# Microsoft KB Update (September 8, 2026) – Medium Severity **URL:** \ **Category:** Threat Prevention News\ **Tags:** threat-prevention, release-patch, patch-tuesday\ **Created:** [September 8, 2026, 5:00pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673 "2026-09-08T17:00:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Tania.Severina](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/tania.severina/32/6133_2.png) [@Tania.Severina](https://community.netwrix.com/u/Tania.Severina)\ **Post date:** [September 8, 2026, 5:00pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/1 "2026-09-08T17:00:27Z")
![threat-prevention-patch](https://netwrix1.discourse-cdn.com/netwrix/original/2X/2/2d82425b8caef3332adcceb84cf84ec09646a2a8.jpeg) **Want the full details? Click the link below!** On September 8, Microsoft released KB updates that conflict with Netwrix Threat Prevention (formerly StealthINTERCEPT) agents. If these KBs are applied before updating the agents, certain Kerberos, AD Replication, NTLM, and RDP authentication (JumpBox cases) events will no longer be captured or blocked. Netwrix recommends delaying the deployment of these KBs if your organization relies on these event types. The Netwrix development and QA teams are working on updated agents compatible with these KBs and will send another notice when they are available. ‼ Important Details If your organization does not use Netwrix Threat Prevention (formerly StealthINTERCEPT) for the following activity event collection, or such events are not deemed important, you may elect to deploy the following Microsoft KBs in advance of updated Netwrix Threat Prevention (formerly StealthINTERCEPT) agents. No other aspect of Netwrix Threat Prevention (formerly StealthINTERCEPT) operation is impacted by the September 8 KBs beyond what is described below. There is no adverse impact to domain controllers if the KBs are deployed without updating the agents. **Event Types Affected:** Kerberos, AD Replication, NTLM, RDP authentication (JumpBox cases) **Severity:** Medium **Affected Products:** - Netwrix Threat Prevention (formerly StealthINTERCEPT) for Active Directory - Netwrix Threat Manager (formerly StealthDEFEND) for Active Directory **Affected Systems:** - Windows Server 2025 - Windows Server 2022 - Windows Server 2016 - Windows Server 2012 R2 **Affected Microsoft KBs:** - KB5122871 - KB5122882 - KB5123099 - KB5123066 **Impact:** **Functional:** Windows Server 2025 / KB5122871: Kerberos events will not be collected or blocked Log messages observed: Couldn’t resolve I\_GetASTicket Windows Server 2022 / KB5122882: Kerberos, AD Replication events will not be collected or blocked Log messages observed: resolving KdcVerifyKdcRequest failed Couldn’t resolve IDL\_DRSGetNCChanges Windows Server 2016 / KB5123099: Kerberos, AD Replication events will not be collected or blocked Log messages observed: Couldn’t resolve I\_RenewTicket Couldn’t resolve I\_GetASTicket Couldn’t resolve IDL\_DRSGetNCChanges Windows Server 2012 R2 / KB5123066: NTLM, RDP authentication (JumpBox cases) events will not be collected or blocked Log messages observed: resolving NlpLogonSamLogon (New) failed resolving CConnectionEx::InitializeClientData (2 param) failed **Stability:** No stability impact on any server platforms or domain controllers. # Need help with this update? There are many different ways to get help with our products! | Situation | Action | | --- | --- | | If you feel the product is broken and not working as intended… | [Contact Support](https://www.netwrix.com/support.html) | | If you have a question you’d like to ask other experts… | Create a discussion in the community: #Threat Prevention > Discussions & Questions | | If you have a feature request… | Let our product team know directly: #Threat Prevention > Ideas | | If you have something cool to show… | Show everyone what you built: #Threat Prevention > Show & Tell | # What are your thoughts? We are always happy to hear from our users on what you like, and what you hope to see in the future. Please, share your thoughts below! ---
**Author:** ![prichards](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@prichards](https://community.netwrix.com/u/prichards)\ **Post date:** [September 21, 2026, 3:56pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/2 "2026-09-21T15:56:46Z")
Anyone else’s DCs crash randomly if the agents are not upgraded despite the “stability” message of “No stability impact on any server platforms or domain controllers.” when the agent is not updated? ---
**Author:** ![TSarra](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/tsarra/32/434_2.png) [@TSarra](https://community.netwrix.com/u/TSarra)\ **Post date:** [September 22, 2026, 10:54pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/3 "2026-09-22T22:54:32Z")
Hi Philip - Please open a support case so we can get this resolved for you. We did not encounter any crashes during the QA cycle using pre Sept. Patch Tuesday NTP agents on DC’s with the Sept. KB’s applied. Just the loss of the stated event types. Thanks, Tony ---
**Author:** ![prichards](https://avatars.discourse-cdn.com/v4/letter/p/7ab992/32.png) [@prichards](https://community.netwrix.com/u/prichards)\ **Post date:** [September 23, 2026, 2:43pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/4 "2026-09-23T14:43:32Z")
Case was already opened. It’s actually something that we have noticed that the statement in the patches is that there will be no stability impact on the services if not patched, manifests as very random reboots of the servers that are only alleviated by upgrading or removing Threat Manager. ---
**Author:** ![SaiCP](https://avatars.discourse-cdn.com/v4/letter/s/c37758/32.png) [@SaiCP](https://community.netwrix.com/u/SaiCP)\ **Post date:** [September 30, 2026, 4:59pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/5 "2026-09-30T16:59:27Z")
2016 DCs crashing post KB5123099 installation even with 8.0.0.88 Agent version LSASS terminated unexpectedly with status code 1073741819 reason code: 0x50006 ---
**Author:** ![Tania.Severina](https://yyz1.discourse-cdn.com/netwrix/user_avatar/community.netwrix.com/tania.severina/32/6133_2.png) [@Tania.Severina](https://community.netwrix.com/u/Tania.Severina)\ **Post date:** [September 30, 2026, 9:49pm UTC](https://community.netwrix.com/t/microsoft-kb-update-september-8-2026-medium-severity/149673/6 "2026-09-30T21:49:47Z")
Hi Sai, Philip, The fix for the Windows Server 2016 DC crashes/reboots is out: [Threat Prevention 8.1.0.40 / 8.0.0.95 / 7.5.0.322](https://community.netwrix.com/t/threat-prevention-patch-version-8-1-0-40-8-0-0-95-7-5-0-322-released-fix-for-windows-server-2016-domain-controller-reboots/159889). The new builds are available on the customer portal.