KB5077796

Microsoft has released an out-of-band cumulative update, KB5077796, for Windows 10 version 22H2 (ESU). This update addresses login failures that occurred during Remote Desktop connections.

The patch resolves login crashes during Remote Desktop sessions that appeared after installing the January 2026 update KB5073724 (Build 19045.6809). It fixes an issue where users encountered credential request errors when trying to establish a Remote Desktop connection to Windows 365 and Azure Virtual Desktop services through the Windows App. Microsoft had previously confirmed the problem and recommended temporarily using the classic Remote Desktop client or the web version of the Windows App as a workaround.

Note: Update KB5077796 is available only for manual installation from the Microsoft Update Catalog.

Improvements and Fixes in KB5077796 (Build 19045.6811)

This out-of-band update includes the quality improvements and fixes previously released in update KB5073724 (Build 19045.6809) from January 13, 2026. The patch also resolves the following specific issue:

• Remote Desktop: Some users experienced login failures during Remote Desktop connection attempts. This problem affected authentication steps for various Remote Desktop applications in Windows, including the Windows App.

If you have previously installed earlier updates, only the new fixes contained in this package will be downloaded and installed on your device.

How the new features work:

Fixing login crashes during RDP sessions (KB5073724): The fix resolves a conflict between the updated Windows credential provider (credssp.dll) and new TLS encryption policies introduced in build 19045.6809. The crash occurred during the CredSSP pre-authentication stage, when the server misinterpreted the tsrequest field. The patch restores RDP protocol version compatibility by returning the correct nonce validation sequence for the handshake.

Credential request errors when connecting to Windows 365 and AVD: The issue was caused by a mismatch in token signing algorithms between the Azure connection broker and the OAuth local cache of the Windows App client. When attempting to obtain a refresh token, the service rejected the request due to an incorrect Unix timestamp in the JWT payload. The fix synchronizes the not_before and exp parameters between the client and the authentication server.

Classic RDP client (mstsc.exe) as a workaround: The classic client uses legacy RDP graphics protocol version 8.1 instead of 10.8, which ignores modified fields in the Client Info PDU block. Unlike the Windows App, mstsc.exe does not send the extended cbMobilePlatform attribute, preventing the server from activating the problematic certificate chain check. Microsoft's workaround recommendation reduces patch management load.

Web version of Windows App as a workaround: The web client operates via WebSocket over HTTPS (wss://) using an RD Gateway with HTTP/2 headers. This method bypasses the system RDP stack (TermDD.sys) and relies entirely on the browser's TLS engine. Since authentication occurs at the web application level via the fetch API, the server never invokes the vulnerable CredSSP module, temporarily solving the sign-in issue.

Login failures for various RDP applications in Windows: The root cause is an override of the IProvideClassInfo interface for the MsRdpClientShell COM object. After the update, multiple applications concurrently accessed the same memory region during RDPSRAPI channel initialization. The patch adds a Global\RDPAuthMutex mutex to serialize calls, preventing a race condition during NTLM or Kerberos credential entry.

The last 10 Windows updates: