Windows 11 Build 29708.1001 Tests Intune Remote Lock, Easier PIN Setup and Cloud Rebuild

Some context first. Microsoft's Flight Hub lists 29708.1001 on November 13, one week after Build 29704.1000 on November 6. It describes Future Platforms builds as "not aligned to any retail release of Windows." In other words, this channel shows what Microsoft is testing on the platform. It is not a schedule for what will ship.

What's in Build 29708.1001 at a glance​

Microsoft says these changes are gradually being rolled out. Installing the build doesn't mean you'll see every feature right away.

Windows Hello PINs: fewer rules for home users​

Microsoft has redesigned Windows Hello PIN setup. For personal accounts:

• PINs now need at least six digits, with an option to use four digits.
• The extra complexity rules are gone. Windows no longer blocks certain number sequences or asks for letters or special characters.

For work accounts, the setup screens get the same refresh, but Microsoft says the requirements are unchanged. If your organization enforces PIN complexity, this build doesn't change that.

Analysis: This is a reasonable trade-off. A Windows Hello PIN only works on the device where it was created, which is what separates it from a password. Forcing home users to include a special character mostly annoyed them without adding much protection. Some security people will still object to keeping a four-digit option at all. The release notes don't explain where that option appears during setup, so we'll wait for hands-on reports before saying more.

Remote Lock: Intune gets a lock that doesn't wipe​

Remote Lock is the most important change in this build for enterprise admins. According to Microsoft, an admin can lock a lost, stolen or compromised Windows device from Microsoft Intune without wiping it. When the lock lands:

• Windows signs out every active session.
• All sign-in options are hidden.
• A Device Locked screen appears.

Nothing gets deleted. The device stays enrolled and managed, BitLocker stays on, and the user's data stays where it was. Only an admin can lift the lock remotely, and the user then picks up where they left off.

Admins can customize the lock screen. Two fields, LockReason and RecoveryHint, let you add your own explanation and a help desk contact.

Why it matters: Until now, the choices for a laptop left in a taxi were roughly "hope it turns up" or "wipe it and rebuild." Remote Lock adds a middle option that suits cases where the device might come back or where you're still investigating. A device you suspect is compromised can be locked out without erasing what the forensics team needs to examine. The release notes don't list licensing, minimum OS versions or other Intune prerequisites, so treat this as a preview capability and don't add it to your runbooks yet.

Cloud rebuild: reinstalling Windows when it won't boot​

Cloud rebuild performs a full reinstall of Windows 11 to return a PC to a clean, known-good state, even when Windows won't boot. Microsoft compares it directly with Reset this PC. Cloud rebuild downloads both the target Windows image and the device's drivers from Windows Update. You don't need USB media or a custom image, and it doesn't depend on the health of the currently installed OS.

How to run Cloud rebuild in this preview​

• Boot into the Windows Recovery Environment (WinRE).
• Select Troubleshoot > Recovery and uninstall > Cloud rebuild.
• Connect to the network from inside WinRE, over wired Ethernet or Wi-Fi.
• Check the target Windows build, edition and language.
• Confirm the data-loss warning. The rebuild starts only after you do.

If Windows still boots, you can also start Cloud rebuild from Settings > System > Recovery. Microsoft wants feedback in Feedback Hub (Win + F) under Recovery > Cloud rebuild.

This is a full reinstall, not a repair. Microsoft shows a data-loss warning for a reason. Back up anything you care about first.

What success looks like and where it can fail​

Coverage of earlier preview builds explains what happens after the rebuild. 4sysops reported that when the rebuild finishes, the machine runs through the out-of-box experience (OOBE); Autopilot-registered, Intune-managed devices can enroll again on their own. So when it works, you see a fresh setup screen, and managed devices bring their policies back automatically.

The same outlet lists the prerequisites that usually cause failures: You need a functional WinRE (verify with reagentc /info), a WinRE network driver from the manufacturer, and hardware that meets Windows 11 requirements. Admin365 added that a device with a disabled WinRE cannot use Cloud Rebuild. If the option is missing or the download stalls, check these three things first:

• Is WinRE enabled? Run reagentc /info from an elevated prompt while Windows still works.
• Can WinRE see the network? Without a WinRE-compatible network driver, the rebuild can't reach Windows Update.
• Does the hardware meet Windows 11 requirements?

