KB5079489 - Windows 11 Version 26H1 Preview Update (OS Build 28000.1764)
Optional non-security preview update for Windows 11 version 26H1, released March 26, 2026. Delivers AI features, built-in Sysmon, RSAT for Arm64, and quality improvements.
Summary
This is an optional, non-security preview update for Windows 11, version 26H1, released March 26, 2026, carrying OS Build 28000.1764. It delivers production-quality improvements across the operating system, including new AI-powered features, security tooling, and reliability fixes. A companion servicing stack update (KB5085536, build 28000.1763) is bundled with this release. Source: Microsoft Support
Highlights
- This update ships through two rollout phases: a gradual rollout that stages delivery to devices over time, and a normal rollout that reaches all eligible devices at once when the update achieves general availability.
- Emoji 16.0 support lands in the emoji panel, adding a small curated set of new emojis spanning each major category.
- The first sign-in restore experience joins Windows Backup for Organizations, covering Microsoft Entra hybrid joined devices, Cloud PCs, and multi-user environments.
- Quick Machine Recovery (QMR) now activates automatically on non-domain-joined, non-enterprise-managed Windows Professional devices.
- A built-in network speed test is accessible directly from the taskbar via Wi-Fi or Cellular Quick Settings, or by right-clicking the network icon in the system tray.
- System Monitor (Sysmon) functionality is now native to Windows as an optional feature, writing captured events to Windows Event Log for use by security tools.
- Remote Server Administration Tools (RSAT) are now supported on Windows 11 Arm64 devices.
Improvements and fixes
Windows 11 PC experiences
- Emoji: Emoji 16.0 introduces a curated set of new emojis across major categories, now visible in the emoji panel.
- Backup and Restore: The first sign-in restore experience is now part of Windows Backup for Organizations, automatically restoring user settings and Microsoft Store apps on first sign-in for Entra hybrid joined devices, Cloud PCs, and multi-user environments.
- Quick Machine Recovery: QMR now switches on automatically for Windows Professional devices that are not domain-joined and not enrolled in enterprise endpoint management, matching the recovery features available on Windows Home. Domain-joined or enterprise-managed devices keep QMR off unless the organization enables it. QMR also now runs a one-time scan on eligible PCs; if no fix is immediately available, it directs users to the best recovery options.
- Taskbar network speed test: A built-in speed test is available from Wi-Fi or Cellular Quick Settings, or via a right-click on the network tray icon. It opens in the default browser and measures Ethernet, Wi-Fi, and cellular performance.
- Taskbar overflow behavior: With the taskbar set to uncombined mode and multiple windows open for an app, only the windows that do not fit move to the overflow menu rather than all windows moving as a group.
- Start menu account benefits: The account menu on the Start menu now includes a link to the Microsoft account benefits page.
- Camera pan and tilt controls: Settings > Bluetooth and devices > Cameras now exposes pan and tilt controls for supported cameras under the Basic settings section.
- Built-in Sysmon: Windows now includes native Sysmon functionality as an optional feature, disabled by default. It can be enabled through Settings > System > Optional features > More Windows features, or via
Dism /Online /Enable-Feature /FeatureName:Sysmon. After installation, runsysmon -ito complete setup. Users who already have the Sysinternals Sysmon installed must uninstall it before enabling the built-in version. - Widgets: Widget Settings now open as a full-page experience inside the Widgets app instead of in a dialog.
- Desktop background: WebP (.webp) images can now be set as the desktop background through Settings > Personalization > Background or by right-clicking an image in File Explorer.
- Taskbar search - group headers: Search result group headers now display result counts, and selecting a header filters results to that group.
- Taskbar search - preview: Hovering over a search result and selecting Preview shows content without opening it.
- Taskbar search - Task Manager icon: The Search process icon in Task Manager has been updated to a magnifying glass.
- Storage Settings: Several dialogs in Storage Settings have been refreshed with a more modern design, and scanning performance for temporary files has been improved.
- RSAT on Arm64: RSAT is now supported on Windows 11 Arm64 devices. Tools available include Active Directory Domain Services and Lightweight Directory Services Tools, Active Directory Certificate Services Tools, Server Manager, Group Policy Management Tools, DNS Server Tools, and DHCP Server Tools. They can be installed via Settings > System > Optional Features or Control Panel > Programs > Turn Windows features on or off.
