KB5079464

Microsoft has released cumulative update KB5079464 for Windows 11 version 25H2, intended for insiders on the Dev channel. This update is a preview build of Windows 11 Insider Preview Build 26300.8068 (KB5079464), and users of that channel will now receive Windows 11 version 25H2 updates available through the enablement package KB5073032 (build 26300.xxx).

• Removal of preinstalled Microsoft apps via policies. In Build 26300.8068, Microsoft updated the "Remove Default Microsoft Store packages" policy for Windows Enterprise and Education editions. It now supports a dynamic app removal list, allowing IT administrators to flexibly manage preinstalled MSIX/APPX apps by adding their Package Family Name (PFN) to a special list. The policy is located at: Computer Configuration > Administrative Templates > Windows Components > App Package Deployment > Remove Default Microsoft Store packages. To remove an app, add its PFN to the "Specify additional package family names to remove" setting. You can identify the package family name using the Get-AppxPackage command in Windows Terminal.
• Windows driver policy update. Starting with this update, the Windows kernel will enforce a new policy that removes default trust for cross-signed drivers, trusting only drivers certified through the Windows Hardware Compatibility Program (WHCP). This feature first enables in audit mode (minimum 100 hours of uptime and 3 reboots), then automatically activates when compatible. After activation, drivers signed via cross-signing may be blocked.
• Point-in-time restore feature updates. When launching Point-in-time restore, local administrators now see a settings window after the UAC prompt, where they can view or change default restore settings and the list of available restore points. In the WinRE environment, a recommendation has been added to connect the device to power before restoring, and the OS version number is now displayed in a four-part format.
• Account settings. Microsoft 365 Family subscribers can now see an offer to switch to another Microsoft 365 plan on the account page in the Settings app, and this option can be hidden by disabling the display of recommended content.
• Drag Tray > Drop Tray. The location of Drop Tray feature settings has been changed: they have been moved from Settings > System > Nearby sharing to Settings > System > Multitasking.
• File Explorer. Microsoft has temporarily stopped rolling out the updated context menu to make additional improvements — the feature will return in a future build.
• Other. Improved reliability of the system preferred display language selection and application feature, and removed an extra error message that could unexpectedly appear when running the sfc /scannow command.

The Dev channel is intended for experienced users, as it includes the latest preview builds of Windows 11 with new features that may have low stability and some issues. The update can be installed through Windows Update for Insiders. Also note that the dynamic app removal list is not yet available in Intune CSP, and testing is recommended via Group Policies. The driver policy update feature initially works in audit mode and requires sufficient system uptime for automatic activation.

Installation via Windows Update: Go to Settings > Windows Update and click Check for updates. A system restart is required to complete the installation.

Removal of preinstalled Microsoft apps via policies: The Remove Default Microsoft Store packages policy uses a Package Family Name (PFN)-based deployment mechanism. When applied, the AppxDeploymentClient reads the PFN list from the registry and calls Remove-AppxPackage API for each package during user initialization. The dynamic list allows removing preinstalled MSIX/APPX without modifying the system image.

Windows driver policy update: The Windows kernel (ntoskrnl.exe) validates driver signatures during load. Previously, cross-signed certificates (third-party CAs) were trusted. The new audit mode monitors such drivers for 100 hours uptime and 3 reboots, then enables blocking — only drivers signed through WHCP and present in the kernel's trusted database are allowed.

Point-in-time restore feature updates: This feature uses Volume Shadow Copy Service (VSS). When launched from WinRE or a running system, the local administrator after UAC gets parameter access via the IVssBackupComponents COM interface. The OS version now displays in four-part format (major.minor.build.rev), and a recommendation to connect power reduces recovery interruption risk due to low battery.

Account settings: The account page in the Settings app shows a Microsoft 365 plan switch offer by verifying the subscription through the Windows.Services.Store API. If the user disables recommended content display (Settings > Personalization > Start), the corresponding XAML visibility condition hides the UI element.

Drag Tray > Drop Tray: Moving settings from "Nearby sharing" to "Multitasking" changed the system hook invocation method. Drop Tray now uses the same gesture and window management subsystem as window snapping. Internally, the toggle resides in the registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced with a DropTrayMode value.

File Explorer: The context menu changes involve XAML Islands and the IContextMenu COM server. Microsoft temporarily disabled the feature flag in Explorer.exe code — the menu reverted to the classic Win32 menu. This allows performance improvements and better handling of third-party extension commands.

Other: The preferred display language selection now uses a rewritten early-binding mechanism via NLS (National Language Support) and consistency checks in HKLM\SYSTEM\CurrentControlSet\Control\NLS\Language. Additionally, a false error message when running sfc /scannow was removed — it occurred due to incorrect interpretation of the catalog integrity check return code.

The last 10 Windows updates: