates | Format-Table HotFixID, Description, InstalledOn, InstalledBy -AutoSize
if (-not $recentUpdates) { Write-Host "No September 2026 updates found via Get-HotFix. Check Win32_QuickFixEngineering or DISM for servicing stack items." }

Write-Host "`n=== Step 2: RDS service and listener health ===" -ForegroundColor Cyan
$termService = Get-Service -Name TermService -ErrorAction SilentlyContinue
$termService | Format-List Name, Status, StartType
$listener = Get-NetTCPConnection -LocalPort 3389 -State Listen -ErrorAction SilentlyContinue
if ($listener) {
    Write-Host "RDP listener is UP on TCP 3389 (PID $($listener[0].OwningProcess))" -ForegroundColor Green
} else {
    Write-Host "RDP listener is DOWN — consistent with the September 2026 RDS regression" -ForegroundColor Red
}

# Recent RDS crash events from the System log
Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Service Control Manager'; StartTime=(Get-Date).AddDays(-3)} -ErrorAction SilentlyContinue |
    Where-Object { $_.Message -match 'Remote Desktop Services' } |
    Select-Object TimeCreated, Id, Message -First 10 | Format-List

if ($RestartRDSService) {
    Write-Host "`n=== Step 3: Restarting dependent RDS services ===" -ForegroundColor Cyan
    Restart-Service -Name UmRdpService -Force -ErrorAction SilentlyContinue
    Restart-Service -Name TermService -Force -ErrorAction SilentlyContinue
    Start-Sleep -Seconds 5
    Get-Service TermService | Format-List Name, Status
}

if ($RemoveKB -ne "") {
    Write-Host "`n=== Step 4: Removing update $RemoveKB (confirm this KB against Microsoft's advisory first) ===" -ForegroundColor Yellow
    $kbId = $RemoveKB -replace 'KB',''
    Start-Process wusa.exe -ArgumentList "/uninstall /kb:$kbId /norestart" -Wait -NoNewWindow
    Write-Host "Removal initiated. A reboot is required. Schedule it during a maintenance window — do NOT leave the server unpatched longer than necessary."
}

Write-Host "`n=== Next steps ===" -ForegroundColor Cyan
Write-Host "1. Cross-check installed KBs against https://learn.microsoft.com/windows/release-health/ for the confirmed known issue and any Known Issue Rollback (KIR)."
Write-Host "2. If Microsoft published a KIR, deploy it via Group Policy or the KIR MSI rather than uninstalling the security update."
Write-Host "3. Re-apply the corrected update as soon as Microsoft releases it — do not pause security updates indefinitely."