This feature isn't new everywhere​

Cloud rebuild has been in testing for months. WindowsForum previously reported that Microsoft added Cloud Rebuild to Windows 11 on July 6, 2026, in Experimental Preview Build 26300.8772. Rack2Cloud reported that the feature moved from the Experimental Insider channel to Beta on September 9, 2026 (Build 26220.9343). What's new in 29708.1001 is that the Future Platforms channel now carries the feature too.

There's also a naming difference. In its coverage of KB5127936, 4sysops said the Settings path ends at a button labeled Rebuild PC, while this build's notes only refer to the Settings > System > Recovery page. Look for either label.

Intune remote initiation is already available. Don't confuse Remote Lock with remote rebuilds. Microsoft's Cloud rebuild documentation says a rebuild can be initiated remotely by an IT administrator through an enterprise endpoint management solution such as Intune, using the Recovery CSP. Remote execution reached the Experimental channel in September 2026, including Future Platforms Build 29671.1000, so it predates 29708.1001. One caveat: the rebuild is triggered through the Recovery CSP's Execute node, which must be committed atomically; starting it with a custom OMA-URI setting isn't supported.

There's a trade-off to keep in mind. A recovery tool that depends on Windows Update and a working network makes old-fashioned offline media less necessary, but it doesn't make that media useless. Keep a USB installer for sites with poor connectivity or unusual network hardware.

Smaller changes​

• WebP metadata in File Explorer: You can now add tags and other metadata to WebP files, which have long been second-class next to JPEGs. Microsoft hasn't listed exactly which fields you can edit.
• Taskbar preview slowdown fixed: Microsoft fixed a recent bug that made app preview windows respond more and more slowly the longer you used them.
• Unicode 17.0 text shaping: Windows now supports text shaping for Unicode 17.0, which added 4,803 characters and four new scripts: Beria Erfe, Sidetic, Tai Yo and Tolong Siki. Text shaping is only part of the job. Characters still need fonts and apps that support them before they appear correctly everywhere.
• Green screen fix: Microsoft fixed an issue that caused some Insiders to see more bug checks (green screens, the Insider version of the BSOD) with DRIVER_IRQL_NOT_LESS_OR_EQUAL. The notes don't say which hardware or driver was involved. If you've been seeing that error in recent Future Platforms builds, this update is the one to install.

Should you be in this channel at all?​

Microsoft's own warnings for Future Platforms are worth repeating:

• Builds can be unstable and may come with limited documentation.
• Features might change, be removed or never ship beyond Insiders.
• Many features use Controlled Feature Rollout, starting with a subset of users and expanding over time.
• Some features may not be fully localized yet. You can report language problems through Feedback Hub.
• The desktop watermark is normal for pre-release builds.

This is the channel for people who want to see platform changes long before they ship and who don't mind an occasional green screen. Don't use it on a PC you depend on for work.

The bottom line​

Build 29708.1001 is a solid preview for anyone who manages or repairs PCs. Remote Lock fills a long-standing gap in Intune between doing nothing and wiping the device. Cloud rebuild, now in Future Platforms as well, keeps moving toward a recovery option that doesn't need a USB stick. The PIN changes make life easier for home users while leaving work-account requirements alone. Remote initiation of Cloud rebuild through Intune's Recovery CSP is already documented by Microsoft, and nothing here is guaranteed to ship. But taken together, these changes show Microsoft is serious about making PCs easier to recover without anyone touching the machine.

Correction (November 13, 2026): An earlier version of this article said Intune remote initiation of Cloud rebuild was still missing and would arrive in a later release. That was wrong: Microsoft's Cloud rebuild documentation says a rebuild can be started remotely through an enterprise endpoint management solution such as Intune using the Recovery CSP, and remote execution reached Experimental builds including Future Platforms Build 29671.1000 in September 2026. The article has been corrected.