Microsoft has acknowledged that its September security updates break three separate things: Remote Desktop Services, sound on some USB audio devices, and pasting in Excel. The Register reported it from Microsoft's own known-issues list. Straight to the point: here's what there is, and more importantly what I'd change starting today.
What happened
Remote Desktop (RDS). The first reports appeared on social media right after the update, and Microsoft has now confirmed it for several versions, including Windows 11 26H1 and Windows Server 2012. Symptoms: connections dropping after a few minutes, and servers hanging on the session configuration message.
"Please wait for the Remote Desktop Configuration"
And it doesn't stop there. Microsoft admits the management console (MMC), the RDS licensing diagnoser and even File Explorer may stop responding, and that the Windows Update page can sit there spinning forever. If the affected machine is virtual and RDP won't let you in, stopping it — deallocating it — and starting it again restores connectivity temporarily. A fix is on the way, with no date attached.
USB audio. Confirmed on Windows 11 26H1, 25H2 and 24H2 with devices using the USB Audio Class 1.0 standard, which dates back to last century. You may end up with no sound at all, a broken sound panel and volume controls, or multichannel audio misbehaving. Some customers got sound back by switching the device to two-channel mode. Fix in progress, timeline none.
Excel. This is the interesting one. The patch that closes remote code execution and information disclosure holes has broken pasting. Excel 2016, 2019, 2021 and 2024 are affected. The user pastes, the source stays selected, the destination doesn't change, and there's no beep and no error message. Microsoft has published no workaround. On the forums, one person fixed it by uninstalling and reinstalling Office; others uninstalled the security update, which also takes the security fix away with it.
Why it matters
The failure that should keep you awake is the Excel one, not RDP. A dead RDS is loud: everyone knows within ten minutes, a ticket gets opened, it gets escalated. A paste that fails without saying anything gets noticed by nobody. Someone copies a block of figures, pastes it into the month-end sheet, looks at another cell, saves and moves on. The number that should be there isn't, and the spreadsheet never complained. That error then travels into an invoice, a report or a data load without a single human seeing it.
Which brings me to the one lesson I take into my own code: an operation that can fail has to shout. If your importer swallows three malformed rows, say so. If your queue drops a message, leave a log line and a counter. Silence on an error path isn't elegance, it's a timer on a bomb. And when the failure lives inside somebody else's tool, as it does here, you're still the one taking the complaint, because the client links the odd number to your system.
If your only way into a server is the thing the patch breaks, you have a design problem, not a patch problem. Microsoft's workaround for virtual machines — stop it and start it again — only works if you still have access to the control plane. Worth checking today that every server has a second door: serial console on the hypervisor or the cloud provider, a management agent that doesn't depend on the graphical session, and break-glass credentials somebody has actually tested this quarter. Not the week it falls over.
Deployment rings, even if you're four people. This installed itself on plenty of machines that had automatic updates switched on. You don't need a WSUS with twenty policies: a small group of machines that gets patches a few days before everyone else is enough, plus a look at the Windows release health page before you open the gates. On production servers: automatic updates off, and a patching window with someone watching.
The rollback trap. Uninstalling the Excel update gives you pasting back, and gives you remote code execution back too. My rule: on machines that open files from outside — email, clients, suppliers — you don't uninstall. You reinstall Office, or you live with the bug and tell users to verify what they paste. On an isolated lab box it's a different conversation. The decision goes per machine role, not in one sweep across the whole fleet.
And if you're still running Windows Server 2012, the date is in the diary: the Extended Security Updates programme ends on 13 October 2026, according to the product lifecycle page. One month of patches left, and the last ones are breaking remote access. If that doesn't move the migration plan, nothing will.
What doesn't change
Not patching is still worse. The vulnerabilities the Excel update closes are real, and people are exploiting that class of bug through attachments every single day.
Credit where it's due, too: we know about all this because Microsoft publishes it in its known-issues list. A thousand times better than a month of silence and guessing on forums. What's missing is the fix timeline, and there isn't one — neither for audio nor for RDS.
The scope is also smaller than the headlines suggest. The audio issue hits Class 1.0 devices, a very old standard; most modern kit speaks 2.0 and never notices. The RDS problem affects some versions and some users, not the whole estate. Nobody should dismantle their update process over this: what needs fixing is the order you apply things in, and how you find out when something fails quietly.
Any questions, tell me and we'll go through it.
All the best, Vicente.