KB5095093

Microsoft has released the preliminary cumulative update KB5095093 (build 26200.8728) for Windows 11 version 25H2 (2025 Update) based on x64 (amd64) and ARM64 processors. The update includes gradually rolled out improvements and fixes aimed at enhancing stability, performance, and user experience, including AI-based features and platform development.

• Point-in-time restore for Windows. A new flexible restore feature allows you to quickly roll back your PC — including apps, settings, and personal files — to one of the recent automatic restore points. This reduces downtime and simplifies troubleshooting when failures occur. Learn more in the Point-in-time restore for Windows document.
• Update pause calendar in Windows Update. In the Windows Update settings (Settings > Windows Update), a calendar interface has appeared where you can pause updates by selecting an end date — for up to 35 days. The pause can be extended by selecting another end date, and updates can be paused again as needed.
• Quiet and focused Widgets experience. Widgets no longer open on hover. Notifications and taskbar icons are collapsed by default, and the icons themselves use Windows accent colors. On first use, Widgets open on the dashboard by default. New users see a simplified lock screen experience, where Weather is the only default widget. Widgets can be customized to your liking via Settings in the navigation bar. Dashboard icons show the notification count and are automatically cleared after leaving the dashboard. Some default values are preserved based on usage, while others change to reduce interruptions. The reliability, responsiveness, and visual quality of Widgets have been improved.
• Color screen tint in Accessibility. Applies a full-screen color layer to reduce eye strain and improve readability. You can choose one of the preset colors, adjust the intensity, or enable it automatically. The feature is available under Settings > Accessibility.
• Magnifier improvements. You can now input the zoom percentage directly and change it with a step right in the Magnifier window for more precise and flexible control. The zoom increment step can now be changed directly from the Magnifier panel, without going into Windows Settings.
• Quick actions on File Explorer Home page. When hovering over a file on the File Explorer Home page, quick actions are now displayed — Open file location and Ask Copilot. This capability is now also supported for work and school accounts (Entra ID). The feature is not available in the European Economic Area.
• File Explorer address bar improvement. The address bar now supports paths with double backslashes and quotation marks (for example, C:\Users\user or "C:\Users\user") — compatibility with more input formats has been improved.
• Address bar suggestion dropdown fix. The dropdown list has become more reliable — it now closes consistently after selecting an item.
• OneDrive file duplication fix in Favorites. Fixed an issue on the File Explorer Home page where OneDrive files could be duplicated in the Favorites section.
• File renaming fixes. Fixed an issue where text was repeatedly selected when renaming items in folder views, and an issue where a case change in the file name did not immediately appear in folder views for items stored locally or in the cloud.
• Bluetooth microphone mute state synchronization. Windows now synchronizes the microphone mute state between the audio mixer and the Hands-Free Profile (HFP) for a more consistent experience with Bluetooth headsets that have microphone mute buttons or indicators.
• Bluetooth audio device compatibility improvement. AirPods appear faster in pairing mode, and microphone reliability on Beats Studio Pro has been improved.
• Bluetooth audio stability and quality improvement. Improved Bluetooth audio stability with specific PC manufacturer drivers (error 0x9F). Improved the quality and reliability of voice calls through classic audio devices with Hands-Free Profile (HFP). Improved LE Audio streaming reliability after disconnection and reconnection. Reduced the time before sound playback starts on LE Audio accessories when using the microphone.
• Reliable Bluetooth device removal. Removing Bluetooth devices works more reliably when the Bluetooth radio is turned off or changed after pairing — the "Failed to remove" message appears less often.
• Bluetooth settings page stability improvement. The Settings > Bluetooth & devices page works more smoothly and consistently.
• Bluetooth reconnection time reduction. Reduced the reconnection time for classic Bluetooth audio devices after Windows resumes from hibernation. Improved reliability when disconnecting LE Audio accessories — for example, when another device, like a phone, connects.
• Audio routing improvement for Phone Link. During an outgoing call dialed from the paired phone, audio stays on the phone during ringing and is transferred to the PC only when answered from the PC. When Do Not Disturb mode is enabled in Windows, the incoming call sound from the paired phone no longer plays on the PC.
