windows-stemcell-v2019x.html.md.erb

---
title: Stemcell v2019.x (Windows Server version 2019) Release Notes
owner: Windows
modified_date: false
---

This topic includes release notes for Windows stemcells used with the following runtimes:

- <%= vars.windows_runtime_full %> (<%= vars.windows_runtime_abbr %>) v2.5 and later:
  - For Windows stemcell compatibilities with <%= vars.windows_runtime_abbr %>, see specific stemcell version notes below.
- VMware <%= vars.k8s_runtime_full %> (<%= vars.k8s_runtime_abbr %>, formerly PKS) v1.5 and later:
  - For Windows stemcell compatibilites with <%= vars.k8s_runtime_abbr %>, refer to the [Release Notes](https://docs.pivotal.io/tkgi/release-notes.html) for your <%= vars.k8s_runtime_abbr %> version.

The stemcell is based on Windows Server, version 2019.

To download a stemcell, see [Stemcells (Windows)](https://network.pivotal.io/products/stemcells-windows-server) on VMware Tanzu Network.
  <p class="note"><strong>Note</strong>: Manual stemcell creation is deprecated.
    Use <code>stembuild</code> v2019.23 or later to create stemcells automatically.
    For more information,
    see <a href="https://docs.pivotal.io/application-service-windows/<%= vars.current_major_version.sub('.', '-') %>/create-vsphere-stemcell-automatically.html">Creating a Windows Stemcell for vSphere Using stembuild</a>.
  </p>

## <a id="2019.48"></a>2019.48

**Release Date**: May 13th, 2022

### Changes

- The Stembuild binaries for this release have been built using Golang 1.18 which has stricter requirements for TLS certificates. If you experience issues, ensure your vCenter certificates are valid, include a Subject Alternative Name and do not use the older SHA-1 hash function.

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday May 10, 2022](https://support.microsoft.com/en-us/help/5013941)

## <a id="2019.47"></a>2019.47

**Release Date**: April 14th, 2022

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday April 12, 2022](https://support.microsoft.com/en-us/help/5012647)


## <a id="2019.46"></a>2019.46

**Release Date**: March 15th, 2022

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday March 8, 2022](https://support.microsoft.com/en-us/help/5011503)

## <a id="2019.45"></a>2019.45

**Release Date**: February 9th, 2022

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday February 8, 2022](https://support.microsoft.com/en-us/help/5010351)

## <a id="2019.44"></a>2019.44

**Release Date**: January 14th, 2022

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday January 11, 2022](https://support.microsoft.com/en-us/help/5009557)

## <a id="2019.43"></a>2019.43

**Release Date**: January 3rd, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday December 14, 2021](https://support.microsoft.com/en-us/help/5008218)

## <a id="2019.42"></a>2019.42

**Release Date**: November 10th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday November 9, 2021](https://support.microsoft.com/en-us/help/5007206)

## <a id="2019.41"></a>2019.41

**Release Date**: October 14th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday October 12, 2021](https://support.microsoft.com/en-us/help/5006672)

## <a id="2019.40"></a>2019.40

**Release Date**: September 14th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday September 14, 2021](https://support.microsoft.com/en-us/help/5005568)

## <a id="2019.39"></a>2019.39

**Release Date**: August 11th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday August 10, 2021](https://support.microsoft.com/en-us/help/5005030)

## <a id="2019.38"></a>2019.38

**Release Date**: July 15th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday July 12, 2021](https://support.microsoft.com/en-us/help/5004244)

## <a id="2019.37"></a>2019.37

**Release Date**: June 10th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday June 8, 2021](https://support.microsoft.com/en-us/help/5003646)

## <a id="2019.36"></a>2019.36

**Release Date**: May 12th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday May 11, 2021](https://support.microsoft.com/en-us/help/5003171)

## <a id="2019.35"></a>2019.35

**Release Date**: April 15th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday April 13, 2021](https://support.microsoft.com/en-us/help/5001342)

## <a id="2019.34"></a>2019.34

**Release Date**: March 30th, 2021

### Changes

- Includes bosh-agent 2.373.0:
  - Enables the use of disk UUID to identify and mount ephemeral disks. This fixes an issue where the agent only accepted disk indices and ignored disks specified by UUID.
  - Fixes an issue with the agent becoming unresponsive after a restart if the BOSH-configured NICs are migrated to a vSwitch which has other hidden virtual adapters with the same MAC address.

