Deploying a Known Issue Rollback (KIR) in Windows Server requires the Microsoft policy-definition MSI for the exact regression, the matching Windows Server version and edition, and a computer-based Group Policy setting. Install the MSI on your Group Policy administration workstation, place its ADMX and ADML files in the domain’s Central Store when one is used, link an issue-specific GPO to the affected computer accounts, set the matching KIR policy to Disabled, refresh policy, and restart each affected server. KIR reverses only the targeted change from a nonsecurity update; it does not uninstall the update or undo security fixes.
What Known Issue Rollback does
Known Issue Rollback is a Windows servicing mechanism for a regression introduced by a nonsecurity update. Microsoft can use it to turn off the particular change causing the problem while leaving the other changes in that update installed. That is different from uninstalling the entire cumulative update, which could remove unrelated fixes as well. Microsoft describes KIR as temporary: a later update can contain corrected code, after which the old rollback setting no longer has an active change to reverse. See Microsoft’s overview at Known Issue Rollback (KIR).
As an Amazon Associate I earn from qualifying purchases.
KIR is not a general-purpose Windows update undo button. Microsoft states, “KIR only affects non-security updates and fixes. Security updates and fixes don’t use KIR.” If the affected change came from a security update, do not try to substitute a KIR template; follow the servicing guidance for that incident instead.
Free tools Windows power users keep installed
One-click scans. No signup required.
For enterprise-managed computers, Microsoft publishes an issue-specific policy-definition MSI. The MSI adds Administrative Template settings that an administrator can deploy through Group Policy. Microsoft activates KIR automatically through Windows Update for nonenterprise devices, but domain-managed servers require the administrator to deploy the corresponding policy.
#1 Best Overall
Before you deploy: identify the exact issue
The policy is tied to one known regression, not to a broad product family. Start with the update’s Known Issues section, Windows update history or release notes, and Windows Release Health. Confirm all of the following before downloading anything:
- The update and symptom match the Microsoft notice describing the KIR.
- The target is a nonsecurity update regression.
- The affected operating system is the exact Windows Server version and edition in your environment.
- The servers are computer accounts that will receive a domain-based computer policy.
Templates and policy settings can differ between Windows versions and editions. A policy that appears correct for one Server release may not apply to another. Microsoft’s KIR guidance explains how to find the template associated with each issue and warns against assuming that one template covers every operating system: KIR documentation.
Choose the correct KIR template
Download the MSI named in Microsoft’s issue notice
Use the download link in the Microsoft notice for the specific regression and operating system. The MSI is the authoritative package for that incident; there is no universal “Windows Server KIR” policy that can be reused for unrelated problems. Record the issue name, update or KB identifier, supported Server versions, and download date in your change record.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallDo not substitute a similar-looking template
If Microsoft has not published a KIR for the regression, do not activate a setting from another issue or another Server release. Contact Microsoft Support and request KIR activation guidance. Applying an unrelated policy can leave the symptom unchanged and make later troubleshooting harder.
| Decision point | What to verify | Why it matters |
|---|---|---|
| Issue | The symptom and update match Microsoft’s KIR notice | Each policy targets a particular code change |
| Operating system | Windows Server version and edition are listed as supported | Administrative Template settings can vary by version and edition |
| Update type | The regression came from a nonsecurity update | KIR does not apply to security updates or fixes |
| Availability | Microsoft has published a template for this incident | No published template means you need Microsoft’s guidance rather than a substitute |
Install the policy definitions
- Run the KIR MSI on the Group Policy administration computer. Use a workstation or server from which administrators edit domain GPOs. The package installs the issue-specific Administrative Template definitions under
C:WindowsPolicyDefinitions, according to Microsoft’s deployment procedure. - Determine whether the domain uses a Central Store. Group Policy tools read definitions from the Central Store when one is configured. Installing the MSI only on your local management computer does not publish the definitions to the domain’s SYSVOL.
- Copy both template file types when a Central Store is in use. Copy the matching
.admxfiles and their language-specific.admlfiles into the Central Store. ADMX files describe the policy structure; ADML files provide the language resources that make the settings readable in the editor. Microsoft’s Central Store guidance explains how the store is organized and replicated across domain controllers: Create and manage a Central Store. - Open Group Policy Management after the files are available. If the policy still does not appear, close and reopen the Group Policy editor so it reloads the definitions. Verify that the ADMX and the matching ADML language file are present in the Central Store and that you copied the files for the correct Server release.
On a domain without a Central Store, the local installation on the computer used to edit policy supplies the definitions to that editor. Other administrators’ computers will need the same MSI if they must edit the GPO locally.
Create and configure the KIR GPO
1. Create an identifiable GPO
In Group Policy Management Console, create a new GPO in the domain and give it a name that includes the issue and operating-system context, such as the Microsoft issue title, KB number, and Server version. A descriptive name makes a temporary mitigation visible during audits and prevents an administrator from confusing it with a permanent baseline.
2. Link it to the affected computer accounts
Link the GPO at the domain or organizational-unit level that contains the affected servers. Keep the scope as narrow as practical while you validate the rollback. Because this is a computer policy, user-account placement does not determine whether a server receives it. Check inheritance, security filtering, and any enforced or blocked links that could change the effective policy.
3. Select the issue-specific setting
Edit the GPO and go to Computer Configuration > Administrative Templates. The MSI adds a category for the particular KIR issue. Open the setting whose description and supported operating systems match the Microsoft notice.
Rank #3
4. Set the matching policy to Disabled
Microsoft’s activation instructions for these templates use the policy state Disabled. This wording is counterintuitive: in the KIR template, setting the policy to Disabled activates the rollback of the targeted change. Do not disable an unrelated policy or use a generic Windows update setting. Preserve the issue, KB, Server version, and the date of the change in the GPO description and your change-management record.
Leave unrelated KIR settings at their default state. A GPO should contain only the policy required for the identified incident unless Microsoft’s notice explicitly directs otherwise.
Refresh policy and restart the servers
Under the default Group Policy configuration, Microsoft says a new policy normally reaches managed devices within 90 to 120 minutes. That is an expected refresh window, not a guarantee; site topology, connectivity, replication, and local policy processing can make the interval longer.
- On an affected server, request an immediate refresh with
gpupdate. If your operating procedure permits, usegpupdate /forceto reapply all policy settings. Wait for the command to report completion. - Confirm that the server can contact a domain controller and that the GPO link and security filtering include the computer account.
- Restart the affected server after the policy has applied. Microsoft’s deployment documentation is explicit: “You have to restart the affected computers in order to apply this Group Policy change.”
- Test the original symptom only after the restart. A policy refresh without a restart is not enough to judge whether the rollback took effect.
For a large fleet, stage the link or security scope, refresh and restart a representative set, then expand deployment while monitoring the affected workload. KIR has no published success-rate or downtime-reduction statistic; evaluate it against the specific regression and Microsoft’s issue guidance.
Rank #4
- Mastering Active Directory: Design, deploy, and protect Active Directory Domain Services for Windows Server 2022, 3rd Edition
- ABIS BOOK
- Packt Publishing
Verify that the rollback reached a server
- Policy visibility: The issue-specific setting appears in the editor from the machine where you manage the GPO.
- Scope: The server’s computer account is in the linked OU or otherwise included by the GPO’s security filtering.
- Refresh:
gpupdatecompletes without a processing error, or the normal 90–120-minute refresh interval has elapsed. - Restart: The server was restarted after the policy change, not merely logged off or disconnected.
- Symptom test: The workload-specific behavior described in Microsoft’s issue notice is retested on the restarted server.
Use your normal Group Policy reporting and event-log procedures to investigate processing failures. Those tools can show whether the computer received the GPO, but the final test remains the original application or operating-system symptom.
Troubleshoot a KIR policy that is missing or ineffective
The setting is not visible in Group Policy Management
- Confirm that you installed the MSI for the exact issue and Server version, not a similarly named incident.
- If a Central Store exists, verify that both the ADMX and matching ADML files were copied there. A local installation does not automatically update SYSVOL.
- Close and reopen the editor after updating policy definitions.
- Check the language folder: an ADMX without the corresponding ADML resource can produce missing or unreadable settings.
The policy appears, but the server does not change
- Recheck the operating-system version and edition against the template’s supported list.
- Verify that the matching KIR setting is set to Disabled, as Microsoft directs for activation.
- Confirm the GPO is linked where the server computer account receives it and that security filtering does not exclude the server.
- Run
gpupdate, then restart the server. Microsoft specifically advises a restart after policy changes. - Make sure the original issue is the one addressed by the template. KIR does not repair unrelated regressions or undo a security fix.
If the symptom remains after these checks, Microsoft recommends contacting Support. Include the affected update, Server version and edition, GPO name, policy-processing results, restart time, and the symptom’s current behavior. The official troubleshooting and lifecycle guidance is available in Microsoft’s KIR article.
Group Policy and Intune are different deployment paths
Microsoft also documents an Intune procedure that uses ADMX ingestion and custom profiles for MDM-managed devices. Group Policy GPOs are not compatible with MDM-based solutions such as Intune, so choose the path that matches how the servers are managed rather than trying to combine both methods. Microsoft states that the Intune procedure requires the cumulative update released on July 26, 2022 or later on the computer used to perform the procedure. Follow the current Intune-specific instructions in Microsoft’s deployment article.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor AD DS-managed servers, continue with the MSI, ADMX/ADML, GPO, refresh, and restart sequence described above. For MDM-managed devices, use the policy-ingestion method instead of linking a domain GPO.
Retire the mitigation when Microsoft fixes the issue
KIR is temporary. Monitor the Microsoft issue notice and release-health information for the corrected update. Microsoft says the old setting becomes benign after a subsequent update fixes the original issue, because there is no longer an active faulty change for that rollback to disable.
- Verify that the corrected update has reached the managed servers and that the original symptom is resolved under normal operations.
- Keep the KIR GPO and policy-definition files during a short validation period required by your change process, with the issue and validation evidence documented.
- Unlink or delete the obsolete GPO according to your organization’s change controls.
- Remove obsolete ADMX and ADML definitions from the Central Store when no active policy needs them. Microsoft notes that outdated policy definitions can be removed from Group Policy infrastructure.
- Record the retirement date and the corrected update so a future administrator can distinguish the closed mitigation from an active incident.
Do not remove the GPO merely because the server was restarted. Retire it after the corrected update is deployed and the fleet has been checked, otherwise a server that has not yet received the fix may still depend on the rollback.
Quick Recap
Operational checklist
- Match the Microsoft KIR notice to the exact regression, update, Windows Server version, and edition.
- Download and install the issue-specific MSI on the Group Policy administration computer.
- Copy the corresponding ADMX and ADML files to the Central Store if the domain uses one.
- Create and narrowly link a clearly named computer GPO.
- Under Computer Configuration > Administrative Templates, set the matching KIR policy to Disabled.
- Refresh policy with
gpupdateor wait for the normal 90–120-minute interval. - Restart every affected server before evaluating the result.
- Monitor Microsoft’s corrected update, then remove the obsolete GPO and definitions after validation.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
