Microsoft’s September Patch Tuesday brings a substantial, feature‑heavy cumulative update to Windows 11—KB5065426—delivering a mix of visible UI polish, staged Copilot+ AI capabilities, privacy controls for on‑device generative features, and a set of bug and security fixes that administrators and enthusiasts will need to treat as more than a routine monthly patch.
Microsoft packaged KB5065426 as the September cumulative update for Windows 11 and has pushed it to devices running both version 23H2 and 24H2. The payload includes not only conventional security and reliability fixes, but also code and model binaries to support on‑device generative AI features in Copilot and Copilot+ experiences. These capabilities are being staged by Microsoft, meaning the underlying code arrives with the update while feature enablement is rolled out server‑side and tied to device hardware, licensing, and region.
Two practical consequences follow: first, appearance of new UI elements or AI tools will vary between otherwise identical machines; second, the update packages are unusually large because they contain on‑device model data. Administrators should therefore expect nontrivial download and storage requirements when deploying this update broadly.
Caveats and unverifiable items:
For organizations, that tradeoff translates into tangible planning needs: bandwidth, storage, licensing reconciliation, policy updates, and user education. For consumers, it means new convenience and creative tooling appear directly where files and tasks live—but with privacy and permissions to manage.
Source: Thurrott.com Patch Tuesday Arrives with New Features for Windows 11
Microsoft packaged KB5065426 as the September cumulative update for Windows 11 and has pushed it to devices running both version 23H2 and 24H2. The payload includes not only conventional security and reliability fixes, but also code and model binaries to support on‑device generative AI features in Copilot and Copilot+ experiences. These capabilities are being staged by Microsoft, meaning the underlying code arrives with the update while feature enablement is rolled out server‑side and tied to device hardware, licensing, and region.Two practical consequences follow: first, appearance of new UI elements or AI tools will vary between otherwise identical machines; second, the update packages are unusually large because they contain on‑device model data. Administrators should therefore expect nontrivial download and storage requirements when deploying this update broadly.
Overview of What’s New
The update surfaces a long list of user‑facing changes plus platform fixes. Key highlights include:- Recall: redesigned homepage and improved controls (Copilot+ only).
- Click to Do: first‑run interactive tutorial and improved discoverability (Copilot+ only).
- Agent in Settings: on‑device settings assistant expanded to AMD/Intel Copilot+ PCs (English only).
- Search: grid image results, clearer indexing status, and differentiation between local/cloud files.
- Notification Center: option to show a larger clock with seconds (similar to Windows 10).
- System dialogs: permission prompts now dim the desktop and present modal dialogs for clarity.
- Lock screen widgets: add/remove/rearrange widgets and a new small size option.
- File Explorer: minor visual/context menu changes and AI image/document actions (some gated by Copilot/Microsoft 365 licenses).
- Windows Hello: redesigned sign‑in visuals and flows; tradeoffs between aesthetics and speed reported.
- Generative AI privacy controls: new Settings page listing which third‑party apps used on‑device generative models and controls to restrict access.
- Widgets: multiple dashboards and a left navigation bar for switching views.
- Task Manager: corrected CPU reporting and optional CPU Utility column in Details view.
- Fixes: assorted security and reliability fixes across ReFS, IME, Arm64, and more.
Technical deep dive
Copilot+ features and hardware gating
The most attention‑grabbing items are the Copilot+ features—Recall, Click to Do, Agent in Settings, and File Explorer AI actions. These are being targeted primarily at Copilot+ PCs, which are machines with on‑device NPUs or other hardware designed to accelerate local generative models. Microsoft’s rollout strategy places the client code into the cumulative update while enabling features selectively based on hardware capability, tenant licensing (Copilot/Microsoft 365 entitlements), locale, and staged server flags. That explains variability in who sees what.- Recall: Now opens to a landing page showing recent snapshots, top apps, and websites with a left navigation bar for Home, Timeline, Feedback, and Settings. Snapshot capture remains opt‑in and local encryption along with Windows Hello gating is used to protect recorded content.
- Click to Do: Gains an interactive tutorial to help users discover text‑and‑image assistant actions (summarize, extract, edit).
- Agent in Settings: The on‑device “agent” that translates plain‑English input into recommended settings is now available on AMD and Intel Copilot+ devices but is limited to English initially.
On‑device models and update size
Several independent reports and catalog entries show the update packages include large model payloads, producing cumulative .msu downloads measured in gigabytes—comparable to small Windows ISOs. That is an intentional design: on‑device generative models are shipped in the update so Copilot features can run locally when enabled. Expect increased network transfer and disk usage, and plan for bandwidth‑constrained environments accordingly.Search, File Explorer and Shell AI actions
Search now displays image results in a grid view and surfaces indexing status in the UI so users understand why results might be incomplete. File Explorer’s context menu is receiving AI image edits (Blur Background, Remove Background, Erase Objects) and a Summarize action for documents that may call cloud Copilot/Microsoft 365 services when required. Note that some AI actions are gated by Microsoft licensing and hardware eligibility.Privacy and security controls for generative AI
A dedicated Text and Image Generation page in Settings (Privacy & security > Text and Image Generation) now lists third‑party apps that recently invoked built‑in generative models, and provides per‑app toggles. This reflects an important privacy control: users and admins can audit and restrict which apps may access on‑device generative features. Nonetheless, the efficacy of these controls depends on enforcement boundaries (OS vs app behavior) and log fidelity—areas that deserve scrutiny.UI/UX tweaks: Windows Hello, Notification Center, and system dialogs
A cleaner Windows Hello visual identity has been implemented across sign‑in and passkey flows; however, early reports note the flows can feel slower and more cumbersome despite the improved look. Notification Center can restore a larger clock with seconds, appealing to Windows 10 holdouts and users who prefer a richer date/time flyout. System permission prompts now appear as modal, dimmed dialogs centered over the Desktop to clarify consent—an accessibility and UX improvement for many workflows.Cross‑checked verifications and caveats
Where possible, multiple independent sources confirm the headlines above: Microsoft’s own Release Preview and update notes describe staged feature enablement, Copilot+ gating, and new privacy controls; independent outlets have validated the UI changes, Task Manager CPU reporting fixes, and large .msu payload sizes. The convergence of these independent reports strengthens confidence that the listed features and operational impacts are accurate.Caveats and unverifiable items:
- Exact timing for broader enablement of staged features is not publicly guaranteed; Microsoft’s server‑side gates are adjusted using telemetry and rollout policies, so there is no deterministic ETA for when any given machine will see a specific Copilot+ feature. Treat rollout timing as probabilistic and monitor telemetry.
- Reported .msu sizes and payload compositions vary by architecture and catalog entry; size figures are available in catalog listings but can change across releases and bundling decisions—administrators should verify the exact package sizes from the Microsoft Update Catalog for their target architecture before large deployments.
Benefits and strengths
- Improved productivity at the shell level
- On‑device AI actions in File Explorer, Click to Do improvements, and Recall’s task‑resumption UX bring generative capabilities closer to where users work, reducing friction for common tasks such as image edits and document summarization. This can speed workflows for content creators and knowledge workers alike.
- Privacy‑forward controls for generative features
- The new Settings page for Text and Image Generation gives users visibility and control over which third‑party apps invoked on‑device generative models. That’s an important design move for accountability and auditability.
- UX and consistency fixes that matter daily
- Smaller refinements—clock in Notification Center, modal permission dialogs, Task Manager CPU reporting alignment—improve the day‑to‑day coherence of Windows and reduce small annoyances that compound over time.
- On‑device AI reduces cloud dependence
- For scenarios requiring offline operation or improved latency, on‑device generative models are a clear win: features can work without a live cloud connection once models are installed locally. This benefits privacy‑sensitive or bandwidth‑limited contexts.
Risks, tradeoffs and operational concerns
- Large update payloads: bandwidth and disk impact
- The inclusion of model binaries increases update sizes dramatically. Enterprises with limited WAN capacity or metered connections will face increased transfer costs and longer maintenance windows. Staggered downloads, peer caching, and use of the Microsoft Update Catalog or Windows Server Update Services (WSUS) mitigations should be planned.
- Feature gating complexity and support burden
- Server‑side gating leads to heterogeneity across devices on the same build. Support teams could see increased variability in user reports and must account for hardware, licensing, and region when triaging “missing features.”
- Privacy and surface‑area questions despite controls
- Recall records snapshots of activity for task resumption. While opt‑in and encrypted with Windows Hello, the existence of automatic capture features expands the attack surface and raises questions about retention, local forensic access, and third‑party app interactions—areas that require clear policy and configuration from administrators. The new Settings controls help, but do not eliminate need for governance.
- Licensing and cloud fallbacks
- Some File Explorer AI actions will call cloud processing and/or require a Copilot/Microsoft 365 license for full capability (for example, document summarization). Users and IT must understand which workflows are free on‑device vs which require cloud entitlements.
- Usability regressions in Windows Hello
- While the Windows Hello UI has been modernized, some users report slower sign‑in experiences. Organizations that rely on fast biometric sign‑in (e.g., reception desks, kiosks) should validate the updated flows before wide rollout.
Deployment guidance for administrators
- Inventory and entitlement assessment
- Identify Copilot+ hardware, CPU/NPU capabilities, and which users have Microsoft 365/Copilot licenses. Map which devices will receive on‑device AI features and which will remain cloud‑assisted. This prevents surprises when features don’t appear.
- Pilot on a controlled ring
- Establish a small pilot group representing diverse hardware and license states to validate UX, performance, and compatibility. Pay attention to disk usage growth and Windows Hello behavior during pilot.
- Plan for bandwidth and storage
- For large updates, use delivery optimization, peer caching, WSUS, or the Microsoft Update Catalog to reduce WAN impact. Confirm exact .msu sizes for target architectures from the catalog prior to mass deployment.
- Update communications and training
- Prepare end‑user messaging that explains Recall opt‑in, how to control generative AI permissions, and where to find the new Settings pages. Provide short how‑to guides for the Click to Do tutorial and any new Windows Hello steps.
- Security and privacy policy updates
- Update acceptable use and retention policies to account for Recall snapshots and on‑device model use. Ensure legal and compliance teams review local retention defaults and the auditability of the new Text & Image Generation settings.
- Monitor telemetry and support channels
- Watch for increased helpdesk tickets tied to feature gating confusion, slow signin flows, or mitigation failures. Use telemetry to track adoption and any anomalous performance regressions.
Practical tips for consumers and power users
- If you prefer to delay large packages, defer the update on Windows Update or use metered connection settings; alternatively download the specific .msu from the Microsoft Update Catalog and install during off‑peak hours. Verify the storage impact in advance.
- Explore the new Settings page (Privacy & security > Text and Image Generation) after updating to see which apps accessed on‑device generative models and toggle access for apps you don’t trust.
- For Copilot+ features that are not visible after updating, confirm device hardware qualifies, English display language is set (for Agent in Settings), and that licensing entitlements are in place—then allow time for Microsoft’s staged enablement.
- If Windows Hello feels slower after the update and it impacts productivity, test credential and device settings and log a support request; some users reported the redesigned flow is visually nicer but slower in practice.
The broader picture: why this matters
This Patch Tuesday marks an inflection point in Microsoft’s desktop strategy: generative AI is no longer an add‑on service but is being integrated into the shell itself—File Explorer, Search, Settings, and lock screens. Shipping model binaries with cumulative updates is a deliberate tradeoff: it brings offline AI capabilities and lower latency, at the cost of larger update sizes and more complex feature gating.For organizations, that tradeoff translates into tangible planning needs: bandwidth, storage, licensing reconciliation, policy updates, and user education. For consumers, it means new convenience and creative tooling appear directly where files and tasks live—but with privacy and permissions to manage.
Conclusion
KB5065426 for Windows 11 supplies a dense mixture of visible UI polish, staged Copilot+ on‑device AI features, and thoughtful privacy controls—while also introducing operational challenges that make this month’s Patch Tuesday more than a routine security rollup. The core improvements—Recall’s new homepage, Click to Do onboarding, Search and File Explorer upgrades, and the Text & Image Generation privacy page—offer real productivity and privacy value when used with awareness of hardware gating and licensing. Administrators should approach deployment deliberately: pilot widely, plan for the larger payloads, update policies, and prepare users for change. The next few weeks will be the litmus test for whether on‑device generative features can deliver meaningful productivity gains without introducing untenable operational or privacy risk.Source: Thurrott.com Patch Tuesday Arrives with New Features for Windows 11