Trouble Installing Patch (KB5056579) on Windows EC2 Instance

Considering below:

1. Block KB5056579 Temporarily Since you're using Patch Manager with default baselines: • Create a custom baseline that explicitly excludes KB5056579 • Use Update Management in Systems Manager to block this patch until it's stable
2. Test in Isolated Environment Before applying to production EC2s: • Spin up a test EC2 instance with the same image and patch manually • Monitor health checks and logs post-reboot
3. Check EC2 Health Dependencies After reboot, if EC2 health checks fail: • Verify network drivers, TPM, and EC2 integration services are intact • Check C:\Windows\Logs\CBS\CBS.log and WindowsUpdate.log for patch-related errors
4. Use DISM to Repair Run this on the EC2 instance before retrying the patch: DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow

Hey,

Hope you're keeping well.

This patch appears to be causing OS-level issues that prevent EC2 from passing status checks after reboot. I’d recommend creating a custom Patch Manager baseline in Systems Manager that excludes KB5056579 and applying it to your production fleet until Microsoft releases a fix. Spin up a non-production Windows Server 2025 instance with the same AMI and instance type, install the update manually, and review C:\Windows\Logs\CBS\CBS.log and C:\Windows\WindowsUpdate.log for errors. If the issue persists, open a case with Microsoft via your AWS Support plan since the underlying patch is vendor-supplied, and keep your AMIs versioned so you can roll back quickly.

Thanks and regards,
Taz