Microsoft Windows Updates Trigger Application Installation Issues: A Security Patch Side Effect

Estimated reading time: 12 minutes

Key Takeaways:

  • Recent Microsoft Windows updates (August 2025) are causing application installation problems for non-administrative users due to stricter UAC prompts.
  • The root cause is a security patch addressing the CVE-2025-50173 Windows Installer privilege escalation vulnerability.
  • Affected platforms include a wide range of Windows client and server versions.
  • Microsoft is developing a solution, with temporary workarounds available including running applications as administrator or using Known Issue Rollback (KIR).
  • Enterprises should strategically address these changes through communication, testing, policy implementation, and training.

Table of Contents:

The Root Cause: Addressing CVE-2025-50173

The core issue arises from a security patch designed to address the CVE-2025-50173 Windows Installer privilege escalation vulnerability. This vulnerability could allow attackers to gain SYSTEM privileges via a weak authentication issue. Microsoft implemented stricter UAC prompts requiring administrator credentials during Windows Installer (MSI) repair operations to mitigate this risk.

While enhancing security, this change introduces operational challenges. Scenarios triggering these prompts include:

  • Running MSI repair commands (e.g., msiexec /fu).
  • Installing applications configured for individual users.
  • Executing Windows Installer during Active Setup.

These prompts hinder standard users from deploying packages through Configuration Manager (ConfigMgr) when configurations depend on user-specific settings. Furthermore, Secure Desktop enablement is affected, alongside launching specific Autodesk applications like AutoCAD, Civil 3D, and Inventor CAM.

Affected Platforms

The scope of impact spans across a broad range of client and server platforms:

  • Client: Windows 11 (versions 24H2, 23H2, 22H2), Windows 10 (versions 22H2, 21H2, 1809), Windows 10 Enterprise LTSC (2019, 2016), Windows 10 (version 1607), Windows 10 Enterprise 2015 LTSB
  • Server: Windows Server 2025, Windows Server 2022, Windows Server (version 1809), Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

This widespread impact requires system administrators to understand and address these issues promptly to maintain operational efficiency and security.

Microsoft’s Response and Temporary Solutions

Microsoft acknowledges the disruption and is developing a solution that allows IT administrators to authorize specific applications to perform MSI repair operations without UAC prompts. This fix will be included in a future Windows update.

In the interim, Microsoft suggests the following temporary workarounds:

  1. Run Applications as Administrator: Users can right-click the application in the Start menu or Search results and select “Run as administrator.”
  2. Known Issue Rollback (KIR): For organizations, IT administrators can deploy a Group Policy using KIR. This involves contacting Microsoft’s business support team and applying a specific Group Policy to the affected Windows versions (Windows 11 versions 22H2, 23H2, 24H2; Windows Server 2025, 2022; Windows 10 versions 21H2, 22H2).

Understanding User Account Control (UAC)

User Account Control is a security component in Windows that helps prevent unauthorized changes to the operating system. It works by prompting users for permission or an administrator password before allowing actions that could potentially affect system stability or security.

Here’s a detailed breakdown of UAC’s function and importance:

  1. Elevation Prompts: When a program attempts to make a change that requires administrative privileges, UAC presents a prompt. This prompt asks the user to either allow the action or deny it. If the user is an administrator, they can approve the action; if they are a standard user, they must provide an administrator’s credentials to proceed.
  2. Protection Against Malware: UAC helps protect against malware by making it harder for malicious software to install itself or make changes without the user’s knowledge. When malware attempts to run with elevated privileges, UAC prompts the user, alerting them to the potentially harmful activity.
  3. Least Privilege Principle: UAC enforces the principle of least privilege, which means that users operate with the minimum level of access necessary to complete their tasks. This reduces the potential damage that can be caused by malware or user error.
  4. Customizable Settings: UAC has customizable settings that allow users to adjust the level of prompting based on their security needs and preferences. These settings range from always notifying (the most secure) to never notifying (the least secure).
  5. Secure Desktop: When a UAC prompt appears, it does so on the Secure Desktop, a separate environment that is isolated from other applications. This prevents malware from interfering with the prompt or tricking the user into granting unauthorized access.
  6. Compatibility with Applications: While UAC enhances security, it can sometimes cause compatibility issues with older applications that were not designed to run with UAC enabled. In these cases, users may need to run the application in compatibility mode or with administrative privileges.

