KB5131096 for Windows 10 (builds 19045.7846, 19044.7846): PowerShell signing and NTLM changes, USB audio fix

KB5131096 is the November 2026 security update for Windows 10, released on Patch Tuesday, 10 November 2026. It raises Windows 10 version 22H2 to build 19045.7846 and Windows 10 version 21H2 to build 19044.7846, and it reaches two groups only: commercial PCs enrolled in Extended Security Updates (ESU) and Windows 10 Enterprise LTSC 2021 machines. Besides security fixes it ships three changes that can affect a fleet: stricter signature checks for PowerShell scripts, NTLM message signing offered by default, and a fix for the remaining USB audio failures that began with September's update.

Key points

• KB5131096 was released on 10 November 2026 and brings Windows 10 22H2 to build 19045.7846 and 21H2 to build 19044.7846.
• Microsoft says commercial devices running Windows 10 22H2 need a Windows 10 ESU Year 2 license to receive it.
• The update makes PowerShell stricter about encoding when verifying script signatures, so scripts with invalid UTF-8 might fail validation even if they were accepted before.
• Clients now offer NTLM message signing by default for non-anonymous connections, to reduce exposure to NTLM relay attacks.
• It fixes Active Directory printer error 87 introduced by the October 2026 update, and the remaining USB Audio Class 1.0 symptoms (error Code 10, no audio) from the September 8, 2026 update.

What to do

1. Check whether you should get it. Windows 10 22H2 left general support in October 2025, so only devices with a Windows 10 ESU license and LTSC 2021 devices are offered this update. Microsoft's article says commercial devices on 22H2 need the ESU Year 2 license to keep receiving security updates.
2. Check prerequisites before deploying by hand. Microsoft says the Windows update released on or after July 8, 2025 (such as KB5062554) must already be installed, whether you use Windows Update, WSUS or the Microsoft Update Catalog. The servicing stack update must be version 19044.6088 or later; to see yours, run DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt.
3. Image builders: if you apply this update to an existing Windows image, include the boot.stl file in the installation media, or the media might fail to start with error 0xc0430001. Microsoft recommends its Update WinPE script, or copying boot.stl from the Windows\Boot\EFI folder of a device. Offline images without the July 25, 2023 (KB5028244) or later update also need the standalone SSU KB5031539 first.
4. Script owners: find signed PowerShell scripts, test them after the update, and for any that fail, save them as UTF-8 with a byte order mark (BOM) and sign them again, as Microsoft instructs.
5. Identity teams: read Microsoft's "NTLM signing security improvements in Windows" page before the update reaches servers and legacy clients, and use the auditing it provides to find connections that do not use signing.
6. Verify: run winver and confirm the build is 19045.7846 (22H2) or 19044.7846 (21H2).

What happened

Microsoft published KB5131096 as part of the November Patch Tuesday cycle, the same day it shipped cumulative updates for Windows 11. For Windows 10 it applies to version 22H2 on ESU-licensed devices and to version 21H2 on LTSC editions; the support article is titled "November 10, 2026 - KB5131096 (OS Builds 19045.7846 and 19044.7846)". The update is delivered automatically through Windows Update and Windows Update for Business, and is available through the Microsoft Update Catalog and WSUS. German Windows site Born's IT and Windows Blog, which lists the day's updates, also says it includes quality improvements to the servicing stack, the component that installs updates. For the Windows 11 side of the same day, see our KB5132061 and Patch Tuesday outlook.

Microsoft's summary of the changes is short. Beyond the security fixes, it lists:

• Date and time: an adjustment to daylight saving rules for Cuba for the extended 2026-2027 period. Cuba stays on UTC-04:00 and does not observe the November 2026 and March 2027 transitions; it returns to UTC-05:00 in November 2027 and resumes its regular schedule in 2028.
• Printing: a fix for adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device, which might fail with error 87, "The parameter is incorrect." Microsoft says the October 2026 update introduced the problem and that it does not generally affect existing printers.
• Remote Desktop: a fix so the "Specify thumbprints of certificates representing trusted .rdp publishers" policy can be configured through Microsoft Intune, and a fix for Remote Desktop shadow connections that might fail with an "Unspecified error" on Windows Server 2016 and Windows Server 2012 R2 after the October 14, 2026 update.
• Windows PowerShell: stricter encoding validation when verifying script signatures.
• Security: NTLM message signing offered by default for non-anonymous connections, with auditing.

