Windows 11 KB5124010 September Preview: Enterprise Deployment Guide — What's Fixed, What Isn't, and What to Test

Microsoft released KB5124010 on 22 September 2026 as the September optional preview update for Windows 11 24H2 and 25H2. Optional previews are non-security releases — they give enterprises an early look at changes expected in the next monthly Patch Tuesday. This post tells you exactly what KB5124010 contains, what is still broken, and how to incorporate it into your October validation without risking production stability.

Watch this post — YouTube walkthrough

KB5124010 September Preview — File History Fixed, AD Trust Still Broken

Endpoint Weekly

Watch on YouTube Subscribe at @EndpointWeekly

The problem: should you deploy KB5124010?

Every September Patch Tuesday, enterprises weigh whether to adopt the optional preview before the security update lands in October. KB5124010 presents a specific decision challenge: it fixes a high-profile File History regression that many admins have been waiting on, but it does not fix the equally high-profile AD domain-trust issue. Deploying it broadly to obtain one fix risks triggering the other known issue on AD-joined devices.

The deployment decision matrix looks like this:

Why it happens: what KB5124010 actually is

Windows releases two distinct classes of updates each month. The monthly security update (Patch Tuesday, usually the second Tuesday) is cumulative, mandatory for security posture, and distributed through Windows Update, WUfB, WSUS, and ConfigMgr automatically. The optional preview update (typically the fourth week) is non-security — it previews quality fixes and features that Microsoft plans to ship in the next Patch Tuesday. Optional previews must be manually opted into; they are never pushed automatically.

KB5124010 is an optional preview. It contains no new security patches. Its job is to give you a window to validate changes before they become mandatory in October. The critical implication: your production security posture does not improve by deploying it. You gain early access to quality improvements and regressions that may or may not affect your fleet.

The servicing stack for KB5124010 is also updated. SSU KB5124009 (build 26100.9539) ships alongside and improves update-installation reliability. For offline/OSD scenarios, the KB5043080 checkpoint requirement remains unchanged, and the correct boot.stl is still required when servicing installation media — a missing or wrong boot.stl causes media to fail to start with error 0xc0430001. Do not change your OSD/image checkpoint logic based on the preview SSU alone.

The File History fix — what it actually fixes

The most important change in KB5124010 for many enterprises is the File History fix. Since KB5124008, File History could fail to back up or restore to external drives and network paths. The drive appeared connected but the backup job either failed silently or showed the error "Reconnect your drive" even when the target volume was healthy and accessible from Windows Explorer.

Microsoft explicitly marks this as fixed in KB5124010. If File History is a genuine business requirement in your environment — for example, on shared workstations or in regulated industries where local backup compliance is audited — this is the signal to test the fix now rather than waiting for October Patch Tuesday.

What is still broken — the AD domain-trust issue

The Machine Identity Isolation domain-trust problem originates in KB5124008 and continues in KB5124010. When Machine Identity Isolation enforcement is configured in an unsupported on-premises AD domain environment, Windows devices can lose their trust relationship with the domain. The machine secure channel fails, which means Group Policy cannot be applied, network authentication breaks, and Kerberos tickets cannot be obtained.

Microsoft's supported workaround is to disable Machine Identity Isolation using the same method that enabled it — Intune policy, Group Policy, or the registry — then restart the device and repair the secure channel using Test-ComputerSecureChannel -Repair or nltest /sc_reset:<domain>. Microsoft has committed to a future Windows update as the proper resolution; KB5124010 is not that update.

What is still broken — USB Audio Class 1.0

USB Audio Class 1.0 devices continue to exhibit issues on KB5124010. Affected symptoms include Device Manager showing Code 10 errors on the audio device, no audio output, volume controls stuck at zero or unresponsive, and the Sound settings page in Windows Settings becoming unavailable or unresponsive. Microsoft says a resolution is still in progress. Keep specialist USB audio hardware in a controlled testing ring.

Lifecycle change: this is the final 24H2 preview

Microsoft has stated that KB5124010 is the final non-security preview update for Windows 11 24H2. Supported 24H2 editions will continue receiving monthly security updates, but Microsoft will no longer issue separate preview releases for that branch. This matters for how you structure your engineering validation process. If your endpoint team uses optional previews to get a four-week head start on Patch Tuesday, your preview ring should move to 25H2 (build 26200.x) now.

Windows 11 24H2 Home and Pro also reach end of servicing on 13 October 2026. Enterprise and Education editions remain supported until 12 October 2027. If your fleet includes 24H2 Home or Pro devices, this is a hard deadline — those devices will stop receiving security updates after that date.

