Administrators are reporting unexpected appearances of Windows Server 2025 after what was published as a security update turned out to be a complete operating system upgrade.

The problem was [1]flagged by a customer of web app security biz Heimdal. Arriving at the office on the morning of November 5, they found, to their horror, that every Windows Server 2022 system had either upgraded itself to Windows Server 2025 or was about to.

Sysadmins are cautious by nature, so an unplanned operating system upgrade could easily result in morning coffee being sprayed over a keyboard.

[2]

Heimdal's services include patch management, and it relies on Microsoft to label patches accurately to ensure the correct update is applied to the correct software at the correct time. In this instance, what should have been a security update turned out to be Windows Server 2025.

[3]

[4]

It took Heimdal a while to trace the problem. [5]According to a post on Reddit: "Due to the limited initial footprint, identifying the root cause took some time. By 18:05 UTC, we traced the issue to the Windows Update API, where Microsoft had mistakenly labeled the Windows Server 2025 upgrade as KB5044284."

[6]Buckle up, admins – Windows Server 2025 officially hits GA

[7]Productivity suites, Exchange servers in path of Microsoft's end-of-support wave

[8]Saying goodbye to the tech dreams Microsoft abandoned with Windows 11 24H2

[9]Admins using Windows Server Update Services up in arms as Microsoft deprecates feature

It added: "Our team discovered this discrepancy in our patching repository, as the GUID for the Windows Server 2025 upgrade does not match the usual entries for KB5044284 associated with Windows 11. This appears to be an error on Microsoft's side, affecting both the speed of release and the classification of the update. After cross-checking with Microsoft's KB repository, we confirmed that the KB number indeed references Windows 11, not Windows Server 2025."

The Register has contacted Heimdal for more information and will update this piece should the security organization respond. We also asked Microsoft to comment almost 24 hours ago. Since then? Crickets.

As of last night, Heimdal estimated that the unexpected upgrade had affected 7 percent of customers – it said it had blocked KB5044284 across all server group policies. However, this is of little comfort to administrators finding themselves receiving an unexpected upgrade.

[10]

Since rolling back to the previous configuration will present a challenge, affected users will be faced with finding out just how effective their backup strategy is or paying for the required license and dealing with all the changes that come with Windows Server 2025. ®

Get our [11]Tech Resources



[1] https://www.reddit.com/r/sysadmin/comments/1gk2qdu/windows_2022_servers_unexpectedly_upgrading_to/

[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZyugtYp0bT2mC0zlRIdyDwAAAEc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZyugtYp0bT2mC0zlRIdyDwAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZyugtYp0bT2mC0zlRIdyDwAAAEc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[5] https://old.reddit.com/r/sysadmin/comments/1gk2qdu/windows_2022_servers_unexpectedly_upgrading_to/lvl4of4/

[6] https://www.theregister.com/2024/11/04/windows_server_2025_ga/

[7] https://www.theregister.com/2024/10/16/microsoft_end_of_support_wave_widens/

[8] https://www.theregister.com/2024/10/03/whats_gone_from_windows_11/

[9] https://www.theregister.com/2024/09/23/microsoft_wsus_deprecation/

[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/oses&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZyugtYp0bT2mC0zlRIdyDwAAAEc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[11] https://whitepapers.theregister.com/