Windows bugs and fixes October 30 2026: status

Which Windows 11 bug has a shipped fix?

KB5127936 fixes the Remote Desktop failure, according to BleepingComputer.

BleepingComputer says the failure affected non-admin users connecting through Remote Desktop when the Administrator protection security feature was enabled on the destination device. The publication says affected connections could fail with error 0xC000000D after KB5124010 or later Windows updates on Windows 11 24H2 and later.

BleepingComputer says Microsoft identified the problem in organizations using Windows security baselines after the October 2026 Windows security update. According to the publication, Windows updates released October 28, 2026, including KB5127936, resolve the documented failure.

BleepingComputer also says administrators can temporarily turn off Administrator protection by resetting the User Account Control Type Of Admin Approval Mode policy through Microsoft Intune or Group Policy. The publication presents that mitigation for people who do not want to install the preview update and prefer to wait for the next Patch Tuesday cumulative updates.

That workaround costs the protection supplied by Administrator protection while the policy remains off, according to BleepingComputer's description of the mitigation. I would install KB5127936 on an affected device rather than weaken the security setting, after checking the Windows version and normal update controls.

Microsoft publishes Windows known issues, workarounds and fix builds through release health and KB articles. A help desk does not need to treat a documented update failure as unexplained. For the previous day's printing case, I have a separate Windows bugs and fixes October 29 report.

Has the Always On VPN repair shipped?

The permanent Always On VPN repair has not shipped, according to TechRepublic.

TechRepublic says Microsoft confirmed that its October 13, 2026 updates did not deliver the expected repair for affected Always On VPN connections. The publication says Microsoft changed the issue from Resolved to Mitigated, removed the repair from the KB5127648 release notes and deferred it to a future release.

According to TechRepublic, the problem concerns affected configurations using automatic protocol selection or fallback between IKEv2 and SSTP. The publication says managed Windows devices can fail to reconnect to corporate networks, leaving employees without internal applications despite a working internet connection.

TechRepublic says Microsoft recommends setting each affected VPN profile to a single tunneling protocol instead of using automatic selection or fallback. The workaround therefore costs protocol choice and fallback until Microsoft ships the permanent Windows update fix.

TechRepublic says Microsoft's documentation covers Windows 11 versions 24H2, 25H2, 26H1 and 26H2, although the problem applies to specific VPN configurations rather than every device. I would change only a profile that shows the documented failure. I would also record the original protocol setting before applying the mitigation.

The Windows bugs and fixes October 27 report covered the earlier no-fix status. The current answer remains plain: use the single-protocol workaround if access is broken, or leave a working profile unchanged while awaiting the permanent repair.

Does KB5134134 repair the remaining October problems?

No. Microsoft Support said on October 26 that KB5134134 updates certificates rather than every October problem.

Microsoft Support names the release October 26, 2026-KB5134134 (OS Build 28000.3237) Out-of-band and applies it to Windows 11 version 26H1, all editions. Microsoft describes KB5134134 as a cumulative, non-security out-of-band update containing previous releases and additional non-security improvements.

Microsoft Support says the update is intended for devices that do not receive current certificate trust list updates, including disconnected devices and systems unable to access Microsoft's certificate-update service. The same Microsoft article also includes an updated trusted root certificate payload for devices where automatic certificate trust list updates are disabled.

The Register said on October 27 that the release does not resolve the listed VPN, Smart App Control, audio or non-admin Remote Desktop problems inherited from the October 13 update. The Register also says many devices will not need the release because their current certificate lists normally arrive through the certificate-update service.

KB5134134 is therefore not a general answer to every Windows KB update problem. I would consider it only when the device matches Microsoft's stated certificate-update conditions. I would not install it expecting an Always On VPN repair. For Remote Desktop, I would use the separately documented KB5127936 path.

What can you do today?

Check the failing function, identify the installed Windows version, and apply only the documented fix or workaround that matches the device.

Windows Latest recommended Windows Update for KB5127936 in its October 28 report.

Windows Latest says people should verify the Windows version under Settings > System > About before choosing the update. The publication also says the Microsoft Update Catalog can supply an offline installer, while recommending that route only when Windows Update is not working.

For a non-admin Remote Desktop failure with Administrator protection enabled, I would first check for KB5127936 through Windows Update. If the update cannot be installed, an administrator can use the temporary policy mitigation documented by BleepingComputer, accepting that Administrator protection will be turned off.

For an affected Always On VPN profile, I would select one protocol as TechRepublic describes and write down the previous automatic or fallback setting. The permanent fix has not shipped. I would not describe the workaround as a completed repair.

For KB5134134, I would confirm that the device cannot receive current certificate trust list updates before installing the out-of-band package. Microsoft Support limits the intended audience to devices meeting those certificate-update conditions.

I would leave a working VPN profile and an ordinarily connected certificate service alone. I would test Remote Desktop or VPN access after the change and reverse only the temporary setting if it causes a new problem. The useful distinction is simple: KB5127936 carries a shipped Remote Desktop fix, the VPN repair remains pending, and KB5134134 serves a narrower certificate purpose.