Skip to content
audiotale.net
Sign in
NewsNews

KB5127936 for Windows 11 25H2 and 26H2: new right-click menu, Cloud rebuild, Remote Desktop fix

Microsoft's optional October 2026 preview update (builds 26200.9818 and 26300.9818) adds a customizable File Explorer menu and fixes the Remote Desktop failure on Administrator protection hosts.

audiotale.net team

· 10 min read

Written by AI from the sources linked below. How we use AI

On this page
  1. Key points
  2. What to do
  3. What happened
  4. Background
  5. The numbers
  6. What it means
  7. What we don't know yet
  8. What to watch next
  9. Update, 30 October 2026
  10. Sources

Microsoft has released KB5127936, the October 2026 optional preview update for Windows 11 versions 25H2 (build 26200.9818) and 26H2 (build 26300.9818). It brings a faster, customizable File Explorer right-click menu, a "Cloud rebuild" recovery option and a long list of fixes, among them the Remote Desktop failure that has blocked non-admin sign-ins on managed PCs since the September preview update. Because it is optional and Microsoft says its changes will reach everyone through a later security update, most people can wait; administrators with broken Remote Desktop hosts may not want to.

Key points

  • KB5127936 is a non-security, optional cumulative preview update, dated October 28, 2026 in Microsoft's release notes, for Windows 11 25H2 (build 26200.9818) and 26H2 (build 26300.9818).
  • Microsoft says it fixes Remote Desktop connection failures for non-admin users on devices with Administrator protection enabled; BleepingComputer reports the error as 0xC000000D, introduced with the September preview update KB5124010.
  • Headline features, rolling out gradually: a redesigned, customizable File Explorer context menu, WinRE reuse of saved Wi-Fi profiles, "Cloud rebuild" reinstall from the cloud, and an adaptive hibernate policy.
  • Microsoft lists one known issue: USB Audio Class 1.0 devices may fail after the September 8, 2026 security update, with no fix timeline.
  • It is not offered through Windows Update for Business; Windows Update shows it under optional updates, and the Microsoft Update Catalog carries the offline packages.

What to do

Who is affected. Anyone on Windows 11 25H2 or 26H2 can install it. Windows 11 24H2 is not offered it: Microsoft's notes say that starting with the October 2026 release, 24H2 no longer receives non-security preview updates, although Enterprise and Education editions still get monthly security updates.

Should you install it? For a home PC that works, you can wait. Microsoft describes this as a preview, and Windows Latest reports the changes are expected to reach all users with the November 10 Patch Tuesday update. Install now if you run Remote Desktop hosts that reject non-admin users, if you want the new context menu early, or if you test updates ahead of your fleet.

How to get it.

  • Windows Update: Settings > Windows Update > Advanced options > Optional updates. Turning on "Get the latest updates as soon as they're available" makes it install without a manual step and improves the chance of getting the gradually rolled-out features.
  • Microsoft Update Catalog: search for KB5127936 and download the x64 or Arm64 .msu. Microsoft says the Arm64 and x64 packages need checkpoint update KB5043080 installed first, and that you should install the files in order with Wusa.exe, or use DISM or Add-WindowsPackage to install the folder together.
  • Prerequisites: for 24H2 and 25H2 installed through WSUS, the Catalog or a standalone package, an update released on or after June 10, 2025 (Microsoft gives KB5060842 as an example) must be present, along with the latest servicing stack update. This update itself includes servicing stack KB5132402.
  • Windows Update for Business: Microsoft says it is not available this way. WSUS: not by default; import it manually from the Catalog.

If Remote Desktop is failing. Microsoft, as reported by BleepingComputer, says the problem is resolved by the October 28 update and later ones. If you cannot install a preview, wait for next month's Patch Tuesday. In the meantime, BleepingComputer says administrators can disable Administrator protection by resetting the "User Account Control Type Of Admin Approval Mode" policy through Intune or Group Policy.

Installation media. If you service installation media with this update, Microsoft says to include the boot.stl file from Windows\Boot\EFI or use the Update WinPE script. Missing it can cause error 0xc0430001.

What happened

Microsoft published the release notes for KB5127936 on October 28, 2026. It is the optional, non-security "D-week" preview of the month: the code that will be folded into the next Patch Tuesday cumulative update, shipped early so enterprises can test it. It applies to Windows 11 versions 26H2 and 25H2 on all editions. Windows Latest lists the same builds.

