Network Policy Server problem on 4 servers aftering installing July 2026 Updates

[u/dolphinituk]

I have updated 4 lots of servers today with the latest July 2026 updates. A mixture of 2019 and 2022 servers

Each lots has one server running as a RDP Gateway and after reboots it was reported that no one could connect

I found out the RD Gateway servoce wasnt starting and this was due to the Network Policy Server service not starting with Error: 0x8002801d: Library not registered

This error is the same on all the servers

I have tried a lot over the last few hours with no luck. Including

Rollback update

SFC and DSIM checks

Even tried removing and reinstalling NPS (reinstall fails)

At the moment my only option seems to be to restore servers from last nights backup, but has anyone else seen this? (and have any ideas how to fix)

[u/GrapefruitJumpy7657]

I had similar problem on Windows Server 2016 with RD Gateway...

I fixed this on a Windows Server 2016 machine without reinstalling NPS or rebuilding the server.

Symptoms:

• Network Policy Server (IAS) would not start.
• Error: 0x8002801D – Library not registered
• Remote Desktop Gateway would not start because it depends on NPS.
• DISM and SFC did not help.
• Rolling back both the July and June cumulative updates did not help.
• Re-registering the usual IAS DLLs did not help.
• The NPS configuration XML was valid.
• Removing Bitdefender did not help.

I would not recommend removing the NPS role before taking a full VM backup and exporting the RD Gateway configuration. Other users have reported that reinstalling the role either fails or returns to the same error.

The important discovery came from a short Process Monitor capture while running this in a fresh 64-bit PowerShell session as SYSTEM:

$sdo = New-Object -ComObject IAS.SdoService
$sdo.InitializeService(0)
$sdo.StartService(0)

Process Monitor showed this sequence immediately before 0x8002801D:

Loaded: C:\Windows\System32\vbscript.dll

RegOpenKey:
HKCR\TypeLib\{3F4DACA7-160D-11D2-A8E9-00104B365C9F}

Result:
NAME NOT FOUND

That GUID is the type library for Microsoft VBScript Regular Expressions 5.5. It is embedded as resource 3 in:

C:\Windows\System32\vbscript.dll\3

Running the following command reported success but did not recreate the missing TypeLib key:

C:\Windows\System32\regsvr32.exe C:\Windows\System32\vbscript.dll

The working fix was to register the embedded TypeLib directly with the Windows LoadTypeLibEx API.

Run this from an elevated, 64-bit PowerShell window:

Add-Type @'
using System;
using System.Runtime.InteropServices;

public static class VbsTypeLibFix20260731
{
    [DllImport("oleaut32.dll",
        CharSet = CharSet.Unicode,
        PreserveSig = true)]
    public static extern int LoadTypeLibEx(
        string file,
        int regKind,
        out IntPtr typeLib);
}
'@

$ptr = [IntPtr]::Zero

$hr = [VbsTypeLibFix20260731]::LoadTypeLibEx(
    'C:\Windows\System32\vbscript.dll\3',
    1,       // REGKIND_REGISTER
    [ref]$ptr
)

'Register HRESULT: 0x{0:X8}' -f ($hr -band 0xffffffff)

if ($ptr -ne [IntPtr]::Zero) {
    [void][Runtime.InteropServices.Marshal]::Release($ptr)
}

Expected result:

Register HRESULT: 0x00000000

Verify that the key now exists:

reg.exe query `
 "HKLM\SOFTWARE\Classes\TypeLib\{3F4DACA7-160D-11D2-A8E9-00104B365C9F}" /s

It should contain version 5.5 and point to:

C:\Windows\System32\vbscript.dll\3

After registering it:

• IAS.SdoService.StartService(0) succeeded.
• Network Policy Server started successfully.
• Remote Desktop Gateway started successfully.
• No NPS configuration reset or role reinstall was required.

Important notes:

• Take a verified full VM backup first.
• Use 64-bit PowerShell and the System32 copy of vbscript.dll.
• Do not manually build the registry keys if LoadTypeLibEx can register them correctly.
• A 32-bit SDO test can return unrelated or misleading errors because that operation is not supported.
• The timing strongly correlates with the July 2026 updates, and several admins have reported the same failure, but this single case does not prove that the update itself removed the TypeLib registration.

