February 11, 2025—KB5051974 (OS Builds 19044.5487 and 19045.5487) - EXPIRED

This security update includes quality improvements. Key changes include: 

• This build includes all the improvements from the supported Windows 10, version 21H2 editions.

• No additional issues are documented for this release.  

This security update includes quality improvements that were a part of update KB5050081 (released January 28, 2025). Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

• This update makes miscellaneous security improvements to internal OS functionality. No additional issues were documented for this release. 

If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.  

For more information about security vulnerabilities, please refer to the new Security Update Guide website and the February 2025 Security Updates. 

Applies to: All users

Symptoms

Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. The service fails with no detailed logging, and manual intervention is required to run the sshd.exe process.

This issue is affecting both enterprise, IOT, and education customers, with a limited number of devices impacted. Microsoft is investigating whether consumer customers using Home or Pro editions of Windows are affected. 

Workaround

This issue is addressed in KB5052077.

Applies to: All users

Symptoms

Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. The 2411 version of this application was released in December 2024.
 
Affected devices might initially download and apply the January 2025 Windows security update correctly, such as via the Windows Update page in Settings. However, when restarting the device to complete the update installation, an error message with text similar to “Something didn’t go as planned. No need to worry – undoing changes” appears. The device will then revert to the Windows updates previously present on the device. 
 
This issue likely affects a limited number of organizations as version 2411 of the SRA application is a new version. Home users are not expected to be affected by this issue. 

Workaround

The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions.

For details, see the documentation provided by Citrix at "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent".

Applies to: All users

Symptoms

The Windows Event Viewer might display an error related to SgrmBroker.exe, on devices that have installed Windows updates released January 14, 2025, or later. This error can be found under Windows Logs > System as Event 7023, with text similar to ‘The System Guard Runtime Monitor Broker service terminated with the following error: %%3489660935’. 

This error is only observable if the Windows Event Viewer is monitored closely. It is otherwise silent and does not appear as a dialog box or notification. 

SgrmBroker.exe refers to the System Guard Runtime Monitor Broker Service. This service was originally created for Microsoft Defender, but it has not been a part of its operation for a very long time. Although Windows updates released January 14, 2025, conflict with the initialization of this service, no impact to performance or functionality should be observed. There is no change to the security level of a device resulting from this issue. This service has already been disabled in other supported versions of Windows, and SgrmBroker.exe presently serves no purpose.

Note: There is no need to manually start this service or configure it in any way (doing so might trigger errors unnecessarily). Future Windows updates will adjust the components used by this service and SgrmBroker.exe. For this reason, please do not attempt to manually uninstall or remove this service or its components. 

Workaround

This issue is addressed in KB5055612.

Applies to: ​​​​​​​Enterprise users

Symptoms

After installing this update, you might observe issues with USB connected dual-mode printers that support both USB Print and IPP Over USB protocols. You might observe that the printer unexpectedly prints random text and data, including network commands and unusual characters. Resulting from this issue, the printed text might often start with the header "POST /ipp/print HTTP/1.1", followed by other IPP (Internet Printing Protocol) related headers. This issue tends to occur more often when the printer is either powered on or reconnected to the device after being disconnected.​​​​​​​

Workaround

This issue is addressed in KB5053643.