Security Not yet confirmed elsewhere 1 publisher 2 min read Published Aug 29, 2026, 2:50 AM PDT

Windows 11 preview update KB5120998 buys patch teams a rehearsal before September Patch Tuesday

KB5120998 carries 35 quality changes and no security fixes, which puts the real deadline in September. The parts worth testing before then are the taskbar and Start menu rework and the removal of WMIC.

The Watch · Security desk

How we use AI Send a correction

What happened

Microsoft has released KB5120998, a preview cumulative update for Windows 11 25H2 and 24H2 carrying 35 changes across the Start menu, taskbar, and Windows search.
As an optional monthly preview, the package ships quality improvements only and contains no security fixes, unlike the mandatory cumulative update due on September's Patch Tuesday.
Users can now move the taskbar to the bottom, top, left, or right edge from Settings, with most customization options, including never combining icons, working in every position.
From August 2026, Windows 11 24H2 and 25H2 no longer include the WMIC command-line utility, and it is no longer offered as a Feature on Demand.
The build also begins rolling out administrator protection, which lets users perform admin tasks with just-in-time privileges.

Why it matters

decision With no CVEs in the package, the only call to make is which pilot ring takes it; there is no case for an out-of-band window or a change-freeze exception.
exposure Any run book, monitoring script, or vendor agent that shells out to wmic.exe stops working once a 24H2 or 25H2 host is updated, and there is no Feature on Demand left to restore it.
constraint Because Microsoft declines to call administrator protection a formal security boundary, risk and audit teams cannot book it as a compensating control for local elevation-of-privilege exposure.
cost The upgrade bill lands on 24H2 Home and Pro fleets first, while managed Enterprise and Education estates have a full extra year before the same work is forced on them.

Next story · Security · yesterday

Windows 11 October Patch Tuesday update puts 24H2, 25H2 and 26H2 on one set of fixes

Confirmed2 publishers

A preview cumulative update is next month's package with the security content stripped out. Microsoft's stated purpose for KB5120998 is to let administrators test fixes, improvements, and new features before they reach everyone in next month's Patch Tuesday ^[2]. Installed, it takes 25H2 to build 26200.9278 and 24H2 to 26100.9278 ^[6], and it does not arrive on its own unless the "get the latest updates as soon as they're available" toggle is set; otherwise it needs a deliberate click or a manual pull from the Microsoft Update Catalog ^[7], which is delivery built for a pilot ring.

What deserves the lab time is the shell work, because locked-down images pin it. This build adds a reduced-height taskbar with smaller icons, small and large Start menu sizes, independent show and hide controls for the Pinned, Recommended, and All sections, and the option to hide the account name and profile picture ^[5]. Kiosk, VDI, and shared-desktop images that enforce those elements by policy either survive it or do not, and whatever breaks in a lab this month breaks in September with a security deadline attached.

Microsoft's own wording on administrator protection is the line to copy into a control matrix: "Administrator protection is not classified as a formal security boundary; it hardens the security against elevation-of-privilege attacks with the introduction of profile separation" ^[10]. It ships off by default and is turned on through Intune OMA-URI or Group Policy ^[11]. It is not something a device gets by accident, and teams should not credit it as a mitigation until they have actually enabled it.

One item is a privacy review rather than a patch review. Windows now indexes your most-used folders automatically so those files appear in later search results, with the control at Settings > Privacy & Security > Search ^[15].

The reboot arithmetic comes next. Microsoft said on Thursday that a limited number of consumer and business devices might take one additional restart during installation of the August optional update, and of updates rolling out over the next several months, after a Secure Boot certificate update is applied ^[12]. That belongs to whoever owns the maintenance window, not the vulnerability queue.

The lifecycle dates set the harder clock. Home and Pro on 24H2 stop receiving updates two months from the August notice, which puts them at roughly October 2026, while 24H2 Enterprise and Education stay in mainstream support until October 2027 ^[13]^[14]. The gap is twelve months, and only the managed editions get it ^[17].

