Access to this page requires authorization. You can try signing in or changing directories . Access to this page requires authorization. You can try changing directories . How to get Windows 11, version 25H2 Secure Boot client playbook for certificates expiring in 2026 An IT pro’s guide to Windows 11, version 25H2 Windows Server Secure Boot playbook for certificates expiring in 2026 Recent announcements This update adds Voice Isolation to Voice Access, helping it better recognize your voice by reducing interference from other speakers and background noise. Windows Hello Enhanced Sign-in Security (ESS) now supports peripheral fingerprint sensors. Taskbar notification badges for Widgets now use your Windows accent color instead of appearing red, helping reduce unnecessary attention-grabbing alerts. File sizes in the Details view now display using appropriate units (KB, MB, GB) instead of KB-only, making them easier to understand at a glance. New touchpad gesture controls let you adjust scroll and zoom speed, and enable accelerated scrolling for faster navigation through long documents. Windows 11, versions 25H2 and 24H2: KB5121767 Windows 11 Enterprise LTSC 2024: Hotpatch KB5121768 This security update includes improvements that were part of update KB5095093 (released June 23, 2026). This update addresses an issue that affects certain third-party apps that use OLE Automation to interact with Microsoft Office. This update changes hotkey unregister and cleanup behavior. This update introduces a security hardening change that enforces TDI transport registration requirements. This update upgrades the curl tool in Windows to version 8.21.0 and includes security improvements that help protect your device. July 1 – Windows Server Secure Boot AMA July 8 – Secure Boot Office Hours for virtualized environments July 15 – OEM Secure Boot Office Hours The redesigned Start menu is available on commercial and managed Windows devices. For an overview of the feature, see Configure the Windows Start menu . IT administrators can use new customization policies: HideCategoryView and ConfigureStartPins . Learn more at Start Policy CSP and Start policy settings . A calendar experience in Windows Update Settings ( Settings > Windows Update ) lets you pause updates by choosing an end date for up to 35 days. You can extend the pause by selecting a different end date and re‑pause updates as needed. Point-in-time restore for Windows helps you quickly roll back your PC, including apps, settings, and personal files, to a recent automatic restore point. It helps reduce downtime and simplifies troubleshooting when issues occur. Windows now keeps the microphone mute state in sync between the audio mixer and the Hands-Free Profile (HFP) for a more consistent experience with Bluetooth headphones with mute buttons or indicators. You can now customize the size of the right-click zone in Settings > Bluetooth & devices > Touchpad . Choose from default, small, medium, or large to control how much of the bottom-right corner responds to a single-finger right-click. This setting is only available on touchpads with a pressable surface. This security update includes improvements that were a part of update KB5089573 (released May 26, 2026). This update expands high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. This update includes a resolution for CVE‑2026‑45585 (BitLocker security feature bypass). The mitigation script remains part of the guidance and does not need to be reverted. Shared audio enables two people to listen to the same audio from a single Windows 11 PC at the identical time. Task Manager now provides enhanced visibility into NPU usage, including new metrics and AI activity insights. Multi‑App Camera allows multiple apps to access the camera simultaneously. Basic Camera mode enables simplified camera functionality, useful for troubleshooting when your camera is not working correctly You can now choose a custom name for your user folder on the Device Name page during Windows setup. User folder names must follow standard Windows naming requirements . This security update includes improvements that were a part of update KB5083631 (released April 30, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update expands high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. This update improves startup reliability after boot file updates, so devices start normally without entering BitLocker recovery. This update improves the reliability of Simple Service Discovery Protocol (SSDP) notifications to help prevent the service from becoming unresponsive. Xbox mode is now available on Windows 11 PCs, including laptops, desktops, and tablets. Xbox mode provides a streamlined, full-screen interface that places games front and center while minimizing background activity. You can enter Xbox mode from the Xbox app, Game Bar settings, or by pressing the Windows logo key + F11 . You can now experience haptic feedback on supported input devices when performing certain actions, such as aligning objects in PowerPoint, snapping or resizing windows. Haptic feedback can be managed in Settings > Bluetooth & devices > Mouse, Touchpad, or Pen > Haptic signals . Enterprise State Roaming (ESR) can now be managed through Windows Backup for Organizations policies, simplifying configuration for IT administrators. To learn more, see Enterprise State Roaming . This update adds support for a dynamic app removal list to the “Remove Default Microsoft Store Packages” policy for Windows Enterprise and Education. Administrators can remove additional MSIX/APPX apps by specifying package family names using Group Policy. For more information, see Policy-based in-box app removal .​​​​​​​

