"After installing the August 2026 Windows security update (the Originating KBs listed above), some Windows Server 2016 devices might generate recurring Application Error events (Event ID 1000, with exception code 0xc0000409) associated with CompatTelRunner.exe," Microsoft explained in a service alert spotted by Microsoft MVP Susan Bradley.
What failed: CompatTelRunner.exe and the Compatibility Appraiser
Microsoft says the August 2026 security update can cause recurring application errors on Windows Server 2016 when the Compatibility Appraiser diagnostic service is enabled. The failing process is CompatTelRunner.exe — the Compatibility Appraiser Telemetry Runner — which is part of Microsoft Compatibility Appraiser, a Windows Compatibility Telemetry component. Microsoft describes Compatibility Appraiser as a background system task that "checks if the device meets the hardware and software requirements for the next major Windows cumulative update or feature upgrade."
Scope of impact: physical machines, VMs, VMware and Azure included
The company warned the problem affects both physical devices and virtual machines, explicitly naming VMware and Azure environments. Microsoft framed the issue as generating recurring Application Error events (Event ID 1000) with exception code 0xc0000409 tied to CompatTelRunner.exe on some Windows Server 2016 devices after the August update.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadMicrosoft's guidance and the near-term fix plan
Microsoft's service alert acknowledges the event log entries but emphasizes they "do not affect device functionality." The company added that "The associated event log warnings can be safely dismissed temporarily until we release a resolution in an upcoming update." Microsoft said it is working on a fix that "will ship with a future Windows update" but has not shared a timeline for a permanent solution.
Related Microsoft issues: June 2026 and recent memory-management changes
Microsoft's notice arrives after a string of other Windows Server concerns this year. In June, Microsoft fixed a Windows Server 2016 known issue that caused June 2026 security updates to fail on systems that were not up to date. Separately, last week Microsoft warned customers they may experience application crashes on some Windows Server 2025 systems because of recent memory management changes. That separate issue affects applications that use Address Windowing Extensions (AWE), and on impacted systems Microsoft said users were seeing "memory corruption errors, access violation exceptions (with 0xC0000005 error codes), SQL Server crash dumps, and SQL Server services stopping or restarting unexpectedly."
What this means for technologists, virtualization/cloud admins, and SQL Server teams
- Technologists and security teams: Expect recurring Application event log entries (Event ID 1000, exception code 0xc0000409) tied to CompatTelRunner.exe on Windows Server 2016 systems where Compatibility Appraiser is enabled. Microsoft’s advisory allows these event log warnings to be "safely dismissed temporarily" because the company states they do not affect device functionality, but teams may still want to track the volume and recurrence pending a formal patch.
- Virtualization and cloud administrators (VMware, Azure): The advisory explicitly includes virtual machines running on VMware and Azure. Administrators should be aware the telemetry task can crash across both physical and virtual deployments and account for log noise when triaging other issues.
- SQL Server administrators and DBAs: While the CompatTelRunner.exe failures are tied to Windows Server 2016 telemetry, Microsoft has separately warned of application crashes on some Windows Server 2025 systems related to AWE and memory-management changes. For those environments, Microsoft reported memory corruption, 0xC0000005 access violations, SQL Server crash dumps, and unexpected SQL Server service stops or restarts — concrete symptoms DBAs should monitor where Windows Server 2025 updates have been applied.
Microsoft has provided a path to ignore the event log entries for now and promised a future fix, but it has not published a schedule. Administrators will therefore need to balance the short-term guidance — that functionality is not affected — against operational preferences for clean logs and the potential need to escalate noisy alerts. The single concrete unknown the advisory leaves: when the promised update that resolves recurring CompatTelRunner.exe failures will arrive.
Source: BleepingComputer — August updates trigger 0xc0000409 errors on Windows Server 2016
