KB5134134, KB5134133, and KB5134130 OOB updates address Windows 11 certificate trust issues

Microsoft released three Windows 11 out-of-band updates on October 26, 2026, to deliver updated certificate trust information to devices that cannot receive it automatically.
KB5134130 covers Windows 11 23H2, KB5134133 covers 26H2, 25H2, and 24H2, and KB5134134 targets 26H1.
The company also removed seven certificates associated with affected eMudhra certificate hierarchies after intermediate certificate authority private keys were compromised.
The release notes list known issues involving Smart App Control, Remote Desktop connections, and some USB audio devices. Most users who receive certificate updates normally do not need to install these packages manually.

Microsoft is releasing two out-of-band (OOB) updates for Windows 11 to deliver updated trusted root certificates to devices that cannot receive current certificate trust list updates through the normal service.

The company released KB5134130, KB5134133, and KB5134134 on October 26, 2026, as cumulative, non-security updates that include improvements from previous releases and updated certificate trust information for supported Windows 11 versions. Windows 10 is also receiving a similar out-of-band update with KB5134125.

The releases also address a certificate security issue involving eMudhra. The company removed seven certificates associated with affected eMudhra certificate hierarchies from the Windows 11 trust list after the private keys of intermediate certificate authorities were compromised. These changes help the operating system to stop trusting the affected certificates.

The updates target devices in disconnected environments, computers that cannot access Microsoft’s certificate-update service, and systems where automatic certificate trust list (CTL) updates are disabled. They also update the list of untrusted certificates.

Devices that receive certificate updates normally don’t need to install these packages manually. Microsoft makes the updates available through the Microsoft Update Catalog, with separate packages for different operating system versions.

Microsoft released KB5134130 for Windows 11 23H2, KB5134133 for Windows 11 26H2, 25H2, and 24H2, and KB5134134 for Windows 11 26H1. The packages include improvements from previous cumulative updates, along with updated certificate trust information.

However, the release notes also list several known issues. Windows 11 26H2, 25H2, and 24H2 users might be unable to turn on Smart App Control after disabling it, while non-administrator users might experience Remote Desktop connection failures. Some USB Audio Class 1.0 devices might also fail to start or produce sound.

Windows 11 October 2026 OOB updates

The software giant released two packages, depending on your Windows 11 version.

Windows 11 26H2, 25H2, and 24H2 update KB5134133

Release date: October 26, 2026.
Builds: 26300.9725 (26H2), 26200.9725 (25H2), and 26100.9725 (24H2).
Purpose: Delivers updated trusted root certificates to devices that cannot receive current certificate trust list updates.
Affected versions: Windows 11 26H2, 25H2, and 24H2.

KB5134133 is a cumulative, non-security update that includes the improvements from the October 13, 2026, update KB5127648, along with the updated certificate payload.

The release also updates several AI components to version 1.2608.951.0, including Image Search, Content Extraction, Semantic Analysis, and Settings Model.

The package includes servicing stack update KB5127647, which brings the servicing stack to build 26100.9703 and improves the reliability of the Windows update installation process.

You can download KB5134133 from the Microsoft Update Catalog.

Windows 11 26H1 update KB5134134

Release date: October 26, 2026.
Build: 28000.3237.
Purpose: Delivers updated trusted root certificates to devices that cannot receive current certificate trust list updates.
Affected version: Windows 11 26H1.

KB5134134 includes the improvements from the October 13, 2026, update KB5127646, along with the updated certificate payload.

The update also brings Image Search, Content Extraction, Semantic Analysis, and Settings Model to version 1.2608.951.0. It includes servicing stack update KB5127645, which brings the servicing stack to build 28000.3225 and improves the reliability of the Windows update installation process.

You can download KB5134134 from the Microsoft Update Catalog.

Windows 11 23H2 update KB5134130

Release date: October 26, 2026.
Build: 22631.7654.
Purpose: Delivers updated certificate trust information to devices that cannot receive current certificate trust list updates.
Affected version: Windows 11 23H2.

KB5134130 is a cumulative, non-security update that delivers an updated trusted root certificate payload to devices that cannot receive current certificate trust list updates through Microsoft’s normal service.

The update is intended for systems in disconnected environments, computers that cannot access Microsoft’s certificate update service, and devices where automatic certificate trust list updates are disabled.

Microsoft lists no known issues for this release.

You can download KB5134130 from the Microsoft Update Catalog.

Windows 10 update KB5134125

Release date: October 26, 2026.
Builds: 19045.7811 (22H2) and 19044.7811 (21H2).
Purpose: Delivers updated certificate trust information to devices that cannot receive current certificate trust list updates.
Affected versions: Windows 10 22H2 and 21H2, including eligible Windows 10 ESU devices.

KB5134125 is a cumulative, non-security out-of-band update that includes improvements from the October 2026 Security Update (KB5126657) and an updated trusted root certificate payload.

The update targets devices in disconnected environments, computers that cannot access Microsoft’s certificate-update service, and systems where automatic certificate trust list updates are disabled.

The company also lists a known issue affecting some USB Audio Class 1.0 devices. These devices might fail to start, produce no audio, or experience unresponsive volume controls. The September 14, 2026, out-of-band update partially resolved the problem for devices using 8-channel or 3D audio modes, but other symptoms remain unresolved.

You can download KB5134125 from the Microsoft Update Catalog.

