KB5023706: The March 2023 Windows 11 22H2 Update Explained

KB5023706 is the March 14, 2023 cumulative security update for Windows 11 version 22H2, and it moves the PC to OS Build 22621.1413. Security fixes, the third phase of DCOM hardening, a domain join fix, plus every feature from the February preview. Here’s what it did and how to deal with it.

What KB5023706 is

A Patch Tuesday cumulative update. Cumulative, so it carries the fixes of the updates before it. A PC that already had those only downloads the new parts, which we like.

It’s a combined package: the servicing stack update and the latest cumulative update in one file. That detail matters later, when you try to remove it.

Its twin for the older Windows 11 release was KB5023698, build 22000.1696. Different version, same month. Not interchangeable.

What changed in KB5023706

Microsoft’s KB5023706 release notes keep the list short. Security fixes, then two items people actually noticed:

• DCOM hardening, phase three. Once installed, the registry key that used to switch it off no longer works.
• Domain join with a reused computer account. It failed with 0xaac (2732), NERR_AccountReuseBlockedByPolicy, on devices with updates from October 11, 2022 or later. Fixed here.
• The servicing stack update, 22621.1344. Quality changes to the part that installs updates.

The DCOM change is the one admins cared about. We’d test older DCOM apps on one machine before rolling it out wide. Our notes on joining Windows Server to a domain cover the domain side.

Features it brought from the February preview

KB5023706 includes everything from preview update KB5022913. So 22H2 PCs that skipped the optional preview got those features here. The ones you’d spot:

• Search results that appear in the taskbar search flyout as you type.
• Windows Studio effects in Quick Settings. Only on PCs with a supported NPU.
• A touch-optimized taskbar on 2-in-1 tablets, with collapsed and expanded states.
• Task Manager search. Ctrl+F filters by name, PID or publisher.
• Energy recommendations under Settings, System, Power & battery.
• Quick Assist listed in All apps in Start.
• Start recommendations with shared files and meeting prep, but only on Azure AD-joined work PCs.
• Narrator braille improvements and new braille displays.
• Rounded focus and hover effects in the system tray.
• Voice access that handles more controls and scrolls sideways.
• A Task Manager theme you can set apart from the Windows theme.

Also a quiet fix we liked. Copying multi-gigabyte files over SMB shares was slow before it, and the preview sped that up.

Comparing editions to see which of these you get? Our Windows 11 Home vs Pro page has the table.

Known issues listed for this update

Five entries on the release page. Most were fixed by later updates, which tells you the fix: keep updating.

The WSUS one hit admins. Servers upgraded in place were missing the UUP file types, so clients never saw the new updates. Adding those MIME types on the server cleared it. Configuration Manager setups weren’t affected.

The start-up problem was the loud one. Explorer.exe errors in a loop, tied to a shell customization app. Update or remove the app, then restart.

KB5023706 on Windows 10 and older Windows 11

On a Windows 10 PC you won’t find it at all. This KB is only for 22H2.

• Windows 11, the first release: KB5023698, build 22000.1696. Same DCOM and domain join items.
• Windows 10: KB5023696 that month, builds 19042.2728, 19044.2728 and 19045.2728.

Not sure which one you run? Win+R, winver. The first five digits of the build give it away. 22621 is 22H2. 22000 is the first Windows 11 release, and 1904x is Windows 10.

Planning the jump to 11 anyway? Then our Windows 11 vs Windows 10 upgrade page lists what changes.

How to install KB5023706

On a 22H2 PC it came automatically. Settings, Windows Update, Check for updates. Nothing else to do.

Want the file itself? Offline machines, a lab, a stuck install:

1. Open the Microsoft Update Catalog.
2. Search KB5023706.
3. Pick “Cumulative Update for Windows 11 Version 22H2” for x64 or ARM64. Skip the Dynamic one, Windows Setup uses that.
4. Run the .msu file and restart when asked.

WSUS works too. It syncs under product Windows 11, classification Security Updates. Big cumulative packages take a while to install, and our note on Windows 11 update time explains the wait.

Check whether the update is installed

Fastest way: Win+R, then this:

winver

Build 22621.1413 or higher? Then it’s in.

A higher number is normal. Later cumulative updates sit on top of this one and include its fixes.

Prefer the list? Settings, Windows Update, Update history. Look under Quality updates.

When KB5023706 fails to install

The error code tells you where to look. The usual suspects on cumulative updates, each with its own page:

• 0x800f081f, repair source missing.
• 0x80073701, a component missing from the store.
• 0x80073712, store in an inconsistent state.
• 0x80070103, usually a driver offered twice.
• 0x800f0922, often space in the reserved partition or a VPN.

No code at all, just “failed”? Run the troubleshooter first. Our Windows Update troubleshooter guide shows where it lives on Windows 11. Then the DISM and SFC repair, and the Catalog package above.

Leave at least 20 GB free on a 64-bit PC before you retry. We’d also make a restore point first, just in case.

Uninstall the March 2023 update

Here’s the catch with combined packages. The wusa uninstall switch doesn’t work on them. The servicing stack part can’t be removed at all.

Only the cumulative part comes off, with DISM. Admin Command Prompt. First list the packages:

DISM /online /get-packages

Find the RollupFix package with 22621.1413 in its name. Copy that name. Then:

DISM /online /Remove-Package /PackageName:<package name>

Restart. Honestly, we’d only do this to confirm the update is behind a problem. Then install the newer cumulative update, which carries the fix.

Do you still need it today?

Not on its own. Any later cumulative update for your version already includes it, so Windows Update won’t offer it to an up-to-date PC.

Rebuilding an old 22H2 image? Slipstream the newest cumulative update, not this one. Same fixes, one package less to add.

Where it still shows up: old installation images, offline PCs, update reports in WSUS. On those we’d install the newest cumulative update instead and get this one’s fixes with it. Same idea as other monthly packages we’ve covered, like KB5063709 for Windows 10 or KB5062557 on Windows Server 2019.

Your Windows license after the update

Updates don’t touch activation. A PC that was activated stays activated. Our guide to check Windows activation status shows where to confirm it.

Setting up an old image that never had a license? Our Windows 11 Pro key is Retail, instant to email.