On January 13, 2026, Microsoft released its monthly security and quality rollup for Windows 11, but this one breaks with tradition. KB5074109 isn’t a single click-to-install update for anyone grabbing it from the Microsoft Update Catalog. The patch arrives as two separate MSU files—a prerequisite checkpoint package and the main cumulative—that must be applied in a strict sequence, or via a DISM command that automates the order. Misstep on the install order and the update can fail, leaving systems partially serviced. For the millions who rely on manual offline patching, this is a workflow change worth understanding.

What actually changed in this month’s update

KB5074109 targets Windows 11 with OS builds 26200.7623 and 26100.7623. According to Microsoft’s support advisory, the package is delivered as a set of MSU files in the Update Catalog. The critical tweak: one file is a checkpoint cumulative update (KB5043080), a smaller, prerequisite base that must be in place before the larger monthly rollup (KB5074109) can land.

When you browse the catalog today, you’ll find:

  • windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu
  • windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu

Installing only the second file—the one with the KB number you recognize—will break if the checkpoint isn’t already present. Microsoft explicitly warns that “the KB contains one or more MSU files that require installation in a specific order.” The recommended approach: dump both files into a single folder and point DISM at the main update. The servicing tool will discover and apply the prerequisite automatically. That’s a new muscle memory for admins accustomed to a single MSU per patch Tuesday.

What it means for you: home users vs. IT pros

Home users and prosumers

If you rely on Windows Update, you’re insulated. The service delivers and sequences the files correctly behind the scenes. You’ll see the update appear as usual, install it, reboot, and move on. The build number will advance to 26200.7623 or 26100.7623 depending on your branch.

Power users who manually download and apply MSU files—perhaps because they manage several family PCs on a slow connection or maintain an offline repair toolkit—need to change their habits. Double-clicking the latest MSU file in File Explorer may trigger an error or an incomplete install. The safe path: download both files, place them in C:\Packages (or any folder), and run one DISM command from an elevated Command Prompt:

DISM /Online /Add-Package /PackagePath:C:\Packages\windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu

DISM will detect kb5043080 in the same folder and install it first. No need to guess the order. After the reboot, verify the build with winver.

IT administrators and image builders

This change touches every deployment pipeline that uses offline servicing or the Microsoft Update Catalog for patch management. If you inject updates into Windows images (install.wim, winre.wim), push packages via Configuration Manager, or stage MSUs for bare-metal deployments, the multi-file requirement must now be scripted.

Key operational impacts:

  • Image servicing: When mounting an offline image, place both MSU files in the same directory on your servicing host, then use DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-kb5074109-x64_...msu. DISM will pick up the checkpoint. After applying the packages, run component cleanup and export the image to reclaim space. Always back up your golden WIM before injecting updates; SafeOS dynamic updates (if included) make changes to WinRE that are non-reversible without restoring from backup.
  • Rollback planning: If the main cumulative must be removed, you can uninstall the LCU with DISM /Online /Remove-Package, but the servicing stack update (SSU) often bundled inside the combined MSU will remain. That’s permanent. Test your rollback scripts against this reality, and prepare to only remove the LCU while accepting the SSU.
  • Third-party compatibility: As with any monthly rollup, drivers, antivirus, VPN clients, and virtualization agents can misbehave. Previous cycles saw Citrix Session Recording Agent cause installation rollbacks and OpenSSH permissions break after October 2024 updates. The KB doesn’t list any new known issues as of release, but pilot rings are mandatory. Validate BitLocker, RDP, and recovery workflows early.
  • WSUS and Hotpatch environments: For shops using Windows Server Update Services or Hotpatch-enabled hosts, the separate packages may require custom approval sequencing. Microsoft’s advisory doesn’t detail WSUS handling, but the catalog’s multi-file structure implies that WSUS may offer both files separately; approve them together or rely on the automatic sequencing within Windows Update.

