Microsoft Breaks Windows: July Security Patch Results In Remote Users Getting Disconnected Every 30 Minutes

Microsoft admitted that the July security patch disrupts remote desktop connections for organisations that have Windows servers set up to use RPC over HTTP protocol within the Remote Desktop Gateway.

Microsoft is working on a fix for this but the tech giant has given some workarounds till then.

Source : Clint Patterson/Unsplash

Microsoft faced a global outage recently due to the CrowdStrike Falcon issue which left millions of users unable to use their systems. Share market, banking industry, civil aviation and even the health sector were affected by it. Now the tech giant is facing another issue. Microsoft recently released a security update however, it didn't go as the tech giant had thought it to be. The users who have installed this security patch are complaining about being disconnected every 30 minutes.  

Microsoft has admitted that some Windows Server users might encounter issues with Remote Desktop Connectivity, such as their logon sessions being lost with all users getting disconnected at around every 30 minutes.

Cause Of The Issue & Its Aftermath

Microsoft has confirmed that the security updates released in July disrupt remote desktop connections for organisations that have Windows servers set up to use the legacy RPC over HTTP protocol within the Remote Desktop Gateway.

Microsoft Windows users hopped onto Reddit to express their frustration over the issue. As per multiple threads on Reddit, users were experiencing Remote Desktop Gateway issues after applying the patch on the Windows 2019 server. They were facing “random mass disconnects throughout the day.” Users also confirmed that the system was “crashing roughly every 30 minutes.”

Microsoft while confirming these said, “Windows Servers might affect Remote Desktop Connectivity across an organization if legacy protocol (Remote Procedure Call over HTTP) is used in Remote Desktop Gateway. Resulting from this, remote desktop connections might be interrupted. This issue might occur intermittently, such as repeating every 30 minutes.”

Impacted Windows Servers

The list of impacted Windows Server releases and the security updates that trigger it includes:

• Windows Server 2022 (KB5040437)
• Windows Server 2019 (KB5040430)
• Windows Server 2016 (KB5040434)
• Windows Server 2012 R2 (KB5040456
• Windows Server 2012 (KB5040485)

How To Fix This

Microsoft is working on a fix for this but the tech giant has given some workarounds till then. Microsoft said that connection over “pipe and port pipeRpcProxy3388 through the RD Gateway” should be disallowed. One can achieve this using firewall software. 

Another mitigation option involves modifying the registry on client devices by deleting the RDGClientTransport key. Microsoft recommends backing up the registry prior to making changes and ensuring a clear path for restoration before applying this workaround.