Microsoft closes book on rogue Windows Server 2025 upgrades

What happened?

It has been reported that more than a year after administrators were surprised by a security update that quietly upgraded Windows Server machines to Windows Server 2025, Microsoft has marked the incident "resolved." The company says the issue was mitigated shortly after it was first reported, but it has taken until now to flip the "Resolved" flag. The purported fix is bundled in KB5082063 — a cumulative update that, unsurprisingly, brings its own headaches.

The upgrade and the blame game

The original problem was every sysadmin's nightmare: servers upgraded overnight with no obvious rollback path. Microsoft blamed third‑party patch-management tools, saying the Server 2025 feature update was released as Optional under the Upgrade Classification "DeploymentAction=OptionalInstallation" and must be treated as optional, not recommended. That explanation did not sit well with some vendors and administrators; it has been reported that several Register readers alleged machines with no third‑party update tooling were also upgraded. Ouch.

The fix — and a new boot‑loop

KB5082063 addresses the uninvited Server 2025 installs, but Microsoft also warns that after installing this update non‑Global Catalog domain controllers in environments using Privileged Access Management might experience LSASS crashes during startup. As a result, affected DCs can restart repeatedly, breaking authentication and directory services — the kind of failure that turns a busy day into chaos. Microsoft says a fix is coming "in the next coming days." Fingers crossed.

What this means for trust

Software quality has been a sore spot for Microsoft lately — a point Windows chief Pavan Davuluri has tried to soothe with public reassurances. But talk is cheap when domain controllers are looping at 3 a.m. Can admins trust updates again? That’s the real question. For now, the uninvited 2025 upgrade appears to be dealt with… but only after a long, bumpy ride. At least the guest was shown the door — for now.

Sources: The Register