Windows Server 2025 Silent Intrusion: The Update That Couldn't Be Stopped

Man

Professional
Messages
3,067
Reaction score
598
Points
113
The unplanned transition to the new version came as a surprise to many.

Automatic upgrades to Windows Server 2025 came as a surprise to companies running Windows Server 2019 and 2022, especially in cases where updates were managed through third-party tools. Many organizations reported a transition to a new version of the system, which occurred without their consent and caused discontent among users. The issue affected server systems that had been upgraded despite the advertised update status as optional. Microsoft and the Independent Update Management Vendors (ISVs) delegate responsibility for the incident.

On November 6, Microsoft updated the Windows Update Status Dashboard, confirming that the upgrade to Windows Server 2025 through the KB5044284 package occurred in environments where third-party products managed updates. It is recommended that you check whether the update management software you are using is configured to prevent the installation of updates that are classified as functional. Microsoft noted that this update was marked as "DeploymentAction=OptionalInstallation", which was supposed to indicate its optional nature. However, third-party update management tools misinterpreted this label, resulting in a mass update.

Interestingly, some of the affected companies did not have Windows Server 2025 licenses. According to BleepingComputer, among the victims were Heimdal customers, where about 7% of customers inadvertently received a new version of the server before Heimdal blocked KB5044284 in the group's policies. Heimdal points to classification errors and the high speed of update distribution as possible causes of the incident. However, at the time of publication, Microsoft has not provided instructions for rolling back the update, other than restoring from backups.

KB5044284 is a cumulative update that is part of Microsoft's Patch Tuesday initiative, and Windows Server 2025 was supposed to be an optional upgrade. However, errors in the configuration of management tools led to its automatic installation for enterprise customers. The Windows Server 2025 release includes new features such as improved security, hybrid cloud support, improved AI and machine learning capabilities, GPU support, and hotpatching to minimize server downtime.

Source
 
Top