One release-note correction

Microsoft amended the KB5124010 release notes on 22 September 2026 to remove a feature that would have reused saved Wi-Fi profiles during Windows Recovery Environment (WinRE) recovery. That feature has been pulled and will roll out at a future date. Do not include it as a KB5124010 acceptance criterion. The separate WinRE remote-management plug-in remains listed and is unaffected.

How to verify: check your current build and exposure

Before deciding whether to pilot KB5124010, verify what build your QA ring devices are currently running and confirm whether any of your estate is already on a build affected by the known issues.

Check the current Windows build

Run the following command from an elevated PowerShell prompt to confirm the current build number. A device on 24H2 should show a build starting with 26100; a 25H2 device shows 26200.

Verify Machine Identity Isolation enforcement status

To check whether Machine Identity Isolation enforcement is active on a device, query the registry. A value of 1 means enforcement is enabled — these devices are at risk from the domain-trust issue and should remain in a controlled ring.

You can also query this with PowerShell across a device group via Intune Proactive Remediation or a simple local command:

Check for Sysmon and USB Audio Class 1.0 exposure

To confirm whether Sysmon is deployed (relevant for validating the filter-driver and Event ID 25 fixes):

For USB Audio Class 1.0 exposure, check Device Manager for Code 10 errors on audio devices. From PowerShell:

Sysmon false Event ID 25 — what it looks like before and after

Before KB5124010, Sysmon could fire Event ID 25 (ProcessTampering) against smss.exe on normal Windows startup, generating false-positive tamper alerts in SIEM pipelines. Here is what the false alert looked like versus a genuine post-fix startup:

The fix: deployment guidance and test ring strategy

The correct deployment pattern for KB5124010 is a small, deliberately-scoped engineering or QA pilot ring — not a broad deployment, and absolutely not the replacement for KB5129195 on production devices.

What your production ring should stay on

Your production devices should remain on KB5129195, the September 2026 security update. The actively exploited Windows Update Stack vulnerability CVE-2026-81963 remains CISA KEV-listed, with a federal remediation date of 22 September 2026. There is no reason to reduce September security-patching urgency. KB5124010 does not add any security fixes over KB5129195 — it only adds quality improvements.

How to manually install KB5124010 on a pilot device

Because KB5124010 is not distributed through WUfB or WSUS automatically, you must manually target pilot devices using one of two methods.

Method 1 — Windows Update Optional updates (preferred for individual pilot devices):

On each pilot device, open Settings, navigate to Windows Update, select Advanced options, and then select Optional updates. KB5124010 will appear here. Select it and choose Download and install.

Method 2 — Microsoft Update Catalog (for ConfigMgr/WSUS environments):

1. Go to the Microsoft Update Catalog and search for KB5124010.
2. Download the appropriate package for 24H2 (x64) or 25H2.
3. In ConfigMgr, use Software Updates › Import Update to bring it into your SUP manually.
4. Create a software update group and deployment targeted only at your pilot device collection.
5. Do not add this to any existing All Workstations or Managed Devices software update group.

What to test in your KB5124010 QA ring

Focus your pilot validation on the areas where KB5124010 makes specific claims, and the areas where known issues persist. Use 10 to 20 representative devices — ideally a mix of 24H2 and 25H2, and including at least one device with each of the hardware types below.

Shifting preview validation to Windows 11 25H2

With KB5124010 confirmed as the final 24H2 preview, your engineering team's preview ring should now target 25H2 (build 26200.x). The same optional update model applies — 25H2 preview updates will appear in Settings › Windows Update › Optional updates each month. If you currently use a dedicated preview device collection in Intune, update its target to include 25H2 build range devices.

In your preview update ring, ensure the ring is scoped to a named group containing only your 10-20 engineering validation devices. Set the feature update deferral to 0 days and the quality update deferral to 0 days for this ring only, so preview builds can be manually installed as described above. Do not change the production ring's deferral settings.

Proof it worked: validation criteria for your QA ring

After deploying KB5124010 to your pilot devices and running the test scenarios above, confirm the following before forming your October Patch Tuesday recommendation.

Confirm the build installed correctly

What a clean QA result looks like

A QA ring that passes on File History, Sysmon, Bluetooth, and general stability gives you confidence that October Patch Tuesday — which will incorporate these same fixes — should be safe to deploy broadly. It does not, however, give you confidence that the AD domain-trust or USB Audio issues are resolved. Maintain those targeted holds until Microsoft ships the specific fixes in a future cumulative update.

References

• Microsoft — KB5124010 September preview release notes (24H2 26100.9550 / 25H2 26200.9550)
• Microsoft — Windows 11 24H2 release health dashboard (known issues and safeguard holds)
• Microsoft — Windows 11 25H2 release health dashboard
• Microsoft Update Catalog — KB5124010 download
• Microsoft Learn — Configure Windows Update for Business

Microsoft MVP community deep-dives