Windows 11 KB5132061: What Is New in the November Update
Windows 11 KB5132061 is the November 2026 Patch Tuesday cumulative update, and it is a bigger release than most security patches. Alongside the monthly security fixes, KB5132061 ships a fully customisable right-click menu, dark mode for two ancient dialogs, a new Cloud rebuild recovery option, per-monitor zoom in Magnifier, and expanded memory integrity protection across eligible devices.
The update applies to Windows 11 26H2 and 25H2. Systems on 26H2 move to Build 26300.9974, and 25H2 systems move to 26200.9974, with no visible differences between the two because they share the same core release. Windows 11 24H2 receives the same security content in its final updates, but its support ended in October 2026, so it will not pick up new features from here.
KB5132061 is a mandatory update, which means it downloads and installs automatically through Windows Update. Microsoft is not currently aware of any issues with the release, although early reports describe installation delays and a 0x800f0993 error for some users, which the usual servicing fixes address.
How to get KB5132061
For most people, KB5132061 arrives on its own. Open Settings, go to Windows Update, and check for updates. The listing appears as 2026-11 Security Update (KB5132061), and installation takes a few minutes to well over an hour depending on the machine. My tests and early user reports put the Windows Update download at roughly 1 to 1.5GB.
The offline route exists for two cases: organisations managing many machines, and systems where Windows Update fails repeatedly. Microsoft Update Catalog carries the standalone .msu installers, and their sizes are large, about 5GB for the x64 builds, because Windows 11 updates now bundle AI models for supported PCs alongside the servicing payload.
The catalog sizes for KB5132061 are 5,062.9MB for x64 and 4,906.0MB for ARM64, for both 26H2 and 25H2. Alongside the main cumulative, expect a .NET Framework security update, such as the .NET 8.0.34 package, and a new version of the Malicious Software Removal Tool. If you have been following the update-hold advice Microsoft issued in 2025, note that this release carries no such warning: Microsoft states it is not aware of issues with KB5132061.
The headline feature is the one users have asked for since Windows 11 launched: control over the context menu.
After installing KB5132061 and receiving the feature, right-clicking anywhere, including File Explorer, and selecting Customize menu opens a new Settings page. From there you can turn built-in commands such as Send to and Create shortcut on or off, and add commands such as Print. You can choose which app extensions appear in the main menu or a submenu, or hide the app extensions submenu entirely. Cut, Copy, Paste, Rename, Delete and Share can be displayed as text instead of a row of icons. And Properties can be moved to the bottom of the menu.
The updated menu also opens faster and reduces clutter, which addresses the most common complaint about Windows 11's context menus since 2021. No action is required to keep the default configuration, and holding Shift while right-clicking still reveals the fuller classic options. The irony the update does not fix: the Properties dialog you open from the new menu still looks like it came from Windows 95, because its modern WinUI replacement is still in development. That gap is the same one our earlier coverage of WinUI's missing basics examined, and the context menu work shows Microsoft is closing it piece by piece.
Dark mode reaches AutoPlay and Folder Options
The slow march away from legacy dialog boxes continued with two more conversions.
The AutoPlay dialog, the one that appears when you connect a phone, camera or USB drive, now supports dark mode and responds properly to text scaling. AutoPlay notifications also stay in the notification centre, so a dismissed prompt can be reopened later instead of requiring you to unplug and reconnect the device.
Folder Options gains dark mode as well. File Explorer picks up three smaller changes. Search results show name, location and date in a consistent layout that is easier to scan. The address bar supports typing a tilde to jump to your user folder, so ~\AppData opens AppData without the usual long path. And the storage section's temporary files page received visual refinements.
Cloud rebuild is the quiet headline of KB5132061
The most consequential addition is not visual. KB5132061 introduces Cloud rebuild, a recovery option that reinstalls Windows 11 using a Windows image and device drivers downloaded from Windows Update, including when Windows cannot start. No USB media or custom image is required.
The feature includes drive sanitisation. You choose between removing files and securely erasing data using the storage hardware's erase capability, and that erasure is irreversible. It also includes remote management, which lets IT administrators start a Cloud rebuild through the Recovery CSP, targeting either the currently installed build or a specified one. In Windows, the path is Settings, System, Recovery, Rebuild PC. If Windows cannot start, the device enters the Windows Recovery Environment after repeated boot failures, and Cloud rebuild appears under Troubleshoot, Recovery and uninstall.
Cloud rebuild works alongside another networking change: Windows recovery can now automatically reuse eligible Wi-Fi profiles already saved in the system, including certificate-based networks, so a broken machine can get online during recovery without preconfigured credentials. That capability is on by default and IT administrators can disable it.
For home users, Cloud rebuild removes the classic recovery headache of missing installation media. For IT departments, remote rebuild with a specified target build is a genuine operations tool, and the sanitisation option matters for device disposal. The irreversible nature of sanitisation deserves the emphasis Microsoft gives it.
Accessibility upgrades worth knowing in KB5132061
Magnifier receives three changes that matter to multi-monitor users and low-vision users alike.
A contrast theme toggle on the Magnifier toolbar reduces glare while preserving the original colours in photos, videos and charts. It uses a dark theme by default, and other contrast themes are available under Settings, Accessibility, Magnifier, with color inversion remaining a separate option.
Per-monitor zoom is on by default. It lets each display hold its own zoom level in extended mode, adjusted by pointing at a display and pressing Windows key plus Plus or Minus, or Ctrl plus Alt with the mouse wheel. Viewport locking keeps one display's magnified view in place while you work on another, toggled with Ctrl plus Windows key plus K, and the locked display remains interactive. Windows key plus Esc releases all locked displays, and the lock shortcut can be changed to Ctrl plus Alt plus P in Magnifier settings.
Narrator gains math reading in KB5132061, covering equations in Word, PowerPoint and supported web content in Edge and Chrome. The navigation uses the Narrator key plus Alt plus N, with arrow keys to move through parts of an equation and Esc to exit. It supports English in US and UK variants, Traditional Chinese, Finnish, German and Spanish, with preferences under Accessibility, Narrator, Math reading. Live Captions gains an Include screen reader audio setting, off by default, so captions no longer transcribe Narrator, JAWS or NVDA unless enabled. Family Safety messaging also improves when applications are blocked by age-restricted parental controls.
Accessibility work rarely makes headlines in Patch Tuesday coverage, and the math reading feature in particular is easy to overlook. For students and professionals who use screen readers with scientific or engineering content, equation navigation is a meaningful capability. Shipping it across Word, PowerPoint and both major browsers in one update is the kind of cross-team work that takes years to arrange.
Security and platform changes under the hood of KB5132061
The security payload is the reason the update is mandatory, and two platform changes deserve attention beyond the vulnerability fixes.
Memory integrity protection, HVCI, is expanding across eligible devices. Supported PCs may have memory integrity enabled during the update to prepare for advanced Windows security features, while respecting existing user or administrator choices. Devices that have deliberately disabled HVCI keep that choice, but everyone else gains the protection by default, which can surface driver compatibility issues that had been masked.
IPv6 support advances with CLAT for Wi-Fi and Ethernet interfaces, adding client-side 464XLAT translation so IPv4-only applications keep working on IPv6-only networks. Prefix discovery runs through router advertisements by default, with DNS fallback. The requirements matter: CLAT needs SLAAC-based IPv6 addressing, and DHCPv6 Prefix Delegation and WSL are not currently supported. Organisations progressing IPv6-only deployments have been waiting for this.
Other notable entries include several quality-of-life changes. An adaptive hibernate policy now hibernates less above 80 percent battery and sooner below 10 percent. A Restore Summary appears after settings backup restores. Phone Link message previews work in Start. A long-standing USB audio issue has been fixed. Text shaping supports Unicode 17.0, which added 4,803 characters including four newly encoded scripts. And prompt-based DPAPI protect and unprotect operations now carry a retirement warning, because Microsoft is removing them in April 2027. If any application on your systems uses DPAPI prompts, that date is closer than it looks, and Microsoft's guidance is to migrate to a non-interactive protection flow before then.
Windows also tightened a home-network behaviour we covered separately. The hidden internet sharing setting that can expose a PC as an open hotspot remains worth checking after any update, and our guide to stopping Windows from sharing your internet walks through it. Security updates change defaults less often than people assume, but a post-update review of privacy and sharing settings is a cheap habit.
Installation notes and early feedback
The early feedback pattern is familiar for a Patch Tuesday release. Microsoft's support page states no known issues. Windows Latest tested KB5132061 and found it installing automatically within minutes. BleepingComputer confirms the update is mandatory and lists the full changelog, and Microsoft's support page carries the official build numbers. Meanwhile, Microsoft Q&A and Neowin document users seeing KB5132061 install for over an hour without completing, and a 0x800f0993 error on some systems.
None of those reports amounts to a known issue, and the standard remedies apply. Retry, run the Windows Update troubleshooter, or use the offline installer from the Update Catalog if Windows Update keeps failing. Given KB5132061's size, a slow-looking install is often just a large payload on a slow disk, and interrupting it mid-install is the one action guaranteed to cause a real problem.
One more practical note: because KB5132061 is mandatory, postponing it is not really an option on 26H2 and 25H2. The context menu customisation makes it a more pleasant forced upgrade than most, and the memory integrity expansion is the part security-conscious users should welcome rather than work around.
