September 22, 2026—KB5124006 (OS Build 28000.3086) Preview

This cumulative update for Windows 11, version 26H1 (KB5124006), includes production-quality improvements.

Announcements and messages

This section provides key notifications related to this release, including announcements, change logs, and end-of-support notices.

Highlights

This update is available through two release phases: gradual rollout and normal rollout. A gradual rollout delivers an update in phases, so features reach devices over time instead of all at once, meaning availability varies by device. A normal rollout is the broad release to all eligible devices at the same time, usually when it reaches general availability (GA).

Note If you installed earlier updates, your device downloads and installs only the new updates contained in this package.

Gradual rollout

The following summary outlines new Windows 11 PC experiences, along with improvements and fixes. The bold text within the brackets indicates the item or area of the change.

[Taskbar]
- This update gives you more ways to customize the taskbar to match how you work and make better use of screen space.
  - New! You can now choose whether the taskbar appears at the bottom, top, left, or right side of your screen. In these other positions, tooltips, flyouts, and animations will still come from the taskbar, and most customization settings, such as never combining taskbar icons, will work with all locations. Search box and smaller taskbar are currently supported only for top and bottom positions. To change the position of the taskbar, go to Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position.
  - New! A smaller taskbar option is now available to help maximize screen space on smaller devices. This experience reduces the size of taskbar icons and the taskbar height while maintaining access to key features such as Start, Search, and the system tray. To change your taskbar size, go to Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar size. When set to Small, both the icons and the taskbar height become smaller.
  - New! The Taskbar behaviors section of the Taskbar settings page is now expanded by default for improved discoverability.
- This update improves the reliability of loading the system tray area of the taskbar for non-touch PCs.
[Start menu]
- This update makes the Start menu more personal with several customizations.
  - New! You can choose between a small or large Start menu, in addition to "Automatic (default)" that's available today. To customize this, go to Settings > Personalize > Start > Start menu size.
  - New! The "Recommended" section is renamed "Recent" in the Start menu and Settings page (Settings > Personalize > Start).
  - New! You can now hide your name and profile picture in Start by going to Settings > Personalize > Start > Hide your name and profile picture on Start.
  - New! The Start menu settings page is now redesigned with section-level toggles to independently show or hide Pinned, Recommended, and All.
[Windows Search]
- This update includes improvements that make Windows Search more dependable, easier to scan, and clearer before you click.
  - New! Search home has been simplified to reduce visual clutter and make it easier to get back to recent searches quickly.
  - New! Search does a better job showing where a result comes from, app, setting, file, web result, or Store suggestion, so it's easier to tell what you're looking at and where you will go before you click.
  - New! A new setting in Settings > Privacy & Security > Search lets you choose whether web and Microsoft Store suggestions appear alongside local results.
  - New! Windows now automatically indexes your most used folders to make those files appear in subsequent search results. You can control the setting at Settings > Privacy & Security > Search > Automatically find additional relevant locations.
[File Explorer]
- New! Launching File Explorer Home is now faster and more responsive.
- New! The Recommended section on Home now supports touch scrolling, making it easier to browse files in the carousel.
[General design] New! This update introduces updated progress indicators across Windows, providing a more consistent and modern experience during startup, sign-in, restart, shutdown, and update installation.
[Windows Share] New! This update adds the ability for users signed in with a work or school account to discover and install relevant apps directly from the share window. To manage this experience, go to Settings > System > Share and select Show suggested apps in share surfaces.
[Administrator Protection] New! Administrator protection aims to protect free floating admin rights for administrators. It enables users to perform administrative tasks using just-in-time privileges. Administrator protection is not classified as a formal security boundary; it hardens the security against elevation-of-privilege attacks with the introduction of profile separation. This feature is turned off by default and can be enabled using OMA-URI in Microsoft Intune or through Group Policy. This feature was previously disclosed in October 2025 KB5067036 and is now beginning to roll out.
[Multiple desktops] Switching between virtual desktops is now smoother and more responsive.
[Display and Graphics]
- This update improves the reliability of navigating to and interacting with Settings > System > Display.
- This update improves the persistence of previous brightness settings once the energy saver turns off.
[Task Manager] This update improves the reliability of displaying app history information in Task Manager.
[Windows Setup]
- This update streamlines the experience for selecting a secondary keyboard during Windows setup, making it easier to skip when it isn't needed.
- This update improves the Get Started app with new App install, Site pinning, and Theme pages to help you personalize your device and discover new features.
[Windows Update] This update improves restart behavior so PCs that were manually put to sleep return to sleep after completing an update, even when automatic sleep is set to Never.
[App Updates] This update adds support for participating apps to coordinate their updates with Windows Update. Supported apps can benefit from improved scheduling and a more streamlined update experience. For more information, see Windows Update Orchestration Platform (UOP).
[Microsoft Store] New! This update provides support for in-app purchases in packaged WinUI 3 apps that require elevation, helping developers offer purchases through Microsoft's integrated commerce platform.
[Windows Autopilot device preparation] New! Device association for Windows Autopilot device preparation is now generally available. This feature helps organizations identify trusted devices before enrollment, enabling device-targeted policies, automatic corporate device enrollment, and additional setup customization during the out-of-box experience (OOBE). To learn more, see Windows Autopilot device preparation.
[Microsoft Execution Containers] New! This update introduces Process Isolation for Microsoft Execution Containers (MXC), a fast, lightweight boundary for responsive workloads such as coding agents and model-generated code. It uses Windows operating-system containment capabilities to restrict access to resources such as files, networking, the user interface, and other operating-system capabilities according to policy.
[Agentic processes] New! This update introduces preview platform support for tagging agentic processes. Authorized components can assign an opaque agent identifier to a process token. Windows protects the marking and automatically passes it to child processes. When an agentic process authenticates through Web Account Manager (WAM), WAM includes the agent identifier from the process token in the authentication request. As a preview capability, the identifier format may change in future releases.
[Cryptography] New! Post-Quantum Cryptography algorithm ML-KEM can now be used as a standalone algorithm for TLS key exchange, in addition to hybrid groups added previously.
[Network]
- This update improves resiliency and recovery from potential VPN process-related background issues that can cause processes to stop responding.
- This update improves the output of the netsh wlan show wlanreport command for Japanese users.
[Input]
- This update improves the reliability of typing with the Japanese IME by reducing potential hangs.
- This update improves the persistence of voice typing settings for automatic punctuation and launcher.
[Windows Management Instrumentation Command-line (WMIC)]
- Starting in September 2026, Windows 11, version 26H1 will no longer include the Windows Management Instrumentation Command-line (WMIC) utility. WMIC is already removed by default in new installations of Windows 11, version 26H1, and will no longer be available as a Feature on Demand (FoD). This change affects only the WMIC utility; Windows Management Instrumentation (WMI) remains supported. Learn more: Windows Management Instrumentation Command-line (WMIC) removal from Windows.

Normal rollout

This non-security update includes quality improvements. The following summary outlines key issues addressed by the KB update after you install it. Also, included are available new features. The bold text within the brackets indicates the item or area of the change.

[Accessibility and Localization] This update improves the accessibility and user experience of the Intelligent Carveout interface and provides improved translations for users across supported languages and regions.
[File History (known issue)] Fixed: This update addresses an issue where File History might fail to back up or restore files to an external drive or network location. Affected devices might incorrectly display a "Reconnect your drive" message even when a compatible backup drive is connected and working properly.

Components updates

AI components

This release updates the following AI components to version 1.2607.840.0: Image Search, Content Extraction, Semantic Analysis, and Settings Model.

To learn more, see Release information for AI components.

Servicing stack update (SSU)

Includes KB5124005 (Build 28000.3081), which improves the reliability of the Windows update installation process. To learn more about SSUs, see Simplifying on-premises deployment of servicing stack updates.

Known issues in this update

Domain-joined devices might lose their secure trust relationship with the domain

Symptoms

After installing the September 8, 2026, Windows security update KB5124012, or later updates, some Credential Guard protected machine accounts might lose their secure channel with an on-premises Active Directory (AD) domain. Users might then be unable to sign in interactively with valid domain credentials and might receive a message stating that the trust relationship between the device and the domain failed. Offline sign-in using previously cached credentials might continue to work. AD replication and AD services on the domain controllers are not affected.

This issue occurs because KB5124012 and later updates enable the Machine Identity Isolation feature. While the update does not directly enable Machine Identity Isolation enforcement, it does cause Windows to begin honoring any existing or policy-provisioned settings that enabled Machine Identity Isolation enforcement. However, this feature is only supported for environments connected to domain controllers running at a Windows Server 2025 Domain Functional Level (DFL) and above. The feature should be disabled elsewhere. Any devices previously configured to use Machine Identity Isolation that are not connected to Windows Server 2025 domain controllers will experience this issue and will need to disable the feature.

Workaround

Important: This section contains information about modifying the registry. Before you modify the registry, back it up and make sure that you know how to restore it if a problem occurs. For more information, see How to back up and restore the registry in Windows.

To work around this issue, disable Machine Identity Isolation using the same management method that was used to enable it. Choose the applicable option below:

If Machine Identity Isolation was enabled by Intune policy, disable Machine Identity Isolation with Intune.
If Machine Identity Isolation was enabled by Group Policy, disable Machine Identity Isolation with Group Policy.
If Machine Identity Isolation was enabled directly in the registry, use these steps to disable it:
- On the Windows 11, version 24H2 or 25H2 device, locate the following registry paths:
```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\MachineIdentityIsolation
```
```
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard\MachineIdentityIsolation
```
- For either of these registry keys, if the value of MachineIdentityIsolation is set to 2, change it to:
```
MachineIdentityIsolation = 0
```

After you disable Machine Identity Isolation, restart the device.

Then reset the secure channel using the following command:

Test-ComputerSecureChannel -Repair -Credential (Get-Credential)

Resolution

Microsoft plans to resolve this issue in a future Windows update by temporarily preventing Machine Identity Isolation enforcement while improvements are made to the feature.