This update improves the performance of launching startup apps after starting your device (apps listed under Settings > Apps > Startup ). Microsoft 365 Copilot is also installed. Copilot wasn’t installed by the user. Copilot wasn’t launched in the last 28 days. Windows Server 2025: KB5091157 (OS Build 26100.32698) Out-of-band Windows Server, version 23H2: KB5091571 (OS Build 25398.2276) Out-of-band Windows Server 2022: KB5091575 (OS Build 20348.5024) Out-of-band Windows Server 2019: KB5091573 (OS Build 17763.8647) Out-of-band Windows Server 2016: KB5091572 (OS Build 14393.9062) Out-of-band Windows Server 2025 Datacenter: Azure Edition: Hotpatch KB5091470 (OS Build 26100.32704) Out-of-band Windows Server 2022 Datacenter: Azure Edition: Hotpatch KB5091576 (OS Build 20348.5029) Out-of-band This security update includes fixes and quality improvements from KB5079391 (released March 26, 2026 - no longer offered) and KB5086672 (released March 31, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update expands high confidence device targeting data, increasing coverage of devices eligible to automatically receive new Secure Boot certificates. Devices receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled and phased rollout. This update improves reliability for SMB compression over QUIC, reducing timeouts and enabling more consistent and dependable performance. This update enhances protection against phishing attacks that use Remote Desktop (.rdp) files by showing all requested connection settings before connecting, with settings turned off by default and a one‑time security warning on first use. Narrator now provides rich image descriptions on Copilot+ PCs and works with Copilot on all Windows 11 devices, allowing users to get instant on‑device descriptions or ask Copilot for more detail. This update improves the design of the dialog boxes in Settings > Accounts > Other users to match the modern Windows look and support dark mode. The visibility of the dialog box option depends on whether the device has a domain joined work or school account. This update improves the File Explorer experience, including more reliable unblocking of downloaded files and support for Voice Typing when renaming files. This update delivers several display improvements, including support for refresh rates above 1000 Hz, improved auto‑rotation and HDR reliability, and better power efficiency for USB4‑connected monitors during sleep. Updates and announcements – This page consolidates ongoing updates, milestones, and rollout status changes for the deployment of new Secure Boot certificates across Windows devices. Use it to stay current on important servicing communications as the deployment progresses. Sample Secure Boot E2E Automation Guide – This guide provides an end-to-end view of the PowerShell‑based automation system for deploying Secure Boot certificate updates using Group Policy to domain-joined machines in a controlled, graduated manner. It includes details, examples, and operational guidance for domain‑joined environments. A Closer Look at the High Confidence Database – This article explains how Secure Boot confidence levels are calculated, how data is evaluated and published, and how Windows servicing uses this information to determine certificate deployment readiness. It’s designed for IT pros, security teams, and support engineers who need deeper insights into certificate evaluation. Your devices receive standard Windows updates. If you are not using the RRAS management tool on Windows devices running versions 25H2 or 24H2. This security update includes improvements that were a part of update KB5077181 (released February 10, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update adds high‑confidence device targeting, expanding coverage for automatic Secure Boot certificate delivery. This update improves File Explorer search reliability when searching across multiple drives or "This PC". This update improves the reliability of choosing trusted catalog files. It adds a warning dialog that helps you confirm that the file you select comes from a trusted source. ​​​​​​​ The Emoji 16.0 release introduces a small, thoughtfully curated set of new emojis, one from each major category. Each emoji carries timeless symbolism and practical versatility. These new emojis now appear in the emoji panel . A built‑in network speed test is now available from the taskbar. You can open it from the Wi‑Fi or Cellular Quick Settings, or by right-clicking the network icon in the system tray. The speed test opens in the default browser and measures Ethernet, Wi‑Fi, and cellular connections. You can now control pan and tilt for supported cameras in the Settings app. The controls appear under Settings > Bluetooth & devices > Cameras , in the “Basic settings” section for your selected camera. Windows now brings System Monitor (Sysmon) functionality natively to Windows . Sysmon helps you capture system events for threat detection, and you can use custom configuration files to filter the events you want to monitor. Windows writes captured events to Windows Event Log, which allows security tools and other applications to use them. Windows 10 Enterprise LTSB 2016 : October 13, 2026 Windows 10 IoT Enterprise 2016 LTSB : October 13, 2026 Windows Server 2016 : January 12, 2027 This security update includes improvements that were a part of update KB5074109 (released January 13, 2026), KB5077744 (released January 17, 2026), and KB5078127 (released January 24, 2026). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update addresses an issue that determines device eligibility for the full-screen gaming experience. This update addresses an issue that prevented some devices from connecting to certain WPA3‑Personal Wi‑Fi networks. Additional resources Last updated on 2026-08-05