Testing Guidance

November 2026 Patch Tuesday Testing Guidance

By ·

Readiness November 2026 Testing Guidance card with the Readiness and Microsoft marks, by Greg Lambert, over a wide-field star cloud image from Carl Bennett's telescope

November looks like another big month. Microsoft’s test guidance for November 2026 Patch Tuesday lists 585 Windows changes to check, up from 496 in October, and Microsoft marks 71 of them High Risk for regression, against 41 last month. The release itself is smaller than October’s record. Microsoft fixed 1,240 CVEs, with 64 rated Critical across Windows, Office, Exchange and the browsers, and 165 of the total are Chromium fixes republished for Edge; without them the count is 1,075, against 1,408 in October. One Outlook flaw is already being exploited, so deploy the Office update first. The good news is that the risk is concentrated. Printing, scanning, fonts and graphics account for 57 of the 71 flags, so if printing still works after the update, most of the risk is behind you. Three of the changes are deliberate, which means a few things will stop working on purpose, and we point those out below.

Printing, Scanning and Fonts (High Risk)

win32kfull.sys, the kernel-mode window manager and GDI, carries 15 High Risk flags on its own; the print providers, port monitors, colour management, scanners and DirectWrite carry the rest. One flag is a behaviour change: printing to an IPP printer through an authenticated proxy now needs a policy value to keep working. Test printing before anything else.

  • Print multi-page documents with mixed fonts and non-English text, and photos, gradients and patterned fills, to a physical printer, Microsoft Print to PDF and the XPS Document Writer, and compare glyphs, spacing, colours and clipping with the screen.
  • Send the same document five times in quick succession, pause, cancel and restart jobs, and confirm the remaining jobs complete in order.
  • Add a printer by IPP URL, WSD discovery, USB and Standard TCP/IP port, print a test page, remove and re-add each one, and confirm its settings persist.
  • Print through an authenticated proxy with saved credentials and confirm no prompt appears, then set EnableProxyAuthForCredentials to 1 under HKLM\Software\Policies\Microsoft\Windows NT\Printers, restart the Print Spooler and repeat.
  • Scan from an eSCL, a WSD and a USB scanner, cancel a scan midway and start another, and confirm each scan completes.

Network Discovery and Device Association (High Risk)

Discovery takes 10 of the flags: the Device Association Framework providers for UPnP, SSDP, WSD and eSCL, Function Discovery, .local resolution and NetBIOS over TCP/IP. Microsoft asks for accurate status, clean rediscovery and a single entry per device.

  • Turn on Network Discovery, publish a shared folder and printer, confirm both appear from a second PC, withdraw the share and confirm it disappears from Network.
  • Discover a UPnP device, a WSD printer and an eSCL scanner, power each off and on, change the WSD device’s IP address, and confirm each is rediscovered as one entry.
  • Resolve a .local hostname and a NetBIOS name, then disable and re-enable the adapter during a large copy and confirm both PCs reappear in Network.
  • Pair a Bluetooth accessory and reconnect a USB keyboard and mouse while typing, and confirm each comes back after sleep and resume.

Kerberos, NTLM and AuthIP (High Risk)

Two of the three flags here are deliberate behaviour changes. Every Windows client now requests signing in its NTLM negotiate message, with two REG_DWORD controls under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0: ClientAllowUnsignedNtlm on the client and ServerRequireNtlmSign on the server. With both set to 1 the server rejects NTLM that does not negotiate signing, by design. This is the first of two phases: in May 2027, Windows servers will start requiring NTLM signing by default and will reject clients that do not offer it (KB5135557). Kerberos loopback detection also changes. The AuthIP flag changes nothing, but a packaged app being denied the protected share is expected and not a regression.

  • Between two updated machines, connect by IP address so the session uses NTLM and copy a file, then repeat with ClientAllowUnsignedNtlm set to 1, then ServerRequireNtlmSign set to 1, then both, recording the OS build, both values and the exact error for any failure outside the both-set case.
  • Restore the original registry values afterwards, because ClientAllowUnsignedNtlm set to 1 is a temporary compatibility setting only.
  • Protect an SMB share with a certificate-based AuthIP rule, open it from File Explorer, then open the same UNC path from Microsoft Edge and confirm the app is denied while desktop access still works.

Remote Desktop, DNS, DHCP and Directory

The Remote Desktop client carries the remaining High Risk flag, with 17 Remote Desktop entries in all. DNS Server is the busiest component at 28 entries, none High Risk, DHCP Server takes 10, and AD CS now rejects malformed signed certificate timestamp data during certificate transparency issuance.

  • Connect to a session host with clipboard, drive, printer and smart card redirection, copy text both ways, print to a redirected printer, disconnect and reconnect in full screen.
  • Connect through a Remote Desktop Gateway, start 10 connections in quick succession, and confirm the gateway lists and clears every session.
  • Create a zone with A, AAAA, MX, SRV and SOA records, enable diagnostic logging, query each record with nslookup over UDP and TCP, and confirm every query appears in the log.
  • Lease, renew and release IPv4 and IPv6 addresses including a reservation, replicate a failover relationship, stop the primary DHCP service and renew from the partner.
  • Enrol a certificate with certificate transparency enabled and confirm it carries the signed timestamp list and no precertificate poison extension.

Storage, Installer and SQL Server

Storage Spaces changes degraded-pool behaviour: removing a disk from a degraded pool should no longer crash or hang. Windows Installer takes 20 entries, focused on standard users and repair sources. SQL Server ships eight GDR packages across 2017, 2019, 2022 and 2025, and the Azure File Sync agent moves to v23.2.

  • Build a Storage Spaces pool from three disks, make one unavailable, remove a remaining disk from the degraded pool, and confirm that removing a disk the data still depends on fails without corruption.
  • Start, save, checkpoint and live migrate Hyper-V virtual machines, and move a shared VHDX role between guest cluster nodes during a file copy.
  • As a standard user, install a per-user MSI, repair it twice, cancel an install from its UI, and uninstall, then rename the MSI source and confirm a repair with no matching package fails.
  • Apply the SQL Server GDR on its RTM or CU baseline, run a backup and restore, confirm Always On availability groups stay healthy, then remove the patch.
  • Install the Azure File Sync v23.2 agent, confirm no file under the StorageSyncAgent program folder grants Everyone full control, and confirm new files still sync.

Office, Outlook and SharePoint

Office carries 22 Critical CVEs this month. The one to act on is CVE-2026-124194, an Outlook spoofing flaw that attackers are already using. Microsoft rates it Moderate, but active exploitation makes it the first update to deploy across Microsoft 365 Apps and Office LTSC 2021 and 2024. SharePoint Server takes 27 CVEs, led by an elevation of privilege flaw rated 9.9 (CVE-2026-120002).

  • Deploy the Office update to a pilot ring of Microsoft 365 Apps and Office LTSC 2021 and 2024 machines, confirm the new build number, then open, reply to and forward messages with links and embedded images in Outlook and confirm the external-content warning still appears before remote content loads.
  • Open Word, Excel, PowerPoint, Access and Visio files with macros, linked data and embedded objects from a network share and from email, and confirm each opens in Protected View and edits normally once enabled.
  • Apply the SharePoint Server update to a test farm, run the SharePoint Products Configuration Wizard, then confirm site access, search crawls and permission-trimmed pages for a standard user and a site owner.

Exchange, .NET and Visual Studio

Exchange Server takes nine CVEs, one of them a Critical remote code execution flaw (CVE-2026-118207). The .NET and Visual Studio set runs to 42 CVEs, all Important, led by Visual Studio Code at 9.6 and ASP.NET Core at 9.0.

  • Install the Exchange Server security update on a test server in maintenance mode, confirm every Exchange service starts, then send and receive internal and external mail, open Outlook on the web and complete a mailbox move.
  • Update the .NET runtime and the ASP.NET Core Hosting Bundle on a test web server, restart the application pools, and confirm sign-in, API calls and file uploads still work.
  • Update Visual Studio and Visual Studio Code, then open, build and debug an existing solution and confirm installed extensions still load.

November 2026 Patch Tuesday Testing Priorities

If you cannot test everything at once, work in this order.

  • The Outlook zero-day first: deploy the Office update for CVE-2026-124194 as soon as your pilot ring passes.
  • Printing and scanning next: 57 of the 71 High Risk flags are in the print and scan path, fonts, graphics and win32k.
  • Then the three behaviour changes: authenticated proxy printing, NTLM signing in all four registry configurations and Kerberos loopback, then the AuthIP check, knowing which failures are intended.
  • Network and device discovery, Bluetooth pairing and USB reconnection.
  • Remote Desktop, then DNS, DHCP and the certification authority, then Exchange, SharePoint and .NET, then Storage Spaces, Windows Installer repair paths, SQL Server and Azure File Sync.

#patch-tuesday#testing-guidance#windows-11#windows-server