RDP Login Failures After Windows 11 Update KB5065426: Cause and Fix
Updated: Sep 27
After installing Microsoft's September 2025 cumulative update KB5065426 on Windows 11 24H2, a lot of organizations suddenly couldn't log in to their virtual desktops over Remote Desktop. The password was right, the account was fine, and yet every attempt failed. I ran into this in a VDI environment, and the cause turned out to have nothing to do with passwords.
The Symptoms
You may see one or more of these after the update:
RDP connections fail with "The username or password is incorrect" or "Your credentials didn't work", even with the right password.
You're asked for credentials over and over.
Network shares and shared printers on the same machines stop working too.
Event Viewer shows Event ID 6167 with the message "There is a partial mismatch in the machine ID."
What Causes It
Starting with the updates released on August 29, 2025 (including KB5064081 and KB5065426), Windows 11 24H2, Windows 11 25H2 and Windows Server 2025 enforce new security checks on each computer's security identifier (SID). If two machines share the same identity, NTLM and Kerberos authentication between them fails.
Duplicate identities usually come from:
Virtual desktops or PCs cloned from an image that wasn't prepared with Sysprep.
Duplicate SID values across machines.
Duplicate MachineGUID values in cloned VDI images.
Who Is Affected
Affected: connections between two machines that both have the update installed and share the same SID or MachineGUID.
Not affected: connections from machines that don't have the update, and users signing in to their own desktop the normal way.
The Quick Fix: Known Issue Rollback
Microsoft provides a special Group Policy that temporarily turns off the new check so RDP works again while you fix your images. Microsoft's support article says IT administrators can get it from Microsoft Support for business. Here's how I applied it:
Install the Known Issue Rollback (KIR) package on the target desktop. This is the package I used: KB5065426 Known Issue Rollback (.msi).
Open Group Policy (gpedit.msc for one machine, or Group Policy Management for your domain) and go to Computer Configuration > Administrative Templates.
Find KB5065426 250912_02251 Known Issue Rollback and set it to Disabled.
Restart the desktop. The MSI alone won't fix it; the policy has to be applied and the machine restarted.
The Permanent Fix: Unique SIDs
The rollback is only a temporary workaround. Microsoft's permanent fix is to make sure every machine has its own identity:
Run Sysprep (with the Generalize option) on your golden image before you clone it.
Rebuild affected virtual desktops from the corrected image.
Review your VDI provisioning process so new clones always get unique SIDs.
Microsoft explains the issue in its support article: Kerberos and NTLM authentication failures due to duplicate SIDs.
Still Stuck?
If your remote desktops still won't authenticate, or you'd like help fixing your images, IT-Tech can connect remotely and work through it with you.
Book a remote support session and we'll get you sorted out.
Comments