Win32 OpenSSH broken after KB5074109 update

Prerequisites

• Write a descriptive title.
• Make sure you are able to repro it on the latest version
• Search the existing issues.

Steps to reproduce

I am experiencing connectivity issues from CentOS 9 Stream client to Windows 11 PC after latest Windows Update has been installed.

I have manually installed OpenSSH on Windows 11 PC and confirmed all the scripts have been run, and that icacls is applied correctly.

I have been able to connect successfully for several months, and after latest Windows Update, this no longer works

ssh_client_post_update.log
2026-01 Security Update (KB5074109) (26200.7623).txt
icacls.txt
sshd-session_prior_update.log
sshd-session_post_update.log
ssh_client_prior_update.log

Expected behavior

[build@aerotrack.com.au@app-bld-cn9-prd .ssh]$ ssh build@ats-w11-d16

Microsoft Windows [Version 10.0.26100.7462]
(c) Microsoft Corporation. All rights reserved.

ats\build@ATS-W11-D16 C:\Users\build>

Actual behavior

[build@aerotrack.com.au@app-bld-cn9-prd .ssh]$ ssh build@ats-w11-d09

Microsoft Windows [Version 10.0.26100.7462]
(c) Microsoft Corporation. All rights reserved.

ats\build@ATS-W11-D09 C:\Users\build>

Error details

8820 2026-01-19 10:13:07.106 debug1: user: (null): attempt 0 failures 0 [preauth]
8820 2026-01-19 10:13:07.138 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ats\\build' Status: 0xC00000BB SubStatus 0.
8820 2026-01-19 10:13:07.283 debug1: generate_s4u_user_token: LsaLogonUser() failed. User 'ats\\build' Status: 0xC00000BB SubStatus 0.
8820 2026-01-19 10:13:07.283 error: get_user_token - unable to generate token on 2nd attempt for user ats\\build
8820 2026-01-19 10:13:07.283 error: ga_init, unable to resolve user ats\\build
8820 2026-01-19 10:13:07.283 debug1: Can't Match group because user ats\\build not in any group at line 85
8820 2026-01-19 10:13:07.283 debug1: user: build: kex_server_update_ext_info: Sending SSH2_MSG_EXT_INFO [preauth]
8820 2026-01-19 10:13:07.283 debug1: user: build: userauth-request for user build service ssh-connection method publickey [preauth]

Environment data

PS C:\Windows\System32> $PSVersionTable

Name                           Value
----                           -----
PSVersion                      5.1.26100.7462
PSEdition                      Desktop
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0...}
BuildVersion                   10.0.26100.7462
CLRVersion                     4.0.30319.42000
WSManStackVersion              3.0
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1

Version

PS C:\Windows\System32> ssh -V OpenSSH_for_Windows_10.0p2 Win32-OpenSSH-GitHub, LibreSSL 4.2.0

Visuals

No response

Compare ssh_client_prior_update.log with ssh_client_post_update.log and sshd-session_prior_update.log with sshd-session_post_update.log, using the KB5074109 report and icacls.txt for context. Reproduce the failed authentication after the update and identify the regression; done means SSH again reaches the expected Windows shell without the token-generation errors.