# 1 - I'm unsure of what "Out of Band" officially means so I will avoid answering that directly, but normally patches are posted shortly after their release from Microsoft based on the severity of the patch.

#2 - https://www.catalog.update.microsoft.com/Search.aspx?q=KB5015019%20%20, It appears this patch is for Windows 2016 Server or Windows 10 1607, both or which are EOL, but Microsoft will release patches for the LTSB (LTSC?) versions of those operating systems.

In General, ZPM does release patches that are only available for LTSB/LTSC Operating Systems, but will not install them on Non-LTSB/C versions of Windows, since Windows will remove them later on Non-LTSB/C versions.

In regards to this specific patch, I can ask but I cannot see it because I do not have any devices that old in my zone, so it would not have downloaded.

I'm still looking into it, but I do not see the ones for the current OS either.

https://www.techzine.eu/news/security/79467/microsoft-emergency-update-fixes-authentication-issues-in-windows-ad/

This was noted -> "The OOB Windows updates are only accessible through the Microsoft Update Catalog and will not be available via Windows Update. The following cumulative updates are available for installation on Domain Controllers (no client action is required):"

This would almost make me suspect that one would need to create a "Custom" patch since this will not come down by default even using native MS tools without making a "Custom Patch" in their software.

However, that is just conjecture, and I am still looking.

Update: Out-Of-Band patches are supplied, but may take longer than normal to be available.  I don't have an ETA.  So while I cannot promise 100% they will show up, it does now appear as if they will.