Windows 11 (KB5046617, KB5046633) November 2024 Patch Tuesday out

Patch Tuesday

Microsoft has released Patch Tuesday updates for Windows 11 24H2, 23H2, and 22H2. The 24H2 update is provided via KB5046617, while the 23H2 and 22H2 update is delivered via KB5046633. You will be on build versions 26100.2314, 22621.4460, and 22631.4460, respectively, after applying the update.

Here's what's new:

24H2

Highlights

This update addresses security issues for your Windows operating system.

Improvements

This security update includes improvements that were a part of update KB5044384 (released October 24, 2024). Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

[Task Manager (known issue)] Fixed: The count for the number of groups is wrong or always zero (0) on the Processes tab. This occurs when you turn on “Group by type.”

[Windows Subsystem for Linux (WSL)] Fixed: You cannot access your Dev Drive.

[Internet connection] Fixed: A small number of devices cannot connect to the internet. This occurs when a DHCP server response has duplicate DHCP options. This stops IPv4 connections on certain networks.

If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.

For more information about security vulnerabilities, please refer to the Security Update Guide website and the November 2024 Security Updates.

Windows 11 servicing stack update (KB5047621)- 26100.2303

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates.

Known issues in this update

Applies to	Symptom	Workaround
All users	We’re aware of an issue where players on Arm devices are unable to download and play Roblox via the Microsoft Store on Windows.	Players on Arm devices can play Roblox by downloading the title directly from www.Roblox.com.

23H2 and 22H2

Highlights

This update addresses security issues for your Windows operating system.

Improvements

Note: To view the list of addressed issues, click or tap the OS name to expand the collapsible section.

Windows 11, version 23H2

Important: Use EKB KB5027397 to update to Windows 11, version 23H2.

This security update includes quality improvements. Key changes include:

This build includes all the improvements in Windows 11, version 22H2.

No additional issues are documented for this release.

Windows 11, version 22H2

This security update includes improvements that were a part of update KB5044380 (released October 22, 2024). Below is a summary of the key issues that this update addresses when you install this KB. If there are new features, it lists them as well. The bold text within the brackets indicates the item or area of the change we are documenting.

[Miscellaneous security improvements to internal OS functionality] No additional issues were documented for this release.

If you installed earlier updates, only the new updates contained in this package will be downloaded and installed on your device.

For more information about security vulnerabilities, please refer to the Security Update Guide website and the November 2024 Security Updates.

Windows 11 servicing stack update (KB5044620) - 22621.4383 and 22631.4383

This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. Servicing stack updates (SSU) ensure that you have a robust and reliable servicing stack so that your devices can receive and install Microsoft updates.

Known issues in this update

Applies to	Symptom	Workaround
All users	Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. The service fails with no detailed logging, and manual intervention is required to run the sshd.exe process. This issue is affecting both enterprise, IOT, and education customers, with a limited number of devices impacted. Microsoft is investigating whether consumer customers using Home or Pro editions of Windows are affected.	Customers can temporarily resolve the issue by updating permissions (ACLs) on the affected directories. Follow these steps: Open PowerShell as an Administrator. Update the permissions for C:\ProgramData\ssh and C:\ProgramData\ssh\logs to allow full control for SYSTEM and the Administrators group, while allowing read access for Authenticated Users. You can restrict read access to specific users or groups by modifying the permissions string if needed. Use the following commands to update the permissions: $directoryPath = "C:\ProgramData\ssh" $acl = Get-Acl -Path $directoryPath $sddlString = "O:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;AU)" $securityDescriptor = New-Object System.Security.AccessControl.RawSecurityDescriptor $sddlString $acl.SetSecurityDescriptorSddlForm($securityDescriptor.GetSddlForm("All")) Set-Acl -Path $directoryPath -AclObject $acl Repeat the above steps for C:\ProgramData\ssh\logs. Microsoft is actively investigating the issue and will provide a resolution in an upcoming Windows update. Further communications will be provided when a resolution or additional workarounds are available.

Applies to

Symptom

Workaround

All users

Following the installation of the October 2024 security update, some customers report that the OpenSSH (Open Secure Shell) service fails to start, preventing SSH connections. The service fails with no detailed logging, and manual intervention is required to run the sshd.exe process.

This issue is affecting both enterprise, IOT, and education customers, with a limited number of devices impacted. Microsoft is investigating whether consumer customers using Home or Pro editions of Windows are affected.

Customers can temporarily resolve the issue by updating permissions (ACLs) on the affected directories. Follow these steps:

Open PowerShell as an Administrator.
Update the permissions for C:\ProgramData\ssh and C:\ProgramData\ssh\logs to allow full control for SYSTEM and the Administrators group, while allowing read access for Authenticated Users. You can restrict read access to specific users or groups by modifying the permissions string if needed.

Use the following commands to update the permissions:

$directoryPath = "C:\ProgramData\ssh" $acl = Get-Acl -Path $directoryPath $sddlString = "O:BAD:PAI(A;OICI;FA;;;SY)(A;OICI;FA;;;BA)(A;OICI;0x1200a9;;;AU)" $securityDescriptor = New-Object System.Security.AccessControl.RawSecurityDescriptor $sddlString $acl.SetSecurityDescriptorSddlForm($securityDescriptor.GetSddlForm("All")) Set-Acl -Path $directoryPath -AclObject $acl
Repeat the above steps for C:\ProgramData\ssh\logs.

Microsoft is actively investigating the issue and will provide a resolution in an upcoming Windows update. Further communications will be provided when a resolution or additional workarounds are available.

These updates will be available from Windows Update and should install automatically in most cases. If you would like to download these updates for offline installation, you can get them from the Microsoft Catalog website. You can find the update for 24H2 here (but check the install instructions here as it's more complex, go to the Catalog tab at the bottom of the page), and 23H2 and 22H2 here.