The notes split changes into two groups. Gradual rollout features reach devices in waves, so two PCs on the same build can look different. Normal rollout items, mostly fixes, arrive with the update itself.

Gradual rollout, the visible changes:

  • A File Explorer context menu that opens faster and can be customized: users reach a "Customize menu" entry to choose which commands and app extensions appear and how they are ordered. Windows Latest adds that the "App extensions" submenu is a separate toggle.
  • A modernized AutoPlay dialog with dark mode and better text scaling, consistent search-results layout, support for the ~ shortcut in the address bar, and dark mode for Folder Options.
  • A regrouped Privacy & security page that puts Camera, Microphone and Location controls together.
  • Recovery changes: the Windows Recovery Environment can reuse saved Wi-Fi profiles, including certificate-based networks, so a machine can get online during recovery without preconfigured credentials. "Cloud rebuild" reinstalls Windows from a cloud image and drivers, with optional drive sanitization and remote management through the Recovery CSP; Windows Latest points to Settings > System > Recovery. After restoring a settings backup to a new device, a Restore Summary lists what came back.
  • An adaptive hibernate policy for Modern Standby: faster resumes when the battery is above 80 percent, earlier hibernation below 10 percent.
  • Accessibility: Magnifier gains a contrast theme toggle, per-monitor zoom (on by default) and viewport locking; Live Captions gets a setting to exclude screen reader audio (off by default); Narrator reads and navigates math in Microsoft 365 apps and supported browsers in English (US and UK), Traditional Chinese, Finnish, German and Spanish.
  • IPv6 CLAT support (464XLAT) for Wi-Fi and Ethernet, with PREF64 discovery. It requires SLAAC and is not supported with DHCPv6 Prefix Delegation or WSL.

Normal rollout, the fixes:

  • Remote Desktop: non-admin connection failures to devices with Administrator protection enabled, and Intune configuration of trusted .rdp publisher thumbprints.
  • Smart App Control could not be re-enabled after being turned off.
  • HDMI and DisplayPort audio failures on certain AMD graphics cards.
  • A boot failure after using the PS_UpdateAndCompareCIPolicy CIM method (Application Control).
  • TPM AIK certificate enrollment hangs caused by non-Microsoft CNG providers.
  • Windows Sandbox closing unexpectedly with error 0x80370106.
  • BitLocker pre-boot PIN retry handling, to prevent accidental TPM lockout.
  • RSA-3072 key support on supported PIV smart cards.
  • Always On VPN connections stuck in "Connecting" or failing with "port already in use" after the September update.
  • Missing nested virtualization for WSL2 on AMD processors.
  • Edge: "Accelerated App Launch" makes Edge open faster under load and requires Edge 150 or later.

Background

Windows servicing follows a monthly rhythm. Security updates land on the second Tuesday (Patch Tuesday), and a non-security preview follows in the fourth week so that features and fixes can be tested before they join the next security release. Previews are optional, and Windows Update for Business does not push them.

The Remote Desktop bug is a good example of why previews matter. According to BleepingComputer, connections failed with error 0xC000000D after KB5124010, the September 2026 non-security preview, or later updates, on Windows 11 24H2 and later. Non-admin users could not connect to devices where Administrator protection was on. That feature asks standard users for Windows Hello authentication when they change the registry or install apps, and it became enabled by default in organizations using Windows security baselines after the October 2026 security update, which is why many enterprise-managed hosts hit the problem together. Microsoft acknowledged it on October 13 and said it primarily affects enterprise-managed remote devices used as Remote Desktop hosts.

It was also not the first Remote Desktop regression this year. BleepingComputer notes Microsoft fixed a similar problem in March 2025 and, in September 2026, shipped emergency out-of-band updates for Remote Desktop Services failures caused by that month's security updates.

Secure Boot is the other thread in the notes. Microsoft says the certificates used by most Windows devices began expiring in June 2026, that updated certificates continue to roll out through Windows Update, and that devices without them still start and update normally. BleepingComputer adds that a limited number of devices may need one extra restart after a Secure Boot certificate update, and that the original 2011 certificates expire in late June 2027.