## <a id="2019.32"></a>2019.32

**Release Date**: March 15th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday March 9, 2021](https://support.microsoft.com/en-us/help/5000822)

## <a id="2019.31"></a>2019.31

**Release Date**: February 25th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday February 9, 2021](https://support.microsoft.com/en-us/help/4601345)

## <a id="2019.30"></a>2019.30

**Release Date**: January 16th, 2021

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday January 12, 2021](https://support.microsoft.com/en-us/help/4598230)

## <a id="2019.29"></a>2019.29

**Release Date**: December 11th, 2020

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday December 8, 2020](https://support.microsoft.com/en-us/help/4592440)

## <a id="2019.28"></a>2019.28

**Release Date**: November 12th, 2020

### Security Patches

- Works with [Microsoft Security Updates Patch Tuesday November 10, 2020](https://support.microsoft.com/en-us/help/4586793)

### Changes

- Double WinRM connection timeouts to 2 minutes (up from 1 minute)
- Set Connection Timeout on WinRM file upload to 2 minutes (down from unlimited)

## <a id="2019.27"></a>2019.27

**Release Date**: October 15th, 2020

### Security Fix
- Includes the Tuesday October 13th, 2020 Microsoft security updates patch.
 For more information, see 
 [October 13, 2020—KB4577668 (OS Build 17763.1518)]
 (https://support.microsoft.com/en-us/help/4577668) 
 in the Microsoft Windows support documentation.

## <a id="2019.26"></a>2019.26

**Release Date**: September 21st, 2020

### Security Fix
- Includes the Tuesday September 8th, 2020 Microsoft security updates patch.
 For more information, see 
 [September 8, 2020—KB4570333 (OS Build 17763.1457)]
 (https://support.microsoft.com/en-us/help/4570333) 
 in the Microsoft Windows support documentation.

<p class="note"><strong>Note</strong>: This release does not include an Azure stemcell due 
  to a change in the Azure Marketplace image publishing requirements. 
</p>

## <a id="2019.25"></a>2019.25

**Release Date**: August 25th, 2020

### Security Fix
- Includes the Tuesday August 25th, 2020 Microsoft security updates patch.
 For more information, see 
 [August 11, 2020—KB4565349 (OS Build 17763.1397)]
 (https://support.microsoft.com/en-us/help/4565349/windows-10-update-kb4565349) 
 in the Microsoft Windows support documentation.

### Bug Fix
- Fixed a bug to ensure UTC timezone is set in the Windows VMs.  

### End of General Service Notice

This stemcell release is the last release supporting stemcell-builder and manually creating stemcells. 
After this release, you must use the stembuild-based approach to build stemcells. 

## <a id="2019.24"></a>2019.24

**Release Date**: July 24th, 2020

### Security Fix
 - Includes the Tuesday July 14th, 2020 Microsoft security update patch.
 For more information, see
 [July 14th, 2020—KB4558998 (OS Build 17763.1339)](https://support.microsoft.com/en-us/help/4558998/windows-10-update-kb4558998)
 in the Microsoft Windows support documentation.


## <a id="2019.23"></a>2019.23

**Release Date**: June 25th, 2020

### General Availability Release of stembuild
This release announces the general availability of stembuild.
For more information about stembuild, see [Creating a Windows Stemcell for vSphere Using stembuild]
(https://docs.pivotal.io/application-service-windows/<%= vars.current_major_version.sub('.', '-') %>/create-vsphere-stemcell-automatically.html).

### Security Fix
 - Includes the Tuesday June 9th, 2020 Microsoft security update patch.
 For more information, see
 [June 9, 2020—KB4561608 (OS Build 17763.1282)](https://support.microsoft.com/en-us/help/4561608)
 in the Microsoft Windows support documentation.

### Features
- `stembuild construct` identifies the location of the base VM, including across multiple data centers.
- `stembuild construct` logs out any users who are logged in while the `construct` command is in progress,
ensuring minimum disruption during stemcell creation.

### Deprecation Notice for Manual Stemcell Creation Process

The manual procedure for creating stemcells is deprecated.
Support for manual stemcell creation ends September 2020.
Ensure that you start using the new stembuild-based stemcell
creation procedure on or before September 2020.
See
[Creating a Windows Stemcell for vSphere Using stembuild](https://docs.pivotal.io/application-service-windows/<%= vars.current_major_version.sub('.', '-') %>/create-vsphere-stemcell-automatically.html).

## <a id="2019.22"></a>2019.22

**Release Date**: May 21st, 2020

### Security Fix
- Includes [Microsoft Security Updates Patch Tuesday May 12th, 2020](https://support.microsoft.com/en-us/help/4551853)

### Features
- `stembuild construct` streams logs after the target VM reboots. Stembuild reconnects to the target VM using WinRM to stream logs after the VM reboot, showing you what is occurring on your target VM.
- The BOSH Agent version is upgraded to v2.317. This version of the BOSH Agent can create a `vcap` user on a Windows VM.


