Windows 11 Insider Preview build 28000.1340 is now rolling out to devices in the Canary Channel as KB5072032. It is a relatively small update on paper, but it quietly flips on more of the work that shipped earlier in the October 2025 non‑security preview for Windows 11 versions 24H2 and 25H2, while also pulling back one security feature and fixing a serious storage bug.
What changes in Windows 11 build 28000.1340
There are three main buckets of changes in this build: general quality updates, a pause for Administrator Protection, and a targeted storage fix.
General improvements. The build includes a small set of under‑the‑hood fixes aimed at making the OS feel more stable and consistent for Canary testers. These are not called out one by one, but they are positioned as polish for systems already on the 28000 series.
Enabling more October preview features. Windows 11 received a non‑security preview update on October 28, 2025 for versions 24H2 and 25H2 (KB5067036, OS builds 26200.7019 and 26100.7019). Build 28000.1340 starts to turn on more of those features and improvements inside the Canary line. Some of that work was already present in earlier 28000 builds; this update expands that rollout to more PCs and more functionality.
Because Canary is used for early platform work, the feature set here can vary between devices. The Control Feature Rollout system means two PCs on the same build might not see identical changes, even after installing the update.
Administrator Protection is temporarily disabled
Administrator Protection is a security feature that targets “free‑floating” admin rights. It builds on Admin Approval Mode, adding an extra layer of protection around administrator‑level elevations so that background or unexpected processes have a harder time silently acquiring full control.
The feature first appeared for Windows 11 version 24H2 (build 26100.7019) and version 25H2 (build 26200.7019), and later surfaced in Canary builds as the platform moved to the 28000 series. With build 28000.1340, Administrator Protection is temporarily turned off for Canary testers.
For now, that means:
- Admin accounts on Canary no longer get the additional Administrator Protection behavior on elevation prompts.
- Standard User and Admin Approval Mode prompts continue to function, but without the extra safeguards this feature introduced.
Microsoft notes that this is a temporary pause and explicitly thanks Insiders for their patience, which usually signals that the feature is being adjusted based on feedback and telemetry before returning in a later build.
Storage Spaces and Storage Spaces Direct get an important fix
Build 28000.1340 includes a targeted fix for Storage Spaces and Storage Spaces Direct — two technologies that pool physical drives into resilient virtual storage.
The issue addressed here could cause:
- Some Storage Spaces volumes to become inaccessible.
- Storage Spaces Direct to fail when creating a storage cluster.
For anyone running storage pools on Canary machines, this is the most concrete and important fix in the update. Canary hardware often doubles as test infrastructure, and broken Storage Spaces Direct clusters or inaccessible pools can mean downtime or lost access to lab data.
After installing build 28000.1340, the expectation is that newly created storage clusters will complete successfully and previously affected spaces should no longer hit the same failure path. As always with storage changes, this is a good moment to ensure independent backups exist before making structural changes to pools or clusters.
How this build fits into the Canary Channel
The Canary Channel is where Windows platform work lands first. Builds here are not tied to a specific future release and are explicitly allowed to be rough, incomplete, or experimental.
For build 28000.1340, several long‑standing Canary principles apply:
- No guaranteed release mapping. Features that appear in this build may change significantly, move channels, or never ship in a public release of Windows 11.
- Staged feature rollout. Many capabilities are gated by Control Feature Rollout. A subset of Insiders receives new functionality first, and the rollout widens only if stability and feedback look good.
- Channel crossover. Some features may first show up in Dev or Beta before appearing in Canary, even though Canary typically has the highest build numbers.
- Localization lag. UI strings and dialogs tied to new features may not be fully localized yet. Translation typically catches up as features get closer to being locked.
Feedback from these early builds is funneled through the Feedback Hub and other Insider channels to shape how features evolve, whether they ship at all, and which channel receives them next.
How to install Windows 11 build 28000.1340 in the Canary Channel
For devices already configured for the Canary Channel, build 28000.1340 appears as a regular Windows Update. Installing it is straightforward.
