April 8, 2025—KB5055519 (OS Build 17763.7136)

Symptoms

Devices that have certain Citrix components installed might be unable to complete installation of the January 2025 Windows security update. This issue was observed on devices with Citrix Session Recording Agent (SRA) version 2411. The 2411 version of this application was released in December 2024.
 
Affected devices might initially download and apply the January 2025 Windows security update correctly, such as via the Windows Update page in Settings. However, when restarting the device to complete the update installation, an error message with text similar to “Something didn’t go as planned. No need to worry – undoing changes” appears. The device will then revert to the Windows updates previously present on the device. 
 
This issue likely affects a limited number of organizations as version 2411 of the SRA application is a new version. Home users are not expected to be affected by this issue. 

Workaround

The issue has been resolved in Citrix Session Recording Agent version 2503, released on April 28, 2025, and newer versions.

For details, see the documentation provided by Citrix at "Microsoft's January Security Update Fails/Reverts on a machine with 2411 Session Recording Agent".

Symptoms

Audit Logon/Logoff events in the local policy of the Active Directory Group Policy might not show as enabled on the device even if they are enabled and working as expected. This can be observed in the Local Group Policy Editor or Local Security Policy, where local audit policies show the "Audit logon events" policy with Security Setting of "No auditing".

This issue might only manifest as a reporting inconsistency. It’s possible that logon events are correctly being audited on the device. However, the “Audit logon events” policy will reflect that this is not the case. Home users are unlikely to be affected by this issue, as logon auditing is generally only necessary in enterprise environments.

Resolution

This issue is resolved in the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update. This out-of-band (OOB) update is available only on the Microsoft Update Catalog. Since this is a cumulative update, you do not need to apply any previous update before installing it, and it supersedes all previous updates. Installation of this OOB will require a device restart.

If your organization has not deployed this update yet and you utilize Active Directory Group Policy, we recommend you apply the April 11, 2025—KB5058922 (OS Build 17763.7240) Out-of-band update instead.

As always, we recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one.

If you install an update released on or after April 11, 2025, you do not need to use a workaround for this issue. ​​​​​​​

If you are using an update released before April 11, 2025, and are experiencing this issue, there are adjustments that can be made to the Windows registry to prevent this issue. For information, see "Security auditing settings are not applied to Windows Vista-based and Window Server 2008-based computers when you deploy a domain-based policy".

Note If you're unable to sign in using Windows Hello facial recognition in low light or with a covered camera lens after installing this update, this is a design change for enhanced security, and unrelated to the known issue listed below. See the "Improvements" tab in the Summary section for details.

The following issue only affects devices where the System Guard Secure Launch or Dynamic Root of Trust for Measurement (DRTM) feature is enabled after installing this update. Devices with Secure Launch or DRTM enabled prior to this update, or those with these features disabled, are not impacted by this issue.

We're aware of an issue affecting Windows Hello on devices with specific security features enabled. After installing this update and performing a Push button reset or Reset this PC from Settings > System > Recovery and selecting Keep my Files and Local install, some users might be unable to login to their Windows services using Windows Hello facial recognition or PIN. Users might observe a Windows Hello Message saying "Something happened and your PIN isn't available. Click to set up your PIN again" or "Sorry something went wrong with face setup".