May 2026 Windows Update — Known Problems and Fixes

May's Windows update has been out for two days. For most people it installed quietly in the background and that was that. A subset of Windows 11 PCs are having a harder time — the update downloads, starts installing, and then reverses itself on restart. Here's what's happening.

Update failing to install — rolls back with an error

The May 2026 cumulative update for Windows 11 is KB5089549, released on 12 May. On some machines running Windows 11 version 24H2 or 25H2, it fails during the installation step and rolls back. You'll see: "Something didn't go as planned — undoing changes. Please keep your computer on."

After that, Windows restarts and everything goes back to how it was before. The PC works fine. The update just didn't take.

Most rollbacks are clean. The problem cases are mainly HP laptops and other devices where the EFI partition — a small hidden partition Windows uses during boot — has almost no space left. Windows needs to write new boot files as part of installing the update, and if that partition is full, it can't. On a handful of HP devices, this has left the PC unbootable rather than rolling back cleanly.

When the post first went up Microsoft hadn't said a word about it. That's changed — see the update below.

What to do

If your PC rolled back and is working normally:

1. Don't panic. The rollback is doing what it's supposed to — protecting you from a bad install.
2. Leave Windows to try again on its own. It will retry the update automatically. Don't go to the Microsoft Update Catalog and manually download KB5089549 — you'd hit the same problem.
3. Check back in Settings > Windows Update in a few days. Either Microsoft will push a corrected version, or the automatic retry will eventually succeed.

If your PC is stuck — not starting up properly after the failed update:

1. Hold the power button until the PC turns off completely. Wait 10 seconds.
2. Turn it back on. If it starts normally, you're fine — see the steps above.
3. If it doesn't start: when the PC is turning on, hold Shift and click Restart from the login screen if you can get to it, or turn the PC off and on three times in a row — Windows will automatically enter recovery mode after repeated failed boots.
4. From the blue recovery screen, go to Troubleshoot > Advanced options > Startup Repair and let it run.
5. If that doesn't sort it, go back to Advanced options > Uninstall Updates > Uninstall latest quality update to remove the partially-installed update.

If your PC won't start at all and recovery mode won't load, a computer repair is the quickest route — trying to rebuild a broken boot environment without the right tools is slow going.

Update (16 May 2026): Microsoft has now confirmed what's causing this and published two official workarounds. The error is 0x800f0922, the install dies at around 35-36%, and the cause is the EFI System Partition having less than 10 MB free. There are two ways to get it through.

Option 1 — Registry edit (works straight away)

This tells Windows not to expect any spare room in that hidden partition. It's a one-liner you paste into Command Prompt.

1. Click Start, type cmd, then right-click Command Prompt in the results and choose Run as administrator. Click Yes on the prompt that pops up.
2. In the black window that opens, type or paste this exactly and press Enter: reg add "HKLM\SYSTEM\CurrentControlSet\Control\Bfsvc" /v EspPaddingPercent /t REG_DWORD /d 0 /f
3. You should see The operation completed successfully. Close the window.
4. Restart the PC.
5. Once it's back up, go to Settings > Windows Update and click Check for updates. The install should now go through.

Option 2 — Let Microsoft fix it for you (slower, no typing)

Microsoft is rolling out a Known Issue Rollback, which is their way of remotely switching off the broken bit. On a home PC it arrives on its own over the next few days — a restart helps it pick up. Once it's landed, Windows Update will work normally without you doing anything else. If your PC is on a work or school network, your IT person needs to apply a specific Group Policy fix; show them this post.

Update (29 May 2026): Microsoft updated their guidance and confirmed that KB5089573 — the May 26 optional preview update — is the official fix for this. The easiest route now is to go to Settings > Windows Update > Advanced options > Optional updates and install it from there. KB5089573 becomes mandatory anyway with June Patch Tuesday on 9 June, so anyone waiting will get it automatically then. The registry edit (Option 1) is still a valid alternative if you specifically want the May security update right now without installing KB5089573.

Slow internet after the update installs

The other one cropping up this week: the update installs fine, the PC reboots, and suddenly the internet feels broken. Websites take ages to load or never finish. Teams and Outlook stop connecting. Video calls drop. Everything else in the house works fine on the same Wi-Fi — phones, tablets, the smart TV — it's only the updated PC that's gone slow.

That last part is the giveaway. Network traces from affected users show latency up to three times higher than before the update, and the slowdown is coming from inside Windows itself — KB5089549 modifies several of the core networking files (ndis.sys, tcpip.sys, netio.sys), and on some setups those changes don't play nicely.

Who this affects: Windows 11 version 25H2 PCs where the update installed successfully. So the opposite crowd from the rollback issue above. Reports are scattered rather than universal — plenty of 25H2 users haven't seen any change in speed at all. If your internet is fine on this PC, you're fine.

Microsoft hasn't acknowledged this one yet, so there's no official fix. A few community workarounds are doing the rounds. They help some people and not others — worth a try in order, restarting between each.

Things to try

1. Reset the network stack. Open Command Prompt as administrator (Start, type cmd, right-click, Run as administrator). Type netsh int ip reset and press Enter. Then type netsh winsock reset and press Enter. Restart the PC and try the internet again.
2. Turn off TCP Fast Open. If step 1 didn't help, open Command Prompt as administrator again and run netsh int tcp set global tfo=disabled. Restart.
3. Update your network adapter driver from the maker's site. Go to your PC or laptop maker's support page (Dell, HP, Lenovo, ASUS, etc.), find your model, and download the latest network or Wi-Fi driver from there. Don't rely on Windows Update for this — its drivers are often older. Install it and restart.
4. Last resort: uninstall the update. Go to Settings > Windows Update > Update history > Uninstall updates, find KB5089549 in the list and remove it. The PC will restart and you'll be back on the previous version. You'll lose this month's security patches until Microsoft sorts it out, so this is a temporary measure rather than a permanent answer. Note: some users have reported the slowdown continues even after uninstalling KB5089549 — if that's the case for you, try the network stack reset steps above before removing the update.

If none of that helps and the slowdown is making the PC unusable, drop me a message — I can take a look in person.

Windows Update quietly rolling back graphics drivers

Microsoft confirmed this week that Windows Update has been replacing manually-installed graphics drivers with older ones. If you downloaded a driver directly from Nvidia, AMD, or Intel rather than letting Windows handle it, the update may have quietly rolled it back to a version from 2024 or earlier.

The issue is with how Windows Update ranks drivers. It can treat an older OEM-certified driver as the best match for your hardware and install it over the newer one you chose. Microsoft acknowledged this on 13 May, the day after Patch Tuesday, and is working on a proper fix. That fix won't arrive until late 2026 at the earliest.

Who this affects: anyone on Windows 11 who has manually installed a graphics driver from Nvidia, AMD, or Intel's website. If Windows has always handled your drivers automatically, you're almost certainly fine. The people who notice are gamers and video editors who keep their GPU drivers current.

The symptom is subtle. A game might feel slightly worse. Video editing software might not be quite as smooth. The PC won't break — the older driver still works, it's just not the one you chose.

How to check and fix it

1. Right-click the Start button and open Device Manager.
2. Expand Display adapters. Right-click your graphics card and choose Properties.
3. Click the Driver tab and check the driver date. If it's from 2024 or earlier and you had something newer, it's been rolled back.
4. Go to your GPU maker's site and download the latest driver — search for "Nvidia driver download", "AMD driver download", or "Intel graphics driver" to find the right page for your card.
5. Run the installer. If it offers a Clean Install option, pick that.
6. Restart the PC when prompted.

Windows 10 USB printer errors (businesses on ESU only)

This one is narrow. It only affects Windows 10 machines enrolled in the Extended Security Update programme — that's organisations paying Microsoft for continued patches after Windows 10 support ended in October 2025. If you're a home user on Windows 10, you're not getting KB5087544 at all, so this doesn't apply.

For those who are on ESU: some multifunction printers from Brother, Canon, and Ricoh are throwing error 0x0000011b when connected via USB after the update. The printer appears in Windows but jobs fail. Microsoft has acknowledged the issue and says a fix is due in the June optional update.

Workaround: switch to a network connection

USB printing is broken for affected devices. Printing over Wi-Fi or ethernet isn't.

1. On the printer's front panel, find Settings or Network. Look for Wireless Setup Wizard or Wi-Fi Setup and follow the steps to connect the printer to your Wi-Fi network.
2. Once the printer is on the network, on your PC go to Settings > Bluetooth & devices > Printers & scanners.
3. Click Add device. Windows should find the printer on the network within a minute.
4. Click Add device next to it and wait for the driver to install.
5. Send a test print. Once that's working, you can unplug the USB cable.

If the printer has no Wi-Fi, run an ethernet cable from it to your router and follow the same steps from point 2. If neither's practical, the other option is to wait for the June fix — or uninstall KB5087544 and delay the update until then.

