Windows 10 KB5131096: Microsoft’s November 2026 Security Update Explained

Microsoft has released the Extended Security Update for November 2026 for Windows 10: KB5131096. This is the first update of the second year of the ESU program. Here’s what you need to know before installing it.

Released on Tuesday, November 10, 2026, this update includes the November Patch Tuesday security fixes. This month, Microsoft addressed more than 1,200 vulnerabilities across all products combined, including Edge. After installation, Windows 10 22H2 machines move to build 19045.7846, and Windows 10 Enterprise LTSC 2021 systems move to build 19044.7846. Because it is cumulative, it also includes the content of the October update and KB5134125 from October 26, which was released outside the monthly schedule. I previously published an article about these out-of-band updates that remove eMudhra authority certificates from Windows' trusted list.

November also marks the start of the second year of the ESU (Extended Security Updates) program, since the first year ended on October 13, 2026. Microsoft reminds users at the top of its support page that business devices running Windows 10 22H2 need a second-year ESU license to continue receiving security updates. For businesses, the price of this second ESU year is $122 per device. Consumers whose PCs are already enrolled do not need to do anything, since Microsoft has quietly extended the consumer ESU program through October 2027.

Printers, Remote Desktop, USB audio: what KB5131096 fixes

As expected, Microsoft is not delivering any functional new features in Windows 10. However, KB5131096 brings several fixes, including some for bugs introduced by the October updates:

• Printing: adding a printer published in Active Directory from Windows Settings could fail with error 87. This bug, introduced by the October 2026 update, usually did not affect printers that were already installed.
• Remote Desktop and Intune: the policy that lists approved .rdp file publishers by certificate thumbprint could not be configured through Microsoft Intune. If this applies to you, my tutorial on signing .rdp files with rdpsign explains how to obtain a certificate and sign your connection files.
• Shadowing (Remote Desktop): shadow connections, which allow an administrator to observe a user session or take control of it, could fail with the message Unspecified error in Windows Server 2016 and Windows Server 2012 R2 environments since the October updates.
• USB Audio: this is the end of the saga for USB Audio Class 1.0 devices (Code 10 error in Device Manager, no sound, non-working volume controls). This update fixes the remaining issues! Part of the problem had already been corrected last September.

At this stage, Microsoft does not report any new known issues with this update.

PowerShell: signed script verification is now stricter

Let’s now look at a notable change if you sign your PowerShell scripts. With this update, Windows enforces script encoding more strictly, meaning the way characters are stored in the file, when signing and verifying the signature. Until now, a file containing invalid UTF-8 bytes was still decoded. From now on, it is rejected. This could have a real impact: a script that was signed and valid yesterday may fail verification today, even though nobody touched it.

According to KB5135999, this tightening is not limited to Windows 10: it also affects Windows 11 and Windows Server, from version 2016 through version 2025. Microsoft clarifies the behavior of PowerShell commands and App Control for Business:

• Get-AuthenticodeSignature: this command, which checks a file signature, returns the NotSigned status for a script that is in fact signed.
• Set-AuthenticodeSignature: this command, which applies the signature, fails with the UnknownError status.
• App Control for Business: with this application control feature (formerly WDAC), affected scripts may run in ConstrainedLanguage mode, a restricted PowerShell mode. The script is not necessarily blocked, but it may fail during execution.

If your PowerShell execution policy is set to AllSigned, which requires signed scripts, a script considered unsigned because of this change will no longer run. I think the files you should check first are those containing accented characters, especially if they have been edited in multiple editors.

Microsoft provides a script named Repair-SignedPowerShellUtf8.ps1 in the same KB, whose Scan mode (default) identifies problematic files without changing anything. To fix them, Microsoft recommends creating a UTF-8 with BOM copy (a marker at the beginning of the file that indicates its encoding) using the ConvertToUtf8Bom mode, then signing the script again.

The list of Windows 10 ESU updates

Below is the list of Windows 10 ESU updates published to date.

To go further:

• Patch Tuesday - November 2026
• Windows 11 - November 2026 Update

Florian Burnel Co-founder of IT-Connect

Systems and network engineer, co-founder of IT-Connect and Microsoft MVP "Cloud and Datacenter Management". I'd like to share my experience and discoveries through my articles. I'm a generalist with a particular interest in Microsoft solutions and scripting. Enjoy your reading.

See Full Bio