KB5079385

Microsoft released cumulative update KB5079385 for Windows 11, version 25H2 for insiders on the Dev channel – Windows 11 Insider Preview Quality Update (26300.7965). The preliminary build Windows 11 Insider Preview Build 26300.7965 (KB5079385) was released. Users of this channel will now receive Windows 11, version 25H2 updates, which are available using the enablement package KB5073032 (build 26300.xxx).

• Administrator protection. In Windows 11 Insider Preview Build 26300.7965 (Dev Channel), Microsoft re-enables the Administrator protection feature. It is designed to protect administrative rights and reduce risks associated with permanent administrator rights on the system. The feature provides a just-in-time administrative privilege model. This means a user with administrator rights can perform administrative actions, but privileges are granted only for the duration of a specific operation. This reduces the risk of abuse or compromise of administrative rights by malicious software. The feature is disabled by default. Administrators can enable it via OMA-URI in Microsoft Intune or using Group Policies.
• File sharing (Drag tray improvement). Based on user feedback, Microsoft refined the Drag tray interface. A more compact peek view is now used, reducing the chance of accidental panel appearance and making it easier to close when working near the top of the screen.
• File Explorer (voice input when renaming). When renaming files in File Explorer, you can now use voice input (Win + H).
• File Explorer (fix for white flashes). Fixed a white flash when opening new File Explorer windows or tabs if it is set to open the “This PC” section. Also fixed white flashes when resizing File Explorer interface elements.
• File Explorer (file unlocking reliability). Improved reliability of unlocking files downloaded from the internet so they can be correctly viewed in the File Explorer preview pane.

Installation via Windows Update: go to Settings > Windows Update and click Check for updates. A computer restart is required to complete installation.

Features and capabilities that are included in Dev channel builds may never appear in the final release, as Microsoft actively tests different concepts and gathers feedback. Features may change, be removed, or be replaced and may not leave the Windows Insider program. Some of them may appear in future versions of Windows when fully ready.

Some prerelease features may not be fully localized in all languages. Localization will gradually improve as feature development completes. If you notice translation issues for your language, report them through the Feedback Hub.

Please note that some accessibility features may temporarily not work with prerelease features such as Recall and Click to Do.

Since the Dev and Beta channels represent parallel development tracks, there are cases where some features and capabilities appear first in the Beta channel.

Administrator protection: The feature implements a just-in-time (JIT) privilege model. Normally, an admin process holds a high integrity level token. When protection is enabled, Windows creates two tokens – medium integrity (user) and a shadow admin token. During an admin operation, the system temporarily elevates only that specific action via AdjustTokenPrivileges, then revokes rights immediately after completion, preventing malware from abusing long-term admin rights.

File sharing (Drag tray improvement): The improved Drag tray switches to a compact peek view. It adjusts touch event thresholds (WM_TOUCH), narrows the activation zone, and auto-dismisses the panel when the drag item is released or focus is lost. This reduces accidental panel triggers near the top of the screen while keeping drag sharing functional.

File Explorer (voice input when renaming): This function uses Win + H to activate Windows speech recognition. When focus is on the file rename field, Explorer calls ISpeechRecognizer API, converts voice to text using a local language model, then injects text via SendInput as if typed manually.

File Explorer (fix for white flashes): White flashes were caused by a white background painted before dark UI elements loaded. The fix changes the WM_CREATE/WM_PAINT order, initializes DirectUI rendering faster, and applies the final color scheme before the first paint, especially when opening "This PC".

File Explorer (file unlocking reliability): Downloaded files have an NTFS alternate data stream Zone.Identifier:ZoneId=3. Locking occurred when Explorer kept the stream open during preview. The fix improves RtlQueryZoneIdentifier handling and ensures file handles are closed correctly before passing data to the preview pane.

The last 10 Windows updates: