The VxD driver does a lot of the heavy lifting and is responsible for initializing WSL9x as well as handling userspace events that have to be relayed to the kernel (i.e., page faults and syscalls), which it does in a rather interesting way due to limitations in the Win9x architecture.
I don't think any organization wants to pay for ESU licenses. Many organizations will migrate, but a non-trivial subset will rely on ESU as a safety net because their constraints are less about 'deciding to upgrade' and more about validating dependencies and coordinating operational downtime.
But are things getting worse? According to Register readers, and the company's own release health dashboard, the answer has to be yes. It isn't just you. The frequency of emergency out-of-band releases for the company's operating systems has been rapidly increasing to the point where, for every Patch Tuesday update, there'll likely be at least one out-of-band patch to fix whatever got broken.
Microsoft is warning organizations about the impending end of support for several Windows products from 2016. These include Windows Server 2016, Windows 10 Enterprise 2016 LTSB, and Windows IoT Enterprise LTSB 2016. According to Microsoft, these products are approaching the final stage of their lifecycle, which has direct consequences for organizations that still depend on this software. The lifecycle documentation on Microsoft Learn shows that Windows Server 2016 has not received regular support since January 2022 and is now fully in the extended support phase.
The issue focuses on how Windows handles these directories for specific user sessions. Because the kernel creates a DOS device object directory on demand, rather than at login, it cannot check whether the user is an admin during the creation process. Unlike UAC, Administrator Protection uses a hidden shadow admin account whose token handle can be returned by the system when calling the NtQueryInformationToken API function.