iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To deploy a Known Issue Rollback (KIR) on Windows Server, obtain the Microsoft MSI for the exact regression and Server version, install its ADMX/ADML policy definitions, configure the matching issue policy as Disabled in a computer-scoped Group Policy Object (GPO), refresh policy, and restart each affected server. KIR reverses only the targeted change from a nonsecurity update; it does not uninstall the update or undo security fixes.
What KIR changes—and what it cannot change
Known Issue Rollback is a Windows servicing mechanism for a specific regression introduced by a nonsecurity update. Microsoft can ship an update containing several changes, then use KIR to turn off the faulty change while leaving the other changes installed. That makes KIR a narrower response than removing the entire cumulative update.
KIR is not a generic rollback switch. Each mitigation is tied to an identified issue, update, and supported operating-system build. Microsoft’s overview states, “KIR only affects non-security updates and fixes. Security updates and fixes don’t use KIR.” See Microsoft’s KIR overview for the current scope and lifecycle.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →- It can do: disable one problematic change after Microsoft publishes a matching KIR policy.
- It cannot do: remove the whole update, reverse a security fix, or provide a universal emergency switch for any symptom.
- It is temporary: Microsoft can deliver corrected code in a later update, after which the old mitigation becomes harmless and can be retired.
For nonenterprise devices, Microsoft controls activation through Windows Update. Administrators of domain-managed servers use an issue-specific policy-definition MSI and Group Policy instead.
#1 Best Overall
Before you deploy: identify the exact issue and target
Do not start by downloading a similarly named template. First establish which regression Microsoft has documented and exactly which servers are affected.
Confirm the regression and update
- Read the affected update’s Known issues section and release notes.
- Check the Windows Release Health entry for the symptom, affected builds, and any mitigation notice.
- Record the update or KB number, the first observed symptom, and the date the problem appeared.
- Map the symptom to the Server versions and editions in your fleet. Include physical and virtual machines if both are involved.
The KIR template and setting can vary by Windows version and edition. A policy that is correct for one Server release is not evidence that it applies to another. If Microsoft has not published a KIR for the regression, do not substitute a different MSI; request activation guidance from Microsoft Support.
Make a deployment inventory
- List computer accounts that should receive the mitigation and exclude unaffected servers.
- Note which organizational units (OUs) contain those accounts and whether inheritance or security filtering could block a computer policy.
- Determine whether the domain uses a Group Policy Central Store. A local installation of policy files is not enough when the management tools read definitions from SYSVOL.
- Choose an issue- and OS-specific GPO name, such as
KIR-KB1234567-Server-2022-FileService. The name should remain understandable after the incident is over.
Get the right Microsoft KIR MSI
Use the download link in Microsoft’s notice for the particular issue and operating system. The MSI is an administration package: it installs the policy-definition files that expose the KIR setting in Group Policy Management. It does not itself roll back servers.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKeep the MSI, its download date, the issue/KB reference, and the supported Server versions in your change record. If the notice lists separate packages for different releases or architectures, download only the package that matches the systems you will manage; do not assume one template covers every edition.
Microsoft’s deployment procedure is documented at How to use Group Policy to deploy a Known Issue Rollback.
Install the policy definitions
Install on the computer used to edit GPOs
- Sign in to the administrative workstation or server where Group Policy Management Console (GPMC) is installed.
- Run the issue-specific KIR MSI with an account permitted to install software and administer policy.
- Verify that the package placed the definitions under
C:WindowsPolicyDefinitions. You should find an issue-specific.admxfile and one or more language-specific.admlfiles in the matching language folder. - Open GPMC after installation, or close and reopen it if it was already running, so the new category can be loaded.
Use the Central Store when the domain has one
In a domain with a Central Store, copy the corresponding ADMX file and its language ADML file into the PolicyDefinitions folder in SYSVOL. Microsoft explains the store’s layout and replication in Create and manage a Central Store. Group Policy tools use that shared location, and the files replicate to domain controllers.
Copy only the definitions supplied for this KIR and preserve the folder structure. For example, an ADML file belongs in the language subfolder (such as en-US) beneath the Central Store’s PolicyDefinitions directory. Installing the MSI on an administrator’s PC does not automatically place files in SYSVOL.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
If the setting does not appear
- Confirm that the MSI is the one named in Microsoft’s issue notice, not a package for another KB or Server release.
- Check whether GPMC is reading a Central Store; if so, verify both ADMX and ADML files there and allow replication to complete.
- Reopen GPMC and check that the administrative templates language matches an installed ADML language.
- Compare the target OS build and edition with the template’s supported versions. A mismatched template may install successfully yet expose no usable setting.
Create and link the KIR GPO
- Open Group Policy Management (for example, run
gpmc.msc). - In the forest and domain tree, right-click the OU or domain that contains the affected computer accounts, select Create a GPO in this domain, and Link it here, and give it the issue- and OS-specific name you chose.
- If an existing GPO is used, confirm its scope and document the change. A separate temporary GPO is usually easier to audit and remove.
- Right-click the new GPO and select Edit. KIR settings are computer policies, so configure them under Computer Configuration, not User Configuration.
- Under Administrative Templates, open the issue-specific KIR category installed by the MSI. The displayed category and policy name are specific to the Microsoft notice.
- Open the matching policy, select Disabled, and apply the setting. Microsoft’s activation instructions use this state for the rollback. Do not disable an unrelated KIR policy or rely on an unconfigured policy.