Step 1: On the Canary machine, open Settings > Windows Update. Make sure Get the latest updates as soon as they’re available is turned on if you want builds as quickly as possible.
Step 2: Select Check for updates. Windows Update should detect the new Windows 11 Insider Preview (Canary Channel), KB5072032 entry with build number 28000.1340.
Step 3: Start the download when prompted. The update will go through the typical download, install, and restart phases. Canary builds can be large and may require multiple reboots; allow extra time if you are jumping from an older 28000 build.
Tip: On test hardware with critical data, take a full image backup before installing Canary builds so you have a clean rollback path if something breaks.
Switching into and out of the Canary Channel
The Canary Channel is designed for highly technical users who can live with frequent breaking changes. Moving into or out of this channel comes with some important constraints.
Join the Canary Channel
Step 1: On a supported Windows 11 device, sign in with a Microsoft account that is registered in the Windows Insider Program. If you are not registered yet, you can sign up on the Windows Insider site at microsoft.com/windowsinsider.
Step 2: Open Settings > Windows Update > Windows Insider Program and link your Insider account if it is not already connected.
Step 3: Choose the Canary Channel under channel selection. After confirming, return to Windows Update and check for updates. The system will then offer the latest Canary build, which currently includes 28000.1340.
Leave the Canary Channel
Leaving Canary is much more restrictive. Windows cannot downgrade directly to lower build numbers on the same installation. Because Canary builds generally have higher build numbers than Dev, Beta, Release Preview, or retail releases, you cannot simply switch channels in Settings and expect the OS to roll back.
To move a device from Canary to any lower channel or to stable Windows 11, a clean install is required.
Step 1: Back up personal data, app configurations, and any important test content to external storage or a network location. Also export virtual machines, containers, and any Storage Spaces pools you can safely remove.
Step 2: Download a current Windows 11 installation image from the official download page at microsoft.com/software-download/windows11 or use the media creation tool from the same site.
Step 3: Perform a clean installation of Windows 11 from the created USB or ISO, deleting the existing Canary installation when prompted. After setup completes, you can choose a different Insider channel or stay on the public release.
Note: This requirement is not unique to build 28000.1340; it is a standing rule for Canary devices because of how Windows handles major build number transitions.
How feature rollouts work in Canary builds
Build 28000.1340 again leans on Control Feature Rollout (CFR), the infrastructure Microsoft uses to deliver new capabilities to a subset of users rather than everyone at once.
CFR lets the Windows team:
- Enable a feature for a small percentage of devices on the same build.
- Monitor reliability, performance, and feedback on that subset.
- Pause, adjust, or expand the rollout without shipping a whole new build.
For Canary testers, that means you may see features that a colleague on the exact same build number does not, or vice versa. It also explains why some capabilities introduced in the October 2025 preview for 24H2/25H2 only become visible gradually on 28000‑series builds.
Why this build matters to different testers
The actual impact of build 28000.1340 depends heavily on how you use your Canary devices.
For storage and lab admins. The Storage Spaces and Storage Spaces Direct fix is the headline change. If you use Canary hardware for cluster or pool testing, this build should reduce failures when creating clusters and help keep virtual disks accessible. It is still prudent to treat any storage change on Canary as experimental and to keep robust backups in place.
For security‑focused testers. The temporary removal of Administrator Protection on Canary devices is a step back in terms of layered defenses, but it is also a signal that the feature is being refined. If you are actively evaluating Admin Approval Mode and Administrative Protection behavior, this build gives you a before‑and‑after gap to compare when the feature reappears.
For general enthusiasts. Most of the changes will feel invisible but contribute to stability and to surfacing more of the October 24H2/25H2 improvements on the 26H1 platform line. If your interest is simply keeping up with the latest platform work, this is a relatively low‑drama update that is still worth installing to stay current.
As always with the Canary Channel, feedback through the Feedback Hub remains critical. Issues with Storage Spaces, elevation prompts, or newly lit‑up features on build 28000.1340 are particularly valuable to report while the build is fresh.
