KB5077241

Microsoft released preview update KB5077241 (26200.7922) for Windows 11 version 25H2 (2025 update). The cumulative update package KB5065426 (build 26100.7922) is intended for Windows 11 version 25H2 (Windows 11 2025 Update) based on x64 (amd64) and ARM64 processors.

• Emoji (new). Added support for Emoji 16.0. A new set of emojis (one from each key category) is now available on the emoji panel (Win + .).
• Backup and restore (new). The first-run restore feature is now part of the Data Archiving Program for organizations. On Microsoft Entra hybrid joined devices, cloud PCs, and multi-user environments, user settings and Microsoft Store apps are automatically restored upon first login.
• Quick Machine Recovery (QMR) (new). The Quick Machine Recovery feature automatically enables on Windows Pro devices that are not domain-joined or managed by enterprise solutions. For domain-joined and enterprise devices, QMR remains disabled unless the organization manually activates it.
• Taskbar and system tray. Added a built-in network speed test. It can be launched from the Wi-Fi/cellular quick settings or via the network icon context menu. The test opens in the default browser and checks Ethernet, Wi-Fi, and mobile connections.
• Taskbar (improvement). When app button combining is disabled, entire apps no longer move to the taskbar overflow area — only the specific window that lacks space moves.
• User accounts. A new item has appeared in the profile menu in the Start menu, allowing you to navigate to the Microsoft account benefits page.
• Identity and access management (new). Added support for SID resolution for Microsoft Entra ID groups and roles. This allows cloud groups to be displayed correctly in file permissions and local groups without using on-premises Active Directory.
• Camera settings (new). In Settings > Bluetooth & devices > Cameras, added pan and tilt controls for supported cameras.
• Built-in Sysmon (new). Sysmon functionality is now integrated directly into Windows. This tool allows logging system events for threat detection and activity analysis. It is disabled by default and can be manually enabled via Optional Features or with the command: Dism /Online /Enable-Feature /FeatureName:Sysmon. After installation, you need to run the command: sysmon -i.
• Widgets. Widget settings now open on a separate page rather than in a popup window.
• Desktop background. Added support for .webp format images for desktop background via Settings > Personalization > Background.
• Search. The search process icon in Task Manager has been updated — it now uses a magnifying glass icon.
• Storage settings. Updated design of some dialog boxes, improved temporary file scanning performance.
• Windows Update. Improved responsiveness of the settings page.
• Login and lock screen. Increased reliability of the login screen.
• Nearby sharing. Increased reliability of large file transfers.
• Projection. Increased stability of the projection panel (Win + P).
• Printing. Improved performance of the print spooler service (spoolsv.exe) under large job volumes.
• File Explorer. Added an Extract All button for non-ZIP archives. Fixed an issue where a new Explorer instance would open when pressing Shift + click or middle mouse click on an icon. Increased reliability of device display in the Network section.
• Display. Optimized display performance and reduced time to exit sleep mode on busy systems. Improved reliability of exiting sleep mode for laptops with the lid closed when powered via a docking station.
• Other. Fixed minor visual issues related to automatic taskbar hiding, Windows security popups, and the print dialog.

Installation via Windows Update: go to Settings > Windows Update and click Check for updates. A computer restart is required to complete the installation. After installing the update, the Windows 11 build number will change to 26200.7918.

Note: to have preview updates installed automatically, enable the Get the latest updates as soon as they are available option in Settings > Windows Update.

How the new features work:

Emoji: Added support for Emoji 16.0. When you press Win + . to open the emoji panel, the system loads new symbols from the updated Unicode spec. The panel accesses a built-in glyph table and color font (e.g., Segoe UI Emoji), where new emojis are placed into corresponding categories — one from each key section.

Backup and restore: On first login to Windows on Entra ID-joined hybrid devices or cloud PCs, the restore environment automatically applies a previously saved profile. The system reads the user’s Entra ID token, queries the organization’s data archiving service, and restores Microsoft Store app settings as well as registry settings (HKCU) without needing on-premises AD.

Quick Machine Recovery (QMR): On Windows Pro devices without a domain or MDM management, this feature is enabled by default. During a critical failure, system components invoke a built-in recovery agent that contacts Microsoft servers, checks for known issues, and can roll back drivers or configurations. On domain-joined machines, QMR is blocked by policy until an admin manually enables it.

Taskbar and system tray: A built-in network speed test client has been added to network settings. It invokes a JavaScript test via WinRT API Windows.Networking.Connectivity, determines connection type (Ethernet, Wi‑Fi, LTE), then opens the default browser to a local web server that measures upload/download using WebRTC or HTTP/2 test file downloads.

