On August 26, Microsoft rolled out the August 2025 non-security preview update for Windows 11 version 23H2, tagged as KB5064080 (OS Build 22621.5840). The headline feature: Windows Backup for Organizations is now generally available, promising IT departments a streamlined, Intune-driven way to restore user settings and Microsoft Store apps during device refreshes. But the update also bundles a long list of less glamorous fixes—touching Copilot reliability, removable storage enforcement, Family Safety prompts, File Explorer behavior, ReFS hangs, and more—that matter just as much to everyday users and enterprise admins alike.

What the Update Delivers

KB5064080 is a “C” release, meaning it’s an optional, non-security preview intended for testing before its contents are folded into the next mandatory security update. It carries a servicing stack update (KB5064743) to strengthen installation reliability, and the combined package cannot have the servicing stack removed through the usual wusa.exe /uninstall route.

The centerpiece is the general availability of Windows Backup for Organizations. First introduced as a preview, this feature now reaches production readiness for Microsoft Entra joined or hybrid joined devices managed through Intune. Its job is to capture user state—settings, preferences, and a list of installed Microsoft Store apps—and allow that data to be restored during a new device’s out-of-box experience (OOBE). The restore is tied to the same Entra identity, so cross-account migrations aren’t supported. Notably, Win32 desktop applications (traditional .exe or .msi installers) are not backed up; only Microsoft Store apps and user settings are in scope.

Beyond the backup milestone, the update patched more than a dozen specific quality issues:

  • Copilot key: Fixed an inability to restart Copilot immediately after using the dedicated hardware key. The key itself also received general reliability improvements.
  • Removable storage policy: A policy designed to block external USB drives and memory sticks now correctly enforces that block, closing a gap that could allow data exfiltration.
  • Family Safety: The “Ask to Use” prompt, which requires parent or guardian approval before a blocked app can launch, now appears reliably.
  • File Explorer: Two fixes address problems where File Explorer would unexpectedly show only a single folder view, and another where syncing a large number of SharePoint sites caused performance drag.
  • SMB over QUIC: Reduced delays when accessing files on an SMB share over QUIC connections.
  • ReFS: A hang that could occur when both deduplication and compression were enabled on ReFS volumes was resolved.
  • Input and IME: Extended Unicode characters required for GB18030-2022 compliance now display correctly, and a Chinese (Simplified) IME issue causing empty boxes for some characters was fixed.
  • Narrator: Corrected a spoken label in facial recognition protection settings.
  • Networking: Fixed Wi‑Fi not reconnecting automatically after a Group Policy refresh.
  • Remote Desktop: Cameras that are added or removed during a remote session now show up in the device list properly.

What It Means for You

The impact of KB5064080 varies depending on whether you’re a home user, a power user, or an IT administrator. Here’s the practical breakdown.

For Home Users and Families

If you’re running Windows 11 23H2 at home, this update will likely land as an optional entry in Windows Update. Most of its fixes are invisible but welcome: the Copilot key on your new laptop won’t get stuck as often; Family Safety’s permission prompts will behave when your kid tries to open a blocked app; File Explorer won’t feel sluggish if you sync a lot of SharePoint libraries; and some Wi‑Fi reconnection issues after policy updates should vanish. None of these are critical for security, so you can install the update at your convenience. However, because it’s a preview, occasional new gremlins are possible—keep a recent system restore point handy just in case.

For Power Users and Developers

Power users who rely on SharePoint sync or command-line tools will appreciate the File Explorer performance fix and the ReFS stability improvement (the latter if you’re using ReFS for development or lab environments). Developers dealing with Chinese localization or extended Unicode character sets will notice the IME and GB18030 fixes. SMB over QUIC users should see snappier file shares. The backup feature is less relevant for unmanaged devices, but you can still look at the update as a quality-of-life rollup that makes the OS a bit more polished.

For IT Administrators and Organizations

This is where the update earns its keep. Windows Backup for Organizations graduating to GA is a concrete step for enterprises managing fleets with Intune. When enabled from the Intune admin center (Devices > Enrollment > Windows > Enrollment options), the tenant-wide setting lets you restore a user’s settings and Store apps during OOBE on a new or freshly reset device. That can reduce helpdesk calls and get employees back to work faster after a hardware swap or OS migration.

But the feature isn’t a substitute for full-image backups. It doesn’t cover Win32 apps, drivers, or system-level data. Its dependency on Entra identity and Intune means any Conditional Access policy that interferes with token acquisition can block restores. So, while it’s a valuable addition, treat it as one layer in your recovery strategy.

The other fixes swing from important policy corrections to reliability tweaks that affect daily operations. The removable storage policy fix is especially critical for DLP enforcement—if you relied on that policy to block USB devices, you’ll want to test immediately. The ReFS fix matters for server workloads, and the Copilot key improvement may reduce tickets from users with newer hardware.

How We Got Here

Microsoft’s “C” releases have been part of the Windows update rhythm for years, giving admins and enthusiasts a sneak peek at upcoming fixes and features. Windows Backup for Organizations first appeared in preview earlier in 2025, and the path to GA reflects feedback from early testers. The feature aligns with Microsoft’s broader push to ease enterprise migration to Windows 11 and modern management models—tools like Intune and Entra are now central to how organizations deploy and recover devices.

The August 2025 update window has been busier than usual. Earlier in the month, mandatory security updates introduced their own fixes but also triggered reports of recovery tool issues and storage hangs under certain loads. Those reports make this preview update’s timing delicate: admins must coordinate testing of both the security and non-security updates to avoid conflicts, especially around reset and restore scenarios.

What You Should Do Right Now

If You’re a Home User

  • Check for updates: Go to Settings > Windows Update and look under “Optional updates” to find KB5064080.
  • Install or wait: It’s safe to install, but if you’re cautious, wait a week and watch for any community reports of problems.
  • Have a safety net: Make sure your files are backed up. The update itself doesn’t touch your data, but preview patches can occasionally cause hiccups.

If You’re an IT Admin

  1. Inventory and prerequisites
    - Identify devices that are Entra-joined or hybrid-joined and Intune-managed if you plan to use the backup feature.
    - Confirm that target devices meet minimum OS build requirements for OOBE restore (typically recent Windows 10 22H2 or Windows 11 22H2 and later).

  2. Lab validation
    - Deploy KB5064080 in a test environment that mirrors your Conditional Access policies, Intune enrollment flows, and typical hardware.
    - Walk through the entire backup-and-restore process: initiate a backup, run through OOBE on a test device, and verify settings and Store apps come back.
    - Test removable storage policy enforcement, File Explorer/SharePoint sync, SMB over QUIC latencies, and ReFS deduplication/compression if applicable.

  3. Pilot ring
    - Roll the update to a small, representative set of devices (5–10%) using Windows Update for Business, WSUS, or Configuration Manager.
    - Monitor telemetry and support tickets for at least one full business cycle.

  4. Scale with care
    - After the pilot looks clean, broaden the deployment gradually. Keep rollback plans intact: document the DISM package name of the LCU so you can remove it with DISM /online /remove-package if needed (the standard wusa.exe /uninstall won’t remove the servicing stack).

  5. Communicate
    - Tell helpdesk and users about the changes, especially the Copilot key fix, Family Safety behavior, and the availability of enterprise backup.

  6. Post-deployment checks
    - Confirm that critical recovery paths—Reset this PC, recovery media, offline images—still function, particularly given the earlier August security update issues.

Looking Ahead

The features and fixes in KB5064080 will almost certainly appear in the September 2025 mandatory security update (the “B” release), so if you’re holding off, you’ll get them eventually. In the meantime, Microsoft will likely refine Windows Backup for Organizations based on feedback from this GA release, so keep an eye on the Intune admin center and Windows release health dashboard for any known issues. For organizations, this update is a strong signal that Microsoft is investing in cloud‑based, identity‑driven user state management—a trend that will only deepen as Windows transitions further to modern management. For everyone else, it’s a solid collection of fixes that make the OS a little smoother, one patch at a time.