Introduction

In February 2025, Microsoft released security update KB5051987 for Windows Server 2025, aiming to enhance system security. However, this update inadvertently introduced a critical issue: Remote Desktop Protocol (RDP) sessions began freezing shortly after connection, rendering mouse and keyboard inputs unresponsive. This article delves into the origins of this problem, its technical implications, and provides guidance on resolving the issue.

Background on KB5051987 Update

The KB5051987 update, released on February 11, 2025, was part of Microsoft's routine security enhancements for Windows Server 2025. While it addressed several vulnerabilities, it also led to unintended disruptions in RDP functionality. Users reported that after establishing an RDP session, the interface would become unresponsive, necessitating disconnection and reconnection to regain control.

Technical Analysis of the RDP Freezing Issue

The freezing issue appears to stem from disruptions in input processing within RDP sessions post-update. Specifically, the update may interfere with the session's ability to handle keyboard and mouse inputs, leading to unresponsive sessions. This suggests potential misconfigurations in protocol handling or deeper interactions between updated security modules and remote session management components.

Microsoft's Response and Resolution

Microsoft acknowledged the issue and provided a resolution in the April 2025 cumulative update (KB5055523), released on April 8, 2025. The company stated:

"After installing the February 2025 Security update (KB5051987), released February 11, 2025, and later updates, on Windows Server 2025 devices, you might experience Remote Desktop sessions freezing shortly after connection. When this issue occurs, mouse and keyboard input become unresponsive within the session, requiring users to disconnect and reconnect. We recommend you install the latest update for your device as it contains important improvements and issue resolutions, including this one." (bleepingcomputer.com)

Mitigation Strategies Prior to the Official Fix

Before the release of the official fix, administrators employed several workarounds to mitigate the impact:

  1. Uninstalling KB5051987: Some administrators reported that removing the problematic update restored RDP functionality. However, this approach left systems without the security enhancements provided by the update.
  2. Disabling UDP for RDP: Configuring RDP to use only the TCP protocol proved effective in some cases. This was achieved by enabling the "Select RDP transport protocols" policy and setting it to "Use only TCP" in the Group Policy Editor. (learn.microsoft.com)
  3. Adjusting Network Detection Settings: Enabling the "Select network detection on the server" policy and setting the "Select Network Detect Level" to "Use both Connect Time Detect and Continuous Network Detect" helped stabilize RDP sessions for some users. (ajni.it)
  4. Disabling Remote Desktop Wallpaper: Some users found that disabling the display of desktop wallpapers during RDP sessions improved stability. This was configured by enabling the "Force removal of Remote Desktop wallpapers" policy in the Group Policy Editor.

Broader Implications and Best Practices

This incident underscores the delicate balance between implementing security updates and maintaining system stability. It highlights the importance of rigorous pre-deployment testing, especially for critical systems, and the need for robust rollback procedures to minimize downtime when issues arise. Transparent communication from vendors is also crucial to ensure that security updates do not compromise system functionality.

Conclusion

The RDP freezing issue following the KB5051987 update serves as a reminder of the complexities involved in patch management. Administrators are advised to stay informed through official advisories and community forums, implement interim solutions as needed, and apply the latest updates to ensure system stability and security.