Windows 10: asked for your BitLocker recovery key after installing the update

This one is narrow. It only affects Windows 10 machines on the Extended Security Update programme (the paid subscription that kept patches coming after Windows 10 support ended), and only those where a specific BitLocker Group Policy setting is in place. If you're a home user on Windows 10, you won't have KB5087544 at all. If you're on Windows 11, this doesn't apply to you.

For those it does hit: after installing and restarting, some machines show the BitLocker recovery screen — the blue screen asking you to type a 48-character recovery key before Windows loads. Microsoft has confirmed this. The key thing is it only happens on the first restart. Once you're in, subsequent reboots are normal.

What to do if you see the recovery screen

1. Don't turn the PC off and on hoping it'll skip the screen — it won't first time. You need to enter the key.
2. On your phone or another device, go to account.microsoft.com/devices/recoverykey and sign in with the Microsoft account tied to this PC. Your key will be listed there.
3. Type the 48-digit key into the recovery screen. Windows continues loading normally.
4. That's it. It won't ask again.

Taskbar animations disappeared after the update

Some Windows 11 users noticed their taskbar felt slightly off after KB5089549 installed — app previews that used to slide open now just snap, and the group animation when hovering over taskbar icons is gone. Both were introduced earlier in 2026 and were working fine before Patch Tuesday. The update knocked them out.

This is cosmetic only. Nothing is broken, nothing's at risk. It's just an animation regression that makes the taskbar feel less polished than it did before. Microsoft has already deployed a Known Issue Rollback to fix it automatically — most home PCs will pick it up on their own without you doing anything.

What to do

1. Restart your PC. The fix arrives automatically over Windows Update in the background — there's nothing to download or install manually.
2. If the animations still aren't back after the first restart, restart once more. That usually does it.
3. If your PC is on a work or school network, the automatic rollback won't apply. Your IT department needs to deploy a Group Policy fix — point them at Microsoft's Windows 11 release health page for the details.

Windows Hello face sign-in stopped working on some Surface devices

Microsoft acknowledged this one in the KB5089549 known issues list. On certain Surface models, face recognition for Windows Hello stopped working after the May update. The device tries to use the camera to sign you in, fails, and falls back to asking for your PIN or password instead.

Who this affects: specific Surface models only. If you're on a regular laptop or desktop with a Windows Hello camera plugged in, you're fine. This is Surface-specific. Microsoft hasn't named the exact models yet, but if you have a Surface and face sign-in has stopped working since the update, this is likely why.

There's no fix from Microsoft yet. The workaround is straightforward: use your PIN.

How to sign in with your PIN

1. At the Windows sign-in screen, click Sign-in options (the icon that looks like a key, below the password field).
2. Select the PIN option (the icon with a number pad).
3. Type your PIN and press Enter.

That's it. Face sign-in should come back automatically once Microsoft pushes a fix through Windows Update.

Unpatched security flaw lets someone bypass BitLocker with a USB stick

On 19 May, security researchers disclosed a zero-day vulnerability called YellowKey (CVE-2026-45585). There's no patch yet. Before you read further: this requires someone physically at your PC. It's not a remote attack. Nobody can exploit this from the internet.

How it works: an attacker inserts a specially prepared USB drive, reboots the machine into Windows Recovery mode, and the exploit bypasses BitLocker. If it succeeds, they have access to everything on the drive without needing your password or PIN. On a locked laptop sitting in front of them, that's a complete compromise.

Who this actually affects: only people who have BitLocker or Device Encryption switched on. Windows 11 Home usually enables Device Encryption automatically if your PC supports it. Windows 11 Pro and Enterprise have the full BitLocker. If yours is off, this flaw cannot touch you — full stop.

For most home users the practical risk is low. This matters if your laptop travels with you and could be stolen, or if you share a house with someone you genuinely can't trust not to sit down at your machine while you're out. Office and business use is a different conversation.

Step 1: check whether you're affected at all

On Windows 11 Home: go to Settings > Privacy & security > Device encryption. If it shows Off, this flaw cannot affect your device — you can stop reading here.

On Windows 11 Pro/Enterprise: go to Control Panel > BitLocker Drive Encryption (search for "BitLocker" in the Start menu). If it says Off, same thing — you're not affected.

Step 2: apply Microsoft's mitigation (if encryption is on and you want it sorted now)

Go to support.microsoft.com and search for YellowKey CVE-2026-45585. Microsoft's support article has a script you can download and run. It removes the vulnerable component from the Windows Recovery Environment and runs automatically. If you're not comfortable running scripts, this is one worth asking someone technical to help with.