## <a id="2019.21"></a>2019.21

<p class="note"><strong>Note</strong>: There is no Windows stemcell v2019.21.</p>


## <a id="2019.20"></a>2019.20

**Release Date**: April 24th, 2020

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday April 14th, 2020](https://support.microsoft.com/en-us/help/4549949)


## <a id="2019.19"></a>2019.19

**Release Date**: March 25th, 2020

### <%= vars.windows_runtime_abbr %> Compatibilities

This stemcell and later v2019.x versions work with:

-  <%= vars.windows_runtime_abbr %> v2.6.15, v2.7.11, or v2.8.6 and later.

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday March 10th, 2020](https://support.microsoft.com/en-us/help/4538461)
- For issues encountered with upgrading to the correct <%= vars.windows_runtime_abbr %> versions, see the following articles in the Knowledge Base:
  - [windows2019fs cert-injector failed when upgrading <%= vars.windows_runtime_abbr %> tile](https://community.pivotal.io/s/article/windows2019fs-cert-injector-failed-when-upgrading-PASW-tile)
  - [Windows container crashes on Windows Stemcells created on vSphere with VMware tools 11.0.1-11.0.5](https://community.pivotal.io/s/article/windows-app-container-crashing-after-Windows-stemcell-upgrade)

## <a id="2019.18"></a>2019.18

<p class="note"><strong>Note</strong>: There is no Windows stemcell v2019.18.</p>


## <a id="2019.17"></a>2019.17

**Release Date**: February 14th, 2020

### <%= vars.windows_runtime_abbr %> Compatibilities

This stemcell and later v2019.x versions work with:

-  <%= vars.windows_runtime_abbr %> versions v2.6.15, v2.7.11, or v2.8.6 and later.

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday February 11, 2020](https://support.microsoft.com/en-us/help/4532691).
- For issues encountered with upgrading to the correct <%= vars.windows_runtime_abbr %> versions, see the following articles in the Knowledge Base:
  - [windows2019fs cert-injector failed when upgrading <%= vars.windows_runtime_abbr %> tile](https://community.pivotal.io/s/article/windows2019fs-cert-injector-failed-when-upgrading-PASW-tile)
  - [Windows container crashes on Windows Stemcells created on vSphere with VMware tools 11.0.1-11.0.5](https://community.pivotal.io/s/article/windows-app-container-crashing-after-Windows-stemcell-upgrade)

### Features

- Supports signed URL capability.
If Windows users opt in, the BOSH agent manages artifacts on the blobstore using signed URLs rather than blobstore credentials.
For more information on how to opt in to signed URLs, see
[Signed URLs](https://bosh.io/docs/director-blobstore-signed-urls/) in the _Cloud Foundry BOSH_ documentation.
- `stembuild` validates the VM OS is Windows Server 2019, OS build 17763. This is
the only OS version that stembuild v2019.x is compatible with.

### Bug Fixes

- Fixed a bug where `stembuild construct` did not execute successfully if it could not fetch
updated root certificates from the public Windows Update Server.
<p class="note"><strong>Note</strong>: You must manually update your certificates if your VM does not have
  access to the public Windows Update Server.</p>
- Fixed a bug that tried to validate your VM credentials before connecting to the VM via WinRM.
For more information on the original validation bug, see ["Validating connection to vm..." step fails during stembuild construct for Stembuild v2019.15]
(https://community.pivotal.io/s/article/Validating-connection-to-vm-step-fails-during-stembuild-construct-for-Stembuild-v2019-15)
in the Knowledge Base.


## <a id="2019.16"></a>2019.16

<p class="note"><strong>Note</strong>: There is no Windows stemcell v2019.16.</p>


## <a id="2019.15"></a>2019.15

**Release Date**: January 18, 2020

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday January 2020](https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/2020-Jan). This release includes fixes for [CVE-2020-0601](https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601).

### Known Issues

- `stembuild construct` may fail when it validates the connection to the VM. This is caused by the WinRM configuration. For more information about the specific symptoms and recommended temporary workaround for this issue, see ["Validating connection to vm..." step fails during stembuild construct for Stembuild v2019.15](https://community.pivotal.io/s/article/Validating-connection-to-vm-step-fails-during-stembuild-construct-for-Stembuild-v2019-15) in the Knowledge Base.

<p class="note"><strong>Note</strong>: The feature to update root certificates in stembuild-built stemcells released in 2019.14 requires internet connection to the Windows Updates Server to complete successfully.</p>


## <a id="2019.14"></a>2019.14

**Release Date**: December 16, 2019

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday December 2019](https://support.microsoft.com/en-us/help/4530715)

### Features

- Updated stembuild to always use the latest version of OpenSSH (8.0.0-p1-beta as of this release)
- Root certificates on machines deployed using stembuild-built stemcells get updated certificates from the Windows Updates Server


## <a id="2019.13"></a>2019.13

**Release Date**: November 22, 2019

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday November 2019](https://support.microsoft.com/en-us/help/4523205)

### Features

- Added logging and exit code to `stembuild construct` to allow users to see the progress of the command and know whether it has completed preparing the VM for packaging
- Added retry behavior for the file rename operation in the compilation VM to reduce risk of compilation failure due to custom antivirus installations in the base image


## <a id="2019.12"></a>2019.12

**Release Date**: October 10, 2019

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday October 2019](https://support.microsoft.com/en-us/help/4519338)

### Features

- Added a flag to `stembuild package` to allow user to specify patch version for the stemcell .tgz output
- Aligned Internet Explorer-based policies in stemcells built using stembuild with Microsoft Baseline Security Standard

### Bug Fixes

- Fixed a bug where `stembuild construct` was failing to execute with a DISM error

<p class="note"><strong>Note</strong>: Do not use <code>stembuild-2019.11</code> because it will fail on <code>stembuild construct</code>. Use <code>stembuild-2019.12</code> instead.</p>


## <a id="2019.11"></a>2019.11

**Release Date**: September 26, 2019

### Security Fixes

- Includes [Microsoft Security Updates Patch Tuesday September 2019](https://support.microsoft.com/en-us/help/4512578)

### Features

- Enabled the Hyper-V Windows feature for enabling Windows 2019 stemcells built using stembuild
- Improved security hardening of Windows stemcells by aligning Internet Explorer-based policies with the [Microsoft Baseline Security Standard](https://docs.microsoft.com/en-us/windows/security/threat-protection/security-compliance-toolkit-10)

### Bug Fixes

- Fixed a bug that left user directories on the target machines after a user had terminated a BOSH SSH connection into that machine:
    - Deleted: `.ssh` directory and all normal files in the home directory that may have been created during the SSH session.
    - Not deleted: `.dat` files loaded as part of the registry hive when a user logs in. Files will exist with file locks until the next VM reboot.

<br>
<p class="note"><strong>Note</strong>: There is no Windows stemcell v2019.10.</p>


## <a id="2019.9"></a>2019.9

**Release Date**: August 27, 2019

### Features

- Includes [Microsoft Security Updates Patch Tuesday August 2019](https://support.microsoft.com/en-us/help/4511553)
- Aligned a set of audit policies on the stemcells based on [Microsoft Baseline Security Standard](https://www.microsoft.com/en-us/download/details.aspx?id=55319)
- Introduced a new feature in `stembuild construct` command to validate/invalidate the OS based on stembuild version.


## <a id="2019.8"></a>2019.8

**Release Date**: July 23, 2019

### Features

- Includes [Microsoft Security Updates Patch Tuesday July 2019](https://support.microsoft.com/en-us/help/4507469)
- Windows Defender is installed but disabled on all stemcells.


## <a id="2019.7"></a>2019.7

**Release Date**: July 1, 2019

### Features

- Key improvements in stembuild with features such as SSH enable-by-default for deployed Windows VMs on vSphere and security fixes.
- Enabled the Hyper-V Windows feature for enabling Windows in PKS and NSX-T compatibility with Windows teams.


## <a id="2019.6"></a>2019.6

**Release Date**: June 19, 2019

### Security Fixes

- Includes Microsoft Security Updates [June 11, 2019—KB4503327](https://support.microsoft.com/en-us/help/4503327/windows-10-update-kb4503327)
- Introduces 2.3.1.2 (L1) and 1.1.1 (L1) CIS L1 policy hardenings based on the CIS Security Benchmark.


## <a id="2019.5"></a>2019.5

**Release Date**: May 30, 2019

### Security Fixes

- Based on [Microsoft's guidance](https://support.microsoft.com/en-us/help/4072698/windows-server-speculative-execution-side-channel-vulnerabilities-prot#section-10), additional fixes to protect against speculative execution side-channel vulnerabilities


## <a id="2019.4"></a>2019.4

**Release Date**: May 22, 2019

### Features

- Platform Engineers can deploy Windows Stemcells on a BOSH Director with Google Cloud Storage as their external Blobstore.
- Improved Troubleshooting of Windows VMs, with ssh enabled by default for all Windows VMs. You can still disable SSH in the <%= vars.windows_runtime_abbr %> tile.
- Includes Microsoft Security Updates to protect against Microarchitectural Data Sampling side-channel vulnerabilities. For more information, see [May 14, 2019—KB4494441 (OS Build 17763.503)](https://support.microsoft.com/en-us/help/4494441/windows-10-update-kb4494441) in the Windows support documentation.

## <a id="2019.3"></a>2019.3

**Release Date**: April 25, 2019

### Features

- This is the first 2019 stemcell.
- Includes [Microsoft Security Updates Patch Tuesday April 2019](https://support.microsoft.com/en-us/help/4493509)