Win32 OpenSSH broken after KB5074109 update
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- linux, powershell
- Domain
- networking, operating-systems
Research direction
Compare ssh_client_prior_update.log with ssh_client_post_update.log and sshd-session_prior_update.log with sshd-session_post_update.log, using the KB5074109 report and icacls.txt for context. Reproduce the failed authentication after the update and identify the regression; done means SSH again reaches the expected Windows shell without the token-generation errors.
Written by the indexing model from the issue text.
Description
Prerequisites
- Write a descriptive title.
- Make sure you are able to repro it on the latest version
- Search the existing issues.
Steps to reproduce
I am experiencing connectivity issues from CentOS 9 Stream client to Windows 11 PC after latest Windows Update has been installed.
I have manually installed OpenSSH on Windows 11 PC and confirmed all the scripts have been run, and that icacls is applied correctly.
I have been able to connect successfully for several months, and after latest Windows Update, this no longer works
ssh_client_post_update.log
2026-01 Security Update (KB5074109) (26200.7623).txt
icacls.txt
sshd-session_prior_update.log
sshd-session_post_update.log
ssh_client_prior_update.log
Expected behavior
[[email protected]@app-bld-cn9-prd .ssh]$ ssh build@ats-w11-d16
Microsoft Windows [Version 10.0.26100.7462]
(c) Microsoft Corporation. All rights reserved.
ats\build@ATS-W11-D16 C:\Users\build>
Actual behavior
[[email protected]@app-bld-cn9-prd .ssh]$ ssh build@ats-w11-d09
Microsoft Windows [Version 10.0.26100.7462]
(c) Microsoft Corporation. All rights reserved.
ats\build@ATS-W11-D09 C:\Users\build>
Error details
8820 2026-01-19 10:13:07.106 debug1: user: (null): attempt 0 failures 0 [preauth]
8820 2026-01-19 10:13:07.138 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ats\\build' Status: 0xC00000BB SubStatus 0.
8820 2026-01-19 10:13:07.283 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ats\\build' Status: 0xC00000BB SubStatus 0.
8820 2026-01-19 10:13:07.283 error: get_user_token - unable to generate token on 2nd attempt for user ats\\build
8820 2026-01-19 10:13:07.283 error: ga_init, unable to resolve user ats\\build
8820 2026-01-19 10:13:07.283 debug1: Can't Match group because user ats\\build not in any group at line 85
8820 2026-01-19 10:13:07.283 debug1: user: build: kex_server_update_ext_info: Sending SSH2_MSG_EXT_INFO [preauth]
8820 2026-01-19 10:13:07.283 debug1: user: build: userauth-request for user build service ssh-connection method publickey [preauth]
Environment data
PS C:\Windows\System32> $PSVersionTable
Name Value
---- -----
PSVersion 5.1.26100.7462
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.26100.7462
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
Version
PS C:\Windows\System32> ssh -V OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0
Visuals
No response
- Dominant language
- No language data
- Stars
- 8.3k
- Forks
- 820
- Avg merge
- 12m
- Merged PRs (30d)
- 1
Getting set up
- No Dockerfile or Docker Compose file
- No pull request template
- Read the contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from PowerShell/Win32-OpenSSH
-
Area-ssh-agent Issue-Upstream Parity
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
PowerShell/Win32-OpenSSH#2458 · 1 reaction ·
-
Area-Authentication Area-Logging/Diagnostics Area-sshd Investigate Issue-Bug
Difficulty 4/5 3-5 days Newbie friendliness 48/100
PowerShell/Win32-OpenSSH#2466 · 1 comment · 1 reaction ·
-
Area-sshd Area-Terminal Investigate Issue-Regression
Difficulty 4/5 3-5 days Newbie friendliness 48/100
PowerShell/Win32-OpenSSH#2465 · 1 comment · 1 reaction ·
-
Area-ssh-agent Issue-Enhancement
Difficulty 5/5 Over a week Newbie friendliness 25/100
PowerShell/Win32-OpenSSH#2462 · 1 comment · 1 reaction ·
-
Area-ssh-agent Investigate
Difficulty 5/5 Over a week Newbie friendliness 25/100
PowerShell/Win32-OpenSSH#2460 · 1 reaction ·
All issues in PowerShell/Win32-OpenSSH
Similar issues
-
bug Component component: net
Difficulty 1/5 Under an hour Newbie friendliness 90/100
RT-Thread/rt-thread#11852 · 1 comment ·
Maintainers usually reply within 1 day
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
btclib-org/btclib-node#1739 ·
Maintainers usually reply within 1 day
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100
grpc/grpc-go#9481 · 1 comment ·
Maintainers usually reply within 2 days
-
comp/gateway P2 platform/webhook sweeper:risk-message-delivery type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 65/100
NousResearch/hermes-agent#132896 ·
Maintainers usually reply within 1 day