- Close the editor, then verify the GPO link, security filtering, WMI filters (if any), and inheritance block settings. The computer account must be able to read and apply the GPO.
Leave the issue, KB, Server version, and policy state in the GPO description and change ticket. That context prevents an administrator from mistaking a temporary mitigation for a permanent baseline.
Refresh policy and restart every affected server
Under the default Group Policy configuration, Microsoft says a new policy normally reaches managed devices within 90 to 120 minutes. That is an expected refresh window, not a guarantee; replication delays, slow links, maintenance windows, and custom refresh intervals can change it.
Request an earlier refresh
On an affected server, open an elevated Command Prompt or PowerShell session and run:
Rank #3
gpupdate /forceWait for the command to report completion. If the computer is offline, connected to a different site, or unable to contact a domain controller, the request cannot apply the new setting until connectivity is restored.
Recommended Free Tools
Restart after the policy is applied
Restart each affected server after policy refresh. Microsoft’s deployment documentation is explicit: “You have to restart the affected computers in order to apply this Group Policy change.” Schedule the restart according to your service window; do not judge KIR from gpupdate output alone.
After reboot, reproduce or monitor the original symptom using the same workload and conditions that exposed it. KIR does not guarantee that an unrelated failure will disappear, and the mitigation may not cover a server that was never in the documented affected build.
Validate that the rollback reached the intended servers
- Use
gpresult /ror an HTML report such asgpresult /h C:Tempgp.htmlto confirm that the GPO is listed under applied computer policies. - Check the resulting policy state in the issue-specific KIR category and verify it is Disabled.
- Confirm the server reboot occurred after the policy was applied, not before it.
- Compare a server in scope with an intentionally excluded test server, where appropriate and safe, to make sure the GPO is not linked too broadly.
- Record the server name, OS edition/build, policy-application time, reboot time, and observed symptom status.
If the GPO is applied and the symptom remains, recheck the documented issue and KB before changing other settings. KIR targets one change; it does not mask every failure associated with an update.
Troubleshoot a KIR deployment that appears not to work
The KIR policy is missing in GPMC
The usual causes are a wrong or incomplete MSI, a Central Store that was not updated, an ADML language mismatch, or a template that does not support the target Server release. Verify the files in the location GPMC actually uses, then restart GPMC. If your domain uses a Central Store, inspect SYSVOL rather than only the local C:WindowsPolicyDefinitions folder.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
The GPO is not listed as applied
Check that the link points to the OU containing the computer account, not the user account. Review security filtering, delegation, inheritance blocks, WMI filters, and domain-controller replication. Run gpupdate /force while the server can reach a domain controller, then generate a gpresult report.
The policy is applied but the symptom continues
Confirm that the exact matching setting is Disabled, that the server was restarted afterward, and that the OS version/edition matches the Microsoft notice. If those checks pass, the symptom may have a different cause or may not be covered by that KIR. Microsoft advises contacting Support when the issue persists after the OS/template match, policy state, and restart have been verified; see the KIR troubleshooting guidance.
The rollback seems to stop after a later update
Follow the issue’s release-health notice. Microsoft may replace the affected code with a corrected update, making the old policy benign. Do not assume the policy is still needed—or remove it blindly—until the corrected update has reached the managed servers and the original regression is no longer observed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retire the mitigation safely
KIR is temporary by design. Monitor Microsoft’s release notes and Windows Release Health for the corrected update, then use a staged process:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Confirm the corrected update applies to every affected Server version and edition.
- Deploy that update through your normal servicing process and verify installation on representative servers.
- Observe the original workload long enough to establish that the regression is resolved.
- Remove the KIR GPO link or delete the temporary GPO according to your change-control procedure.
- If the definitions are no longer needed anywhere, remove obsolete ADMX/ADML files from the Central Store or administration workstation only after checking for other policies that use them.
- Keep the incident record, affected KB, rollout evidence, and retirement date for audit and future troubleshooting.
Microsoft notes that the old setting becomes benign once the original issue is fixed in a subsequent update. Retiring it still keeps the policy environment understandable and prevents an obsolete mitigation from confusing future incident response.
Group Policy versus Intune for KIR
Use the management channel that actually controls the devices. Group Policy and MDM policy are separate models; a GPO does not configure an Intune-managed device.
| Environment | Deployment method | Key requirement |
|---|---|---|
| Active Directory domain or hybrid servers receiving computer GPOs | Install the KIR MSI, place ADMX/ADML in the local PolicyDefinitions folder or Central Store, configure the issue policy, refresh, and restart. | The GPO must be linked and scoped to the affected computer accounts. |
| MDM-managed devices using Intune | Use Microsoft’s ADMX ingestion and custom-profile procedure rather than a GPO. | The computer used for the Intune procedure must have the cumulative update released July 26, 2022 or later, as specified by Microsoft. |
Microsoft’s Group Policy article includes the Intune alternative and its prerequisites. Do not attempt to solve an MDM deployment by linking a domain GPO that the device does not process.
Quick Recap
Operational checklist
- Issue, KB, affected build, Server edition, and symptom are recorded.
- The MSI came from Microsoft’s notice for that exact issue and OS.
- ADMX and matching ADML files are installed where GPMC reads them; Central Store files are replicated if applicable.
- The issue-specific computer policy is set to Disabled.
- The GPO link and security scope include only intended servers.
- Policy was refreshed (or the 90–120-minute default window was allowed) and each server was restarted.
- Applied-policy evidence and symptom validation are recorded.
- The corrected update is tracked and the temporary GPO and definitions have an owner and retirement plan.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