- Windows Update Settings: Responsiveness of the Windows Update settings page has been improved.
- Sign-in screen: Reliability of the sign-in screen has been improved.
- Nearby Sharing: Reliability when sending larger files has been improved.
- Projecting: Reliability of the project menu appearing after pressing Windows logo key + P has been improved.
- Printing: Performance of the Windows printing service (spoolsv.exe) has been improved to reduce slowdowns during high-volume printing.
- File Explorer - new window: Opening a new File Explorer window by holding Shift and clicking its taskbar icon, or using the middle mouse button, is now more reliable.
- File Explorer - archive extraction: An Extract all option now appears on the command bar when browsing non-ZIP archive folders.
- File Explorer - network devices: Reliability of displaying devices on the Network page has been improved.
- Display - wake from sleep: Reliability when waking from sleep has been improved, and resume time from sleep has been reduced, particularly under heavy system load.
- Visual consistency: General visual consistency improvements have been made across the taskbar (auto-hide mode), credential fields in the Windows Security dialog, and the print dialog.
Quality fixes
- Application Control for Business: Application ID tagging in Application Control for Business policies is now more accurate, with more reliable behavior when identifying which apps should receive tags.
- Narrator: The Natural Voices experience in Narrator has been improved, and Natural Voices setup is now more reliable.
AI component updates
The following AI components are updated in this release (applicable to Copilot+ PCs only; they do not install on standard Windows PCs or Windows Server):
| Component | Version |
|---|---|
| Image Search | 1.2602.1451.0 |
| Content Extraction | 1.2602.1451.0 |
| Semantic Analysis | 1.2602.1451.0 |
| Settings Model | 1.2602.1451.0 |
Known issues
Microsoft lists no known issues for this update at the time of writing.
How to get this update
This update bundles the latest servicing stack update (SSU KB5085536, build 28000.1763) with the latest cumulative update (LCU) in a single package. No separate SSU installation is required before applying KB5079489.
Windows Update: Open Start > Settings > Update and Security > Windows Update. The update appears under the Optional updates available section. Select the link to download and install it.
Windows Update for Business: The changes will be available in the next security update released to the Windows Update for Business channel.
Microsoft Update Catalog: Download the standalone MSU files for KB5079489 directly. Two installation methods are supported:
- Method 1: Download all MSU files and place them in a single folder (for example,
C:/Packages). RunDISM /Online /Add-Package /PackagePath:c:\packages\Windows11.0-KB5079489-arm64.msufrom an elevated Command Prompt, or useAdd-WindowsPackage -Online -PackagePathfrom an elevated PowerShell prompt. DISM will discover and install prerequisite files automatically. - Method 2: Install the MSU file individually in the order listed on the Catalog page using DISM or Windows Update Standalone Installer (wusa.exe).
WSUS: Import the update manually from the Microsoft Update Catalog into Windows Server Update Services.
Removing the update: To remove the LCU, use the DISM /online /remove-package command with the LCU package name. Running wusa.exe /uninstall against the combined package will not work because the SSU is included and cannot be removed after installation.
Frequently asked questions
Does built-in Sysmon replace the Sysinternals Sysmon tool?
The built-in Sysmon provides native System Monitor functionality and writes events to Windows Event Log. It is off by default and must be enabled manually. Microsoft states that if you already have the Sysinternals Sysmon installed, you must uninstall it before you enable the built-in version. The two cannot run side by side.
Is RSAT now fully supported on Windows 11 Arm64 devices?
Yes, this update adds RSAT support for Windows 11 Arm64. Administrators can install tools including Active Directory Domain Services and Lightweight Directory Services Tools, Active Directory Certificate Services Tools, Server Manager, Group Policy Management Tools, DNS Server Tools, and DHCP Server Tools through Optional Features in Settings or Control Panel.
Will AI component updates in this package install on standard PCs or Windows Server?
No. The AI component updates included in this package - Image Search, Content Extraction, Semantic Analysis, and Settings Model - are applicable only to Windows Copilot+ PCs. Microsoft states they will not install on standard Windows PCs or Windows Server.
Can the servicing stack update be removed after installing this combined package?
No. Because the SSU (KB5085536) is combined with the LCU in a single package, the SSU cannot be removed from the system after installation. Microsoft advises reviewing the risks of removing security updates before uninstalling any component of this release.
