- Engineer — Act: Hold or roll back the September 2026 cumulative updates on Windows Server 2019/2022/2025 until Microsoft issues a fix; test any staged deployments in non-production before wider rollout to avoid RDS outages requiring hard resets.
- SOC/IR — Learn: RDS connectivity failures and unexpected hard-reset events seen in monitoring this week are likely patch-induced, not attack activity; useful triage context to avoid chasing false positives in endpoint or session logs.
- Leader — Plan: The September patch cycle has a confirmed defect disrupting RDS across three current Windows Server versions; confirm with engineering whether deployment is paused and whether any business-critical RDP-dependent workflows are at risk while the fix is pending.