How we got here: the rise of checkpoint cumulatives

Microsoft has been moving toward checkpoint cumulative updates for over a year, first with Windows Server and then with Insider previews. The idea: instead of shipping a monolithic LCU every month, split the payload into a smaller, infrequently changed checkpoint and an incremental differential that changes monthly. This reduces download sizes for bandwidth-constrained environments and speeds up offline imaging because the checkpoint can be baked into a golden image once, and only the differential is applied later.

Windows 11’s servicing model now implements this pattern. KB5043080 appears to be a checkpoint that lays down a consistent code baseline, and KB5074109 is the differential with January’s security and quality fixes. The two-file delivery is not a bug; it’s the new design. The DISM command-line behavior—auto-discovering prerequisites when all files share a folder—was added specifically to handle this scenario and reduce human sequencing errors. Microsoft’s documentation on checkpoint cumulative updates explains that this model also improves the reliability of Windows Update-driven installs, because the update agent can fetch and apply the right pieces without leaving the system in a half-patched state.

What’s new for January 2026 is the arrival of this pattern in production, non-Insider Windows 11 channels. It’s the first time many sysadmins will encounter the multi-MSU requirement outside a lab. The learning curve is shallow, but the operational consequences are real, particularly for environments that still rely on simple wusa.exe /install scripts.

What to do now: a practical installation guide

  1. Download both MSU files for KB5074109 from the Microsoft Update Catalog. Save them into a single folder, e.g., C:\Packages.
  2. Open an elevated Command Prompt and run:
    DISM /Online /Add-Package /PackagePath:C:\Packages\windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu
    For an offline mounted image:
    DISM /Image:C:\mount\offline /Add-Package /PackagePath:C:\Packages\windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu
  3. Reboot when prompted.

Option B: Install each file individually, in order

If you must install the MSUs separately—for example, for auditing or compatibility reasons—follow this exact sequence:

  1. windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu (install first)
  2. windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu (install second)

Use DISM, the Windows Update Standalone Installer (wusa.exe), or your deployment tool of choice. Never reverse the order.

Verification and post-install checks

After installation, confirm the patch took hold:

  • Run winver or check Settings > System > About; the OS build should be 26200.7623 or 26100.7623.
  • In an elevated command prompt, list installed packages:
    DISM /Online /Get-Packages | findstr /i 5074109
    Both the checkpoint (if it was newly installed) and the LCU will appear.
  • Examine Windows Update history for KB5074109 and any associated reboot.
  • For image servicing: verify the mounted image with DISM /Get-ImageInfo. If you updated WinRE, use reagentc /info and check Event Viewer for WinREAgent events (Event ID 4501).

Troubleshooting common failures

  • Installation fails with CBS or DISM errors: Collect C:\Windows\Logs\CBS\CBS.log, run DISM /Online /Cleanup-Image /RestoreHealth, ensure the servicing stack is healthy, then retry.
  • The system reboots but rolls back: Look for incompatible drivers or pending reboot flags from prior operations. Uninstall or update conflicting third-party software (security agents, disk encryption utilities) and attempt the update again.
  • OpenSSH stops working after the update: This has happened before. If the service won’t start, check ACLs on C:\ProgramData\ssh. Microsoft has published workaround scripts for permission regressions in past updates.
  • WinRE mismatch: If you injected a SafeOS Dynamic Update into a recovery image, changes are permanent for that image. To revert, restore from a golden backup.

Outlook

Microsoft will likely expand the checkpoint model to more Windows 11 editions and eventually to Windows Server updates that haven’t adopted it yet. The multi-file delivery from the Catalog is here to stay, and the DISM auto-sequencing feature will become the de facto method for offline servicing. IT teams should update their deployment documentation, retrain techs on the new DISM syntax, and add verification steps to compliance checks. Home users who occasionally dip into the Catalog can adopt the folder-plus-DISM pattern as a one-line safety net.

The January 2026 update may be a routine security rollup under the hood, but its delivery is a milestone for Windows servicing logistics. Treating it as a single click now requires an extra mental step, but the trade-off—smaller future downloads and faster imaging cadences—could benefit everyone by midyear. For now, grab both files and let DISM do the ordering.