Windows 11 KB5127936 and KB5127653 Add Cloud Rebuild, Windows CLAT, and Administrator Protection

Microsoft has released two optional Windows 11 preview updates, KB5127936 for versions 25H2 and 26H2, and KB5127653 for version 26H1.

Both updates introduce improvements to security, system recovery, networking, and device management, with several changes aimed at IT administrators.

Microsoft expects to include these improvements in the November 10, 2026 Patch Tuesday updates, although some features will reach devices gradually.

Administrator Protection gets easier to configure

Windows 11 26H1 users can now enable Administrator Protection directly through Windows Security > Account protection.

Previously, administrators had to configure the feature using Group Policy, Microsoft Intune, or a Configuration Service Provider.

The new option simplifies setup, although Microsoft is introducing it through a gradual rollout.

Windows Recovery Environment gains Wi-Fi and cloud recovery improvements

Microsoft is also improving Windows Recovery Environment (WinRE) across Windows 11 versions 25H2, 26H1, and 26H2.

WinRE can now automatically connect to networks using saved Wi-Fi profiles, allowing devices to access the internet during recovery without requiring users to reenter network credentials.

The feature comes enabled by default, but administrators can disable it.

Meanwhile, Windows 11 25H2 and 26H2 are gaining Cloud Rebuild support, allowing administrators to restore devices using system images and drivers from Windows Update instead of relying on USB installation media or custom recovery images.

Both improvements are rolling out gradually.

Windows 11 26H1 also introduces a remote recovery management plug-in that mobile device management providers can use to expand recovery capabilities.

Windows CLAT is now generally available

Another important change affects networking. Windows CLAT has reached general availability for Windows 11 25H2 and 26H2 through the October preview update.

The technology uses 464XLAT to allow IPv4 applications and services to work on IPv6-only and IPv6-mostly networks.

This improvement helps organizations move toward IPv6 without losing compatibility with applications that still require IPv4 connectivity.

Microsoft expands built-in app removal for enterprise devices

Microsoft has also expanded policy-based removal of built-in Windows applications to support multi-session environments in Windows 11 Enterprise and Education.

The improvement applies to versions 25H2, 26H1, and 26H2, giving administrators more control over which preinstalled applications remain available in managed environments.

Unlike the other features, this change follows Microsoft’s normal rollout schedule, meaning users receive it immediately after installing the applicable update.

The October preview updates remain optional, but Microsoft plans to bring these changes to more Windows 11 devices through the November 10 security updates.

Via Neowin