What to watch

Whether September's Patch Tuesday cumulative update ships these shell changes unchanged, which decides if pilot-ring findings still hold.
Reports of the Secure Boot certificate restart affecting more than the limited set of devices Microsoft described.
Vendor agents and management tooling that still call wmic.exe shipping replacements before fleets reach the August build.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence62
Adoption30
Hype gap−10
Incentives42
Confidence58

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Microsoft released the KB5120998 preview cumulative update for Windows 11 versions 25H2 and 24H2, containing 35 changes including improvements to the Start menu, taskbar, and Windows search.
Reported SupportedView cited source
[2]
KB5120998 is a preview update that lets IT administrators test Windows bug fixes, improvements, and new features before they roll out to all users during next month's Patch Tuesday release.
Reported SupportedView cited source
[3]
Unlike cumulative updates, monthly optional updates do not include security fixes and provide only quality improvements.
Reported SupportedView cited source
[4]
After installing the August 2026 preview update, users can move the taskbar to the bottom, top, left, or right side of the screen in Settings > Personalization > Taskbar > Taskbar behaviors > Taskbar position, with most customization settings, such as never combining taskbar icons, working in every position.
Reported SupportedView cited source
[5]
KB5120998 adds a smaller taskbar option that reduces taskbar height and icon size, small and large size options for the Start menu, the ability to independently show or hide the Pinned, Recommended, and All sections, and the ability to hide the account name and profile picture.
Reported SupportedView cited source
[6]
The optional non-security update upgrades Windows 11 25H2 and 24H2 devices to builds 26200.9278 and 26100.9278 respectively.
Reported SupportedView cited source
[7]
Because it is optional, users must click the "Download and install" link unless the "Get the latest updates as soon as they're available" option is enabled, and the update can also be downloaded manually from the Microsoft Update Catalog.
Reported SupportedView cited source
[8]
Starting in August 2026, Windows 11 versions 24H2 and 25H2 no longer include the Windows Management Instrumentation Command-line (WMIC) utility; it is already removed by default in new installations and will no longer be available as a Feature on Demand.
Reported SupportedView cited source
[9]
With KB5120998, Microsoft has started rolling out the administrator protection feature, which allows users to perform admin tasks using just-in-time privileges.
Reported SupportedView cited source
[10]
Microsoft said: "Administrator protection is not classified as a formal security boundary; it hardens the security against elevation-of-privilege attacks with the introduction of profile separation."
Reported Supported Source: MicrosoftView cited source
[11]
Administrator protection is turned off by default and can be enabled using OMA-URI in Microsoft Intune or through Group Policy.
Reported SupportedView cited source
[12]
On Thursday Microsoft warned that with recent and upcoming Windows updates over the next few months, a limited number of consumer and business devices might experience one additional restart during installation, occurring after a Secure Boot certificate update is applied.
Reported Supported Source: Microsoft message center updateView cited source
[13]
Microsoft reminded customers earlier in the month that devices running Home and Pro editions of Windows 11 24H2 will stop receiving updates in two months.
Reported SupportedView cited source
[14]
Windows 11 24H2 Enterprise and Education editions remain under mainstream support until October 2027.
Reported SupportedView cited source
[15]
Windows now automatically indexes a user's most-used folders so those files appear in subsequent search results, controlled at Settings > Privacy & Security > Search > Automatically find additional relevant locations.
Reported SupportedView cited source
[16]
KB5120998 therefore contains no security fixes, only quality improvements, ahead of September's mandatory Patch Tuesday cumulative update.
Derived Supported1 source— create a free account to open them
[17]
Home and Pro 24H2 devices fall out of updates around October 2026, twelve months before the October 2027 end of mainstream support for Enterprise and Education 24H2.
Derived Supported1 source— create a free account to open them

Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.