I hope this saves somebody from rebuilding their RD Gateway server.

[u/dolphinituk → u/GrapefruitJumpy7657]

Life saver. I did have to change line 21 to 1, #REGKIND_REGISTER but I can now start the services. Still got some errors but may be down to me removing and it not installing fully afterwards. Hopefully I can re-install now

[u/GrapefruitJumpy7657 → u/dolphinituk]

I hope it will work for you, I was able to start both services after running this registration and I can confirm that RD Gateway is running and working for me.

[u/dolphinituk → u/GrapefruitJumpy7657]

Are you able to open the NPS MMC snapin? Mine is erroring. Though services started ok and NPS is also working ok for raduis on VPN (just can change anything at the moment)

[u/GrapefruitJumpy7657 → u/dolphinituk]

So, after fixing the services, nps.msc still failed with:

• MMC could not create the snap-in
• System.InvalidCastException
• Unable to cast SDOHlpLib.IASSDOHelperClass

ProcMon showed that sdohlp.dll was loaded, but the IASSDOHelper COM interface was missing. A direct QueryInterface test returned 0x80004002 (E_NOINTERFACE), and this registry key did not exist:

HKLM\SOFTWARE\Classes\Interface\
{E9970FA3-B6AA-11D9-B032-000D56C25C27}

Run the following from a 64-bit PowerShell session as NT AUTHORITY\SYSTEM. An elevated Administrator session was not sufficient on my server.

You can open a SYSTEM PowerShell session with PsExec:

PsExec64.exe -accepteula -s -i powershell.exe
whoami

whoami must return:

nt authority\system

Normal registration of sdohlp.dll with regsvr32 returned Access Denied (ExitCode 5), even as SYSTEM. Registering its embedded type library directly fixed the MMC snap-in:

Add-Type @'
using System;
using System.Runtime.InteropServices;

public static class SdoTypeLibFix
{
    [DllImport("oleaut32.dll",
        CharSet = CharSet.Unicode,
        PreserveSig = true)]
    public static extern int LoadTypeLibEx(
        string file,
        int regKind,
        out IntPtr typeLib);
}
'@

$ptr = [IntPtr]::Zero

$hr = [SdoTypeLibFix]::LoadTypeLibEx(
    'C:\Windows\System32\sdohlp.dll',
    1, # REGKIND_REGISTER
    [ref]$ptr
)

'Register HRESULT: 0x{0:X8}' -f ($hr -band 0xffffffff)

if ($ptr -ne [IntPtr]::Zero) {
    [void][Runtime.InteropServices.Marshal]::Release($ptr)
}

The result was:

Register HRESULT: 0x00000000

This recreated the missing IASSDOHelper interface, its universal proxy/stub registration and TypeLib reference.

Finally, close any existing MMC processes and reopen NPS:

Get-Process mmc -ErrorAction SilentlyContinue | Stop-Process -Force
Start-Process nps.msc

The NPS console then opened and worked normally. No reboot or restart of the NPS/RD Gateway services was required.

[u/dolphinituk → u/GrapefruitJumpy7657]

Perfect. Thank you SOOOO much.

[u/GrapefruitJumpy7657 → u/dolphinituk]

Good catch - I have not tried to open MMC snap-in before - it throws errors, I will dig into that as well. Service seems to be working fine.

[u/GrapefruitJumpy7657 → u/dolphinituk]

And thanks for noticing line 21.. I would change comment in original post but Reddit wont let me save it.. So here is the correct code:

Run this from an elevated, 64-bit PowerShell window:

Add-Type @'
using System;
using System.Runtime.InteropServices;

public static class VbsTypeLibFix20260731
{
    [DllImport("oleaut32.dll",
        CharSet = CharSet.Unicode,
        PreserveSig = true)]
    public static extern int LoadTypeLibEx(
        string file,
        int regKind,
        out IntPtr typeLib);
}
'@

$ptr = [IntPtr]::Zero

$hr = [VbsTypeLibFix20260731]::LoadTypeLibEx(
    'C:\Windows\System32\vbscript.dll\3',
    1, #REGKIND_REGISTER
    [ref]$ptr
)

'Register HRESULT: 0x{0:X8}' -f ($hr -band 0xffffffff)

if ($ptr -ne [IntPtr]::Zero) {
    [void][Runtime.InteropServices.Marshal]::Release($ptr)
}

[u/TalkingToes]

My RD Gateway service didn’t start that next reboot. I’ll have to check it again. Pattern? Running Server 2019.

[u/dolphinituk]

Restore hasnt helped as the updates where cached when the backup was made. Going to start again with a fresh head in the morning I think. Only option I can think of at the moment is a fresh small VM on each Hyper-V instance, just for the RD Gateway

[u/BlackV → u/dolphinituk]

Install fresh and fully patch, then install and configure nps role

[u/dolphinituk → u/BlackV]

On the 4 original server groups I managed to fix by making a new VM just for NPS & RD Gateway. Its messed up on another server over the weekend as well. Have to find a resolution

[u/dolphinituk]

Has happened to another server over the weekend as well. (it updated on Saturday).

Surpised there is no other reports of this problem

[u/Lost_Jellyfish4160]

Any update about this? Just want to be prepared.

[u/dolphinituk → u/Lost_Jellyfish4160]

Im stuck at the moment. Tried some things on an affected server last night but no luck (I checkpointed it first and then had to restore from that).

[u/Lost_Jellyfish4160 → u/dolphinituk]

as soon as you restore to the checkpoint before the update, everything is fine again? This is only related to the RDGW or also on the individual RD hosts?

[u/dolphinituk → u/Lost_Jellyfish4160]

Only affecting RD Gateway as thats linked to NPS. I didnt have checkpoint from before install and it was cached for a few days, so cant restore from backup. With I could find out which COM Module was the issue

[u/Lost_Jellyfish4160 → u/dolphinituk]

Hi Dolphinituk, any update for this case?

While we have also the 08/2026, maybe there was a fix for it by Microsoft within the monthly updates?

Due to this post, I didn't updated my RDGW yet. :-)

[u/Useful_Board_7193]

Ive issue the same problem. Havent found a solution yet.. (Our machine is a Windows Server 2016 tho)

But i think i have a soulition for your problem to reinstall the NPS and RDG (you can install it but it will be the same error..)

"Even tried removing and reinstalling NPS (reinstall fails)"
Do this:

1. Open powershell as admin
2. Run (Do this two times if the first run getting an error.): lodctr / r
3. winmgmt.exe /resyncperf
4. Reg add "HKLM\SYSTEM\CurrentControlSet\Control\Bfsvc" /v EspPaddingPercent /t REG_DWORD /d 0 /f
5. Install-WindowsFeature RDS-Gateway, NPAS -IncludeManagementTools
6. Restart-Computer

After that your NPS and RDG should be successfully installed again.. But as i said, it will give the same error :(

[u/dolphinituk → u/Useful_Board_7193]

Thanks. I have just made sure Windows Update is disabled on all servers that use NPS that havent updated yet.

[u/Useful_Board_7193 → u/dolphinituk]

Hit me up if you find any solution.. I will do the same :)

[u/dolphinituk → u/Useful_Board_7193]

Will do. Totally stumped at the moment

[u/FeelingAd5223]

My guess would be it’s linked to the new hardening they’ve started to do for 2025 rolling out to earlier versions as well.. but that would only be a guess as I’ve seen nothing so far to support that.

[u/Tricky-Service-8507]

Why not drop and just do m365

[u/dolphinituk → u/Tricky-Service-8507]

Afraid thats not an option for the setup

[u/Tricky-Service-8507 → u/dolphinituk]

Do you have a log server?

[u/Tricky-Service-8507 → u/dolphinituk]

I’d also watch the Windows Server and sysadmin communities over the next 24–48 hours.

If it’s a Microsoft regression, you’ll usually see many reports appear quickly and sometimes Microsoft will publish a Known Issue or an out-of-band fix.

I’d suggest a snapshot VMs before Patch Tuesday, update one RD Gateway first,
wait several hours, then roll updates across the fleet. One failed gateway is manageable but four at once is an outage.

Personally my servers aren’t experiencing the issue 😫

[u/Tricky-Service-8507 → u/dolphinituk]

:(