KB5073722: 6 Proven Steps to Install It Safely

Written by: Kymakers Support Team · Reviewed by: Kymakers Technical Team
Last updated: July 2026 · Applies to: Windows Server 2016, Windows 10 version 1607, Windows 10 Enterprise LTSB 2016 (OS Build 14393.8783)
Difficulty: Intermediate · Estimated time: 30–60 minutes

KB5073722 is the January 13, 2026 cumulative security update for Windows Server 2016 and Windows 10 version 1607, bringing the OS to build 14393.8783. It resolves 50 security vulnerabilities, including three zero-days and one rated critical — which makes it a priority install rather than an optional one.

There’s one detail that catches people out: for manual installation you must install the servicing stack update KB5073447 before KB5073722, or it will fail. This guide covers what the update changes, that prerequisite, six proven install steps, and the two deadlines Server 2016 administrators need on their radar.

⚠️ Two deadlines to plan around

Server 2016 cumulative updates end on January 12, 2027 — after that, no more security patches. And Secure Boot certificates for Server 2016 expire in June 2026, meaning both the UEFI Secure Boot DB and KEK need updating to the 2023 certificate versions. If you’re still running Server 2016, these two dates should be driving your upgrade planning now, not later.

Table of Contents

1. What KB5073722 changes
2. Step 1: Install the SSU first (manual installs only)
3. Step 2: Install via Windows Update
4. Step 3: Install manually from the Update Catalog
5. Step 4: Verify the install
6. Step 5: Fix install failures
7. Step 6: Check the modem driver removal
8. Planning past Server 2016
9. FAQ

What KB5073722 Changes

KB5073722 supersedes December 2025’s KB5071543 and rolls in the out-of-band update KB5074974 from December 18, 2025. Alongside the 50 security fixes, three changes are worth knowing about:

• Credential autofill hardening — a security change that restricts certain applications from automatically filling login credentials. This closes an avenue that could be abused during remote access or automated workflows, but it may affect automation scripts that relied on that behaviour.
• Modem drivers removed — legacy modem drivers are removed by this update. Any hardware depending on them stops working after installation. Rare in 2026, but worth checking if you run older industrial or telephony equipment.
• WinSqlite3.dll updated — resolves a vulnerability that some security scanners had been flagging.

The credential autofill change is the one most likely to surprise an administrator, so test it against your automation before a wide rollout.

Step 1: Install the SSU First (Manual Installs Only)

This is the step that causes most failed manual installations of KB5073722.

The corresponding servicing stack update is KB5073447. For automated deployments through Windows Update or Windows Update for Business, it’s offered and installed automatically as part of the process — you don’t need to do anything.

But for manual installation, you must download and install KB5073447 before KB5073722. Skip it and the cumulative update fails. Download the SSU from the Microsoft Update Catalog, install it, reboot if prompted, then proceed with the main update.

Step 2: Install via Windows Update

The simplest route, and the one that handles the SSU automatically.

1. Open Settings → Update & Security → Windows Update.
2. Click Check for updates.
3. KB5073722 is offered and installs, with KB5073447 handled as part of the process.
4. Restart when prompted.

For managed environments, approve it through WSUS or your update management platform as normal — the SSU dependency is handled there too. This is the recommended path for most deployments.

Step 3: Install Manually From the Update Catalog

Use this when Windows Update is broken, the server is isolated, or you’re staging updates offline.

1. Install KB5073447 (the SSU) first — see Step 1.
2. Go to the Microsoft Update Catalog and download the correct package for your platform (Server 2016 x64, or Windows 10 1607 x86/x64).
3. Run the .msu file, or deploy it with DISM:

DISM /Online /Add-Package /PackagePath:C:\Packages\windows10.0-kb5073722-x64.msu

1. Restart the server.

Getting the order wrong here — cumulative update before servicing stack — is the single most common cause of a failed manual install.

