Windows 11 KB5132061: Fix for the Install Failure Error

Microsoft's November 2026 Patch Tuesday cumulative update for Windows 11, KB5132061, is causing installation failures on some Windows 11 24H2 Enterprise and Education devices, throwing error codes 0x80070306, 0x800f0989, or 0x800f0993. Microsoft says an automatic repair began rolling out to affected devices on November 11, 2026, and should resolve the issue within 24 to 48 hours, after which the update should install normally. The update itself, released November 10, 2026, bumps builds to 26300.9974 (26H2), 26200.9974 (25H2), and 26100.9974 (Enterprise/Education 24H2), and turns on NTLM message signing by default for non-anonymous connections, alongside fixes for USB audio devices, Active Directory printer errors, and Remote Desktop certificate mismatches.

What is KB5132061, and which builds does it install?

KB5132061 is the cumulative update Microsoft shipped on November 10, 2026, as part of that month's Patch Tuesday cycle. According to Microsoft's official KB5132061 support page, the update applies across every currently serviced release of Windows 11, moving each to a new build number:

A companion servicing stack update, KB5132688, brings the servicing stack to build 26100.9971 and is bundled with the cumulative update to improve the reliability of the installation process itself — notable given the install failures some 24H2 devices are hitting with this very release. Microsoft also shipped updated AI components, version 1.2610.1063.0, covering Image Search, Content Extraction, Semantic Analysis, and the Settings Model; these only install on Copilot+ PCs and are skipped on other Windows client PCs and on Windows Server.

Windows 11 KB5132061 installation failure: what the error codes mean and how Microsoft is fixing it

The most urgent issue tied to this update isn't a feature — it's that the update won't install for everyone. Microsoft's support page for KB5132061 documents a known issue affecting some Windows 11, version 24H2 Enterprise and Education devices: the update repeatedly fails to install and returns one of three error codes:

• 0x80070306
• 0x800f0989
• 0x800f0993

Microsoft's stated fix is server-side, not something IT admins or home users need to script around: an automatic repair is rolling out through Windows Update to affected devices, with Microsoft saying the repair should reach connected devices within 24 to 48 hours of the window opening on November 11, 2026, at 10am PT. Once a device is repaired, the November security update is expected to install automatically on the next scheduled check, with no separate action required.

If you're hitting one of these codes right now, the practical options are:

• Wait it out. Since the repair is automatic and tied to Windows Update check-ins, simply leaving the device connected and periodically checking for updates (Settings > Windows Update > Check for updates) is the path Microsoft is designing for.
• Confirm your edition and version. The issue is specific to 24H2 Enterprise and Education; if you're on 25H2 or 26H2 and seeing an unrelated install error, this particular known issue and fix window doesn't apply to you.
• Check servicing stack prerequisites. KB5132061's page notes that 24H2/25H2 devices should already have servicing stack update 26100.4193 or later installed; you can confirm with DISM /Online /Get-Packages | findstr /i "ServicingStack" from an elevated command prompt.
• For managed fleets, contact Microsoft Support for Business if the repair window has passed and the error persists on specific devices, rather than attempting manual workarounds that could conflict with the automatic repair.

For broader context on how Microsoft rolls out and documents these monthly fixes, see our explainer on how Patch Tuesday works.

NTLM message signing now on by default for non-anonymous connections

On the security side, KB5132061 changes a long-standing default: Windows 11 clients now offer NTLM message signing by default for non-anonymous connections. Message signing cryptographically signs NTLM traffic, which closes off a class of NTLM relay attacks where an attacker intercepts and replays authentication traffic between a client and server. Microsoft's documentation for this change (KB5135557) also adds auditing for connections that aren't signed, giving administrators visibility into which legacy clients or services still rely on unsigned NTLM.

This matters because NTLM relay has been one of the more reliably exploited weaknesses in Windows networks for years — an attacker who can position themselves between a client and a server (or trick a client into authenticating to an attacker-controlled endpoint) can relay the captured NTLM handshake to authenticate elsewhere as that user, without ever cracking a password. Signing doesn't eliminate NTLM itself, but it makes relayed traffic detectable and, in many configurations, rejected outright. Organizations that depend on older line-of-business applications incompatible with signing should review the new auditing output before this default spreads further, since Microsoft has been incrementally hardening NTLM across recent Windows 11 releases and this is unlikely to be the last step. Where compatibility issues show up, the auditing data KB5135557 adds is the starting point for figuring out which specific service or device still needs an exception, rather than disabling signing globally.

Secure Boot certificate rollout gets more device-targeting data

KB5132061 also expands the device-targeting data Microsoft uses to determine which PCs are eligible for new Secure Boot certificates. This continues a rollout Microsoft has been managing through 2026: some of the original Secure Boot certificates installed on PCs began expiring in 2026, and Microsoft has been pushing newer certificates out via Windows Update. Devices that haven't yet received the newer certificates can still start up and receive standard updates normally — this update doesn't change that — but it feeds Microsoft more data about which devices still need the newer certificates pushed to them. IT administrators managing fleets or custom images should consult Microsoft's Secure Boot client playbook for certificates expiring in 2026, which also flags that anyone deploying this update into a custom Windows image needs to include boot.stl from the Windows\Boot\EFI folder — skipping it can trigger a separate error, 0xc0430001, unrelated to the installation-failure issue above.

Other fixes in KB5132061: USB audio, AD printers, RDP certificates, and AMD audio

Beyond the headline security and installation items, KB5132061 rolls up several targeted bug fixes that had been affecting specific hardware and workflows since earlier 2026 updates:

Microsoft's own Windows 11, version 24H2 known issues and notifications page independently confirms two of these: it lists the USB audio Code 10 problem and a related Remote Desktop issue (non-admin users hitting error 0xC000000D with Administrator protection enabled) as resolved specifically by KB5132061, both marked resolved on November 10, 2026. That page is also where Microsoft tracks the status of the installation-failure issue and any further updates to the repair timeline, making it worth bookmarking if you're managing more than a handful of 24H2 devices. For a look at the month's other Patch Tuesday update, our coverage of October's KB5127648 has the comparable rundown for the prior cumulative update.

PowerShell script signing: stricter UTF-8 validation could break old scripts

One change worth flagging for IT and DevOps teams: KB5132061 adds stricter encoding validation when Windows checks the digital signature on a signed PowerShell script. Scripts saved with invalid UTF-8 encoding may now fail signature validation even if they were previously accepted and ran without issue. Microsoft's guidance, documented under KB5135999, is to re-save affected scripts as UTF-8, ideally with a byte-order mark (BOM), and re-sign them. If your organization runs a lot of older, hand-signed automation scripts — the kind that get written once, signed, and left alone for years — this is the sort of change that can silently break a deployment pipeline weeks after the update ships, usually surfacing as a signature-validation failure on a script that "used to just work." It's worth auditing signed scripts in CI/CD pipelines and scheduled-task contexts proactively after installing KB5132061, rather than discovering the failure mid-deployment. Re-saving and re-signing is a one-time fix per script, but there's no bulk tool mentioned in Microsoft's guidance, so larger script libraries will need a scan-and-resign pass.

A small but real change: Cuba's time zone stays put

KB5132061 also updates Windows' time zone database for Cuba. Rather than following its usual daylight-saving pattern, Cuba will remain on UTC-04:00 and skip both the November 2026 and March 2027 daylight-saving transitions, according to Microsoft's change notes. Cuba is expected to return to UTC-05:00 in November 2027. It's a minor line in the changelog, but it's exactly the kind of fix that matters a lot to anyone scheduling meetings, cron jobs, or server maintenance windows involving Cuban time zones, and missing it could throw off automated systems that assume the old DST schedule.

How to install KB5132061 (and what to check if it won't apply)

For most Windows 11 24H2, 25H2, and 26H2 devices, KB5132061 arrives like any other Patch Tuesday release: go to Settings > Windows Update > Check for updates, download and install, and restart when prompted. Standalone MSU packages for x64 and Arm64 are also available for IT admins who deploy via WSUS, Configuration Manager, or manual installation, per Microsoft's support page. Before deploying at scale, confirm the device already has the prerequisite servicing stack update installed — 26100.9539 or later for 26H2, or 26100.4193 or later for 24H2/25H2 — since an outdated servicing stack is a common cause of update installation failures generally, separate from the specific 0x80070306/0x800f0989/0x800f0993 issue Microsoft is actively repairing this month.

If your device sits in the affected 24H2 Enterprise/Education population and is still failing after the 24-48 hour repair window has passed, Microsoft's recommended channel is Support for Business for managed environments, or the Get Help app for individual devices (reachable from Settings or via ms-contact-support://smc-to-emerald/knownissues on an affected PC).

What's next for Windows 11 servicing

Microsoft has already signaled that the December 2026 cycle will look a little different: there will be no non-security preview update in the second half of December, with normal preview servicing resuming in January 2027 — a predictable holiday-season pause rather than anything tied to this month's installation issues. Expect the automatic repair for the 0x80070306/0x800f0989/0x800f0993 installation failures to continue rolling out through mid-November, with Microsoft updating its release-health documentation if the timeline shifts. Admins managing 24H2 Enterprise and Education fleets should keep an eye on the Windows 11, version 24H2 known issues page for status changes, and anyone curious about the parallel security story — this month's update also lands alongside a large batch of CVE fixes — can find the vulnerability count in our coverage of November's Patch Tuesday CVE total.

Written byFelix Moreau

Felix Moreau writes Pandromeda's software coverage and how-to guides. He covers Windows, macOS and Linux updates, the apps people rely on, emulators and developer tools, and turns official documentation into clear, numbered steps that work on the current version.

More from Felix MoreauAll Software & Guides coverage