Taskbar (improvement): When app button combining is disabled in taskbar settings, the system no longer moves an entire app to the overflow area. Instead, the window manager checks available width and moves only the specific button (window) that lacks space, keeping other windows of the same app visible.

User accounts: A new item in the Start menu’s profile menu invokes the URI ms-settings:yourinfo-benefits. When activated, the system launches the Settings navigation handler, which opens the Microsoft account benefits page in the default browser, passing session parameters for automatic sign‑in.

Identity and access management: Added SID resolution for Entra ID groups and roles. When displaying NTFS permissions, the system calls a cloud security provider that converts a cloud SID (e.g., S-1-12-...) into a readable group name. This allows local services like lsass.exe to correctly show Entra groups in ACLs without an on‑premises domain controller.

Camera settings: In Settings > Bluetooth & devices > Cameras, for webcams that support PTZ (Pan‑Tilt‑Zoom), the system reads device descriptors via USB Video Class (UVC). When you click the controls, the camera driver receives relative or absolute pan/tilt commands through IOCTL_VIDEO_SET_CAMERA_EXTENDED_CONTROL without third‑party utilities.

Built-in Sysmon: Sysmon is now an optional Windows component. After running Dism /Online /Enable-Feature /FeatureName:Sysmon, the system deploys a kernel‑mode driver (sysmon.sys) that hooks system calls (CreateProcess, NetworkConnect, FileCreateTime). When you run sysmon -i, it registers an ETW consumer to log events into Microsoft-Windows-Sysmon/Operational.

Widgets: Previously, the widget settings window was a popup rendered inside WebView2. Now, when you open widget settings, the system navigates to a separate page inside the Settings app using an XAML container. This decouples configuration from the main widget process and improves isolation.

Desktop background: The system now natively supports .webp images for desktop wallpaper. When you select a .webp file via Settings > Personalization > Background, the internal dwm.exe converter decodes the image using the Windows Imaging Component (WIC), turning it into a raster bitmap for the desktop renderer without intermediate JPEG/PNG conversion.

Search: The icon for SearchHost.exe in Task Manager has been updated to a magnifying glass. Task Manager now pulls the icon from the process resource instead of generating a generic one – the developers fixed the explicit icon index reference inside the executable.

Storage settings: Updated design of some dialogs (e.g., temporary file cleanup). Scanning performance improved by asynchronously enumerating files with FindFirstFileEx using the FIND_FIRST_EX_LARGE_FETCH flag and caching results in a thread pool – temporary folder analysis is now faster with many small files.

Windows Update: The update settings page responds faster. The old synchronous update list retrieval has been replaced with a background task – the UI no longer blocks while calling the wuauserv service. Data is cached in the local component store (C:\Windows\SoftwareDistribution) and updated asynchronously via Task Scheduler.

Login and lock screen: Login screen reliability improved. A rare race condition between LogonUI.exe and the Credential Manager has been fixed, which sometimes prevented the password field from getting focus. Timings are now synchronized through a new event protocol between Winlogon and the logon process, eliminating hangs with smart cards or PINs.

Nearby sharing: For large files (>1 GB), Wi‑Fi Direct transfer stability is improved. A buffer overflow at L2 level has been fixed – transfers are now chunked with per‑block acknowledgements over AF_BLUETOOTH sockets. If the connection drops, automatic retransmission resumes from the last acknowledged chunk instead of from the start.

Projection: The projection panel (Win + P) is more stable. The system switches display modes (PC screen only, duplicate, extend, second screen only) by calling the SetDisplayConfig API. Previously, fast consecutive presses caused a crash in displayswitch.exe due to a message queue race – now synchronization is protected by a mutex.

Printing: Print spooler service (spoolsv.exe) performance improved under heavy job loads. The original spooler lock during each job’s processing has been replaced with a thread pool for print scheduling (XPS/OpenXPS filters). Jobs now enter the queue faster, and temporary file cleanup happens asynchronously in the background.

File Explorer: Added an "Extract All" button for non‑ZIP archives (e.g., .rar, .7z) if a third‑party extension is installed. Fixed a bug where Shift+click or middle‑click on a navigation pane icon opened a new Explorer instance – now modifier flags are properly checked. Improved device display stability in the Network section by correctly polling Function Discovery.

Display: Optimized display performance and reduced time to exit sleep mode on busy systems. Improved reliability of waking laptops with the lid closed when powered via a docking station – fixed a power management driver bug that incorrectly considered the lid closed even when an external display was attached.

Other: Fixed minor visual issues: automatic taskbar hiding (pixel counting on restore fixed), Windows security popups (correct multi‑monitor centering), and the print dialog (button flickering when changing printer settings fixed).

The last 10 Windows updates: