Windows Patch Tuesday hits snag with Citrix software, workarounds published

Devices that have Citrix's Session Recording software installed are having problems completing this month's Microsoft Patch Tuesday update, which includes important fixes.

Microsoft noted the problem in the list of known issues with the update, which arrived on January 14. According to the Windows vendor, affected devices will download and apply the update, but, after restarting to complete the installation, will show an error along the lines of "Something didn't go as planned. No need to worry – undoing changes" and the devices then roll back.

There are some rather important fixes in the security update, not least to plug under-attack privilege escalation holes in Hyper-V, so for the update to revert due to a problem with Citrix's Session Recording Agent (SRA) is less than ideal.

The issue occurs with 2411 SRA, which Microsoft noted was a new version. The tech giant estimated that a limited number of organizations would be affected.

Citrix, which said it was investigating the issue, published a workaround on its support site. In a nutshell, it requires the user or admin to disable the Session Recording Monitor Service before installing the update. The service can then be restarted. The same procedure applies if a user needs to uninstall Microsoft's January 2025 security update.

• Microsoft fixes under-attack privilege-escalation holes in Hyper-V
• New Outlook marches onto Windows 10 for what little time it has left
• Microsoft preps for a year of enterprise-impacting M365 retirements
• Security pros baited with fake Windows LDAP exploit traps

Home users are unlikely to be affected by the issue, but enterprises running Citrix components could be. Session Recording records, catalogs, and archives sessions for retrieval and playback. It's either a handy tool for support or a way of monitoring user activity, raising potential privacy concerns, although Citrix noted: "Session Recording isn't designed for the evidence collection for legal proceedings."

The 2411 version was also not designed for Microsoft's updates, by the looks of things.

Microsoft is looking into the problem too, and while the workaround will be a headache for affected users, it is at least relatively straightforward. ®