KB5128942 Replaces KB5122035 in the Windows 11 24H2 and 25H2 Setup Flow
Microsoft's support entry for KB5128942 covers all editions of Windows 11 version 24H2 and all editions of version 25H2. The summary says the update "improves" the OOBE, applies only to the OOBE process, and is available only when OOBE updates are installed. Microsoft lists no prerequisites. A restart is required after the update is applied.
The support page doesn't say what the improvement is. It names no fixed bug, changed screen, CVE, or known issue, and it gives no OS build number, package size, or standalone installer. The only technical detail is a downloadable CSV of the files included in the package, which opens in Notepad or Microsoft Excel. Microsoft also notes that the US English version may contain files for other languages. Admins who want to know which components changed can compare that file list with the one published for KB5122035. The KB text itself doesn't answer that question.
The support entry also describes the package as a cumulative update. The August package it replaces was titled a plain "Out of Box Experience update", although Microsoft's own URL for that page already included "oobe-zdp-cumulative". The replacement chain shows how often these packages ship. The KB5122035 page, dated August 27, 2026, said it replaced KB5095189, and KB5128942 now replaces KB5122035. Earlier in the year Microsoft shipped KB5078674 for the same two versions. That entry said the same thing: "This update applies only to the Windows OOBE process and is available only when OOBE updates are installed." Microsoft has been refreshing the setup-time code for 24H2 and 25H2 roughly monthly, and KB5128942 is the latest in that series.
How Windows 11 Delivers Zero-Day Patches During OOBE
OOBE is the series of first-run screens a Windows 11 PC shows when it is turned on for the first time or after a reset. Microsoft's hardware documentation lists the usual order: language, region, keyboard, network connection, a step that downloads critical patches and driver updates, the license agreement, account sign-in, Windows Hello, privacy settings, and optional OneDrive, Microsoft 365, and OEM registration pages. Not every user sees every page, and the order can vary. On Home editions, a network connection is required to finish OOBE.
The update step belongs to what Microsoft calls zero-day patch (ZDP) updates. According to Microsoft's documentation, critical ZDP updates start downloading automatically once the user connects to a network. Users can't opt out, because Microsoft says these updates are required for the device to work properly. Windows tells the user it is checking for and applying updates. Microsoft's OOBE documentation lists a ZDP download as one of the events that forces a restart during setup, alongside picking a non-default language and installing a newer version of Windows.
KB5128942 is one of these setup-time packages, and it arrives through a different route from the monthly updates people know. WindowsForum's earlier coverage of this update class described the model the same way: installer-time packages are queried and applied during setup instead of via the standard post-setup Windows Update channel. The support entry lists only one way to get KB5128942: automatic installation during OOBE when an internet connection is available. It doesn't mention a Settings > Windows Update entry or a Microsoft Update Catalog download for a PC that is already set up.
Setup Time and Restarts on New Windows 11 PCs
The practical effect for anyone unboxing or resetting a 24H2 or 25H2 machine is an extra restart during setup. Microsoft's general OOBE update guidance also says that, depending on the OS build, a user may be offered a newer version of Windows during setup. That process can take 30 minutes or more, depending on the size of the update, the network, and the hardware. Microsoft advises keeping the PC on and plugged in, and OOBE restarts the machine to finish.
That 30-minute figure applies to feature-version updates during OOBE in general. Microsoft hasn't given a separate download or install time for KB5128942. Microsoft also documents a restart edge case: if a device wasn't connected to a network before the restart, or loses its connection during the restart, some OOBE pages repeat afterward. If you see a repeated network or language screen after the update restart, that is documented behavior. It doesn't mean setup has failed.
Once OOBE is complete, Windows enters what Microsoft calls a post-OOBE quiet period. No apps launch automatically to show UI, background services can still run, and the Start menu opens instead. Anything KB5128942 changes happens before that point.
