On March 26, Microsoft released a non-security preview update for Windows 11 that fixes a deployment-breaking bug, improves Narrator’s AI-driven image descriptions, and warns of a looming Secure Boot certificate expiration in June 2026.

Key Changes in KB5079391

The update (KB5079391) applies to Windows 11 version 24H2 and 25H2, pushing builds to 26100.8116 and 26200.8116 respectively. Microsoft delivers it through gradual rollout and normal rollout channels, so not every device will see everything on day one.

What’s inside:
- Narrator image descriptions expand. On Copilot+ PCs, users get richer detail; on all Windows 11 devices, Narrator works with Copilot using shortcuts—Narrator key + Ctrl + D for focused image, + Ctrl + S for full screen.
- Natural Voices setup becomes more reliable, reducing friction during voice selection.
- Application Control for Business improves app ID tagging accuracy, helping admins enforce policies with fewer false blocks.
- WUSA deployment fix resolves a problem where installing .msu files—especially from network shares—could fail with ERROR_BAD_PATHNAME. This matters for enterprises using Windows Update Standalone Installer.
- Windows Hello fingerprint reliability improves on certain devices, making biometric sign-in less prone to intermittent failures.
- SFC /scannow no longer shows an extraneous error message that could mislead users running system file checks.
- ARM64 recovery is more stable when running x64 apps inside Windows Recovery Environment, helping troubleshooters on ARM hardware.
- A servicing stack update (KB5079387) is bundled, hardening the update mechanism itself.
- Secure Boot certificate expiration looms: Microsoft warns that certificates used by most Windows devices start expiring in June 2026, which could affect secure boot if ignored.

Who Benefits Most

The update touches both visible features and under-the-hood plumbing. Here’s how it breaks down by audience.

Home users and accessibility

If you rely on Narrator, the image description expansion is the headline. Being able to get AI-generated descriptions of the focused image or full screen with a keyboard shortcut reduces navigation friction. The Natural Voices reliability fix may quietly improve your daily experience, especially during first-time setup.

Windows Hello fingerprint improvements are subtle but important. A fingerprint sensor that fails even occasionally can push you back to typing passwords. Fixing that reliability loop matters more than adding new sign-in bells and whistles.

The SFC fix removes confusing noise from a tool that many power users reach for when troubleshooting. No more false alarms about corrupted files.

IT administrators and deployment teams

The WUSA fix is the standout for admins. If you’ve been double-clicking .msu files or running them from a network share and hitting ERROR_BAD_PATHNAME, this update clears that roadblock. For scripted or semi-manual deployments, that’s a workflow-saver.

Application Control for Business gets more accurate tagging, which means policies that rely on app identity will be enforced more reliably. In large fleets, even small improvements in tagging accuracy reduce support tickets.

The multi-MSU packaging requires attention. KB5079391 contains multiple .msu files that must be installed in order. Microsoft provides two methods: either place all MSUs in one folder and let DISM handle the sequence, or install them one by one in the correct order. Getting this wrong can break the update, so testing on representative hardware before broad rollout is essential.

Then there’s the Secure Boot deadline. Microsoft warns that certificates will expire starting June 2026, which could prevent devices from booting securely if not updated. This is not a theoretical risk; it’s a project that needs to start now. Device audits, firmware updates, and alignment with upcoming servicing changes will be required.

The Growing Importance of Monthly Previews

Microsoft’s monthly cadence has a predictable shape: second-Tuesday security updates, followed by non-security previews like this one near month’s end. These previews are the last safe testing ground for enterprise IT before the same code rolls into the next mandatory security update.

KB5079391 is part of the servicing line shared across Windows 11 24H2 and 25H2. That consolidation means changes tested on one version often affect the other, so ignoring a preview on the grounds of “I’m not on that build” is risky.

The update also reflects how Microsoft layers accessibility, AI, security, and architecture improvements into a single monthly package. For the reader, that means a dryer, more operationally focused update can sit right next to a consumer feature like Narrator image descriptions without either losing urgency.

Steps to Take Now

For everyone: This is an optional preview. You can install it through Windows Update if you want the fixes early, but it’s perfectly fine to wait for the April security release. If Narrator or fingerprint reliability bugs have been nagging you, grab it now.

For IT admins:
1. Download KB5079391 from the Microsoft Update Catalog. Choose the correct architecture package (arm64 or x64).
2. If using DISM’s folder method, place all MSUs in one folder and run DISM /Online /Add-Package /PackagePath:folderpath with the target package name.
3. If installing individually, apply windows11.0-kb5043080... first, then windows11.0-kb5079391....
4. Test on a small set of machines that mirror your production hardware. Include ARM64 devices if they’re in your fleet.
5. Verify Windows Hello, application control policies, and WUSA-based deployment paths.
6. Begin Secure Boot readiness: audit devices, review Microsoft’s guidance on the certificate expiration, and plan firmware updates well before June 2026.

For accessibility users: Once updated, try the new Narrator shortcuts with Copilot—even on non-Copilot+ PCs. If Natural Voices weren’t working reliably before, this update may fix setup glitches.

What’s Next

The gradual rollout means some features, like the improved Narrator image handling, may take weeks to appear on all eligible devices. Microsoft will likely broaden availability over time, especially as it collects telemetry.

Secure Boot planning will intensify. Expect more tools and documentation from Microsoft as the June 2026 deadline approaches. The PowerShell cmdlets added in February’s update (like Get-SecureBootUEFI -Decoded) are a preview of that preparation.

This preview’s fixes—particularly the WUSA and application control improvements—will almost certainly be locked into April’s Patch Tuesday. If all goes well, this release may be remembered less for a single feature and more for quietly removing operational risks at scale.