Microsoft ships Windows 10 KB5131096 ESU security update

By Amara Osei

Microsoft’s November 2026 Patch Tuesday addressed 1,235 vulnerabilities across its products, including one actively exploited Outlook zero-day flaw, and Windows 10 KB5131096 now carries fixes from that release.

The release mainly extends security maintenance for organizations that still run Windows 10. Microsoft says the update “mainly includes security updates and bug fixes,” and the company no longer releases new features for the operating system.

Who can install KB5131096, and which builds will they run?

Windows 10 Enterprise LTSC users and organizations enrolled in Microsoft’s Extended Security Update (ESU) program can install KB5131096 through Settings > Windows Update > “Check for Updates.” Windows 10 moves to build 19045.7846, while Windows 10 Enterprise LTSC 2021 moves to build 19044.7846.

The practical result: eligible organizations get the update through the standard Windows Update path, with a specific build number to verify after installation.

What operational problems did Microsoft fix?

KB5131096 carries four areas of change beyond the broader security release:

• Daylight saving time. Microsoft extended Cuba’s DST rules for 2026–2027. Cuba remains on UTC-04:00 and does not observe the November 2026 and March 2027 transitions. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028. Microsoft directs administrators to its Daylight Saving Time & Time Zone Blog for guidance.
• Printing. Adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device could fail with error 87, “The parameter is incorrect.” The October 2026 update introduced the defect, which generally does not affect existing printers or printing.
• Remote Desktop. Microsoft fixed a failure to configure the policy for specifying thumbprints of certificates representing trusted .rdp publishers through Microsoft Intune. It also fixed shadow connection failures displaying an Unspecified error on Windows Server 2016 and Windows Server 2012 R2 after the October 14, 2026 update.
• PowerShell. Microsoft strengthened script signing and signature verification with stricter encoding validation. Scripts containing invalid UTF-8 may fail signature validation even if they passed before. Administrators must review affected scripts, save them as valid UTF-8 with a byte order mark (BOM), and sign them again. Microsoft’s Encoding Guidance for Signed PowerShell Scripts provides further instructions.

In short, the release repairs time-zone handling, printer enrollment, remote access and script validation rather than adding platform features.

Have the USB audio problems been resolved?

Microsoft said it “has now resolved all known issues affecting USB Audio Class 1.0 devices introduced by the September 2026 Windows security updates.” The failures stopped some devices from producing audio, caused Code 10 startup errors, or left volume controls and sound settings unresponsive.

Microsoft had already issued an emergency out-of-band update on September 14 for issues affecting 8-channel and 3D audio modes. The company says the remaining audio issues are fixed in this Windows 10 release.

For administrators, the September audio regression now has both a documented resolution path and a completed fix.

What additional security service did Microsoft promote?

Microsoft also promoted Adaptive Security, which uses AI agents to analyze email intent, context and behavior. The service targets phishing, business email compromise and invoice fraud. Its offer includes a free 14-day read-only scan of Microsoft 365 or Google Workspace, with no changes to MX records.

This assessment offer sits outside KB5131096 and does not form part of the Windows 10 installation or remediation work.

KB5131096 extends security maintenance and targeted repairs for organizations still running Windows 10; it does not add new features.