Strategic Implications and Mitigation for Enterprises

Enterprises must strategically address these changes to minimize disruptions. This involves:

  • Communication: Informing users about the changes and the reasons behind them. Provide clear instructions on how to handle UAC prompts and potential installation issues.
  • Testing: Thoroughly testing applications for compatibility with the new UAC settings. Identify applications that require administrative privileges and explore alternative solutions.
  • Policy Implementation: Implementing Group Policies to manage UAC settings across the organization. This ensures consistent security and user experience.
  • Training: Training users on how to recognize and respond to UAC prompts. Emphasize the importance of not granting administrative privileges to unknown or untrusted applications.
  • Application Whitelisting: Consider using application whitelisting to restrict the execution of unauthorized software. This can help prevent malware from running, even if a user inadvertently approves a UAC prompt.
  • Monitoring and Auditing: Monitoring system logs for UAC-related events. This can help detect unauthorized activity and identify potential security threats.

Connection to Cyber Threat Intelligence and PurpleOps Services

These Microsoft Windows update issues illustrate the importance of proactive cyber threat intelligence. Understanding vulnerabilities like CVE-2025-50173 and their potential impact allows organizations to prepare for and mitigate risks effectively. Services such as real-time ransomware intelligence, dark web monitoring service, and telegram threat monitoring can provide early warnings about exploits targeting these vulnerabilities.

PurpleOps offers comprehensive cybersecurity services that align with addressing such vulnerabilities and their exploitation:

  • Breach Detection: PurpleOps’ breach detection services can identify unauthorized access attempts and malicious activities exploiting the Windows Installer vulnerability.
  • Supply-Chain Risk Monitoring: Ensuring that third-party applications and updates do not introduce vulnerabilities into the system is crucial. PurpleOps’ supply-chain risk monitoring helps organizations assess and manage these risks.
  • Underground Forum Intelligence: Monitoring underground forums can provide insights into attacker tactics and tools, enabling organizations to proactively defend against potential exploits.
  • Brand Leak Alerting: Detecting leaked credentials or sensitive information on public or private forums can help prevent unauthorized access and data breaches.
  • Cyber Threat Intelligence Platform: PurpleOps’ cyber threat intelligence platform aggregates and analyzes threat data from various sources, providing organizations with actionable insights to improve their security posture.
  • Live Ransomware API: Access real-time ransomware intelligence to identify and block ransomware attacks targeting vulnerabilities in Windows systems.

Actionable Advice

  • Technical Readers (System Administrators):
    • Prioritize deploying the Known Issue Rollback (KIR) through Group Policy to mitigate UAC prompt issues.
    • Thoroughly test applications post-update to identify any compatibility issues.
    • Monitor system logs for unexpected UAC prompts and failed installation attempts.
    • Leverage a cyber threat intelligence platform to stay informed about potential exploits targeting Windows vulnerabilities.
  • Non-Technical Readers (Business Leaders):
    • Ensure IT teams are promptly addressing the UAC prompt issues caused by the Windows updates.
    • Allocate resources for user training on recognizing and responding to UAC prompts.
    • Evaluate the organization’s PurpleOps Solutions processes to minimize third-party vulnerabilities.
    • Consider investing in a dark web monitoring service to detect leaked credentials and sensitive information.

The Interplay between Security and Operational Disruption

The Microsoft Windows updates highlight the tension between enhancing security and avoiding operational disruption. Security measures, while essential, can inadvertently impact user experience and application functionality. It is important to balance these considerations through careful planning, testing, and communication. Organizations must adopt a layered approach to security, combining proactive threat intelligence with robust incident response capabilities.

By understanding the nature of these Windows update issues, implementing appropriate workarounds, and leveraging comprehensive PurpleOps Solutions, organizations can maintain a secure and efficient IT environment.

To learn more about how PurpleOps can help you protect your organization from emerging cyber threats, explore our platform or contact us for a consultation.

FAQ

Q: What is CVE-2025-50173?
A: CVE-2025-50173 is a Windows Installer privilege escalation vulnerability that could allow attackers to gain SYSTEM privileges. The Microsoft security patch addresses this by implementing stricter UAC prompts during MSI repair operations.

Q: How do I run an application as an administrator?
A: You can right-click the application in the Start menu or Search results and select “Run as administrator.”

Q: What is Known Issue Rollback (KIR)?
A: Known Issue Rollback is a technology that allows Microsoft to quickly revert a problematic change in a Windows update. In this case, IT administrators can deploy a Group Policy using KIR to revert the stricter UAC prompt behavior.

Q: How can PurpleOps help with these issues?
A: PurpleOps offers various cybersecurity services, including breach detection, supply-chain risk monitoring, underground forum intelligence, and a cyber threat intelligence platform, which can help organizations proactively defend against exploits targeting Windows vulnerabilities.