• Voice access and voice typing in French, German, and Spanish. As you speak, the PC improves the text in real time: corrects grammar, punctuation, and recognition errors, and enhances clarity even with background noise. This makes dictation smoother and reduces the need for manual corrections. Available on Copilot+ PCs.
• In-box HD Audio driver reliability improvement. Improved the audio subsystem operation.
• Start menu invocation reliability improvement. Improved the reliability of invoking the Start menu when clicking the left edge of the Taskbar when taskbar icons are aligned to the left.
• GIF provider change for the Emoji Panel. The Emoji Panel (Win + period) now uses GIPHY as the GIF provider — browsing and sharing GIFs has become smoother after the discontinuation of Tenor support.
• Networking improvements for virtualized environments. Confidential Virtual Machines (CVM) now use SR-IOV hardware acceleration by default to increase network throughput, and a network configuration error in Hyper-V nested virtualization has been fixed for reliable VM network provisioning. What is SR-IOV? Are you interested? Read the description.
• Windows networking stack reliability improvement. Reduced the number of system crashes (blue screen) related to Wi-Fi power management, and improved cellular connectivity (WWAN), including IPv6 VPN support. Also improved compatibility with third-party VPN software and SR-IOV configurations on server hardware. Network adapter settings and bindings are now preserved during OS upgrades.
• IPP protocol printer installation by default. New printer installations now use the Internet Printing Protocol (IPP) by default when supported — this simplifies setup and improves reliability. The behavior can be changed using a toggle under Settings > Bluetooth & devices > Printers & scanners > Install printers by default using Windows Ready Print. Details on the deprecation of third-party drivers can be found in the End of Servicing Plan for Third-Party Printer Drivers on Windows document.
• WSL usage improvement. Improved the use of Windows Subsystem for Linux (WSL) in mirrored networking mode with VPN.
• Rendering and color profile reliability improvement. Improved rendering reliability of content when scrolling in certain applications stretched across multiple monitors. Improved the reliability and preservation of applied color profiles.
• Location settings display change. When location services are turned off, the Default location and Allow location override settings are displayed as inactive — to eliminate confusion about when they take effect. This change is located under Settings > Privacy & security > Location.
• Search Group Policy application reliability improvement. Improved Search operation with Group Policies.
• Right-click zone size setting on touchpad. The size of the right-click zone can now be configured under Settings > Bluetooth & devices > Touchpad. Options available are Default, Small, Medium, and Large. If the device manufacturer provides a setting through their own app, a Custom option will appear. The setting is only available on touchpads with a pressable surface. Also, improved recognition of English characters during Japanese handwriting input.
• Overall system reliability improvement. Made changes to improve explorer.exe reliability — including on sign-in and lock screens when using third-party credential providers. Reduced the likelihood of empty gray placeholders appearing instead of icons on the Taskbar. Improved the reliability of navigating to the File Explorer Home page during OneDrive synchronization. Improved explorer.exe reliability when switching between multiple desktops. Improved application launch reliability when shell extensions are installed. Fixed issues with acrylic blur effects in the Start menu, Settings, and on the lock screen.
• Device coverage expansion for new Secure Boot certificates. As part of Windows quality updates, additional high-confidence targeting data has been added, expanding the coverage of devices that automatically receive new Secure Boot certificates. Certificates are delivered only after receiving a sufficient number of successful installation signals, ensuring a controlled phased rollout.
• Secured Netlogon connections improvement. Improved secured Netlogon connections between domain controllers — connections from a domain member server to domain controllers configured before 2025 are now successfully established.
• Network share connection improvement. Connections used by applications and system functions, such as the NetUseAdd function, now work more reliably — including unauthenticated connections (null session).
• Start menu operation improvement. Newly installed or removed apps now appear without needing to log out or restart. This primarily affects apps that create a folder in the Start menu with multiple shortcuts.
• Taskbar notification icon display improvement. Notification counters and the icons themselves now update correctly, making it easier to stay informed of new activity.

To install the update, go to Settings > Windows Update and click Check for updates. A system restart is required to complete the installation. After the update, the Windows 11 build number will change to 26200.8728.

If update KB5095093 deleted your files, you can download the Recuva program, which can quickly restore files after a possible failure.

How the new features work:

Point-in-time restore for Windows. The feature leverages Volume Shadow Copy Service (VSS) to create snapshots of the system volume, preserving the state of the registry, binaries, and user profile. During rollback, the boot manager selects a saved checkpoint, after which the system atomically replaces the registry hives, restores the NTFS file structure via the change journal, and recreates hard links to unchanged data blocks, minimizing downtime through incremental restore logic.

Update pause calendar in Windows Update. The calendar interface interacts with the Task Scheduler and the wuauserv service, setting a temporary block in the registry under HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU via the NoAutoUpdate parameter or creating a deferred trigger. When a date is selected, the mechanism calculates a timeout of up to 35 days and sends a command to the COM interface of the Update Agent, which pauses scanning and package downloads without removing already downloaded files.

Quiet and focused Widgets experience. The widgets panel no longer expands on hover due to the removal of onmouseover event handlers in the WebView2 host, reducing background activity of Edge WebView. Collapsing notifications and applying accent color is implemented through integration with the Action Center API and UISettings. On the dashboard, counters update via the local notification broker, resetting the count when the widgets window loses focus, preventing the accumulation of unseen alerts.

Color screen tint in Accessibility. The function engages the DWM (Desktop Window Manager) compositing layer, overlaying a full-screen color filter atop the final frame buffer before it is sent to the display, similar to the night light mode. Intensity and preset selection are modulated through the ISettings interface in the Windows.UI.Accessibility namespace, allowing real-time adjustment of the alpha channel and RGB transformation matrix without requiring applications to redraw their content.

Magnifier improvements. The Magnify.exe component now directly accepts numerical zoom percentage input via a NumericUpDown control in its panel, modifying the view matrix transformation coefficient without accessing the Settings app. The zoom increment step is changed locally through an internal slider that affects the ZoomIncrement parameter in the registry (HKCU\Software\Microsoft\ScreenMagnifier), enabling precise discrete scaling independent of global settings.

Quick actions on File Explorer Home page. When hovering over a file, a command bar flyout is invoked, initiating contextual operations through IExplorerCommand. The "Open file location" action calls ShellExecute with the openfolder parameter. The Copilot query constructs a file link string and passes it to the chat interface via Launcher.LaunchUriAsync, with Entra ID accounts undergoing conditional access policy checks during the process.

File Explorer address bar improvement. The path parser in the address bar has been modernized to handle escaped sequences: double backslashes \ are interpreted as a literal separator for UNC or local paths, and quotation marks correctly extract string literals containing spaces. This unifies input processing, as pasting paths from PowerShell scripts with double backslashes and quotes previously often resulted in parsing errors.

Address bar suggestion dropdown fix. The autocomplete mechanism, based on the IAutoComplete2 interface, has been refined regarding dropdown state synchronization: after selecting an item, a CB_DISMISS message is immediately sent to destroy the popup, eliminating the list hanging caused by desynchronization between the user input thread and the background system index search thread.

OneDrive file duplication fix in Favorites. The issue was caused by incorrect merging of two namespaces: the local Favorites list stored in %AppData%\Microsoft\Windows\Network Shortcuts, and the cloud alias provided by the OneDrive registry filter (GPO). The sync filter now checks the link hash before adding it to the view, preventing the simultaneous display of a local shortcut and a cloud placeholder file pointing to the same target resource, thus eliminating duplicates.

File renaming fixes. An error in ListView was fixed, where, during slow processing of a rename system notification (SHCNE_RENAMEITEM), the edit-control procedure would repeatedly select text, interfering with user input. The property caching issue was also resolved: changing character case in the name did not invalidate the display cache, as the comparison function considered names equivalent, not triggering a redraw of the item in "Details" view.

Bluetooth microphone mute state synchronization. The Hands-Free Profile (HFP) stack now tracks state changes of the audio endpoint (KSNODETYPE_MICROPHONE_ARRAY) via KSPROPERTY_AUDIO_MUTE. When the physical button on the headset is toggled, an AT-command message triggers a callback in the audio mixer, synchronizing the Mute flag between the HFP rendering endpoint and the capture graph, preventing indicator mismatches between the system and the device.

Bluetooth audio device compatibility improvement. For AirPods, the timing of the response to the fast pairing inquiry scan (Inquiry Scan) has been optimized, allowing the SWIFT Pair profile to receive the MAC address faster. Microphone reliability on Beats Studio Pro has been improved by adjusting eSCO packet synchronization parameters, reducing the number of retransmissions and preventing audio channel drops during 2.4 GHz interference at critical sync intervals.

Bluetooth audio stability and quality improvement. A critical error 0x9F (DRIVER_POWER_STATE_FAILURE), related to ACPI timeouts in specific vendor drivers when resuming from sleep with an active audio stream, has been fixed. Voice call quality via HFP has been enhanced through jitter-compensated buffering. LE Audio reliability has been strengthened by correctly handling CIS channel disconnection events, and playback start latency has been reduced by preloading the LC3 codec before the isochronous stream is established.

Reliable Bluetooth device removal. A radio state polling mechanism has been added to the removal dialog: if the radio is off or the adapter has been restarted, the system first performs a software power-on via Enable-BluetoothRadio in the driver stack, waits for initialization, and then sends the Remove Device command to the BTHPORT stack, preventing the false "Failed to remove" message caused by transport unavailability.

Bluetooth settings page stability improvement. The Settings > Bluetooth & devices page now uses asynchronous data binding to a model obtained from the BluetoothAdapter WinRT component. This prevents UI hangs when slowly enumerating GATT characteristics of remote devices, as long-running polling operations are offloaded to a background thread with subsequent dispatcher notification via CoreDispatcher.RunAsync.

Bluetooth reconnection time reduction. When resuming from hibernation, Windows immediately restores the RFCOMM connection context using cached session keys from the registry's PM_STORE, avoiding a full re-negotiation of pairing. For LE Audio, the disconnection procedure upon aggressive channel takeover by another device (e.g., a phone) has been improved: the CIS stream is correctly released, and the headset transitions to directed advertising mode for a rapid return.

Audio routing improvement for Phone Link. During an outgoing call dialed from the paired phone, the system tracks the line state via Hands-Free Profile commands. The ringing sound plays locally on the phone, and audio routing to the PC (through BT_HFP.sys) is activated only after receiving a CallState == Active event with the endpoint switch flag on the PC side. Do Not Disturb mode suppresses the ringtone via the Quiet Hours API.

Voice access and voice typing in French, German, and Spanish. The local speech recognition engine, utilizing ONNX Runtime models on the Copilot+ NPU, performs streaming post-processing: a neural network corrects grammatical errors and automatically inserts punctuation into the speech buffer, applying a transformer output adjustment model. Noise suppression isolates the voice signal from the environment using beamforming, after which the cleaned spectrum is fed to the decoder for improved accuracy.

In-box HD Audio driver reliability improvement. The operation of the audio subsystem has been improved: hdaudio.sys now includes additional controller state checks before sending commands over the HD Audio Link, preventing deadlocks during simultaneous requests from multiple audio streams. The interrupt handling mechanism has also been optimized, eliminating the loss of DMA buffer initialization events under high bus load.

Start menu invocation reliability improvement. Click event handling on the left edge of the Taskbar, when icons are left-aligned, has been improved. The HitTest for the area a few pixels wide to the left of the first icon now uses a deferred Rect boundary check, compensating for animation offsets, ensuring stable invocation of the Start menu flyout without false positives on overlapping windows.

GIF provider change for the Emoji Panel. Following the discontinuation of Tenor support, the panel component (invoked by Win + .) has been switched to the GIPHY API. Content loading now occurs via HTTP requests to api.giphy.com using a developer key embedded in emoji.dll resources. Results are cached locally in %LocalAppData%\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState, and the UI uses a virtualized list for smooth preview scrolling.

Networking improvements for virtualized environments. For Confidential Virtual Machines, Single Root I/O Virtualization (SR-IOV) is now enabled by default, allowing Virtual Functions to directly access the physical network adapter, bypassing the hypervisor and increasing throughput. A Hyper-V virtual switch configuration error in nested virtualization, where port profiles were incorrectly assigned and blocked the guest network stack, has been fixed.

Windows networking stack reliability improvement. The number of BSODs caused by Wi-Fi power management has been reduced by refining wdiwifi.sys, eliminating a race condition in FsmPowerTransition. WWAN cellular connectivity has been improved, including stabilizing the IPv6 VPN tunnel by handling PDP context change events. Third-party VPN compatibility has been enhanced through expanded WFP filters. Network adapter settings and bindings are now migrated via an EDGE XML manifest during OS upgrades.

IPP protocol printer installation by default. The printer installation wizard now queries port 631 first via Get-PrinterPort for IPP support and prefers the Microsoft IPP Class Driver. This avoids installing vendor kernel-level drivers, using a universal driver that runs in the isolated PrintIsolationHost.exe environment. The behavior can be disabled using the toggle in the Printers & scanners section, which restores priority to proprietary discovery protocols.

WSL usage improvement. In mirrored networking mode for WSL with VPN, the DNS request forwarding logic from the Linux distribution has been fixed: the virtual switch now correctly forwards packets to the VPN interface via netfilter hooks, avoiding routing loops. This ensures that WSL traffic is correctly tunneled through the VPN connection without leaking to the local gateway when network mirroring is enabled.

Rendering and color profile reliability improvement. Rendering artifacts when scrolling on multi-monitor configurations with different scaling factors have been fixed; the DWM compositor now unifies texture sizes before composition. ICM/ICC profile handling has been improved: the WcsSetCalibrationManagement function ensures gamma table application prior to display chain initialization, preventing profile resets when a display is hot-plugged.

Location settings display change. When location services are disabled, the "Default location" and "Allow location override" controls now dynamically bind to the master toggle state. If the LocationService is stopped, these settings receive the IsEnabled=False flag via binding to SystemSettings.Location.IsActive, visually appearing grayed out, thus eliminating user confusion about whether values apply when geolocation is off.

Search Group Policy application reliability improvement. The search client has reworked its reading of policies from HKLM\Software\Policies\Microsoft\Windows\Windows Search. When Group Policy is updated (GPUpdate), SearchIndexer.exe now rereads the full configuration without caching old values and correctly handles conflicts when merging GPOs from multiple scopes, eliminating UI hangs when indexing prohibitions for specific paths are applied.

Right-click zone size setting on touchpad. The setting manages Precision Touchpad gesture configuration through the IOCTL_INTERNAL_TOUCHPAD_SET_RIGHT_CLICK_ZONE control code sent to the class driver. The available options (Default, Small, Medium, Large) modify the exclusion area within the cursor movement zone, where a press is interpreted as a right-click. If the vendor provides an application, the driver prioritizes its profile, displaying the Custom option.

Overall system reliability improvement. A refactoring of explorer.exe has eliminated deadlocks during the initialization phase of third-party credential providers and stabilized icon rendering on the Taskbar, preventing the appearance of gray placeholders. Navigation reliability to the Home page during OneDrive synchronization and desktop switching has been improved. Acrylic blur bugs, where an incorrect background brush layer calculation caused the effect to disappear, have been fixed.

Device coverage expansion for new Secure Boot certificates. Through monthly quality updates, the high-confidence telemetry database is expanded, identifying PCs compatible with new UEFI Secure Boot certificates (KEK/db). The certificate update delivery service accumulates positive signature verification signals, and only after a threshold is reached activates the updated certificate installation through svchost.exe -k netsvcs, implementing a controlled phased rollout.

Secured Netlogon connections improvement. The authentication mechanism between domain controllers has been updated to handle legacy security contexts: servers configured before 2025 now successfully establish a secure channel with 2026 member servers, as the negotiation protocol has been extended to support hybrid RC4/AES encryption during the transition period, eliminating session establishment errors due to version incompatibility.

Network share connection improvement. NetUseAdd calls and internal system functions now correctly handle null sessions, allowing unauthenticated connections to network shares bypassing token validation. An SMB client bug has been fixed where the authentication flag check discarded requests with empty passwords, even if the server allowed anonymous access, disrupting legacy logging and printing scenarios.

Start menu operation improvement. The application installation system now synchronizes the Start menu database with shell:programs in real time via the SHChangeNotify notification mechanism with SHCNE_MKDIR and SHCNE_RMDIR flags. This allows tiles and shortcuts to appear or disappear instantly without a shell restart, which is particularly relevant for installers that create a folder with multiple shortcuts.

Taskbar notification icon display improvement. Counters on icons and the icons themselves in the notification area now update via an atomic Shell_NotifyIcon call with the NIM_MODIFY parameter. This ensures that the counter change and icon redraw occur synchronously, eliminating delays where the new icon appeared but the old counter remained, misleading the user about new activity.

The last 10 Windows updates: