This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(182.40000000000003, 99%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERH%3C/text%3E%3C/svg%3E)
Server 2019 std desktop, using hyper v.
It seems (for me anyway) that the KB5014692 monthly update causes a network stack failure. After an install / reboot, it runs and serves OK for 5 mins, and then the network response quits. Uninstalled and reinstalled the update twice to confirm this.
From a console via iDrac, Watching wireshark, the server (host OS) receives the initial SYN, issues an ACK, the client sends back the next ACK and the next packet.... (sofar all normal)... but the server goes deaf at this point and issues nothing more. Then sometime later both ends re-transmit, but nobody is listening at the server end.
Affects all traffic, all ports but only after 5 mins of normal running. Feels like some buffer or counter not correctly coded.
Anyone else?
Update June 28th, 2022.
Microsoft now acknowledges this (RRAS / NAT) issue in known issues :
... and repaired it with "out of band" fix in KB5014669 :
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(22.400000000000002, 31%, 12%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESM%3C/text%3E%3C/svg%3E)
Similar issues on 2019 v1809 servers. These are edge servers running RRAS service that provides SSTP VPNs. When the patch is applied, the server accepts initial SSTP client request and forwards it to the NPS server. End users are prompted for MFA but the connection never completes.
RRAS Server Event Log: Event ID 36: The description for Event ID 36 from source NPS cannot be found.
NPS Server Event Log: Event ID 20271, Remote-Access: The user xxx connected from xxx but failed an authentication attempt due to the following reason: The connection was prevented because of a policy configured on your RAS/VPN server. Specifically, the authentication method used by the server to verify your username and password may not match the authentication method configured in your connection profile.
Client Event Log: The user xxx dialed a connection named xxx which has failed. The error code returned on failure is -2147014836.
Additionally, after this update is applied to the RRAS server, its RDP service no longer accepts inbound connections. Its desktop is only accessible from the console.
This problem occurs immediately after KB5014692 is installed. Problem goes away after rolling back. Problem occurred a second time after this patch was reinstalled. Rolling back fixed the issue, again. We experienced this problem from two different RRAS servers from two different locations -single domain.
Adding to my initial post... attached is the Wireshark trace showing how the fault occurs. This was taken at the server via the iDrac console.
I show one connection, but its the same on all attempts from anywhere. The server goes deaf and ignores the connection it initially allowed. (there is no anti-anything crap ware of any kind on this server).
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(275.2, 23%, 36%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
i have similar issues on two 2019 v1809 servers with RRAS (l2tp) and one of server with windows server 2012 r2 with update (KB5014738) - but windows 2012 r2 worked over 1 hour and then the network response quits too.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(160, 16%, 25%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ESK%3C/text%3E%3C/svg%3E)
Are you multi-homed?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(115.19999999999999, 75%, 21%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EW%3C/text%3E%3C/svg%3E)
Having same/similar issues. Two 2019 RRAS servers with NAT enabled break when this KB is installed. Netlogon no longer works as server can't communicate with network at all. Can login with local admin only.
Well if we users knew where to make official reports to MS about a defective monthly update... there would be two valid reports. So your answer is not acceptable.
We do we report problems that actually get anywhere?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(230.39999999999998, 7.000000000000001%, 32%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EFS%3C/text%3E%3C/svg%3E)
Similar problems after june update. Server 2019 fully patched.
HyperV exchange 2019 also fails. RDP fails: so I need to work on the server hardware it self. Clients can’t logon.
Good... I mean we are building some evidence here. Obviously its limited to a subset of servers... I wonder if its related to the installed roles? On mine I have the following installed:
DNS, File & Storage, Hyper-V, Remote access, IIS.
After 5 mins, all those things quit working, including RDP. But I think I was still able to use RRAS via L2TP/IPsec, but unable to tunnel anything TCP.
How do we report this properly to MS, where they actually listen?
Added:
There is a known issue that affects Win10 1809 using the same update, with similar problems as ours here. "After installing KB5014692, Windows devices might be unable use the Wi-Fi hotspot feature. When attempting to use the hotspot feature, the host device might lose the connection to the internet after a client device connects."
Do you use Certificate-Auth. for Dial-In ?
...and do you use NAT ?
In our test-environment we do not use Certificates for Dial-In and no NAT. No issues so far...
Certificates no. NAT yes. But the issue is bigger than just RRAS. It's all services and all ports on the host OS. ...after 5 min of use.
Maybe I can try with RRAS disabled, but its such a enormous job to undo this mess via fiddly remote consoles.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(211.20000000000002, 6%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EPE%3C/text%3E%3C/svg%3E)
having the same issues so i did a couple of things from ideas from reading here:
next best guesses???
i backed out kb5014692 and everything looks to be working as before. will wait until there is better guidance.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(208, 16%, 30%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EMV%3C/text%3E%3C/svg%3E)
Same issue here on 2 servers with NAT enabled
3th server without NAT is unaffected
Symptoms. The internal (not natted) network behaves weird.
Pinging works
DNS resolve works
http, rdp or ssh times out..
no issues on the Natted internet connection.
Stop the RRAS service and everyting works fine again
Start the RRAS service and everyting works fine until the second VPN connection comes in... and all goes south again.
Kill all VPN connections / keep them down.. and after a while it works again..
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 95%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ET%3C/text%3E%3C/svg%3E)
@37800101
Did you try rolling back 'C:\Windows\System32\drivers\ipnat.sys' from version *.22000.739 to previous version - *.22000.653 ?
(previous version can be found in C:\Windows\WinSxS*
example: 'C:\Windows\WinSxS\amd64_microsoft-windows-ipnat_31bf3856ad364e35_10.0.22000.653_none_565fe30f009eed8b\ipnat.sys')
Has anyone tried this method to solve the problem?
I did a rollback of the patch causing the problem
Windows Server 2012 R2: wusa /uninstall /kb:KB5014746
Windows Server 2019: wusa /uninstall /kb:KB5014692
Windows Server 20H2: wusa /uninstall /kb:KB5014699
Windows Server 2022: wusa /uninstall /kb:KB5014678
manually replacing files is not something I would do unless there is no other option left (sorry not that brave ;) )
A new "out of band" update is available now. For server 2019 its KB5014669
It looks to have repaired the issue. While our fault with RRAS NAT is not listed in the repaired issues, the new KB says it fixed the Win10 ICS error that was also present. Given that ICS is all about NAT, I'm sure its the same cause and solution.
I see they replaced ipnat.sys with a newer version than last weeks one. Now using v10.0.17763.3113 of this driver.
https://www.catalog.update.microsoft.com/Search.aspx?q=KB5014669
This update, KB5014669, installs and does not create any adverse issues with our RRAS, NAT, VPN server.
KB5014669 fixed my issue as well