Step 4: Verify the Install

Confirm KB5073722 applied by checking the build number. Run winver, or from PowerShell:

Get-ComputerInfo | Select-Object OsBuildNumber, OsVersion

You’re looking for build 14393.8783. You can also check installed updates:

Get-HotFix | Where-Object {$_.HotFixID -eq "KB5073722"}

If the build number didn’t change after a restart, the update didn’t apply — move to Step 5.

Step 5: Fix Install Failures

If KB5073722 fails to install, work through these in order:

1. Confirm the SSU is installed. For manual installs, verify KB5073447 applied first. This resolves the majority of failures.
2. Repair the component store. From an admin Command Prompt: sfc /scannow, then DISM /Online /Cleanup-Image /RestoreHealth, then sfc /scannow again. Our System File Checker and DISM guide explains why that order matters.
3. Clear the update cache. Stop the Windows Update and BITS services, clear the SoftwareDistribution folder, restart the services, and retry.
4. Check free disk space. Cumulative updates need several gigabytes free on the system drive to stage.
5. Check for superseded update conflicts. Occasionally an older security update conflicts with a newer cumulative one. If a specific KB is implicated in the error log, removing the superseded update can clear the path.

Review C:\Windows\Logs\CBS\CBS.log for the specific failure if the generic steps don’t resolve it.

Step 6: Check the Modem Driver Removal

This one only affects a small number of environments, but it’s disruptive when it hits.

KB5073722 removes legacy modem drivers. If your server or workstation connects to industrial equipment, telephony systems, fax hardware, or older serial devices that rely on those drivers, that hardware will stop working after installing.

Check before deploying: inventory any modem or serial-communication hardware, confirm with the vendor whether it depends on the in-box Windows modem drivers, and check whether an updated vendor driver is available. If it isn’t, you’ll need to weigh the security fixes against the hardware dependency — and plan a replacement path, since the drivers aren’t coming back.

Planning Past Server 2016

Installing KB5073722 keeps a Server 2016 machine patched, but it’s worth being honest about the timeline.

Server 2016 cumulative updates end January 12, 2027. After that, no security patches — an internet-facing or business-critical server in that state is a genuine risk, not a theoretical one. And the Secure Boot certificate expiry in June 2026 arrives even sooner, requiring UEFI DB and KEK updates to the 2023 certificate versions.

If you’re running Server 2016 in production, the sensible plan is to use the remaining months to migrate to a supported version rather than to arrive at the deadline unprepared. Our Server 2019 end of life guide covers the wider lifecycle picture across versions.

FAQ About KB5073722

What build does KB5073722 install?
OS Build 14393.8783, on Windows Server 2016, Windows 10 version 1607, and Windows 10 Enterprise LTSB 2016. Verify with winver.

What does KB5073722 fix?
It resolves 50 security vulnerabilities, including three zero-days and one critical. It also hardens credential autofill behaviour, removes legacy modem drivers, and updates WinSqlite3.dll.

Do I need KB5073447 before KB5073722?
For manual installation, yes — KB5073447 is the servicing stack update and must be installed first, or the cumulative update fails. Through Windows Update or WSUS it’s handled automatically.

Why does KB5073722 fail to install?
The most common cause is a missing servicing stack update on a manual install. After that: component store corruption (run SFC and DISM), a stale update cache, or insufficient disk space.

Does KB5073722 break any hardware?
It removes legacy modem drivers, so hardware depending on them stops working. Check any modem, fax, or serial-communication equipment before deploying.

How long is Windows Server 2016 supported?
Cumulative updates end January 12, 2027. Secure Boot certificates for Server 2016 expire in June 2026, requiring UEFI DB and KEK updates before then.

KB5073722 keeps Server 2016 patched, but with support ending January 12, 2027, migration planning matters more than any single update. Kymakers supplies genuine Windows Server 2025 Standard and Windows Server 2022 licences with instant delivery and activation support, so you can plan the upgrade on your own timeline. If a server is crashing rather than just needing patches, our Windows Server critical process died guide covers that, and Best Practice Analyser helps audit a new deployment.

Install the SSU first. Verify the build number afterwards. And use the time before January 2027 to plan the migration properly.

Official reference: January 13, 2026—KB5073722 (OS Build 14393.8783) — Microsoft Support