Microsoft Calls KB5120998 “Non-Security.” It Still Changes Admin Privileges, Agent Isolation and Enterprise Automation.
Updated 29 August 2026: User reports now link KB5120998 to cursor customisation failures, desktop wallpaper reverting to black and, in some cases, degraded text rendering. Windows Latest found a growing cluster of reports and said Microsoft acknowledged the cursor complaints in Feedback Hub and is investigating.
Update: cursor and wallpaper regressions are now under investigation
The scope remains uncertain. The Windows Latest test system and several community members did not reproduce the failures. Microsoft’s official KB page still says the company is not aware of any issues with the update. That is a reason to describe the evidence precisely, not to ignore it.
The operational advice is now firmer: do not broadly deploy this optional preview outside a representative test ring. If an affected PC needs recovery, BlackTree has a Dutch and English KB5120998 removal guide. Healthy systems do not need a blanket uninstall, but administrators should monitor Microsoft’s release-health pages because the preview’s contents are expected to enter the next required cumulative update.
Microsoft calls Windows 11 KB5120998 a non-security preview update. That description is accurate, but incomplete. The optional release does not introduce newly documented CVE fixes, yet it changes how Windows handles administrative privileges, agent isolation, legacy management tools, post-quantum cryptography and several enterprise deployment workflows.
For security and IT teams, the important question is not whether this update deserves emergency deployment. It does not. The question is whether the changes arriving through this preview will affect the organisation when they become part of a later mandatory cumulative update.
The short version: KB5120998 is optional and Microsoft classifies it as non-security. Use a test ring rather than treating it as an urgent patch. Start checking WMIC dependencies now, evaluate Administrator Protection carefully, and treat the new agent isolation capabilities as early technology rather than a finished security boundary.
KB5120998 is optional, but its changes will not stay optional
Microsoft released KB5120998 on 27 August 2026 for Windows 11 24H2 and 25H2. It moves those releases to OS Builds 26100.9278 and 26200.9278 respectively.
The package is available through Windows Update as an optional preview. Microsoft also says the changes will appear in the next security update for Windows Update for Business. In other words, organisations can defer this particular preview, but many of its changes are expected to reach managed endpoints through the normal cumulative servicing cycle.
Feature availability is also gradual. Installing the package does not guarantee that every new capability appears immediately on every device. Microsoft currently lists no known issues, although that statement should not replace application and hardware testing inside each organisation.
Administrator Protection changes what an admin session means
The most immediately security-relevant addition is Administrator Protection. Instead of leaving an administrator signed in with a reusable elevated token, Windows keeps the user de-privileged and creates elevation only for an authorised administrative operation.
Microsoft describes the design as just-in-time elevation with profile separation. Windows creates a hidden, system-generated account for the isolated administrative token and destroys that token when the elevated process ends. A new administrative task requires a new authorisation.
This is a meaningful reduction in standing privilege. Malware running in the ordinary user context has less opportunity to inherit or reuse a long-lived administrative token. The separation can also make it harder for an unelevated process to tamper with data belonging to the elevated operation.
There are important limits. Microsoft says Administrator Protection is not a formal security boundary. It is disabled by default and must be enabled using Group Policy or an OMA-URI policy, including through Microsoft Intune. Security teams should therefore treat it as hardening, not as a substitute for application control, endpoint detection, credential protection or standard-user operation.
A controlled pilot is the right first step. Test helpdesk tools, installers, management agents and workflows that assume an administrator has a conventional persistent profile or token. A stronger privilege model is useful only when teams understand how their current software behaves inside it.
Windows is adding identity and containment for AI processes
KB5120998 also introduces two platform capabilities aimed at agentic software.
Microsoft Execution Containers add process isolation for workloads such as coding agents and model-generated code. Policies can restrict access to files, networking, the user interface and other operating-system resources. The architectural goal is important: code produced or selected by an AI system should not automatically inherit all the access available to the user running it.
The second capability lets authorised components attach an opaque agent identifier to a process token. Windows protects that marking, passes it to child processes and includes it when an agentic process authenticates through Web Account Manager. That creates the beginnings of attribution across a process tree and into authentication activity.
Both features should be treated as previews. Microsoft’s public MXC repository warns that the implementation is early, that some generated policies are overly permissive and that current MXC profiles should not be treated as security boundaries. The identifier format used for agentic processes may also change.
The direction is more consequential than the current maturity. Windows is beginning to distinguish an AI agent from an ordinary application process and to provide dedicated containment and identity primitives. That can eventually give defenders better policy enforcement, telemetry and accountability, but organisations should not claim those protections before testing what the preview actually enforces.
WMIC removal can break old automation
The most practical operational change is the removal of the Windows Management Instrumentation Command-line utility, or WMIC. It was already removed by default from newer Windows installations. Starting with this August release, it is no longer available as a Feature on Demand on Windows 11 24H2 and 25H2.
Microsoft’s Windows deprecation list now records WMIC as removed. Windows Management Instrumentation itself remains supported. The removal affects the legacy command-line interface, not WMI as a management technology.
Old inventory scripts, deployment packages, support procedures and monitoring integrations may still call wmic.exe. Those dependencies can fail when the executable disappears. Administrators should search scripts and management repositories now, then replace WMIC calls with supported PowerShell and CIM-based alternatives before the change arrives through the normal servicing channel.
Post-quantum TLS, Search controls and deployment changes
The update allows the ML-KEM post-quantum algorithm to be used as a standalone TLS key-exchange method, in addition to the hybrid groups Windows already supported. This does not mean organisations should immediately replace established TLS configurations. It does mean Windows is expanding the cryptographic options available for testing post-quantum readiness.
Windows Search receives a privacy-relevant control that lets users choose whether web and Microsoft Store suggestions appear beside local results. Windows can also automatically index frequently used folders, with a setting available to control that behaviour. Enterprises should review how these defaults interact with their privacy, data-location and endpoint configuration requirements.
Other changes include generally available device association for Windows Autopilot device preparation and support for applications to coordinate updates through the Windows Update Orchestration Platform. Deployment teams should also note Microsoft’s warning about dynamically updated installation media: the correct boot.stl file must be included, or affected media may fail to start with error 0xc0430001.
What security and IT teams should do
- Do not treat KB5120998 as an emergency security patch. It is an optional preview and contains no newly documented CVE fixes.
- Use a representative test ring. Check endpoint-management agents, VPN software, helpdesk tooling, installers, drivers and sleep or restart behaviour.
- Find WMIC dependencies now. Search scripts, scheduled tasks, deployment packages and operational documentation for
wmic.exe. - Pilot Administrator Protection deliberately. Measure compatibility and support impact before broad Group Policy or Intune deployment.
- Evaluate AI isolation claims against actual enforcement. MXC and agentic-process tagging are promising previews, not finished security guarantees.
- Review Windows lifecycle planning. Windows 11 24H2 Home and Pro reach end of updates on 13 October 2026.
BleepingComputer counted 35 changes and fixes in the release. The more useful enterprise reading is that Microsoft has placed privilege separation, agent containment, agent identity and legacy-tool removal inside a package labelled non-security. The label describes the servicing classification. It does not describe the full operational consequence.
Sources
- Microsoft: KB5120998 for Windows 11 24H2 and 25H2, published 27 August 2026. Microsoft provides a date but no publication time.
- Microsoft: earlier Release Preview notes for KB5120998, published 14 August 2026. Microsoft provides a date but no publication time.
- Microsoft Execution Containers repository, accessed 28 August 2026.
- BleepingComputer: Windows 11 KB5120998 update released with 35 changes and fixes, published 28 August 2026 at 05:10 EDT, or 11:10 Europe/Madrid.
- Windows Latest: KB5120998 cursor, wallpaper and text-rendering reports, published 28 August 2026. The page provides a date but no publication time.
- Windows 11 community thread opened by a Microsoft engineer, 28 August 2026.
- BlackTree: Windows 11 KB5120998 verwijderen | How to uninstall KB5120998, published 29 August 2026.
