RDP Authentication Broken After January 2026 Update
KB5073722 — Server 2016 Fix & Workarounds
The January 2026 cumulative update for Windows Server 2016 introduced a regression in the RDP authentication stack. Users cannot connect. Credential prompts loop. Domain controllers flood with Event ID 4625 and 4776. Accounts lock out. Here is exactly what happened and how to fix it right now.
Failed Logon
NTLM Failure
What Exactly Broke After the January 2026 Updates
The January 2026 cumulative update for Windows Server 2016 (KB5073722) introduced a regression deep inside the RDP authentication handshake. This is not a configuration error on your end. Every business running Server 2016 with this update installed is hitting the same wall.
Here is the exact failure sequence. The RDP client connects normally and presents the credential prompt. Instead of forwarding the credentials the user types, the client defaults to the current local session identity. The server reads this as an invalid or mismatched credential and rejects the connection instantly. The client retries using the same broken identity in a continuous loop. Every retry writes a new Event ID 4625 and 4776 to your domain controller's Security log.
What Users Report
Businesses across RDP, Azure Virtual Desktop, Windows 365, and the Windows App are all reporting the same cluster of symptoms. The server is healthy. The credentials are correct. Nothing works.
Credential Prompt Loop
The sign-in prompt appears and disappears immediately. Retrying with the correct password produces the same instant failure over and over.
User-FacingAccount Lockouts
Each retry counts as a failed logon attempt. Lockout thresholds are hit within seconds, locking out legitimate user accounts automatically.
Active DirectoryEvent ID Storm on DC
Domain controllers flood with Event ID 4625 (failed logon) and Event ID 4776 (NTLM credential validation failure) from every affected RDP client.
Event ViewerDesktop Never Loads
RDP sessions never reach the remote desktop. The server is online and healthy. The issue is entirely in the authentication handshake before the session is established.
Session LayerAffected Systems
The regression affects multiple Windows versions, but Server 2016 is the only one without a released fix. This is why Server 2016 environments are generating the highest volume of RDP support requests in 2026.
| Operating System | Update | RDP Status | Fix Available |
|---|---|---|---|
| Windows Server 2016 | KB5073722 | ⚠ Broken | Rollback only |
| Windows Server 2019 | Jan 2026 CU | ✓ Fixed | Patch released |
| Windows Server 2022 | Jan 2026 CU | ✓ Fixed | Patch released |
| Windows App (Client) | Builds 26100 / 26200 | ⚠ OOB Fix | KB5077744 |
| Azure Virtual Desktop | Server 2016 backend | ∼ Partial | Depends on backend OS |
Step-by-Step Fix for KB5073722 RDP Authentication Failure
Applies to Windows Server 2016. Follow these steps in order. Each step is additive.
Since Microsoft has not released a patch for Server 2016, uninstalling KB5073722 is the most reliable fix available. Rolling it back removes the broken credential handshake behavior and restores normal RDP authentication.
Open PowerShell as Administrator on the affected server and run:
wusa /uninstall /kb:5073722 /quiet /norestart
Schedule the server reboot for your next maintenance window. After the reboot, test RDP authentication and confirm users can connect normally before calling this step complete.
After removal, Windows Update will attempt to reinstall KB5073722 automatically during the next update cycle. Block it immediately using one of these methods:
- Use the Microsoft wushowhide.diagcab tool to hide the specific update from the Windows Update list on the affected server.
- In WSUS, decline or pause KB5073722 to prevent it from distributing to Server 2016 targets.
- Apply a Group Policy Object to defer cumulative updates temporarily while you plan the Server 2019 or 2022 migration.
- In Intune or Configuration Manager, create a software update exclusion rule targeting KB5073722 on Server 2016 device groups.
The modern Windows App is the most severely affected client. The legacy mstsc.exe client uses a different credential flow and is not impacted by the same handshake regression. While the rollback and block are being implemented, redirect users to the classic client.
- Tell users to launch mstsc.exe from the Start menu or Run dialog instead of the Windows App.
- If the Windows App is enforced by policy, disable the "Use Windows App for RDP" group policy setting temporarily.
- Use VPN plus LAN-side RDP as an additional bypass for users connecting remotely, which routes around some of the broken pre-authentication logic.
The credential loop generates multiple failed logon attempts per second per affected user. With default lockout thresholds, entire user bases will be locked out within minutes. Buy yourself time to remediate by adjusting these settings temporarily in Group Policy.
- Increase the Account Lockout Threshold to a higher value (20 to 50 attempts) to slow down the lockout rate.
- Extend the Observation Window and Lockout Duration so accounts recover faster without admin intervention.
- Enable fine-grained auditing to identify which specific accounts are being affected most aggressively.
The repeated NTLM and Kerberos failures generated by the authentication loop can strain domain controllers significantly. After rolling back the update, verify the environment has recovered cleanly before restoring full lockout policy settings.
repadmin /replsummary
- Open Event Viewer → Windows Logs → Security and confirm Event ID 4625 and 4776 entries have stopped flooding in.
- Check DC CPU utilization in Task Manager or Performance Monitor. LSASS.exe should not be pegged at high CPU after the rollback.
- Run repadmin /replsummary to confirm replication across all domain controllers is healthy and no errors were introduced during the lockout storm.
- Unlock any user accounts that were locked out during the incident and communicate with affected users that access has been restored.
Server 2016 Is Running Out of Time
This incident is not an isolated patch quality issue. It is a preview of the operational risk that comes with staying on Windows Server 2016. End of extended support arrives in January 2027. Microsoft is already deprioritizing patches for this OS version. Server 2019 and 2022 received fixes for this same regression. Server 2016 did not.
Businesses running RDP-dependent workflows on Server 2016 should treat this incident as the forcing function to begin migration planning now.
Server Issues Are Our Specialty
We handle rollbacks, patch management, and server migrations entirely remotely for small and medium businesses nationwide.
Emergency Windows Server Support
RDP down means your team is locked out. We respond in under 15 minutes, connect remotely, and roll back the problematic update during a single session.
Get Emergency Help →Patch Management & Update Control
We test, approve, and deploy Windows updates on a managed schedule. Regressions like KB5073722 get caught in our staging environment before they ever reach production.
Learn More →Server Migration Planning
If this incident is the sign you needed to move off Server 2016, we plan and execute the migration to Server 2019 or 2022 with zero data loss and minimal downtime.
Learn More →RDP Authentication Failure — KB5073722 FAQ
Get Your Server 2016 RDP Working Again Today
Our certified engineers connect remotely, roll back KB5073722, block reinstallation, validate your domain controller health, and restore access in a single session. Emergency response under 15 minutes.