KB5079473

Microsoft released cumulative update KB5079473 for Windows 11, version 25H2 (2025 Update) as part of Patch Tuesday (March 2026). The cumulative update package KB5065426 (Build 26200.8037 and Build 26100.8037) is intended for Windows 11, version 25H2 (Windows 11 2025 Update) based on x64 (amd64) and ARM64 processors.

On September 30, 2025, Microsoft began deploying Windows 11 2025 Update to supported devices. Windows 11, version 25H2 is delivered as an enablement package (eKB) KB5054156 (build 26200.xxx). Installing the eKB requires only one device restart. Improvements and fixes in KB5079473 (Build 26200.8037) include all fixes and changes from update KB5077241 (Build 26200.7922) Preview for Windows 11, version 25H2.

• Built-in Sysmon support. Added ability to monitor security events through built-in Sysmon support.
• Network speed check via taskbar. Added ability to check network speed directly from the taskbar.
• Advanced camera control settings. Added pan and tilt functions for camera control.
• WebP image support as desktop background. You can now set WebP format images as desktop background.
• BitLocker improvements. Improvements made to BitLocker functionality.
• Updated battery icons. Implemented updated battery icon design.
• Secure Boot. Windows quality updates now use additional data to accurately identify devices that can automatically receive new Secure Boot certificates. Devices receive new certificates only after the system records enough successful update signals, ensuring controlled and phased deployment.
• File Explorer. Improved search reliability in File Explorer when performing queries across multiple drives or in "This PC" section.
• Windows Defender Application Control. Improved handling of allowed COM object policies (allowlisting). Previously COM objects could be blocked if the endpoint security policy was stricter than the allowlisting policy. After the update, COM objects are allowed correctly.
• Windows System Image Manager. Improved reliability when selecting trusted catalog files. Added a warning dialog box to help ensure the selected file comes from a trusted source.

Cumulative update 5079473 for PCs installs automatically via Windows Update. To check, go to Settings > Windows Update and click Check for updates.

Built-in Sysmon support: Windows includes Sysmon as an optional kernel-mode driver. It hooks system calls (process creation, network connects) and writes structured events to EventLog. Administrators activate it via sysmon -accepteula -i config.xml, enabling SIEM or audit tools without third-party agents.

Network speed check via taskbar: The taskbar tooltip periodically polls network interface byte counters from the TCP/IP stack. The difference between two samples divided by the time delta gives current Mbps speed, shown in the connection status flyout.

Advanced camera control settings: Low-level control commands (KSPROPERTY_CAMERACONTROL_EXT_PAN_TILT) are added for USB/UVC camera drivers. Apps send absolute or relative pan/tilt angles through MediaCapture API; the driver converts them to stepper motor commands.

WebP image support as desktop background: Desktop Window Manager (dwm.exe) now decodes WebP (VP8/VP8L blocks) using windowscodecs.dll. It directly converts WebP to ID2D1Bitmap without intermediate BMP, reducing memory and disk I/O.

BitLocker improvements: Recovery key reset with TPM+PIN is accelerated. Asynchronous encryption of suspended volumes is added. Metadata chain integrity (FVE_METADATA) is validated via fvevol.sys before mounting.

Updated battery icons: Taskbar ModernFlyout replaces static PNGs with Direct2D vector rendering. It polls percentage and milliwatts from WmiBatteryClass and animates gradient and lightning bolt shape during charging.

Secure Boot: Windows quality updates compare boot telemetry (BootCKCL.efi logs) with a trust model. New .p7b certificate is added to UEFI DB only after 30 stable days — phased deployment without rollback risk.

File Explorer: The search indexer now handles distributed queries in parallel: when searching "This PC", queries go to each drive's SystemIndex concurrently. Non‑indexed volumes are queried directly via SearchFolder.

Windows Defender Application Control: COM object policy merging logic is fixed. Previously stricter policy could block allowed CLSIDs. Now the runtime engine (SI.dll) checks allowlist before deny — explicit allow takes priority.

Windows System Image Manager: When adding a .cat file, the system computes its hash and calls WinVerifyTrust. If the publisher is not in the trusted store, a warning dialog appears but does not block — leaving final control to the engineer.

The last 10 Windows updates: