Microsoft Patch Tuesday Update Fails If Citrix Recording Software Installed

Microsoft’s January 2025 Patch Tuesday update has encountered significant compatibility issues with certain Citrix software installations, causing widespread concern among enterprise users and IT administrators.

The problem primarily affects devices running Citrix Session Recording Agent (SRA) version 2411, a tool commonly used in corporate environments for monitoring and recording user sessions.

When these machines attempt to install the latest Windows security updates, they encounter a frustrating cycle of failed installations and system reversions.

According to Microsoft’s official statement, affected devices initially downloaded and applied the January 2025 Windows security update without issue. However, upon restarting to complete the installation process, users are greeted with an error message stating, “Something didn’t go as planned. No need to worry – undoing changes.” The system then reverts to its previous state, leaving it vulnerable to the security issues the update was meant to address.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

This issue does not impact home users, as Citrix SRA is typically deployed in enterprise environments. However, it affects a broad range of operating systems, including:

• Windows Server 2025 (KB5050009)
• Windows Server 2022 (KB5049983)
• Windows Server 2019 (KB5050008)
• Windows 11 versions 24H2, 23H2, and 22H2 (KB5050009, KB5050021)
• Windows 10 version 22H2 (KB5049981)

Citrix has acknowledged the issue and is actively investigating the root cause. In the meantime, they have published a workaround for affected users. The temporary fix involves stopping the Citrix Session Recording Monitor Service before applying the Microsoft update and then re-enabling it afterward.

Workaround 1: Using Services Console

1. Stop the Citrix Session Recording Monitor Service
   • Open the Services console by pressing Win + R, typing services.msc, and pressing Enter.
   • Locate “Citrix Session Recording Monitor Service.”
   • Right-click the service and select Stop.
2. Disable Service Startup Type
   • Right-click the service again and select Properties.
   • Set the Startup type to Disabled and click OK.
3. Apply Security Updates
   • Install the Microsoft security update via Windows Update or manual installation.
   • Restart the system when prompted.
4. Restart and Re-enable the Service
   • After rebooting, return to the Services console.
   • Right-click “Citrix Session Recording Monitor Service” and select Start.
   • Set its Startup type back to Automatic under Properties.

For IT administrators managing large fleets of devices, Citrix has provided PowerShell and Command Prompt scripts to automate this process. However, this manual intervention adds an extra layer of complexity to what should be a routine update procedure.

Workaround 2: Using PowerShell or Command Prompt

For administrators comfortable with command-line tools:

1. Stop and Disable the Service
   • PowerShell:powershellStop-Service -Name "CitrixSmAudMonitor" -Force Set-Service -Name "CitrixSmAudMonitor" -StartupType Disabled
   • Command Prompt:textsc stop CitrixSmAudMonitor sc config CitrixSmAudMonitor start= disabled
2. Install Updates and Reboot
   • Proceed with installing updates as usual and restart when prompted.
3. Re-enable and Start the Service
   • PowerShell:powershellSet-Service -Name "CitrixSmAudMonitor" -StartupType Automatic Start-Service -Name "CitrixSmAudMonitor"
   • Command Prompt:textsc config CitrixSmAudMonitor start= auto sc start CitrixSmAudMonitor

Microsoft estimates that only a limited number of organizations will be affected, as the problematic SRA version 2411 was released relatively recently, in late November 2024. Home users, who typically don’t use Citrix’s enterprise software, should be able to install the January updates without issue.

The incident highlights the ongoing challenges in maintaining compatibility between operating system updates and third-party software, especially in enterprise environments where security and functionality must be carefully balanced. It also underscores the importance of thorough testing before rolling out updates to production systems.

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates