KB5077241 Windows 11 Preview: Taskbar Speed Test, Sysmon Inbox & More

Microsoft has released an optional, non‑security preview for Windows 11 — KB5077241 — that begins rolling out as build 26200.7922 (25H2) / 26100.7922 (24H2) and brings a small but meaningful set of quality, performance, and usability improvements: a taskbar‑accessible network speed test, native System Monitor (Sysmon) packaged as an optional inbox feature, File Explorer reliability and shortcut fixes, WebP desktop background support, emoji updates, widget and camera tweaks, and a handful of enterprise‑level changes aimed at Secure Boot readiness and recovery capabilities.

Background​

Windows 11 updates have been under intense scrutiny this year after a rocky January servicing wave that produced a string of regressions — including shutdown, Remote Desktop, cloud‑file I/O issues and, in a limited but serious subset of cases, devices failing to boot with UNMOUNTABLE_BOOT_VOLUME after the January cumulative update. Microsoft acknowledged those reports and deployed out‑of‑band fixes while continuing investigation, and that context makes February’s preview an especially welcome — and cautionary — release for many users and administrators.
Microsoft is delivering KB5077241 as a preview (optional) update today and will fold the same fixes and selected features into the next mandatory cumulative update that ships during Patch Tuesday. Multiple outlets and deployment trackers indicate the March 10, 2026 Patch Tuesday wave is the likely date this preview will be offered as part of the regular cumulative rollout (availability by device will still be controlled via Microsoft's gradual rollout policies).

---

Overview: what’s actually new in KB5077241​

Microsoft’s official notes list a collection of user‑facing and platform fixes that are largely focused on responsiveness, reliability, and a few clear functional additions. Below are the headline items, then we’ll unpack why they matter and what to watch for.

• A built‑in network speed test, exposed from the taskbar and Quick Settings, that launches your default browser to measure Ethernet, Wi‑Fi, or cellular performance.
• Sysmon (System Monitor) as an inbox feature: a native, optional Sysmon implementation that integrates with Windows Event Log and is disabled by default.
• File Explorer reliability and usability improvements, including reliably opening a new Explorer instance via Shift+taskbar click or middle‑mouse click, and an Extract All button for non‑ZIP archives.
• Widgets settings as a full‑page experience, new emoji glyphs (Emoji 16.0 subset), and the ability to use WebP images as desktop backgrounds.
• Better wake/resume behavior and display performance improvements, improvements to Windows Update responsiveness and printing dialogs, RSAT support for Arm64, and camera pan/tilt controls where hardware supports them.

These changes are intentionally modest in scope — they are quality‑of‑life and manageability improvements rather than sweeping new platform features. That small scope is, in many ways, deliberate: after the January disruption there’s clearly demand for stability and incremental refinements more than headline new features.

---

Deep dive: the three features most people will notice​

1) Taskbar network speed test — quick, discoverable diagnostics​

• What it is: a one‑click launcher for an internet speed measurement that appears when you right‑click the network icon in the system tray or open Wi‑Fi/Cellular Quick Settings. The control opens your default browser and runs a web‑based speed test against Microsoft’s measurement endpoint, capturing basic download/upload/latency metrics.
• Why it matters: Windows historically left network diagnostics fragmented — a mixture of command‑line tools, Control Panel/Settings pages, and third‑party sites. Putting a discoverable speed test in the taskbar reduces friction for casual troubleshooting and helps vendor support and help desks get a quick baseline before deeper investigation.
• Limitations & caveats:
• Measurement fidelity: the test is a convenience path to a browser‑based measurement, not a full RFC‑grade diagnostic suite. For enterprise network validation, formal throughput tests and controlled testbeds remain necessary. The browser‑based test can be influenced by local browser extensions, proxying, VPNs, or browser network stacks.
• Privacy & telemetry: the test uses a web endpoint; the browser and the endpoint will see the request and metrics. Organizations concerned about telemetry should treat this as they would any web‑based diagnostic and document policy for its use in managed environments.
• How to run it (quick steps):
• Right‑click the network (system tray) icon and choose Perform speed test if shown.
• Or open Quick Settings (click the network/Wi‑Fi/Cel lular tile) and select Test internet speed.
• The default browser will open and display the test results.

This is a practical addition for end users and support desks, but don’t treat it as a substitute for comprehensive network testing in professional environments.

2) Built‑in Sysmon — convenience for defenders, responsibility for admins​

• What it is: Microsoft has added System Monitor (Sysmon) as an optional Windows feature you can enable from Settings or via DISM/PowerShell; captured events are written to Windows Event Log so existing SIEM and EDR tooling can consume them. By default, Sysmon is disabled; organizations must explicitly enable the feature.
• Why it matters:
• For security teams, having Sysmon packaged with the OS reduces friction for consistent telemetry collection across fleets, removes a third‑party dependency, and streamlines baseline provisioning for threat detection. It also enables consistent event formatting for incident response and hunting.
• For smaller organizations and home users, native Sysmon makes it easier to follow best practices for logging without scripting installers or pushing external binaries.
• Best practices and risks:
• Enable only after planning. Sysmon produces verbose logs. Teams must plan retention, filtering, and ingestion to avoid storage bloat and performance issues. Use custom configuration files to select the event families you want to capture.
• Uninstall older Sysmon first. If you previously installed Sysmon from Sysinternals, Microsoft recommends removing the external package before enabling the inbox feature to avoid conflicts.
• Visibility & privacy. Sysmon captures process, network and file activity that can include user‑identifying information. Treat enabling as a security operation that requires policy and documentation.
• How to enable (two supported options):
• Settings: Settings > System > Optional features > More Windows features, then check Sysmon.
• Command line (admin):
• DISM: Dism /Online /Enable-Feature /FeatureName:Sysmon
• After the package installs, finish setup with: sysmon -i (using a config file of your choice).

Sysmon being inbox is a net positive for defenders — but only when deployed thoughtfully and with retention and parsing designed into the security pipeline.

3) File Explorer fixes and usability improvements​

• What they changed:
• Holding Shift and clicking the File Explorer icon on the taskbar, or using the middle mouse button, now reliably opens a new instance of File Explorer rather than focusing an existing window. This restores a long‑used Explorer shortcut behavior many power users rely on.
• File Explorer’s command bar now shows an Extract all option when browsing non‑ZIP archive folders.
• The Network page in File Explorer is more reliable at showing discovered and connected devices.
• Why these matter: Small interaction regressions add up. Reliable shortcuts and better archive handling speed common workflows for technicians and power users, and the Network page reliability helps in mixed device environments where SMB/UPnP discovery has been flaky.

---

Platform and security items you can’t ignore​

Secure Boot certificate lifecycle and BitLocker reliability​

KB5077241 includes work related to the Secure Boot certificate expiration Microsoft warned about: new update packages add high confidence targeting data so eligible devices can automatically get replacement Secure Boot certificates as they become available. This is a phased rollout that only applies to devices that demonstrate successful update signals. Microsoft also notes a BitLocker reliability fix to prevent systems from becoming unresponsive after entering a recovery key.
Why that matters for IT teams:

• The Secure Boot certificate expiration window begins in June 2026, and organizations should be aware that Microsoft and OEMs will coordinate certificate distribution. Devices that don’t receive the new certificates in time could face boot issues — advance planning, firmware updates, and testing across device models are essential.
• The BitLocker reliability improvement addresses a high‑impact failure mode (device stops responding after asking for a recovery key), so administrators should test recovery flows in their estates after applying the March cumulative release.

Controlled Feature Rollout — expect variability​

Microsoft continues to use Controlled Feature Rollout (CFR) which means that even after you install an update, a given feature may be gated server‑side or dependent on hardware/partner compatibility. Don’t assume immediate parity across devices; confirm availability by testing on representative hardware.

---

Should you install KB5077241 now, or wait for Patch Tuesday?​

This is the practical question every home user, power user, and IT admin is asking.

• If you are a typical consumer who values stability over immediacy: wait for the March 10 cumulative rollout (the preview will be included then). That timing allows Microsoft to fold this preview into the mandatory channel and for broader telemetry to surface any latent regressions. Multiple tracking sites and outlets report that Microsoft is scheduled to include these preview changes in the March 10 Patch Tuesday wave.
• If you are an early adopter or need a specific new capability (for example, inbox Sysmon for lab testing, or WebP wallpaper support for a designer workflow): install the preview on test machines first, not on production devices. Use a controlled test plan: image backups, driver checks, and a rollback plan.
• For enterprise admins:
• Stage KB5077241 into a pilot ring limited to representative hardware, including the oldest and most common firmware families in your estate.
• Validate Secure Boot, BitLocker recovery, and wake/resume workflows explicitly.
• If you rely on third‑party endpoint tooling, test Sysmon inbox behavior versus your existing Sysinternals configuration to avoid duplication or conflicts.

Given the January servicing issues, a conservative approach — pilot then broad — remains the safest path for most organizations.

---

Practical how‑tos and admin checks​

Installing the preview (GUI)​

• Settings > Windows Update > Check for updates. Look under Optional updates or the Optional updates available link and select KB5077241 to download and install.

Installing the preview (command line / offline)​

• Microsoft documents DISM/PowerShell and MSU package installation steps. For example, you can use:
• DISM /Online /Add-Package /PackagePath:c:\packages\Windows11.0-KB5077241-x64.msu
• Or use PowerShell Add-WindowsPackage -Online -PackagePath "c:\packages\Windows11.0-KB5077241-x64.msu"
  Microsoft also publishes the individual MSU ordering if you prefer to install components separately.

Enabling built‑in Sysmon (recommended pilot procedure)​

• On a test host, uninstall any Sysmon previously installed from Sysinternals.
• Enable the inbox feature via Settings > System > Optional features > More Windows features > check Sysmon, or run:
• DISM /Online /Enable-Feature /FeatureName:Sysmon
• Configure Sysmon with a vetted configuration file and install it with: sysmon -i <your-config.xml>. Start with a conservative config that captures process creation, image loads and network connection events, and expand only if your SIEM/infrastructure can handle the volume.

Testing File Explorer changes​

• Verify new‑instance behavior: hold Shift and click the File Explorer icon or click the wheel/middle button. Confirm a new window opens rather than switching to the existing instance. Test archive extract behavior on several archive types to confirm the Extract All control appears as expected.

Testing Secure Boot and BitLocker​

• Backup recovery keys and test BitLocker recovery on a spare machine before deploying widely. Test firmware updates in pilot groups, especially for devices that may not automatically receive the certificate update. Microsoft’s guidance and KB notes highlight the phased nature of the Secure Boot certificate rollout; plan firmware and driver tests accordingly.

---

Risks, limitations and what to watch for​

• Controlled rollouts and partial availability: don’t assume instant parity. If a feature matters to your workflow, validate it after install.
• Sysmon data volume and privacy: Sysmon logs can significantly increase event volumes and contain sensitive telemetry. Plan retention, ingestion, and access controls before enabling at scale.
• Speed test expectations: the new taskbar test is convenient but not authoritative. It’s useful for quick diagnostics but can be skewed by local browser configuration, VPNs, or proxying. Use it as a triage tool, not a replacement for controlled network benchmarking.
• Firmware and OEM coordination for Secure Boot: the Secure Boot certificate changes are necessary but operationally complex. Firmware and OEM involvement means some device families may need extra attention; test early.
• Historical context: the January update sequence serves as a reminder that even security updates can surface high‑impact regressions in rare cases. That history argues for measured rollout strategies and robust recovery playbooks.

---

The verdict: practical takeaway for different audiences​

• Home users and casual power users: KB5077241 is attractive because it’s mostly polish and UX fixes. If you’re worried about system stability or don’t need the new Sysmon/Extract All convenience immediately, wait for the March 10 cumulative release so wider telemetry can surface any edge regressions.
• Power users and early adopters: install on a secondary device now if you care about the new taskbar test, WebP desktop support, or Explorer shortcut behavior. Expect the experience to be incremental and generally positive.
• IT administrators and security teams: pilot the update in a representative ring, validate BitLocker recovery and Secure Boot certificate behavior, and test Sysmon in a controlled lab to tune parsers and retention. Treat Sysmon activation as a policy decision and align it with your SIEM/EDR strategy.

---

Final thoughts​

KB5077241 doesn’t attempt to rewrite Windows 11’s roadmap. Instead, it takes the minimalist — and in this moment, appropriate — approach of delivering practical, visible improvements paired with a few important platform and security refinements. That matters because after a turbulent January, users and admins crave predictability and incremental wins that make everyday tasks feel snappier and more reliable.
The inclusion of inbox Sysmon and the Secure Boot readiness work are the most consequential elements for IT and security teams; the taskbar speed test and File Explorer fixes are small but welcome enhancements for everyone else. As always, controlled rollouts mean patience pays: pilot, validate, and then broaden deployment. If you need immediate access to the features for testing or operational reasons, the preview is available today; otherwise, waiting for the next Patch Tuesday automatic inclusion on March 10, 2026 is a perfectly reasonable path for stability‑minded users and organizations.

---

---

Source: AOL.com https://www.aol.com/articles/windows-11-february-2026-now-015349440.html