Add to ChatGPT Add to Claude

Sources

1 independent publisher whose own reporting we read for this story.

bleepingcomputer.com
1 article · August 28, 2026
Windows 11 KB5120998 update released with 35 changes and fixes

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

One line in the highlights list matters more than everything above it: WMIC is gone from 24H2 and 25H2, absent from new installs, and no longer obtainable as a Feature on Demand. Anything that still shells out to wmic — installer custom actions, inventory scripts, monitoring agents, that one onboarding batch file nobody owns — fails silently on updated machines with no fallback to re-add the component. Administrator protection is the second item to read: just-in-time elevation changes what an app can assume about an interactive admin session, and while it ships off by default, the moment an admin flips it via Intune or Group Policy your elevation flows are in a new test matrix. The taskbar can now live on four edges and the Start menu's Pinned, Recommended and All sections can be hidden independently, which is cosmetic for most software and not cosmetic at all for kiosk or managed-shell builds. All of this comes from BleepingComputer relaying Microsoft's release notes, so the settings paths are precise but nobody has published what actually breaks.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence62: 0100
One outlet, but checkable artifacts
Almost everything here can be verified by an administrator in ten minutes: a KB number, two resulting build numbers, exact settings paths, and two direct Microsoft quotations on administrator protection and the Secure Boot restart. That is unusually falsifiable for a single-source story. What holds the score down is that BleepingComputer is the only voice, the 35-change count is Microsoft's own tally repeated without audit, and the piece's closing line dates 25H2 to September 2024 — an internal slip that suggests the surrounding detail was transcribed rather than checked.
Adoption30: 0100
Shipped to everyone, installed by nobody we can count
The update is genuinely out — Windows Update and the Update Catalog both carry it, and administrator protection has started rolling out — so availability is real rather than announced. But an optional preview only lands where someone clicks 'Download and install', the marquee security feature arrives switched off pending an Intune or Group Policy push, and this reporting offers no install figures, no telemetry and no example of an organisation that has deployed it. Availability is confirmed; uptake is entirely unobserved.
Hype gap−10: −100 understated0 aligned+100 overstated
Cosmetics lead, breaking changes trail
If anything this story sells itself short. The taskbar moving to the left edge and the Start menu's hideable sections get the top of the piece; WMIC's removal — an unannounced-feeling break for every script that still calls it — appears as the fifth bullet in a highlights list, and the servicing cutoff for Home and Pro 24H2 lands in the second-to-last paragraph. Microsoft's own caveat that administrator protection is not a formal security boundary is quoted faithfully instead of being inflated into a security win. Nothing is overstated; the consequential material is just filed below the pretty material.
Incentives42: 0100
Vendor notes in, sponsor pitch out
The sourcing runs one way: Microsoft describes its own update, its own new privilege feature and its own reboot side effect, and the reporting relays that framing down to the recommendation that customers move to 25H2 — which is also what Microsoft wants. The reader-facing tell is at the other end of the piece, where a vendor's 2026 security report and a 'Get the report' call to action are appended to the news copy. Neither pressure is concealed, and the Microsoft quotes are marked as quotes, so this is ordinary press-release-adjacent reporting rather than anything captured.
Confidence58: 0100
Firm on the what, thin on the how many
We would stake a lot on the mechanics — the KB identifier, the builds, the settings paths, the fact that this update carries no security fixes — because they are specific and independently checkable. We would stake very little on scale or consequence: 'a limited number of devices' is Microsoft's phrase and no one has bounded it, the two-month servicing warning is relative rather than dated, and with a single publisher a transcription error like the 25H2 availability date can survive unchallenged. High confidence in the instructions, low confidence in the impact estimates.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Windows Patch Management Follow
Endpoint Privilege HardeningFollow
Windows Servicing LifecycleFollow
Legacy Tooling DeprecationFollow
Windows Shell CustomizationFollow

Entities

Microsoft Follow
Windows 11 Follow
KB5120998Follow
Windows Management Instrumentation Command-line (WMIC)Follow
Administrator ProtectionFollow
Microsoft Intune Follow
Secure Boot Follow
Microsoft Update CatalogFollow
BleepingComputer Follow