Known issues on Windows 11 KB5134133 and KB5134134

The company lists several known issues affecting these releases. Some problems have workarounds, while others remain partially or completely unresolved.

Smart App Control might not turn on

After installing KB5134133, some devices might be unable to turn on Smart App Control in the Windows Security app if the feature was previously disabled. On affected computers, the Smart App Control option may appear grayed out.

Devices where Smart App Control is already enabled are not affected and remain protected. However, Microsoft provides two workarounds for affected systems.

Warning: Before proceeding, it’s crucial to acknowledge the risks associated with modifying the Registry. Incorrect changes can lead to system instability or operational issues. Therefore, ensure you have a full system backup before making any changes. Proceed with caution and understanding.

Option 1. Modify the registry

You can restore the ability to enable Smart App Control by modifying the registry with the steps:

Open Start.
Search for Command Prompt, right-click the top result, and select the Run as administrator option.

Type these commands, pressing Enter after each one:

reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2883193997 /t REG_DWORD /d 1 /f
reg add "HKLM\SYSTEM\CurrentControlSet\Policies\Microsoft\FeatureManagement\Overrides" /v 2850574478 /t REG_DWORD /d 1 /f

Restart the computer.

Option 2. Install the Group Policy workaround

Network administrators can use Microsoft’s special Group Policy downloads for Windows 11 24H2, 25H2, and 26H2.

The company provides two policies, KB5074105 261015_19222 Feature Preview and KB5074105 261015_19221 Feature Preview. Install and configure both to resolve the issue. The first restores the ability to enable Smart App Control, while the second enables logging to help troubleshoot problems.

After installing both policies, configure both settings as “Enabled” under Computer Configuration > Administrative Templates and restart the affected devices.

Microsoft says it’s working on a permanent resolution for a future update.

This issue is listed for KB5134133, which covers Windows 11 26H2, 25H2, and 24H2. It’s not listed in the release notes for KB5134134 for Windows 11 26H1.

Remote Desktop connections might fail for non-admin users

The company also lists a Remote Desktop connection problem affecting non-administrator users connecting to remote devices with Administrator protection enabled.

The issue can occur after installing the September 2026 non-security preview update KB5124010 or later updates. Connections might fail with error 0xC000000D and display the message, “The token that was passed to the function is invalid.”

The problem primarily affects enterprise-managed devices used as Remote Desktop hosts with Administrator protection enabled.

Microsoft notes that Windows 11 security baselines enable Administrator Protection by default in versions 24H2, 25H2, and 26H2 unless an organization has configured the policy differently.

The workaround is for administrators to temporarily turn off Administrator Protection on affected devices by resetting the “User Account Control Type Of Admin Approval Mode” policy through Microsoft Intune or Group Policy.

Microsoft is also working on a permanent fix for a future Windows update.

USB audio devices might fail to start or produce sound

The company continues to list a known issue affecting some USB Audio Class 1.0 devices after the September 8, 2026, security update KB5124012.

Affected devices might display Code 10 in Device Manager, produce no audio, have unresponsive volume controls, or show unavailable sound settings.

Some devices may work in standard stereo mode but fail with multichannel audio, including 8-channel and 3D audio configurations. Switching to two-channel mode might restore audio on some affected devices.

Microsoft partially resolved the issue through the September 14, 2026, OOB updates. KB5129195 addresses symptoms affecting 8-channel and 3D audio modes on Windows 11 25H2 and 24H2, while KB5129194 addresses them on Windows 11 26H1.

However, other USB Audio Class 1.0 problems remain unresolved. The company says network administrators who need an immediate workaround for the remaining symptoms should contact Microsoft Support for Business.

Install Windows 11 OOB updates KB5134130, KB5134133, and KB5134134

The software giant makes KB5134130, KB5134133, and KB5134134 available through the Microsoft Update Catalog. Before installing a package, check its release notes for the required servicing stack and prerequisite updates for your Windows version.

For Windows 11 24H2 and 25H2, The company also requires an update released on or after June 10, 2025, such as KB5060842, before installing KB5134133.

To download the packages, follow these steps:

Open the Microsoft Update Catalog.
Search for KB5134130, KB5134133, or KB5134134, depending on your version of Windows 11..
Download the package that matches your operating system and system architecture.
Double-click the downloaded package to start the installation.
Continue with the installation instructions (if applicable).

If you have already installed previous updates, the operating system will download and install only the new content included in the package.

Network administrators deploying dynamic updates to existing Windows images should also ensure that the boot.stl file is included in the installation media. Otherwise, devices might fail to start from the media and display error 0xc0430001.

Microsoft recommends using the Update WinPE script to update an existing Windows image. Network administrators can also manually copy the boot.stl file from the device’s Windows\Boot\EFI folder to the corresponding folder on the installation media.

Out-of-band (OOB) updates explained

Out-of-band updates are releases that Microsoft publishes outside its regular monthly update schedule. The company uses them to deliver targeted fixes or improvements when certain devices need changes outside the normal release cycle.

These updates can be cumulative, meaning they include previous improvements alongside the new changes. However, not every OOB update is an emergency security patch, and not every device needs to install one manually.

In this case, KB5134133 and KB5134134 are non-security updates intended primarily for devices that cannot receive current certificate trust list updates through Microsoft’s normal service. Users who receive certificate updates automatically do not generally need to install these packages manually.