What KB5132061 does not include
Two absences are worth noting so expectations stay realistic.
The update does not change the Start menu layout. It does not bring a new Settings design beyond the Privacy regroup. And it does not address the WinUI gaps that keep parts of Windows looking dated, which our earlier look at WinUI's missing basics detailed. Properties dialogs, legacy control panels and the classic Notepad-adjacent tools remain a mixed bag, and the pace of modernisation is one dialog per release rather than a wholesale refresh.
It also does not include anything specific to Copilot or AI features for unsupported PCs, despite the bundled AI models increasing the download size. The AI payload ships with updates and waits for supported hardware, which is why the catalog packages are five gigabytes while the effective download on an older machine is a fraction of that.
A customisable right-click menu sounds like a small feature, and it is actually a structural change to how Windows handles shell extensions.
Every installed application can register context menu entries, and over years of use those entries accumulate until the menu is a wall of vendor shortcuts. Windows 11's original design responded by hiding everything behind a Show more options button, which satisfied nobody: the modern menu was sparse, and the classic menu required an extra click every time. KB5132061's Customise menu page turns that binary choice into a per-item control, which is what the settings page should have been from the start.
The performance claim matters too. Context menu slowdowns are frequently caused by third-party shell extensions loading synchronously when the menu opens. A faster, filtered menu that keeps third-party extensions in a submenu reduces the work done at right-click time, which is why the update promises a quicker menu rather than just a tidier one. Users with many installed applications stand to gain the most.
It is also worth noting what this change signals. Shell extensibility has been effectively frozen since Windows 11 launched, and reopening it with user control suggests Microsoft heard the feedback and chose configuration over restriction. Whether the same philosophy reaches the Start menu or the taskbar in future updates is the thing to watch.
What IT administrators should note about KB5132061
Enterprise deployments have a few specific items in this release, and two of them change defaults.
The WinRE Wi-Fi reuse feature is on by default, letting recovery environments join saved corporate networks including certificate-based ones. That is convenient for quick machine recovery and cloud rebuild, and it is worth reviewing if your recovery environments were deliberately kept network-isolated. The setting can be disabled by IT administrators if the isolation was intentional.
Memory integrity expansion is the second default change. Eligible devices may find HVCI enabled after KB5132061, which is the security-positive outcome but one that can break incompatible drivers. The usual pre-flight applies: test the driver inventory, stage the rollout, and use the documented opt-out where a legacy driver cannot yet pass HVCI.
The DPAPI retirement warning is the third item with a deadline attached. Applications relying on prompt-based protect and unprotect operations need migration before April 2027, and the migration is code work, not a toggle. Inventory now rather than in early 2027.
On the positive side, Cloud rebuild's remote management through the Recovery CSP gives IT a new recovery lever for remote and hybrid fleets, and the IPv6 CLAT support removes a long-standing blocker for IPv6-only network transitions on Windows clients. Both deserve a place in deployment notes.
Questions readers are asking
Which builds does KB5132061 install?
26300.9974 on Windows 11 26H2 and 26200.9974 on 25H2. The same update also applies security content to 24H2, whose support ended in October 2026, and a separate cumulative, KB5131087, serves 23H2.
How large is the KB5132061 download?
Around 1 to 1.5GB through Windows Update and roughly 5GB for the standalone .msu installers, which are 5,062.9MB for x64 and 4,906.0MB for ARM64. Windows 11 updates are larger than Windows 10's because they bundle AI models for supported PCs.
Why did my KB5132061 install take over an hour?
Large cumulative payloads install slowly on systems with slower storage, and early reports of hour-long installs and a 0x800f0993 error are consistent with past Patch Tuesday patterns. Let it finish, and if it fails, retry or use the offline installer rather than interrupting the process.
Not immediately. Microsoft is rolling the feature out gradually, so an updated system may not show the Customise menu option until the feature flag reaches it. No action is required; the menu modernises itself when the feature arrives.
Does KB5132061 force memory integrity on?
It enables HVCI during the update on supported and eligible devices, while respecting existing choices. If you or your administrator deliberately disabled memory integrity, the update preserves that state, but a default-off system may find it enabled afterward, which is worth knowing if you run older drivers.
The bottom line
KB5132061 is a Patch Tuesday release with substance beyond the security fixes. The customisable right-click menu closes the most persistent complaint about Windows 11's daily interface. Cloud rebuild and WinRE Wi-Fi reuse fix recovery problems that have frustrated users for a decade. And the accessibility upgrades are genuinely useful rather than cosmetic.
Install it through Windows Update, keep the offline installer in mind only if that fails, and let the memory integrity change happen unless you have a specific reason and a tested exception. The right-click menu alone means most people will notice this update, which is more than can be said for most Patch Tuesdays.