Microsoft pushed out its January 2026 security and quality update for Windows 11 this week, tagged KB5074109, and it takes version 24H2 to build 26100.7623 and 25H2 to build 26200.7623. But buried in the announcement is a critical detail that could trip up anyone who patches devices offline: you must install the update’s multiple .msu files in a specific order—or better yet, use one simple DISM command that handles sequencing automatically.

What's actually in the update?

KB5074109 is a monthly cumulative update, so it delivers the usual batch of security fixes and reliability improvements. Microsoft doesn't list every CVE patched in the initial release note, but the company typically discloses those separately. Beyond security, the update continues Microsoft's Controlled Feature Rollout (CFR) strategy for Copilot-era experiences. That means on qualifying devices—those with the right hardware, account, and region settings—you may see new taskbar shortcuts for Copilot or additional File Explorer refinements after installing. But don't be surprised if those features don't appear immediately; they're gated server-side, and Microsoft activates them in waves.

The build numbers tell the story: after installing, your PC will report OS Build 26100.7623 if you're on Windows 11 24H2, or 26200.7623 if you're on 25H2. You can confirm that by running winver or looking in Settings > System > About.

One thing that sets this update apart from classic cumulatives is its packaging. When you head to the Microsoft Update Catalog to download the offline installer, you'll find not one .msu file but two—or possibly more, depending on your architecture. Those files must be applied in the right sequence, because Microsoft now uses checkpoint-style cumulatives. In simple terms, the smaller file (often a servicing stack update) must be applied before the main cumulative payload. If you double-click the wrong one first, the install can fail, leave your system partially serviced, or even trigger a recovery loop.

Community tests and catalog listings peg the combined download size for the x64 version at roughly 3.9–4.3 GB. That's notably larger than cumulative updates from a year ago, and it fuels speculation that Microsoft is bundling more on-device AI components into these packages. While Microsoft hasn't publicly confirmed the full extent of model payloads in every monthly release, the trend is clear: updates are getting heavier as they prepare Windows for AI features that run locally.

The sequencing trap: why the install order matters

For years, downloading a standalone cumulative update meant one .msu file that you could run without thinking. That changed as Microsoft began bundling the servicing stack update (SSU) with the latest cumulative update (LCU) and later introduced checkpoint updates. Now, the payload is split: a prerequisite .msu and the main update .msu. The KB5074109 page on Microsoft's support site explicitly lists two files in order: windows11.0-kb5043080-x64_953449672073f8fb99badb4cc6d5d7849b9c83e8.msu and windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu. (Note: hashes may differ if you download for a different architecture.)

If you install them backwards—for example, by running the bigger file first with Windows Update Standalone Installer (wusa) in the wrong order—the servicing stack won't be updated, and the cumulative install can fail with cryptic errors. Worse, because the SSU portion is permanent once applied, you can't simply uninstall it if something goes wrong; a rollback often requires re-imaging the entire machine.

Microsoft's recommended workaround is elegantly simple: put all the downloaded .msu files into a single folder, then use DISM to install the target update. DISM will scan the folder, detect any prerequisite packages, and apply them in the correct order automatically. That single-command approach, described as Method 1 on the support page, eliminates human error. Method 2—manually installing each file in the specified sequence—is still available, but it's riskier unless your deployment tooling demands it.

Step-by-step: how to install KB5074109 without headaches

Who needs to care? If you're a home user or small business relying on Windows Update, stop reading—the update will arrive automatically through Windows Update, which handles sequencing, differential downloads, and reboots for you. Simply allow the install and restart when prompted.

For IT admins, system builders, or anyone servicing offline images, here's the safe path.

1. Download the correct files.
Visit the Microsoft Update Catalog, search for "KB5074109", and download all .msu files for your device's architecture. Save them to a local folder, say C:\Packages.

2. Launch an elevated command prompt.
Right-click Command Prompt (or Terminal) and choose "Run as administrator."

3. Run DISM with the folder trick.
Even though you're targeting the main KB, the command points DISM to the folder:

DISM /Online /Add-Package /PackagePath:C:\Packages\windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu

DISM automatically discovers and installs the prerequisite .msu(s) from the same folder before proceeding. If you prefer PowerShell (elevated):

Add-WindowsPackage -Online -PackagePath "C:\Packages\windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu"

4. Reboot when prompted.
The update may require a restart; let it finish.

5. Verify the installation.
Check the build with winver or Settings. Confirm the KB is registered:

DISM /Online /Get-Packages | findstr /i 5074109

If you need to service an offline Windows image (e.g., for deployment), use the /Image parameter:

DISM /Image:mountdir /Add-Package /PackagePath:windows11.0-kb5074109-x64_fe29a336e6e650dda4038e82bcc0c6286c70b9a1.msu

And if you're injecting SafeOS or WinRE dynamic updates, be extra careful: those changes are effectively irreversible on the image. Always keep a golden backup of your WinRE.wim and the original install image before making such modifications.

Watch out for these pitfalls

SSU permanence. When the servicing stack update is bundled into the cumulative, that part of the update cannot be removed. If a later LCU causes issues, you can't just uninstall the SSU—you may need to roll back the entire image or fall back to a known-good snapshot. Plan your golden-image retention strategy accordingly.

Third-party drivers and security software. As with every cumulative, the most common source of post-update failures are kernel-mode drivers and endpoint security agents that hook deeply into the system. If you're piloting the update, include machines with representative third-party software in your test group. After installation, if you encounter a recovery loop or certain apps break, dive into the CBS logs (C:\Windows\Logs\CBS\CBS.log) and check Event Viewer for servicing errors. Often, these issues trace back to third-party filter drivers; disable or update any security agents that hook NTFS or registry calls before troubleshooting further.

Feature rollouts aren't instant. Because of Controlled Feature Rollouts, two identical PCs running KB5074109 may show different Copilot or UI elements. That's by design, and it can lead to confusion if you're expecting a uniform feature set across a fleet. Verify feature expectations only on devices explicitly entitled by Microsoft.

Large file sizes can strain bandwidth. At up to 4.3 GB per architecture, downloading the update for a large fleet can clog your WAN links. Use peer-to-peer delivery or delivery optimization where possible, and schedule downloads during maintenance windows.

The bigger picture

Microsoft's shift toward checkpoint cumulatives and SSU-LCU bundling is a net positive for the hundreds of millions of PCs that get their patches through Windows Update: it reduces fragmentation and odd failure states. But it clearly makes offline servicing more finicky. As AI workloads—from local language models to real-time Copilot processing—become more central to Windows, expect these update payloads to grow even further. IT shops that have relied on manually sequenced wusa installs for years will need to retrain their staff or update their automation scripts to use the DISM folder method.

For now, KB5074109 is a routine security update that most users will install without a second thought. But if you're managing a Windows image lab, a VDI pool, or a set of air-gapped terminals, the difference between a smooth patch Tuesday and a weekend of emergency reimaging comes down to one folder and one DISM command.