The numbers

The offline packages are large. Windows Latest lists the Update Catalog downloads at about 5.2 GB for x64 and 5.0 GB for Arm64, the same for 25H2 and 26H2, and says the Windows Update download is usually under 2 GB. It attributes some of the Catalog size to bundled AI components; Microsoft's notes list AI components version 1.2610.1063.0 for Copilot+ PCs only, and we could not confirm the writer's explanation. Microsoft does not give a size in the notes we read.

KB5127936 offline package size by architectureMB
KB5127936 offline package size by architecture (MB)
MB
x64 (25H2 and 26H2)5180.8
Arm64 (25H2 and 26H2)4973.5

Source: Windows Latest, October 29, 2026

Other figures worth keeping: 41 changes, according to BleepingComputer's headline count (Microsoft's notes describe them in groups rather than numbering them), the 80 percent and 10 percent battery thresholds in the hibernate policy, and an April 2027 retirement date for prompt-based DPAPI protect and unprotect operations, which Microsoft flags as a warning for developers.

What it means

For administrators. The most useful line is the Remote Desktop fix. If Administrator protection is on across a fleet and non-admin users cannot connect, KB5127936 is the first shipping fix Microsoft names, and the workaround of resetting the UAC policy trades away a protection you may have turned on deliberately. Weigh that against the cost of pushing a preview to the affected hosts only. The Always On VPN and BitLocker PIN items are also the kind of fixes that justify a pilot ring.

For developers. Two notes matter. Edge's Accelerated App Launch is Microsoft-only for now: Windows Latest says there is no user toggle and that developers must update their apps to support it. And prompt-based DPAPI protect and unprotect operations are scheduled to be retired in April 2027, so code that relies on them has about six months to change.

For everyone else. The context menu is the change most people will notice, but because rollout is gradual you may not see it even after installing. Hardware owners should note that Windows Latest says Memory Integrity (HVCI) is turned on by default on eligible PCs, while Microsoft's own notes say it "may" be enabled on eligible devices during updates while respecting existing user or admin choices. We follow Microsoft's wording. Windows Latest also repeats earlier reports of 5 to 15 percent frame-rate drops from Memory Integrity but notes Microsoft has not published a figure, so treat that as unconfirmed.

Who loses. Windows 11 24H2 devices get no more non-security previews, and anyone relying on the USB Audio Class 1.0 workflow is still waiting.

What we don't know yet

  • Known issues. Microsoft's notes list the USB Audio Class 1.0 problem after the September 8, 2026 security update (Device Manager Code 10, no audio output, unresponsive volume controls, volume stuck at zero), with no timeline for a fix. Windows Latest says Microsoft is not aware of any known issues, which conflicts with that; we follow the primary source.
  • When each feature arrives. Gradual rollout means no date for a given PC. Windows Latest expects everything to reach all users on November 10; Microsoft's notes do not give a date.
  • Scope of the Remote Desktop fix. Microsoft says the issue was resolved by the October 28 updates "and later"; we have not seen a list of every affected configuration.

What to watch next

  • Patch Tuesday on November 10, 2026, which should carry these changes to everyone.
  • Whether Microsoft publishes a fix date for the USB Audio Class 1.0 problem.
  • Whether the context menu and Cloud rebuild reach the stable channel without regressions.
  • The Secure Boot certificate rollout, ahead of the June 2027 expiry of the 2011 certificates.

For related Windows servicing background, see KB5134133, the update that removes seven eMudhra certificates.

Update, 30 October 2026

Correction on Secure Boot dates. The Background section above says, citing BleepingComputer, that the original 2011 Secure Boot certificates expire in late June 2027. Microsoft's own certificate page gives different dates: the KEK CA 2011 expired on June 24, 2026, the UEFI CA 2011 on June 27, 2026, and the Windows Production PCA 2011 on October 19, 2026. We follow Microsoft's dates; the 2027 figure should not be relied on. Microsoft says devices without the 2023 replacements keep starting normally but stop receiving new boot-level protections. We explain how to check your PC in our Secure Boot guide.

Source: Microsoft Support: Windows Secure Boot certificate expiration and CA updates

Sources

SaveStart the discussion

Written by

audiotale.net team

The official account of the people who run audiotale.net: announcements, conversation starters and the newsroom's drafts. Posts written with AI say so. Every other account here is a real person.

Read next