Microsoft released its July 2026 security update for Windows 11 on Tuesday, delivering a critical boost to Remote Desktop protections alongside a not-so-subtle nudge for millions of consumers still running Windows 11 24H2 Home or Pro: you have until October 13, 2026, to upgrade to a supported version, or you’ll stop receiving security patches entirely.

The cumulative update, cataloged as KB5101650, applies to Windows 11 version 25H2 (build 26200.8875) and version 24H2 (build 26100.8875). Its headlining security feature is the addition of SHA-2 certificate thumbprint support for trusted Remote Desktop publishers, a move that lets administrators enforce stronger cryptographic verification for .rdp files. An updated curl utility—now at version 8.21.0—and continued Secure Boot certificate delivery round out the package.

What this means in practice varies sharply between home users and IT professionals. For everyday Windows users, the immediate action is simple: apply the update, verify your build number, and if you’re on 24H2 Home or Pro, start planning your upgrade path now. For admins, the update triggers a minor reconfiguration of Remote Desktop trust settings, a targeted driver update for a subset of Dell systems, and a check of deployment media to prevent boot failures.

Here’s a closer look at the changes, the deadlines, and the next steps Windows users should take.

What KB5101650 actually delivers

The update landed on July 14 as part of the regular Patch Tuesday cadence. Microsoft documented 622 total CVEs in the July security release, with 416 of those affecting Windows components. But KB5101650 isn’t just a security patch—it bundles functional improvements that change how Windows handles a few key tasks.

  • Remote Desktop SHA-2 support. Until now, Windows would only trust SHA-1 certificate thumbprints when verifying signed .rdp files. With KB5101650, you can now add SHA-256 thumbprints to the list of trusted publishers. SHA-1 is still accepted for backward compatibility, but Microsoft says it will be removed in a future release. Two new Group Policy settings control this: “Specify SHA256 thumbprints of trusted .rdp publishers” and the existing SHA-1 policy. The transition gives organizations a window to update their .rdp signing workflows.
  • Inbox curl bumps to 8.21.0. The command-line data transfer tool that ships with Windows gets a version upgrade with security fixes. If your scripts or deployment tools call the built-in curl.exe, this change matters. If you rely on a separately installed curl, it doesn’t.
  • Secure Boot certificate continuation. Many Secure Boot certificates began expiring in June 2026. Microsoft is delivering replacement certificates through its regular update channel, and KB5101650 includes additional targeting data to ensure the right devices receive the right certificates. As long as you keep the OS updated, Secure Boot should continue working without manual intervention.
  • Dell Intel IPF compatibility hold—and fix. On some Dell devices equipped with Intel Innovation Platform Framework (IPF) drivers, Microsoft temporarily blocked KB5101650 due to an incompatibility. The issue has since been resolved with an out-of-band update, KB5121767. Affected systems should get that fix through Windows Update or their management channel, not by forcing the main update.
  • Dynamic Update boot media requirement. If you maintain Windows installation media that uses Dynamic Update, you must ensure the file boot.stl is present. Without it, a device may refuse to boot from the media and throw error 0xc0430001. This is a separate task from patching running systems—your recovery USBs and deployment task sequences may need a refresh.

Microsoft also flagged that third-party TDI (Transport Driver Interface) transport behavior might be impacted by security updates released on or after July 14. The advisory doesn’t name specific apps, but older networking software or custom firewall drivers should be tested during your normal pilot ring rollout.

The clock is ticking for 24H2 Home and Pro

Buried in the support notes is a date that will matter to anyone still on Windows 11 Home or Pro edition version 24H2: October 13, 2026. That’s the day those systems stop receiving monthly security updates. After that, they’ll still work, but they’ll be increasingly vulnerable to new threats.

Enterprise and Education editions of 24H2 have a longer runway, until October 12, 2027. That discrepancy means organizations with a mix of editions can’t treat the whole 24H2 population uniformly. Home and Pro devices need to move to version 25H2 (or whatever current branch is available) before mid-October.

“Immediate application reduces exposure to known threats across supported editions,” the update guide states, and that advice now carries an implicit upgrade imperative for 24H2 Home/Pro users. The update itself doesn’t force an upgrade; it simply supports the existing version. The decision to move to a newer version remains a manual step.

For home and power users: what to do now

If you’re running Windows 11 at home, the update should arrive automatically through Windows Update. Here’s how to get it and what to check afterward:

  1. Open Settings > Windows Update, click “Check for updates,” and install KB5101650. You’ll need to restart.
  2. After restart, go to Settings > System > About and confirm your OS build: for 25H2 it should be 26200.8875; for 24H2, 26100.8875.
  3. If you use Remote Desktop to connect to your home PC from elsewhere, you don’t need to configure anything—the client improvements will protect you when you receive .rdp files from trusted sources, assuming a managed environment enforces the policy. Home users likely don’t manage publisher trust themselves, so this is more of a backend hardening.
  4. Check your version. If you’re still on 24H2 Home or Pro, head to Settings > System > About and look for “Edition” and “Version.” If it says 24H2 and Home or Pro, start planning your upgrade. The simplest path is to wait for the next feature update to be offered through Windows Update, or you can use the Installation Assistant to move to 25H2 now. Don’t wait until October—upgrade a few weeks early so you have time to troubleshoot.

The deadline may feel distant in July, but schedules fill up. Set a reminder for September to confirm you’ve moved or have a plan. There’s no cost to upgrade; it’s the same license.

For IT administrators: configuration required

Admins have more to do this month, but nothing that should disrupt a normal patch cycle. Here’s a concise priority list:

  • Enable SHA-256 RDP publisher trust. Open Group Policy and navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Connection Client. Enable “Specify SHA256 thumbprints of trusted .rdp publishers” and populate it with the thumbprints of your organization’s signed .rdp files. Keep the SHA-1 policy active until you’ve confirmed all .rdp workflows can produce SHA-256 signatures. This is a change that requires deliberate testing: a misconfigured policy could block legitimate remote desktop connections.
  • Inventory and update Dell IPF systems. If your fleet includes Dell laptops or desktops with Intel Innovation Platform Framework drivers, check whether KB5101650 was offered to them. If it was held back, deploy KB5121767 via your standard endpoint management tool (Intune, ConfigMgr, WSUS). Use PowerShell to get a quick look: Get-CimInstance Win32_PnPSignedDriver | Where-Object { $_.DeviceName -match 'Innovation Platform Framework|Intel.*IPF' -or $_.DriverName -match 'Innovation Platform Framework|Intel.*IPF' } | Select-Object DeviceName, DriverName, DriverVersion, Manufacturer, InfName. But always verify against Dell’s official guidance; driver names can vary.
  • Validate boot media for Dynamic Update. If you use task sequences, USB deployment sticks, or recovery media that rely on Dynamic Update, confirm that boot.stl is present. Boot from one such media in a test environment and ensure you don’t hit error 0xc0430001. This is a silent failure you don’t want to discover during an outage.
  • Test legacy networking apps. The TDI note is vague, so during your pilot ring, pay extra attention to any older VPN clients, firewall software, or custom transport-layer tools. Document any anomalies and engage the vendor if needed.
  • Separate 24H2 Home/Pro from Enterprise in your reports. In Configuration Manager or Intune, create a collection or filter specifically for Windows 11 24H2 Home and Pro devices. Assign an owner to upgrade them before October 13. Don’t rely on the later Enterprise date—those are separate timelines.

The Secure Boot certificate work requires no direct admin action this month; it’s handled by the servicing stack. However, if you later rebuild a machine from older media, the certificate updates won’t be baked in, which is why boot media validation is essential.

How we got here

The July update is a direct follow-up to June’s KB5094126 (build 26100.8655) and the June preview KB5095093 (build 26100.8736). It continues the monthly drumbeat of Patch Tuesday, but with a heavier than usual emphasis on Remote Desktop security.

Microsoft has been signaling the move away from SHA-1 for years. The July update finally gives RDP administrator tools a concrete path to adopt SHA-256 without breaking existing connections. The decision to leave SHA-1 enabled—for now—reflects a practical admission that many organizations still use older .rdp files and signing processes.

The Dell Intel IPF hiccup is the kind of hardware-specific quirk that has become almost routine for Windows updates. Microsoft’s safeguard hold system is designed to prevent mass driver-related failures, and the KB5121767 fix arrived quickly. For most non-Dell users, it’s irrelevant.

Secure Boot certificates are a quieter, ongoing story. The digital certificates that vouch for the integrity of your PC’s firmware have expiration dates, and Microsoft’s strategy is to slipstream replacements through Windows Update. The June 2026 expiration wave prompted the company to accelerate delivery, and it will continue to do so in the months ahead.

Outlook

The next Patch Tuesday, in August, will bring another cumulative update building on the same codebase. Secure Boot certificate updates will keep arriving with patches, so there’s no separate “certificate update” to track. Dell users should see KB5121767 pushed to their affected systems through normal channels.

The real news for the rest of 2026 remains the 24H2 Home/Pro expiration. October 13 is not flexible; after that, no more security fixes for those editions. The upgrade to a newer version is free and relatively painless, but it requires user or admin action. The best time to plan that transition is now, while there are still three months of supported operation to handle any surprises.

KB5101650 is at its heart a maintenance update—important, yes, but not disruptive. Its true value may be as a reminder that staying current isn’t just about this month’s patches; it’s about the version that will still be supported next year.