KB5077221

Microsoft has released cumulative update KB5077221 (Build 28020.1611) for Windows 11, version 26H1. Windows 11 Insider Preview build 28020.1611 – a build that belongs to the br_release development branch, is available to Windows Insider Program participants on the Canary Channel. Users of this channel will now receive updates for Windows 11, version 26H1 (Build 28020), which is activated based on Windows 11, Version 26H1 (Build 28000) using the Feature Enablement package KB5073122.

• Built-in Sysmon. In Windows 11 Insider Preview Build 28020.1611 on the Canary channel, Microsoft begins implementing built-in Sysmon support. Previously, this tool was distributed separately via Sysinternals, but now its functionality is integrated directly into Windows. Sysmon allows logging system events that can be used for threat detection and activity analysis on the system. Administrators can use custom configuration files to filter tracked events. All data is written to the Windows Event Log, ensuring compatibility with security solutions and monitoring tools. By default, the built-in Sysmon is disabled and requires manual activation.
• Windows Share. The Windows Share window has been improved when working with OneDrive cloud files. Now, when you click "Copy link" in the context menu of a OneDrive file, additional options for sharing the link through other apps appear in the "Share using" section. The feature is rolling out to Windows Insiders signed in with a Microsoft account (excluding countries in the European Economic Area).
• General changes. Fixed an issue with the desktop watermark — it now displays the correct build number.

Installation via Windows Update Center: Go to Settings > Windows Update and click Check for updates. A computer restart is required to complete the installation.

To activate built-in Sysmon, go to Settings > System > Optional features > More Windows features and enable Sysmon, or run the command in PowerShell or Command Prompt: Dism /Online /Enable-Feature /FeatureName:Sysmon. To complete the setup, run: sysmon -i.

Important: if Sysmon was previously installed manually from the Sysinternals website, it must be removed before activating the built-in version. Sysmon functionality remains the same. Documentation will be added to Windows later.

Builds released to the Canary Channel represent the latest platform changes at early stages of development and are not tied to any specific Windows release. Features and functionalities included in these builds may never make it to the final version, as Microsoft tries out various concepts and gathers feedback. Features may change, be removed, or replaced, and some may never become available outside the Windows Insider Program. However, when these features are ready, they may appear in future Windows releases.

Many features in the Canary Channel are distributed using Control Feature Rollout technology. Initially, they become available to a small group of Insiders, and then their availability expands as feedback is received and analyzed, to assess how they are perceived before becoming available to all participants of this channel.

Some features under active development may not be fully localized. Localization will be completed as features are finalized. If you notice localization issues for your language, please report them through the Feedback Hub app.

Some features may first appear in the Dev and Beta channels before appearing in the Canary channel.

How the new features work:

Built‑in Sysmon: In Windows 11, Sysmon (previously from Sysinternals) is integrated. A file system filter driver intercepts system calls (process creation, network connections, file changes) and forwards events to the Microsoft‑Windows‑Sysmon/Operational Event Log. Administrators apply filtering rules via an XML config (Sysmon.exe -c config.xml) to reduce noise. Disabled by default — enabled manually using sysmon -accepteula -i.

Windows Share: The native Share dialog for OneDrive files now dynamically invokes URL scheme handlers of other apps. When selecting "Copy link" in the context menu, Share enumerates registered UWP/desktop apps through the ShareTargetContract instead of only classic link buffering. Rolling out to Insiders with a Microsoft account (excluding EEA region).

General changes: Fixed desktop watermark rendering that previously displayed an incorrect build version. The DWM (Desktop Window Manager) now correctly reads the build string from the registry (HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\BuildLabEx) and renders the overlay via DirectComposition, eliminating artifacts from the previous shell32.dll handler caching.

The last 10 Windows updates: