Windows 11 KB5066835 (Oct 2025): what’s fixed, what might change, and how to install

KB5066835 is the October 14, 2025 cumulative update for Windows 11. It’s rolling out to version 24H2 (build 26100.6899) and version 25H2 (build 26200.6899) with security fixes and quality improvements. Devices already on recent builds will only download the newer bits inside this package.

What’s fixed in KB5066835 (24H2 and 25H2)

• Browser: resolves a hang in the print preview screen in Chromium‑based browsers.
• Gaming and input: fixes a state where signing in with only a gamepad at the lock screen could leave apps and games unresponsive to input afterward (unless another input method was also used).
• PowerShell/WinRM: addresses PowerShell Remoting and WinRM commands timing out after ~10 minutes; also restores a missing audit event that was not being logged.
• Windows Hello: fixes setup failures for face recognition when using USB infrared camera modules (e.g., repeated “Make sure your face is centered in the frame” messages).
• Compatibility: removes the legacy ltmdm64.sys fax modem driver. Hardware that depends on this driver will no longer function in Windows.

Windows Updates do not include Microsoft Store app updates; those are delivered separately.

AI component packages included

The cumulative update includes updated AI component packages. These apply only to Copilot+ PCs; on other systems they will not install.

Servicing stack details

This release includes a servicing stack update to improve the reliability of the Windows update process.

Known issue: protected video playback in some apps

Some Digital TV and Blu‑ray/DVD apps may fail to play protected content after installing the August 29, 2025 non‑security preview update or later updates. If you use such apps for protected playback, test on a pilot device before broad rollout.

Secure Boot certificates expire starting June 2026 — plan now

Secure Boot certificates used by most Windows devices begin expiring in June 2026. Updating certificates in advance prevents devices from failing to boot securely. Review the official guidance for preparation steps and timelines at the Windows Secure Boot certificate expiration and CA updates page: Windows Secure Boot certificate expiration and CA updates.

How to install KB5066835

Most PCs will get this update automatically via Windows Update. To check manually: open Settings > Windows Update and select Check for updates.

If you need the offline installer or are updating images:

1. Download the MSU package from the Microsoft Update Catalog: KB5066835 on Microsoft Update Catalog.
2. If the Catalog shows multiple MSU files for your platform, place them in one folder and use DISM to install; DISM will apply prerequisites in the correct order.

Install on a running PC (elevated Command Prompt):

DISM /Online /Add-Package /PackagePath:C:\Packages\Windows11.0-KB5066835-x64.msu

Install on a running PC (elevated PowerShell):

Add-WindowsPackage -Online -PackagePath "C:\Packages\Windows11.0-KB5066835-x64.msu"

To service offline media, add the package to a mounted image using DISM with /Image:<mountdir> and /Add-Package.

If you need to roll back the Latest Cumulative Update (LCU)

Because the SSU and LCU are combined, using the Windows Update Standalone Installer (wusa.exe) with /uninstall on the combined package will not work. To remove the LCU:

Remove the LCU by package name:

DISM /Online /Remove-Package /PackageName:<LCU-package-name>

Find the exact package name:

DISM /Online /Get-Packages

Note: The servicing stack update (SSU) cannot be removed after installation.

What you might notice after updating

Beyond the documented fixes, Microsoft is gradually lighting up a handful of feature changes across 24H2 and 25H2. Availability can vary by device and rollout wave. Examples include:

• A pre‑installed, command‑line “Edit” text editor.
• Notification Center functionality on secondary displays.
• Adjustable on‑screen indicator position for volume/brightness.
• An “AI Actions” shortcut in File Explorer’s context menu.
• A consolidated “Advanced Settings” page in Settings > System.

If these don’t appear immediately after installing the update, they may arrive later as the rollout progresses.

Quick reference

Install KB5066835 promptly to pick up the latest security fixes, especially if you rely on PowerShell remoting or Windows Hello. If your workflow includes protected video playback apps, validate behavior first. And if your organization uses Secure Boot at scale, begin the certificate update planning now to avoid June 2026 surprises.