Overview
Microsoft has confirmed that its September 2026 Windows security updates can cause the built-in File History backup feature to stop working on some Windows systems. Affected devices may fail to create new backups, incorrectly display “Reconnect your drive” even when the backup destination is available, stop updating the Last Backup timestamp or report that previously protected files have no previous versions available. Microsoft says it is working on a resolution. For IT leaders, the broader issue is more important than the individual Windows bug: backup success cannot be assumed simply because a backup policy exists.
What Is Going Wrong?
File History is designed to maintain historical copies of user files on an external drive or network location, allowing users to recover earlier versions following deletion, corruption or accidental changes. After installation of affected September security updates, some systems may no longer create or update those copies. Event Viewer can also record crashes involving FileHistory.exe and KERNELBASE.dll. Microsoft has documented the issue across multiple supported Windows 10 and Windows 11 releases, including Windows 11 23H2, 24H2, 25H2 and 26H1.
The Dangerous Part Is Silent Backup Failure
An obvious system outage is usually noticed quickly. A failed backup process can be more dangerous because the organisation may only discover the problem when recovery is required. A user may continue working normally while believing that files are being protected in the background. If the Last Backup timestamp is not being actively monitored, that assumption could continue for days or weeks. This creates a critical distinction between having a backup system and having a verified recoverable backup.
Security Patching and Resilience Must Work Together
The incident also illustrates one of the ongoing challenges of enterprise change management. Security updates need to be deployed quickly because they address vulnerabilities, but every change can potentially introduce operational side effects. The answer is not to avoid patching. Instead, organisations need deployment rings, testing, monitoring and rollback planning that allow updates to be introduced without losing visibility into critical services. Microsoft has already addressed several separate September update issues through follow-up releases, while the File History problem remains under investigation at the time of writing.
What IT Leaders Should Consider
Organisations that still depend on File History should confirm that backups have continued successfully following the September updates rather than relying solely on the feature being enabled. Backup timestamps, destination availability and restore capability should be checked. More broadly, backup monitoring should generate alerts when expected backup jobs do not complete. Critical business data should also not depend on a single endpoint-level recovery mechanism. Enterprise resilience normally requires multiple protection layers, potentially including endpoint backup, cloud storage protection, centralised backup platforms and tested recovery procedures.
Restore Testing Matters More Than Backup Status
Many organisations monitor whether a backup job completed, but fewer regularly prove that the protected data can actually be restored. Successful backup reporting is only one part of resilience. Recovery testing validates whether the data exists, whether it is usable and whether the organisation can restore it within required recovery objectives. A technical failure such as the File History issue is therefore a useful reminder that backup monitoring and restoration testing should be treated as operational controls, not optional maintenance tasks.
Expert in the Cloud Insight
The Microsoft File History issue reinforces a simple but important principle: a backup that has not been verified is only an assumption. Technology leaders should not ask only: “Do we have backups?” The stronger question is: “Do we know they completed, and have we proved that we can restore from them?” Security updates, configuration changes and platform failures can all affect recovery systems without immediately affecting day-to-day productivity. That is why cyber resilience depends on continuous validation. The moment you discover whether your backup strategy works should never be the moment you desperately need it.
Leave a Reply