Step 3: optional extra layer

Enabling a BitLocker startup PIN blocks this attack entirely — the machine won't boot at all without it, even with the exploit USB plugged in. It's more involved to set up and isn't something I'd suggest doing without a bit of guidance. If you want help configuring it, drop me a message and I can walk you through it or do it for you.

Should you still install the update?

Yes, when it works. This month's patch fixes 120 vulnerabilities, including some nasty ones in Microsoft Word where an attacker can run code on your machine just by you previewing a dodgy file in File Explorer or Outlook. You don't have to open it. That's the kind of thing that ends up weaponised quickly.

The people hitting the rollback are a minority. Most Windows 11 PCs have taken KB5089549 without any trouble.

If yours keeps rolling back, sit tight. Don't force it. Windows will handle it when Microsoft pushes an updated version of the package, or when you have enough disk space freed up that the update can succeed. In the meantime, your PC is no worse off than it was before Patch Tuesday.

May's optional preview update (KB5089573, 26 May)

Update (30 May 2026): Microsoft released an optional preview update on 26 May. You won't get it automatically — you have to go to Settings > Windows Update and click "Download & install" next to it. It becomes mandatory in June's Patch Tuesday on 10 June.

If you're wondering whether to bother: this one has a genuinely useful performance tweak. Microsoft added something called a "Low Latency Profile" for the CPU that speeds up the Start menu, search, and app launches. On the PCs I've tested it on, the difference is noticeable. Start feels snappier. Apps open faster. It's a small thing but you feel it.

Other bits in the preview: two apps can share the camera at the same time (handy if you're on Teams and also recording), Windows Hello becomes the default sign-in method permanently rather than resetting, and Task Manager now shows NPU usage columns if your PC has one.

If you're on the fence: wait for June Patch Tuesday. You'll get everything in this preview plus the next round of security fixes in one go. No reason to rush an optional update.

Secure Boot certificates expiring on 26 June

This one isn't a bug from the May update, but it's related and the deadline is close enough that it's worth covering here.

The digital certificates Windows uses for Secure Boot — the system that stops malware from loading before Windows starts — expire on 26 June 2026. Microsoft has been rolling out replacement certificates through normal Windows updates since late 2024. If your PC is up to date, you almost certainly have the new ones already.

Your PC will not stop working on 27 June. Nothing breaks overnight. What happens is that PCs still running the old certificates won't receive future boot-level security updates. Over time that gap widens. It's not urgent in the "your PC is on fire" sense, but it's the kind of thing you want sorted sooner rather than later.

How to check

1. Press Windows + R, type msinfo32 and press Enter.
2. Look for Secure Boot State. It should say On.
3. If it says On, your PC is receiving the certificate updates through normal Windows Update. Make sure you're current on updates and you're covered.
4. If Secure Boot is Off or not supported, this doesn't apply to your machine.

One thing to avoid: don't go into BIOS and toggle Secure Boot off and back on. That can reset the certificate database and undo the update Microsoft already pushed. Leave it alone if it's working.

Three weeks on — where things stand

It's been nearly three weeks since Patch Tuesday. The picture has mostly settled, with a couple of additions.

The taskbar animation regression sorted itself out back on 21 May. The install rollback now has an official fix — install KB5089573, or wait for June Patch Tuesday and you'll get it automatically. The network slowdown still has no permanent fix from Microsoft. The USB printer error on ESU machines gets a fix in June's optional update. The BitLocker recovery prompt was a one-off — once past it, done. Windows Hello face recognition stopped working on some Surface devices; use your PIN while Microsoft sorts it.

The GPU driver downgrade is the longest tail. Microsoft confirmed a proper fix won't land until October 2026's Patch Tuesday. Pro users get a Group Policy workaround in June, but Home users are stuck reinstalling their Nvidia, AMD, or Intel driver after each major Windows update until autumn.

YellowKey still has no patch. Microsoft's mitigation script is the best they've offered. Reminder: someone has to be physically at your PC with a USB stick for this to work. If your laptop travels and BitLocker is on, run the script. Otherwise, not worth losing sleep over.

The optional preview KB5089573 dropped on 26 May with some nice performance improvements, but it carries the same install bug as the main update. It becomes mandatory on 10 June. And keep an eye on the Secure Boot certificate deadline on 26 June — if your PC is up to date, you're already covered, but it's worth checking.

Next Patch Tuesday is 10 June. I'll have a new post up that day.

Mark

Mark has been fixing computers since the late '90s and went self-employed in 2008. Based in St Helens since 2013, he works evenings and weekends from his home in Laffak — friendly, affordable repairs for PCs, laptops, and Macs. See reviews on Google