As reported by BleepingComputer, Microsoft has confirmed that its September 2026 security updates have broken the Windows File History backup feature across a broad range of supported operating system versions. This is not an isolated incident — it is the latest in a string of quality failures from this patch cycle that previously required out-of-band fixes for Remote Desktop Services, Hyper-V, and USB audio issues.
Why This Matters More Than It Sounds
A broken backup feature is not merely an IT nuisance. File History is the primary built-in mechanism many small-to-midsize organizations rely on for endpoint-level file recovery. When it silently fails — no error dialog, just stale 'Last Backup' timestamps and missing previous versions — the first indication of a problem is often the moment a user needs to restore a deleted or corrupted file and finds nothing available. That is a data loss event masquerading as a software bug.
The risk compounds because the failure is quiet. Affected systems display misleading 'Reconnect your drive' messages even when drives are properly connected, and Event Viewer shows FileHistory.exe crashes referencing KERNELBASE.dll. Without active monitoring, administrators will not know backups have stopped.
Affected Environment
| OS Version | Originating KB |
|---|---|
| Windows 11 26H1 | KB5124012 |
| Windows 11 25H2 / 24H2 | KB5124008 |
| Windows 11 23H2 | KB5122880 |
| Windows 10 22H2 / 21H2 | KB5122878 |
| Windows 10 Enterprise LTSC 2019 | KB5122876 |
| Windows 10 Enterprise LTSC 2016 | KB5123099 |
No patch or official workaround for the File History issue has been released at time of writing. Microsoft is investigating.
The Defender's Dilemma
This creates a genuinely difficult risk management decision. The September updates address security vulnerabilities — rolling them back means carrying known exploitable flaws. But deploying them means accepting that endpoint file backups may silently stop functioning across your fleet. For environments that depend on File History as a compensating control against ransomware impact or accidental deletion, the security patch itself introduces a data protection gap.
LTSC environments are particularly exposed. These SKUs are deployed in regulated, industrial, and specialized contexts where change windows are narrow and backup validation is critical. LTSC 2016 reaching this level of impact suggests the regression spans deep into the Windows servicing stack.
Immediate Actions
HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\FileHistory for recent crash events.Shield53 Recommendations
- Treat this as a tier-2 operational risk: broken backups mean elevated ransomware impact severity if an incident occurs during the gap.
- Prioritize monitoring over rollback. Pulling the September updates reintroduces security vulnerabilities that may be under active exploitation — a worse outcome than stale backups.
- For LTSC environments, engage Microsoft Premier Support to escalate the File History regression. LTSC customers have contractual SLAs that should be leveraged.
- Document this incident for your patch management risk register. The September 2026 cycle has now produced six confirmed regressions across RDS, Hyper-V, USB audio, domain logons, and File History — a pattern worth flagging to leadership as a vendor quality concern.