Background

Windows 10 version 22H2 reached the end of regular support in October 2025. Since then, security updates come only through the paid ESU program, and Microsoft's November note states that commercial 22H2 devices need the Year 2 license. LTSC is a separate track: the Windows 10 Enterprise LTSC 2021 and IoT Enterprise LTSC 2021 editions that KB5131096 also serves have free support that ends on January 12, 2027, according to the same article, which points those customers to its end-of-support planning page.

The recent run of Windows 10 updates has been bumpy. Microsoft's update history for 22H2 lists a regular update on September 8, 2026 (KB5122878), an out-of-band fix on September 14 (KB5129236), the October 13 update (KB5126657), another out-of-band release on October 26 (KB5134125), and now KB5131096. The out-of-band releases are the kind Microsoft ships outside the monthly cycle when something breaks.

The USB audio problem dates to the September 8 update. After it, some USB Audio Class 1.0 devices might fail to start or produce audio. Symptoms Microsoft lists are "This device cannot start (Code 10)" in Device Manager, no audio output, volume controls that do not respond or stay at zero, and sound settings that are unresponsive or unavailable. Some devices still worked in standard stereo but failed in multichannel modes, including 8-channel or 3D audio, and some customers restored audio by switching to 2-channel mode. The issue is limited to USB Audio Class 1.0 devices. Microsoft says the 8-channel and 3D symptoms were addressed by the September 14 out-of-band update, and that the remaining symptoms are addressed in KB5131096.

How it works: the two security changes

PowerShell signatures. Code signing proves a script has not changed since it was signed. The signature covers the file's bytes as the signing tool read them, so how the text is encoded matters. Microsoft says the update introduces stricter encoding validation, and as a result scripts containing invalid UTF-8 encoding might fail signature validation even if they were previously accepted. The practical risk is on machines that enforce signed scripts, for example through an execution policy that requires them: a script that ran last week might be refused. Microsoft's fix is to review the affected scripts, save them with valid UTF-8 encoding with a BOM, and sign them again, and it points to a separate guide, "Encoding Guidance for Signed PowerShell Scripts".

NTLM signing. NTLM is the older challenge-response authentication protocol that Windows still falls back on. An NTLM relay attack forwards an authentication exchange to a different server; message signing makes that harder because the attacker cannot produce valid signatures for the relayed session. Microsoft says clients now offer NTLM message signing by default for non-anonymous connections, which "helps reduce exposure to NTLM relay attacks", and that the update provides auditing to identify connections that are not using signing. We could not find in the article what happens to a server that refuses signing; test your older file servers and appliances in a pilot ring first.

What it means

For ESU customers, KB5131096 is a routine monthly patch with two items that need an owner. The PowerShell change is the more likely one to cause help-desk tickets, because failures show up as scripts that stop running, not as an install error. The NTLM change is quieter and more valuable: it is a default that moves clients toward signing, with auditing so administrators can see who is left behind.

For LTSC shops the clock matters more than the patch, since free support for LTSC 2021 ends on 12 January 2027.

For printer and remote-access administrators, the update removes two regressions from recent months: error 87 when adding an Active Directory printer, and failed Remote Desktop shadow sessions on Windows Server 2016 and 2012 R2.

What we don't know yet

• Microsoft's article does not list CVE identifiers or counts for this update in the part we read, so we do not give them here; see the Security Update Guide for the vulnerabilities fixed.
• We have not seen a list of which kinds of scripts have invalid UTF-8 in practice, or how common this is.
• The NTLM change's effect on servers that refuse signing is not described in the article text we read.
• We could not open BleepingComputer, Neowin or Pureinfotech coverage of this update, and rely on Microsoft's article and Born's blog for the facts above.

What to watch next

Watch the Windows 10 release health page for new known issues over the next days, and for an out-of-band fix, as happened in September and October. Test signed PowerShell scripts in a pilot ring before the wider rollout. The next scheduled Patch Tuesday is in December.

Sources

• Microsoft Support, November 10, 2026 - KB5131096 (OS Builds 19045.7846 and 19044.7846) (primary)
• Borns IT- und Windows-Blog, Patchday: Windows 10/11 Updates (10. November 2026)
• audiotale.net, KB5132061 and Patch Tuesday outlook