Has anyone else seen Windows Server 2019 domain controllers fail to boot after installing the August or September 2026 cumulative updates? In our environment, every writable DC and RODC affected by KB5120238, KB5121645, KB5122876, or KB5126144 installs successfully through MECM, reaches about 30% during the reboot phase, and then crashes with CRITICAL_SERVICE_FAILED (bugcheck 0x5A). The fourth parameter is 0xC0000428, indicating that Windows cannot verify a file's digital signature. The crash occurs during driver initialization in nt!IopLoadDriver and related routines, followed by a boot loop. This affects five Windows Server 2019 Hyper-V domain controllers running AD DS, DNS, DHCP, and file services, while 14 non-domain-controller Server 2019 systems install the same updates normally. Sophos is installed on some systems, but removing it did not change the behavior. Secure Boot, Hyper-V settings, DCDIAG results, CBS logs, Code Integrity logs, and crash dumps have not identified a specific driver or package. The only reliable recovery so far is running dism /image:C: /cleanup-image /revertpendingactions from recovery, which rolls back the update. Is there a known driver, Secure Boot certificate change, or AD DS-related component involved, and are there any workarounds besides reverting the pending actions?
3 Answers
The 0xC0000428 status makes the Secure Boot certificate or image-signature changes worth investigating. The August servicing update reportedly included certificate-related changes, so I would compare the Secure Boot databases and Code Integrity events before and after installation. The stack only shows the point where Windows tries to load the system driver, not necessarily the offending driver itself.
I have not seen this exact BSOD, but I have been holding several Server 2019 domain controllers back after seeing unusual post-update behavior. One 2019 DC failed to start the main NTDS service and temporarily affected the domain, although it did not crash. There have also been reports of Server 2022 DCs needing multiple hard resets after the August patches, so I would stage these updates carefully and make sure another healthy DC is available before rebooting.
We have three Server 2019 domain controllers and two DHCP servers. We skipped the August updates, then installed the September cumulative and .NET updates, including KB5122876 and KB5126144, without any problems. That does not rule out the issue, but it suggests the failure may depend on a particular installation sequence, system state, driver, or certificate configuration rather than affecting every Server 2019 DC universally.
That comparison is useful. I would document whether the September packages were installed cleanly or after the August packages had previously been attempted, since the servicing chain could be important here.
That was my first thought too. I would check whether the same certificate refresh or boot component is present on both the affected DCs and the unaffected member servers, then compare the Code Integrity event details from each system.