KB5067036 is an optional, non‑security preview update for Windows 11 that rolls out in two waves (gradual, then normal). It introduces a redesigned Start menu for some users, begins the Administrator Protection rollout, and delivers a long list of fixes and reliability improvements.

Who gets which build

Windows version OS build after installing KB5067036
Windows 11, version 24H2 26100.7019
Windows 11, version 25H2 26200.7019

Feature availability is staged. The new Start menu and other UI changes may appear later on your device even after the update is installed.

New features and notable changes

  • Redesigned Start menu (rolling out): a more responsive layout with clearer categories, grid views, and a scrollable “All” section to make apps easier to find.
  • Administrator Protection (preview): reduces risk from “always‑on” admin rights by requiring a Windows Hello identity check before actions that need elevation (software installs, sensitive system changes, access to protected data). It’s off by default and can be enabled via Microsoft Intune (OMA‑URI) or Group Policy.
  • Battery status at a glance: updated tray and Quick Settings icons with color indicators (green charging/healthy, yellow at or below 20% battery saver, red critically low) and simplified overlays that keep progress visible. Battery percentage can be toggled in Settings > System > Power & battery.
  • Taskbar hover fix: selecting a window from a taskbar thumbnail now reliably brings it to the foreground instead of dismissing the preview.

Fixes and improvements (highlights)

Area Resolved issues and improvements
Display & graphics
  • Eliminates partially unresponsive window content while other fullscreen apps update in the background (especially noticeable while scrolling).
  • Fixes red tint affecting some videos and games introduced by a prior update.
  • Prevents Settings from crashing on opening System > Display when the Connected Devices Platform Service is disabled.
Input Resolves exceptions and hangs in apps using pen and handwriting (microsoft.ink.dll and related APIs).
Narrator Fixes Narrator failing to launch during Windows setup from an ISO.
Open/Save dialogs Prevents certain apps from becoming unresponsive when opening file pickers.
Remote Credential Guard Restores expected behavior between the latest Windows 11 builds and Windows Server 2022 or earlier.
Sign‑in and lock screen Improves taskbar loading performance after wake; addresses cases where the password field and other sign‑in elements did not render after sleep.
Task Manager Corrects process grouping so apps are properly organized under their parent processes.
Windows Update
  • “Update and shutdown” now consistently shuts down after applying updates.
  • Reduces failures with error 0x800f0983.
Media Creation Tool (known issue resolved) Fixes an Arm64 problem where version 26100.6584 failed with “We’re not sure what happened, but we're unable to run this tool on your PC.”
Protected content (known issue resolved) Fixes playback failures for protected content on some devices after a recent update.
Networking (known issue resolved) Web servers using HTTP.sys (e.g., IIS) no longer reject incoming requests with a “NOT_SUPPORTED” error.
Screen readers Stops announcements of “legacy window” without reading contents in some apps.
Authentication
  • Allows permitted users to change passwords remotely on member servers or workgroup devices without unexpected ACCESS_DENIED errors.
  • Resolves a condition where manually stopping the KDC service on server domain controllers prevented retrieval of Kerberos tickets.
  • Addresses repeated reauthentication issues in AD FS scenarios after the September 2025 Windows Server 2022 update.

AI components (Copilot+ PCs only)

KB5067036 carries updated AI components that apply only to Windows Copilot+ PCs. These component updates do not install on non‑Copilot+ Windows PCs or on Windows Server.

Component Version
Image Search 1.2510.1152.0
Content Extraction 1.2510.1152.0
Semantic Analysis 1.2510.1152.0
Settings Model 1.2510.1152.0

How to install KB5067036

From Windows Update (recommended for most PCs): open Settings > Windows Update, check for updates, and choose Download and install when the preview appears. Because this is an optional preview, it won’t install automatically unless you’ve opted in to receive the latest updates as soon as they’re available.

Manual install (for IT and advanced users): download the appropriate packages for your device architecture from the Microsoft Update Catalog once, then install with DISM. The catalog provides separate packages for 24H2 and 25H2, x64 and Arm64.

Get KB5067036 from the Microsoft Update Catalog

Install a single MSU directly to a running system:

DISM /Online /Add-Package /PackagePath:C:\Packages\Windows11.0-KB5067036-x64.msu

Or with PowerShell:

Add-WindowsPackage -Online -PackagePath "C:\Packages\Windows11.0-KB5067036-x64.msu"

Tip: If multiple MSUs are provided for your scenario, place them in the same folder and point DISM at the folder. DISM will detect and install prerequisites in the required order.

Servicing stack update and uninstall guidance

This release also includes a servicing stack update (SSU) to improve the reliability of future updates. The SSU is permanent; it cannot be removed.

  • To remove the latest cumulative update (LCU) component after installation, use DISM with the LCU package name:
DISM /Online /Get-Packages
DISM /Online /Remove-Package /PackageName:Package_for_RollupFix~<full_package_name>

Note: wusa.exe /uninstall will not work on the combined SSU+LCU package.

WSUS: admins can import the update manually via the Microsoft Update Catalog if needed.

Plan ahead: Secure Boot certificate expiration

Secure Boot certificates used by most Windows devices begin expiring in June 2026. Some devices might fail to boot securely if certificates aren’t updated in time. Review the guidance and update plans well ahead of that date.

Read Microsoft’s Secure Boot certificate and CA update guidance

KB5067036 is a wide‑ranging preview that tidies up rough edges across graphics, input, accessibility, networking, and authentication, while starting a careful rollout of the new Start menu and Administrator Protection. If you need the fixes now, install it as an optional update; otherwise, these changes are slated to land in the next monthly cumulative release.