Microsoft released the Windows 11 KB5120998 update, an optional preview cumulative update carrying 35 changes for versions 24H2 and 25H2, according to BleepingComputer and Microsoft's own release notes. The update moves 25H2 devices to build 26200.9278 and 24H2 devices to build 26100.9278, ahead of the features becoming mandatory in next month's Patch Tuesday security release.
As a preview build, KB5120998 lets sysadmins and MSPs test interface changes, reliability fixes, and a new privilege-hardening feature called Administrator Protection before they roll out broadly, and before Windows 11 24H2 Home and Pro editions lose support in October 2026.
Key takeaways
- KB5120998 is an optional, non-security preview update for Windows 11 24H2 (build 26100.9278) and 25H2 (build 26200.9278).
- The update lets users move the taskbar to any screen edge and resize both the taskbar and Start menu.
- Microsoft is beginning a phased rollout of Administrator Protection, a just-in-time privilege elevation feature disabled by default.
- Windows now automatically indexes frequently used folders for search, a behavior admins can disable via policy.
- Windows 11 24H2 Home and Pro editions are set to stop receiving updates soon, per Microsoft's support documentation.
Affected
What does the Windows 11 KB5120998 update change?
KB5120998 is Microsoft's optional preview cumulative update for Windows 11 versions 24H2 and 25H2. It advances 25H2 devices to build 26200.9278 and 24H2 devices to build 26100.9278, according to Microsoft's own release notes cited by BleepingComputer and Pureinfotech.
Unlike a monthly cumulative security update, this is a quality-and-feature preview: it carries 35 documented changes but no security fixes, and Microsoft says the same features are expected to reach general availability in next month's Patch Tuesday cumulative update.
- Taskbar can now be moved to the bottom, top, left, or right of the screen via Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position.
- A new smaller taskbar option reduces icon size and taskbar height on smaller screens, currently limited to top and bottom positions.
- Start menu gains Small/Large/Automatic sizing and independent toggles for the Pinned, Recommended (renamed Recent), and All sections.
- Windows Search now auto-indexes frequently used folders, controllable at Settings > Privacy & Security > Search.
How does Administrator Protection change privilege elevation?
Administrator Protection is a Windows 11 hardening feature that lets users perform admin tasks with just-in-time privileges instead of standing administrator rights, according to Microsoft's own description quoted by BleepingComputer. Microsoft states the feature "is not classified as a formal security boundary" but is designed to reduce elevation-of-privilege risk through profile separation.
The feature is disabled by default in KB5120998 and must be turned on through Microsoft Intune using OMA-URI or through Group Policy, per the vendor's guidance. Microsoft first disclosed Administrator Protection in October 2025 under KB5067036, and KB5120998 marks the start of its rollout, per Elevenforum's republication of Microsoft's changelog.
KB5120998 also confirms that Windows 11 24H2 and 25H2 will no longer include the Windows Management Instrumentation Command-line (WMIC) utility starting this update. WMIC was already absent from new installations and is being fully retired as a Feature on Demand; Windows Management Instrumentation itself remains supported, so scripts calling WMI directly are unaffected.
Who should install this preview update?
KB5120998 applies to devices running Windows 11 versions 24H2 and 25H2 that have opted into optional updates, with users able to install it manually or have it install automatically if they've enabled the "Get the latest updates as soon as they're available" option, per BleepingComputer's reporting.
IT administrators managing fleets typically use preview builds like this one to validate compatibility with line-of-business apps, group policies, and the new Administrator Protection controls before Microsoft folds the same changes into next month's mandatory cumulative security release.
- Consumers on Windows 11 24H2/25H2 Home or Pro who want early access to taskbar and Start menu customization.
- MSPs and IT admins testing Administrator Protection via Intune or Group Policy before broader deployment.
- Organizations auditing scripts or tools that still depend on the WMIC command-line utility, which is being removed.
How do you install or avoid the KB5120998 update?
To install KB5120998, open Windows Settings, go to Windows Update, and select Check for Updates; because it is optional, users must click "Download and install" unless automatic optional-update installation is already enabled, per BleepingComputer. Administrators can also fetch the standalone .msu package directly from the Microsoft Update Catalog for offline or scripted deployment across managed devices.
Microsoft separately warned in a message center note that a limited number of devices may experience one additional restart during installation of this and upcoming updates, tied to a Secure Boot certificate update process rolling out through Windows Update over the coming months, per Elevenforum's citation of Microsoft's advisory.
