# July 2026 Windows security update: deployment checks for managed environments > Microsoft’s July 2026 Windows update enforces Kerberos RC4 protections, while a July 18 out-of-band release resolves the limited Dell and Intel IPF compatibility hold. - Canonical URL: https://update.dsesecurity.com/updates/july-2026-windows-security-update-deployment-checks/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-07-16T14:00:00+00:00 - Modified: 2026-07-19T19:29:33+00:00 - Last reviewed by DSE: 2026-07-19 - Resource type: Briefing - DSE priority: Important - Topics: Cybersecurity, IT - Reading time: 3 minutes ## What you need to know Microsoft’s July 2026 Windows update enforces Kerberos RC4 protections, while a July 18 out-of-band release resolves the limited Dell and Intel IPF compatibility hold. ## Potentially affected Supported Windows client and server environments, especially Active Directory workloads with legacy RC4 dependencies and the limited Dell systems identified by Microsoft as using affected Intel IPF drivers. ## DSE recommendation Review current Microsoft release health, identify RC4 dependencies, confirm device-specific update applicability, pilot representative systems, verify recovery paths, and deploy through controlled waves. ## Article ## What Microsoft published Microsoft released the July 2026 security update for supported Windows versions on July 14. The [Windows message center](https://learn.microsoft.com/en-us/windows/release-health/windows-message-center) recommends prompt installation and links administrators to version-specific release notes and known-issue status. The release also begins the enforcement phase for Kerberos RC4 protections associated with CVE-2026-20833. Microsoft says domain controllers now enforce updated service-ticket behavior, with AES expected for supported configurations. Workloads that still depend on legacy RC4 behavior can experience authentication failures, so service accounts, older applications, appliances, and non-Windows Kerberos integrations need deliberate validation. ## The limited Dell and Intel hold has been resolved Microsoft initially withheld KB5101650 from a limited number of Dell devices using Intel Innovation Platform Framework drivers. On July 18, Microsoft published [out-of-band update KB5121767](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/07/kb5121767-out-of-band) to address the issue and allow the affected devices to move forward. Microsoft states that the out-of-band update is intended for devices affected by that specific issue. Eligible devices can receive it through Windows Update; administrators should confirm model, driver, and update applicability rather than deploying an out-of-band package indiscriminately. ## Why change control still matters Prompt patching and controlled deployment are complementary. The Kerberos change can expose dependencies that were not visible during ordinary operation, while device-specific safeguards and out-of-band releases can change the correct update path for a subset of the fleet. A representative pilot makes those conditions visible before they become a broad service disruption. ## DSE deployment checklist - Inventory supported Windows client and server versions, build numbers, device models, and servicing channels. - Review Microsoft release health and the release notes for every version in scope. - Use documented Microsoft guidance and relevant event data to identify accounts, applications, devices, or integrations that still rely on RC4-based Kerberos behavior. - Confirm which Dell and Intel IPF devices were affected and whether normal Windows Update now offers the applicable resolution. - Pilot representative domain controllers, servers, workstations, remote users, and line-of-business applications. - Verify monitoring, current backups, recovery access, and a tested rollback or recovery path before broad deployment. - Validate authentication, endpoint health, business applications, printing, remote access, and security tooling after installation. - Record deferred systems, the reason, compensating safeguards, an owner, and a review date. ## Keep the evidence with the change Record the Microsoft references reviewed, approval, pilot population, observed results, exception list, deployment waves, and post-change validation. That record makes it easier to distinguish a patch issue from an application, identity, driver, or network dependency and supports a safer follow-up if Microsoft changes the release status again. ## Official references - [Windows message center](https://learn.microsoft.com/en-us/windows/release-health/windows-message-center) — Microsoft’s July 14 update and Kerberos enforcement announcements. - [KB5121767 out-of-band update](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/07/kb5121767-out-of-band) — Microsoft’s July 18 resolution for the affected Windows 11 devices. - [Detect and remediate RC4 usage in Kerberos](https://learn.microsoft.com/en-us/windows-server/security/kerberos/detect-remediate-rc4-kerberos) — Microsoft’s discovery and remediation guidance. ## Primary reference - Name: Microsoft Windows message center - Authority: Microsoft Learn - URL: https://learn.microsoft.com/en-us/windows/release-health/windows-message-center - Source publication date: Not stated by the source ## Citation and use Preferred citation: “July 2026 Windows security update: deployment checks for managed environments,” DSE Security, https://update.dsesecurity.com/updates/july-2026-windows-security-update-deployment-checks/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.