thankyouforpatching.com11 openbuilt 2026-10-25 00:21 UTC

~LenelS2

Hold

Old OnGuard vs new Windows: the Login Driver can't find its way home

Open

Vendor
LenelS2
Products
LenelS2 OnGuard 7.4-8.1 and Windows cumulative updates Aug-Oct 2026
Date
Status
Open

Call: Hold, only on hosts running OnGuard 8.1 or older. This is reported, not confirmed. I count about 5 independent reports across three r/Lenel threads. LenelS2 hasn’t posted anything official, and it isn’t on Microsoft release health.

Trigger: the August 11, 2026 cumulative updates and every one since, because they’re cumulative. October’s KB5127648 and its Server versions are included.

  • KB5120418 (Server 2016 / Win10 1607)
  • KB5120238 (Server 2019)
  • KB5120242 (Server 2022)
  • KB5120233 (Server 2025)
  • KB5120249 (Win10 22H2/21H2)
  • KB5121003 (Win11 24H2/25H2)
  • One user also names KB5120710.

What breaks:

  • OnGuard asks for the “Login Driver Location” and can’t reach its database.
  • Event ID 9 shows up in the RPC-Events log, from SystemAdministration.exe.
  • Users have narrowed it to the 32-bit RPC runtime: SysWOW64\rpcrt4.dll 10.0.26100.8875 works and 10.0.26100.9168 doesn’t.
  • Re-imaged machines get hit hardest, because current install media has the updates slipstreamed in. There’s nothing to uninstall.
  • One integrator saw about 8 customers in a single day.

Versions:

  • 7.4, 7.5, 7.6 and 8.0 are affected.
  • 8.1 is disputed: two posters say it’s affected and one says it’s fine. A second-hand LenelS2 TSG statement, relayed by ckirejevas, says only 8.0 and below are affected and 8.1-8.4 are not. Until LenelS2 says so in writing, treat 8.1 as at risk.
  • LenelS2 lists 8.0 end of support in Aug 2024 and 8.1 in Dec 2025.

Don’t hold quietly. The October CU fixes CVE-2026-96951, a Windows Shell zero-day that is being exploited and is on CISA KEV. A held OnGuard box needs compensating controls:

  • No email or web browsing on it.
  • Segment it from user networks.
  • Write down the date the hold ends.

What people are doing:

  • Rollback: uninstall the update on server and clients, then pause updates. This works if the update can be uninstalled.
  • Don’t: some users swapped rpcrt4.dll back to the 8875 build. That’s unsupported, it rolls back RPC security fixes, and it puts a hand-edited system DLL on the box that unlocks your doors.
  • Fix: upgrade to a supported OnGuard release under your SSA, and confirm the path with LenelS2 support.

Everyone else: I found no October breakage for Genetec, Milestone XProtect, C•CURE 9000, Avigilon or Pro-Watch. Honeywell hadn’t posted its October Pro-Watch tested-patch list as of Oct 24.

Sources: r/Lenel 1vneny5, r/Lenel 1ws95ac (r/accesscontrol cross-post), r/Lenel 1vx5z5d (r/accesscontrol cross-post), LenelS2 end-of-life notices, Honeywell Pro-Watch patch testing notices.

Sources