Support deadline approaching
Windows 11 24H2 Home and Pro editions reach end of updates in the coming months; Enterprise and Education editions remain supported until October 2027, per Microsoft's official support documentation.
Why is Microsoft previewing these changes now?
Monthly optional preview updates like KB5120998 are Microsoft's standard mechanism for surfacing non-security quality and feature changes roughly three weeks before they ship in the next Patch Tuesday cumulative update, which does include security fixes. This cadence gives administrators a window to test new UI behavior, such as the movable taskbar or redesigned Start menu settings, without exposing production fleets to unreviewed security patches.
Pureinfotech reports that the same builds are expected to reach broader Stable-channel availability ahead of formal inclusion in the September 2026 Security Update, while a parallel build, 26300.9278, is rolling out to Insiders in the Release Preview channel as Microsoft prepares an annual feature update.
What should IT teams watch next?
The next milestone is the September 2026 Patch Tuesday cumulative update, when the 35 changes in KB5120998, including Administrator Protection and the WMIC removal, are expected to become mandatory for all Windows 11 24H2 and 25H2 devices, per Pureinfotech's rollout timeline.
Admins running scripts or monitoring tools dependent on WMIC should confirm alternatives are in place before that broader rollout, since the utility will no longer be available as a Feature on Demand. Organizations nearing the end-of-support date for 24H2 Home and Pro should also plan the move to 25H2, which Microsoft recommends in its own guidance.
Timeline
Impact & actions
KB5120998 is a low-risk optional preview update that lets admins test 35 non-security changes to Windows 11 24H2 and 25H2 before they become mandatory in the September 2026 Patch Tuesday release.
Security: Administrator Protection introduces just-in-time privilege elevation and profile separation to reduce elevation-of-privilege risk, though Microsoft says it is not a formal security boundary and it ships disabled by default.
Privacy: Automatic indexing of frequently used folders and new web/Microsoft Store suggestions in Search change what content surfaces in search results by default; both are admin-configurable.
Recommended actions · Low urgency
- 1Test KB5120998 in a pilot ring before broad deployment, since it previews changes due in next month's mandatory security update
- 2Replace any scripts or tools that depend on WMIC before it is fully removed from 24H2 and 25H2
- 3Evaluate enabling Administrator Protection via Intune OMA-URI or Group Policy once validated
- 4Review the new Search indexing and suggestion settings against organizational data-handling policies
- 5Plan upgrades off Windows 11 24H2 Home/Pro before their end of updates
Technical details
- Affected versions
- Windows 11 24H2 (pre-KB5120998), Windows 11 25H2 (pre-KB5120998)
- Patched versions
- Windows 11 24H2 build 26100.9278, Windows 11 25H2 build 26200.9278
Mitigations
- Enable Administrator Protection via Microsoft Intune OMA-URI or Group Policy to enforce just-in-time admin privilege elevation and profile separation
Response
Vendor
Customer guidance
Install KB5120998 through Windows Update by selecting Check for Updates and clicking Download and install, or apply the .msu package manually from the Microsoft Update Catalog; skip it if you prefer to wait for the mandatory September 2026 Patch Tuesday release.
FAQ
What is Windows 11 KB5120998?
KB5120998 is an optional, non-security preview cumulative update Microsoft released for Windows 11 24H2 and 25H2, adding 35 changes ahead of September 2026 Patch Tuesday.
Does KB5120998 include security fixes?
No. As a monthly optional preview update, KB5120998 contains only quality and feature improvements, not security patches, according to BleepingComputer.
How do I install KB5120998?
Go to Settings > Windows Update, click Check for Updates, then Download and install, or download the .msu package manually from the Microsoft Update Catalog.
What is Administrator Protection in this update?
Administrator Protection is a feature that lets users perform admin tasks with just-in-time privileges and profile separation; it is off by default and enabled via Intune OMA-URI or Group Policy.
Is WMIC removed in this update?
Starting with this rollout, the Windows Management Instrumentation Command-line (WMIC) utility is no longer available as a Feature on Demand in Windows 11 24H2 and 25H2, though WMI itself remains supported.
When does Windows 11 24H2 Home and Pro stop getting updates?
Windows 11 24H2 Home and Pro editions reach end of updates in the coming months; Enterprise and Education editions remain supported until October 2027, per Microsoft's support documentation.
The bottom line
KB5120998 previews 35 non-security changes for Windows 11 24H2 and 25H2, led by a repositionable taskbar, Start menu resizing, and the phased Administrator Protection rollout.
What happens next
What to do