USB Audio Class 1.0 devices with error Code 10 or no output

Symptoms

After installing the September 8, 2026, Windows security update, some USB Audio Class 1.0 devices might fail to start or produce audio. Affected devices might experience one or more of the following symptoms:

The device displays an error in Device Manager: "This device cannot start (Code 10)."
No audio output.
Volume controls are unresponsive or remain at zero.
Sound settings are unresponsive or unavailable.

This issue is limited to USB Audio Class 1.0 devices.

Resolution

Microsoft is working on a resolution and will update this documentation when more information is available.

How to get this update

Before you install this update

Microsoft combines the latest servicing stack update (SSU) for your operating system with the latest cumulative update (LCU). For general information about SSUs, see Servicing stack updates.

Deployment

If you deploy dynamic updates such as this update to an existing Windows image, ensure the boot.stl file is included as part of the installation media. Failure to include the file might prevent devices from successfully starting from the installation media and can result in error code 0xc0430001.

Note

The boot.stl file is used during Secure Boot validation and must match the Windows version and architecture of the image you are updating.

To ensure the boot.stl file is included as part of the installation media, do one of the following:

Use the Update WinPE script to update an existing Windows image. (Recommended)
Manually copy the boot.stl file from the device Windows\Boot\EFI folder to the corresponding folder on your installation media before deploying the update.

For information about how to apply Dynamic Update packages to existing Windows images, see Update Windows installation media with Dynamic Update.

Install this update

To install this update, use one of the following Windows and Microsoft release channels.

Available	Next Step
	Open Start > Settings > Windows Update > Advanced options > Optional updates. In the Optional updates available area, you will find the link to download and install available updates. Check for optional updates

Available	Next Step
	These changes will appear in the next security update to Windows Update for Business.

Available	Next Step
	To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions. If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version. Note This latest update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Available

Next Step

To install this update, download the standalone package(s) for this update from the Microsoft Update Catalog. This update contains MSU files that require installation in a specific order. Follow the Arm64 installation instructions.

If you install additional Dynamic Update packages, use versions from the same release month as this update. If a Safe OS Dynamic Update or Setup Dynamic Update is not available for the same release month, use the most recently released version.

Note This latest update includes updates for AI components. AI components are applicable only to Copilot+ PCs and will not install on other Windows client PCs or Windows Server.

Arm64 installation instructions

Note The Microsoft Update Catalog may include one or more required checkpoint cumulative updates and the target cumulative update. Install the checkpoint cumulative updates in order before installing the target cumulative update.

Download all MSU files for update KB5124006 from the Microsoft Update Catalog and place them in the same folder (for example, C:/Packages). Ensure no other files are present in the folder.

This update consists of the following update file(s).

Item	MSU file
Required checkpoint cumulative update	Not required
Target cumulative update	windows11.0-kb5124006-arm64.27460707951b972385f8b2ecbb89703f5c95a6ba.msu

Method 1: Install each MSU file individually, in order

Double-click each file in the following order to install that update (if there is more than one .msu file listed):

windows11.0-kb5124006-arm64.27460707951b972385f8b2ecbb89703f5c95a6ba.msu

Note If a required checkpoint cumulative update is already present, a message will indicate that the update is already installed. For guidance on using the Windows Update Standalone Installer (Wusa.exe), see Description of the Windows Update Standalone Installer in Windows.

Method 2: Install all MSU files together

Use Deployment Image Servicing and Management (DISM.exe) to install the target cumulative update. DISM automatically scans the folder specified in the PackagePath folder and installs any required checkpoint cumulative updates.

Updating a Windows PC

To apply this update on a running Windows PC, run the following command from an elevated Command Prompt window:

DISM /Online /Add-Package /PackagePath:c:\packages\windows11.0-kb5124006-arm64_27460707951b972385f8b2ecbb89703f5c95a6ba.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Online -PackagePath "c:\\packages\\windows11.0-kb5124006-arm64_27460707951b972385f8b2ecbb89703f5c95a6ba.msu"

Updating Windows installation media

To apply this update to Windows installation media, see Update Windows installation media with Dynamic Update.

To add this update to a mounted image, run the following command from an elevated Command Prompt window:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-kb5124006-arm64_27460707951b972385f8b2ecbb89703f5c95a6ba.msu

Or, run the following command from an elevated PowerShell window:

Add-WindowsPackage -Path "c:\\offline" -PackagePath "windows11.0-kb5124006-arm64_27460707951b972385f8b2ecbb89703f5c95a6ba.msu" -PreventPending

Available	Next Step
	You can import this update into Windows Server Update Services (WSUS) manually. See the Microsoft Update Catalog for instructions.

File information

For a list of the files provided in this update, download the file information for cumulative update KB5124006.

For a list of the files provided in the servicing stack update, download the file information for the SSU (KB5124005) - version 28000.3081.

Windows monthly updates explained

Description of the standard terminology used for Microsoft software updates