April 8, 2025—KB5055519 (OS Build 17763.7136)

Symptoms

Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. The 2411 version of this application was released in December 2024.
 
Affected devices might initially download and apply the January 2025 Windows security update correctly, such as via the Windows Update page in Settings. However, when restarting the device to complete the update installation, an error message with text similar to “Something didn’t go as planned. No need to worry – undoing changes” appears. The device will then revert to the Windows updates previously present on the device. 
 
This issue likely affects a limited number of organizations as version 2411 of the SRA application is a new version. Home users are not expected to be affected by this issue. 

Workaround

Citrix has documented this issue, including a workaround, which can be performed prior to installing the January 2025 Windows security update. For details, see Citrix’s documentation.

Microsoft is working with Citrix to address this issue and will update this documentation once a resolution is available. 
 

Symptoms

Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local audit policies show the "Audit logon events" policy with Security Setting of "No auditing".

This issue might only manifest as a reporting inconsistency. It’s possible that logon events are correctly being audited on the device. However, the “Audit logon events” policy will reflect that this is not the case. Home users are unlikely to be affected by this issue, as logon auditing is generally only necessary in enterprise environments.

Resolution

This issue is resolved in the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update. This out-of-band (OOB) update is available only on the Microsoft Update Catalog. Since this is a cumulative update, you do not need to apply any previous update before installing it, and it supersedes all previous updates. Installation of this OOB will require a device restart.

If your organization has not deployed this update yet and you utilize Active Directory Group Policy, we recommend you apply the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update instead.

As always, we recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.

If you install an update released on or after April 11, 2025, you do not need to use a workaround for this issue. ​​​​​​​

If you are using an update released before April 11, 2025, and are experiencing this issue, there are adjustments that can be made to the Windows registry to prevent this issue. For information, see "Security auditing settings are not applied to Windows Vista-based and Window Server 2008-based computers when you deploy a domain-based policy".