Microsoft blocks Dell PCs from July KB5101650 rollout

Microsoft applied a safeguard hold on this month’s Windows 11 security update, KB5101650, for a limited set of Dell devices running Windows 11 25H2 and 24H2. Affected machines were pulling KB5095093 — the June 23 preview — and then throwing a yellow exclamation in Device Manager next to the Intel Innovation Platform Framework Processor Participant driver, followed by unexpected shutdowns, poor performance, increased heat, and battery drain. The Windows Release Health entry was opened at 09:03 PT on 2026-07-14 and updated at 09:33 PT.

Root cause per Microsoft: an incompatibility between that Intel IPF driver — which handles power and thermal on affected Dells — and the new Windows USB-C Connection Manager interface Microsoft shipped in the June 23 preview. Dell caught it in its own testing. Redmond and Dell are working the fix together; Microsoft says a resolution is coming “in the coming days.”

What that means in practice:

• Affected devices: Windows 11 25H2 or 24H2, on OS Build 26100.8737 or later, on the specific Dell models that ship with Intel IPF Processor Participant. Microsoft has not published the model list. If you see the yellow-bang on that driver in Device Manager, you’re in the affected set.
• Server: none. This is client-only.
• What Microsoft is doing: KB5101650 will not be offered to affected devices through Windows Update while the hold is in place. The rest of the fleet gets the July security update on the normal cadence.

Here’s what to actually do, in the order you should be doing it:

1. Don’t force-install KB5101650 on affected Dells. No wusa /install, no manual .msu, no WSUS override to punch through the safeguard hold. The hold exists because the underlying June preview already broke thermal/power on those boxes; adding July’s security update on top doesn’t unbreak them and puts you further out on a limb when the actual fix ships.
2. If a Dell has already installed KB5095093 and is shutting down, that’s the June preview causing it, not July. Preview updates aren’t mandatory — if you deploy previews through your patch ring for pre-flight testing, this is exactly the kind of thing that ring is supposed to catch. Uninstall the June preview (wusa /uninstall /kb:5095093) and hold at OS Build 26100.8655 until Microsoft ships the resolution. Uninstalling a preview does not affect your security posture; June’s actual security update was KB5094126 from June 9, and that one stays.
3. On unaffected devices, take KB5101650 as normal. This month’s security update carries the fixes for the three exploited/disclosed zero-days in AD FS, SharePoint, and BitLocker — those are the load-bearing patches, and you don’t want to defer them across the whole fleet because a subset of Dells is having a bad week.
4. Watch the release-health page for the resolution. Microsoft historically ships these as a Known Issue Rollback that lands quietly through Windows Update, but if it’s a driver-side fix from Dell or Intel, it’ll come as an OEM firmware/driver package instead. Read the actual note when it lands — don’t assume.

The honest timeline: the offending preview shipped June 23. Dell reported the incompatibility in testing. Microsoft confirmed the issue publicly the same morning it shipped July’s security update — 2026-07-14, 09:03 PT — and applied the hold before broad rollout. That’s the system working as designed: preview builds surface breakage, safeguard holds keep the security update off the boxes that would trip on it, and the rest of the fleet still patches on time.

The failure mode to avoid is treating the safeguard hold as a general reason to freeze July across your Windows fleet. It isn’t. The three zero-days from this Patch Tuesday — CVE-2026-56155 (AD FS, KEV), CVE-2026-56164 (SharePoint, KEV), and CVE-2026-50661 (BitLocker, disclosed) — patch this month’s update. Patch the rest of the fleet. Let the affected Dells wait.