KB5079489

Microsoft released preview (optional) update KB5079489 (Build 28000.1764) for Windows 11 version 26H1. This non-security update includes quality improvements, new features, and stability fixes. It is available for PCs with ARM64 architecture processors (Snapdragon), as well as for devices with x64 processors (Intel and AMD) that have been updated to version 26H1 using official ISO images. Deployment happens in two phases: gradual rollout (new features appear in stages) and broad distribution (simultaneous release of fixes for all supported devices).

• Emoji 16.0 support. Added a new set of emojis, including a small carefully curated set of characters — one from each major category. New emojis are now available in the Windows emoji panel.
• First-time sign-in restoration for organizations. The restoration feature is now part of Windows Backup for organizations. It automatically restores user settings and Microsoft Store apps upon first sign-in on Microsoft Entra hybrid joined devices, Cloud PCs, and multi-user environments.
• Quick Machine Recovery (QMR). The feature now automatically enables on Windows Pro devices that are not domain-joined and not registered in corporate systems. Such devices receive the same recovery capabilities as Windows Home. QMR performs a one-time scan on PCs with recovery options enabled and offers suitable options if necessary.
• Built-in network speed test. Launched from Wi-Fi or cellular quick settings, as well as through the context menu of the network icon in the system tray. The test opens in the default browser and checks Ethernet, Wi-Fi, and mobile connections.
• Improvement to taskbar without combining buttons. If an app has multiple windows open, they will no longer be entirely moved to the overflow area — only those windows for which there is truly no space left will go there.
• New item in the account menu. The account menu in Start now has an item leading to the benefits page of a Microsoft account.
• Camera pan and tilt control. In the Settings app (Bluetooth and devices > Cameras), you can now control these functions for supported cameras.
• Built-in Sysmon. Windows gets built-in support for System Monitor to log system events. Disabled by default — enabled manually via Settings > System > Optional features or using the Dism command. If Sysmon was already installed from Sysinternals, you need to remove it before enabling the built-in version.
• Widgets settings. Now open as a full-screen page inside the Widgets app, not as a separate dialog window.
• .webp background support. .webp format images can now be used as desktop backgrounds via Settings > Personalization > Background or through the file context menu in File Explorer.
• Taskbar search improvements. Group result headers show the number of items found. Hovering over a result now provides a preview. The Search process icon in Task Manager has been updated to a magnifying glass.
• Storage settings improvements. Some dialogs now have a more modern design, and temporary file scanning performance has been improved.
• RSAT for Arm64 support. Administrators can install Active Directory, Group Policy Management, DNS, and DHCP Server Tools on Windows 11 Arm64 devices via Settings > System > Optional features.
• Remote Server Administration Tools (RSAT). Added RSAT support for Windows 11 Arm64 devices. Administrators can install and use Active Directory Domain Services, Lightweight Directory Services, Active Directory Certificate Services, Server Manager, Group Policy Management, DNS Server Tools, and DHCP Server Tools.

No known issues are officially listed for this update. Among the broad distribution improvements: increased accuracy of app labeling in Application Control for Business, improved Natural Voices in Narrator, increased reliability of the login screen, sending large files via Nearby Sharing, displaying the projection menu (Win+P), and print spooler service (spoolsv.exe) performance.

In File Explorer: holding Shift and clicking on an icon or middle-clicking opens a new instance; when viewing non-ZIP archives, an Extract All button appears; improved reliability of device display on the Network page.

Also improved wake-from-sleep and optimized wake time on systems under high load, improved visual consistency of the interface (taskbar in auto-hide mode, input fields in Windows Security dialogs, print window).

Cumulative update KB5079489 is installed manually via Windows Update. Go to Settings > Windows Update and click Check for updates.

When 2026-03 Preview Update (KB5079489) (28000.1764) appears, click Download and install.

A system restart is required to complete installation. After the update, the Windows 11 version 26H1 build number will change to 28000.1764. If previous updates are already installed on the device, the system will download and install only the new fixes included in the KB5079489 package.

How the new features work:

Emoji 16.0 support: Windows updates the color font engine to support new Unicode code points. When you open the emoji panel (Win + .), the system maps the entered character to a glyph in the system font, which now contains graphics for Emoji 16.0.

First-time sign-in restoration for organizations: On first sign-in to a Microsoft Entra hybrid or Cloud PC device, the Windows Backup client downloads the user profile from the cloud, compares settings hashes, and automatically restores settings and Store apps via the background DeviceManagement-Enterprise-Diagnostics-Provider service.

Quick Machine Recovery (QMR): On Pro devices without domain or corporate registration, the recovery agent activates via Task Scheduler. At boot, it checks registry keys at HKLM\System\CurrentControlSet\Control\Recovery and, if critical failures are found, runs a one-time scan of the WinRE recovery environment.

Built-in network speed test: The client retrieves the current network type via netsh wlan show interfaces, then opens the system browser to the ms-speedtest: URI. The browser contacts Microsoft or partner (Speedtest) servers and measures latency, download, and upload via WebSocket + JavaScript API.

Improvement to taskbar without combining buttons: The Taskbar Host calculates available width. For apps with multiple windows, the smart overflow algorithm moves only those windows whose minimum pixel width exceeds the free space — leaving the main window untouched.

New item in the account menu: The account menu in Start now calls the Windows.System.UserProfile.AccountSettings API, which generates an ms-accounts:benefits URI. Explorer handles this URI via the ms-accounts protocol and opens the Microsoft Account benefits page in the default browser.

Camera pan and tilt control: In Settings > Bluetooth & devices > Cameras, the UI calls the USB Video Class (UVC) extension KSPROPERTY_CAMERACONTROL_EXTENDED_PANTILT. The camera driver sends absolute angle or relative movement commands over USB to the camera's servos.

Built-in Sysmon: Windows includes the Microsoft-Windows-Sysmon component (disabled by default). Via DISM /Enable-Feature or optional components, the Sysmon64 service registers an ETW provider and begins logging process, network, and registry events using a built-in or custom config file.

Widgets settings: The Widgets host (Widgets.exe) now loads the settings page as a full-screen WebView2 web view instead of a dialog. This allows modern CSS layouts and touch gestures without recreating the visual container.

.webp background support: When setting wallpaper via context menu or Personalization, File Explorer (explorer.exe) calls DWM APIs to decode .webp. The Windows.UI.Composition library converts VP8 compressed blocks into a pixel array applied to the desktop as a Direct2D surface.

Taskbar search improvements: The Windows Search service (SearchIndexer) adds a ResultCount field to results. The taskbar UI on hover calls ISearchPreviewItem to render a thumbnail via XAML Islands. The Task Manager process icon is updated via SearchHost.exe.mui resources.

Storage settings improvements: The Settings app (SystemSettings.exe) now uses Adaptive Cards for dialogs. Temporary files are scanned asynchronously via the StorageSense API with result caching, speeding up the process using parallel FindFirstFileEx calls.

RSAT for Arm64 support: The Windows Component Store (CBS) on Arm64 installs RSAT tools via CHPE (Compiled Hybrid Portable Executable) emulation. Administrative snap-ins (ADUC.msc, GPMC.msc) run natively through x86 → Arm64 translation in the compatibility layer.

Remote Server Administration Tools (RSAT): Enabling via optional features calls DISM with the /FeatureName:Rsat flag. DNS and DHCP tools install as shared packages (.cab) with registration in %SystemRoot%\System32\WindowsPowerShell\v1.0\Modules, where modules are listed via Get-Module -ListAvailable.

The last 10 Windows updates: