April’s Windows Server patches are not just failing to install cleanly. They can also push domain controllers into LSASS crash loops, which blocks new or replacement controllers from finishing setup and can stall AD recovery work.
Microsoft says the out-of-band fixes cover Windows Server 2025, version 23H2, and Windows Server 2022, with Windows Server 2025 KB5091157 addressing both the KB5082063 install failure and the restart issue. Other supported releases get fixes for the domain controller restart problem only, including Windows Server 2019 and Windows Server 2016.
The practical risk is deployment-time failure, not remote compromise. If a domain controller cannot complete startup or setup, recovery and expansion of the directory service can be delayed until the affected build is replaced or patched.