Where KB5128942 Fits for Autopilot and Imaging Admins
For enterprise IT, OOBE is where devices first come under management. Windows Autopilot provisioning and Intune enrollment both happen during setup. Microsoft has also added controls over whether regular quality updates (the monthly cumulative patches) install during OOBE. According to M365 Admin, a Microsoft 365 administration blog, with Windows Autopilot and Microsoft Intune (or alternative management solutions), you can maintain seamless control over quality update behavior during provisioning. The same blog lists a prerequisite for that capability: devices that are imaged with the November 2025 Windows non-security update or later or are automatically updated with the November 2025 OOBE zero-day patch (ZDP) update.
That control covers monthly quality updates during provisioning. The mandatory ZDP packages such as KB5128942 are a separate category. Microsoft's documentation says users can't opt out of critical ZDP updates, and the KB5128942 entry mentions no Intune or Autopilot setting that would block or defer it. Admins should expect the package to apply on any 24H2 or 25H2 device that reaches the internet during setup, whatever their quality-update policy says.
For image builders, the replacement chain is the part to watch. An image that already carries an older OOBE package will pick up KB5128942 during setup if the device can reach Microsoft's servers. An offline setup will run whatever OOBE code is in the image. The KB gives no offline installation route, so a lab that provisions devices without internet access won't get this update through any documented method.
Lifecycle timing matters for 24H2 Home and Pro. Microsoft's August preview release notes state that Windows 11, version 24H2 Home and Pro editions will reach end of updates on October 13, 2026. KB5128942 still covers every 24H2 edition. If you are setting up new consumer or small-business PCs that ship with 24H2 Home or Pro, plan to move them to 25H2 soon after setup, whatever this OOBE package does.
The Secure Boot Warning on the KB5128942 Page
The KB5128942 page also carries a notice that Secure Boot certificates used by most Windows devices began expiring in June 2026. Microsoft says the expiry could affect the ability of some personal and business devices to boot securely if they aren't updated in time, and it recommends updating certificates ahead of time. The notice appears as a related topic. Microsoft doesn't say that KB5128942 updates certificates, fixes Secure Boot problems, or is needed for the certificate work.
The same warning appears across this year's Windows 11 release notes. The August preview update notes say devices that haven't received the newer certificates will continue to start and operate normally, and standard Windows updates will continue to install. Updated certificates will continue to be delivered through Windows Update in the coming months. Microsoft's separate Secure Boot guidance lists expiry dates of June 24, 2026 for Microsoft Corporation KEK CA 2011, June 27, 2026 for Microsoft UEFI CA 2011, and October 19, 2026 for Microsoft Windows Production PCA 2011. It warns that devices without the 2023 certificates may stop receiving new early-boot protections, such as Windows Boot Manager updates and revocation list changes. Treat the certificate work as its own project, with the October 19 date as the next deadline. Installing KB5128942 won't complete it.
What this means for you
Only people setting up or resetting Windows 11 24H2 or 25H2 devices need to do anything, and all that means is letting setup reach the internet and finish its restart. If a PC is already at the desktop, it doesn't need this package, and the support entry gives no reason to go looking for it in Windows Update.
- KB5128942 was released September 22, 2026. It covers all editions of Windows 11 24H2 and 25H2 and replaces KB5122035 from August 27, 2026.
- The update installs automatically during OOBE when the device is online, has no prerequisites, and triggers a restart before setup continues.
- Microsoft hasn't said what the update changes. The file-list CSV is the only detail published, and admins can compare it with KB5122035's list.
- Autopilot and Intune controls over quality updates during OOBE are separate from mandatory ZDP packages, which Microsoft says users can't opt out of.
- Devices set up offline won't receive KB5128942 through any documented route, so check that your images and staging networks match the OOBE code you expect.
- The Secure Boot certificate warning on the KB page needs its own action, and October 19, 2026 is the next listed certificate expiry.
KB5128942 is a routine monthly refresh of the code Windows 11 runs during setup, and it installs without anyone having to act. Unless Microsoft changes its pattern, another OOBE package will replace this one within weeks. For admins, the more pressing September items are the October 13 end of updates for 24H2 Home and Pro and the Secure Boot certificate expiry on October 19.