Enterprise IT departments are grappling with a significant operational disruption following Microsoft's April security updates, which have rendered numerous third-party backup solutions non-functional. The issue stems from Microsoft's decision to block a kernel driver that many backup vendors rely on, creating an immediate conflict between security hardening and business continuity.
The root cause lies in Microsoft's addition of psmounterex.sys to its Vulnerable Driver Blocklist—a security measure designed to prevent exploitation of a high-severity buffer overflow vulnerability tracked as CVE-2023-43896. This vulnerability allows attackers to escalate privileges or execute arbitrary code, making its mitigation a critical security priority.
Widespread Impact Across Backup Ecosystem
The disruption affects a broad swath of enterprise backup solutions, including products from established vendors like Macrium Reflect, Acronis Cyber Protect Cloud, UrBackup Server, and NinjaOne Backup. These applications rely on Volume Shadow Copy Service (VSS) snapshots and the now-blocked driver to mount backup images as virtual drives—a core functionality for backup verification and restoration processes.
Organizations running Windows 11, Windows Server, and Windows 10 environments are experiencing varied symptoms of this disruption:
The Security vs. Operations Dilemma
Microsoft's response has been clear: the company does not recommend uninstalling or pausing the security update. Instead, affected organizations are advised to upgrade to newer versions of their backup applications that utilize updated drivers with proper security protections. This guidance, while technically sound from a security perspective, places the burden on organizations to coordinate with their backup vendors for updated solutions.
The timing of this issue highlights the ongoing challenge of balancing immediate security needs with operational stability in enterprise environments.
IT administrators can identify affected systems by examining Event Viewer logs for 'Event ID 3077' with Policy ID {D2BDA982-CCF6-4344-AC5B-0B44427B6816} in the Code Integrity Operational log. This event indicates that the psmounterex driver was blocked in enforcement mode.
Broader Pattern of Update-Related Issues
This backup software disruption represents just one facet of a broader pattern of complications following Microsoft's April update cycle. The company has also addressed separate issues affecting Windows Server 2025 devices, including unexpected BitLocker recovery prompts and installation failures that triggered restart loops on some systems.
These cascading issues underscore the complex interdependencies within modern IT infrastructure and the challenges of implementing security hardening measures without disrupting critical business operations.
What You Should Do
Organizations affected by these backup failures should take immediate action to assess and mitigate the impact:
- Inventory affected systems: Check Event Viewer logs across your environment for Event ID 3077 to identify systems where the driver has been blocked
- Contact backup vendors: Reach out to your backup solution providers to obtain updated software versions that use compliant drivers
- Test backup functionality: Verify that backup creation is still functioning and document any mount or restore operation failures
- Plan upgrade timeline: Develop a rollout schedule for updated backup software that balances security requirements with operational needs
- Document workarounds: Identify alternative restore methods that may be available while waiting for software updates
The situation serves as a reminder that security hardening initiatives, while necessary, require careful coordination with application vendors and thorough testing in enterprise environments. Organizations should expect vendor updates to address this compatibility issue in the coming weeks, but immediate planning and assessment remain critical for maintaining backup and recovery capabilities.
