MCS image preparation fails to rearm Windows after the November 2026 Windows Server updates

book

Article ID: CTX697347

calendar_today

Updated On:

Description

Environment:

  • Citrix DaaS and Citrix Virtual Apps and Desktops (on-premises), using MCS with image preparation (Windows rearm) enabled.
  • Master images running Windows Server with the November 10, 2026 security update installed:
  • Windows Server 2019: KB5131085 (OS Build 17763.9487)
  • Windows Server 2022: KB5131090 (OS Build 20348.5870)
  • Windows Server 2025: KB5131080 (OS Build 26100.33822)
  • The issue is in Windows. It does not depend on the VDA version, the hypervisor, or cloud platform.

Cause

The November 10, 2026 Windows security updates include a change Microsoft made to address CVE-2026-96300. After this update, the Windows Software Licensing WMI provider rejects the query that MCS image preparation makes for the client machine ID before it rearms Windows. The query fails with 0x80041008 (Invalid parameter), so the rearm step cannot run.

Microsoft lists this as a known issue in the November 2026 update release notes. It is not caused by Citrix, and no change in MCS will make the rearm succeed while the issue is present.

Resolution

Solution:

Microsoft expects to release a fix by the end of the day on November 13, 2026. When it is available:

  1. Install the fix on the master image.
  2. Shut down the master image and take a new snapshot.
  3. Update the machine catalog with the new snapshot so that image preparation runs again.
  4. Confirm that the catalog update completes without the rearm warning.

Until the fix is available, choose one of the following:

  • Contact Microsoft Support for business for the workaround that Microsoft provides for this issue.
  • Keep using the master image snapshot taken before the November 2026 update, and postpone catalog updates that use the new image until the fix is installed.

Note: Machines created from an image that was not rearmed share the same KMS client machine ID. A KMS host counts them as a single machine, so they may not reach the KMS activation threshold. Machines that are already activated stay activated.

Issue/Introduction

Symptoms or Error:

After you install the November 10, 2026 Windows security update on a master image, creating or updating a Machine Creation Services (MCS) catalog reports that the Windows rearm failed during image preparation.

Studio shows:

During image preparation, the rearming process for the copy of Windows installed on the master image failed.

In Citrix DaaS, the catalog operation finishes with the warning "Operating System Licensing Rearm failed" (ImagePreparationOSRearmFailed). The master image is not rearmed.

The image preparation log on the preparation VM (C:\Program Files\Citrix\PvsVm\Service\PersistedData\PreparationStatus.xml) shows this under the OsRearm step:

System.Management.ManagementException: Invalid parameter
   at System.Management.ManagementBaseObject.GetPropertyValue(String propertyName)
   at Citrix.MachineCreation.ImagePreparation.SoftwareLicensingService.get_ClientMachineID()
   at Citrix.MachineCreation.ImagePreparation.ImagePreparation.RearmWindows(PreparationResults results)

Running slmgr.vbs commands on the same machine (for example /ipk or /skms-domain) can fail with error 0x80041008, Invalid parameter (SWbemObjectEx).

Additional Information

Powered by Wolken Software