Hello, Windows Insiders. Today marks the release of Windows 11 Insider Preview Build 28020.1611 to the Canary Channel. Please note that the desktop watermark currently displays an incorrect build number, which will be rectified in an upcoming build. For reference, this update is associated with KB 5077221.
What’s new in Canary Build 28020.1611
Changes and Improvements gradually being rolled out with toggle on*
[Built-in Sysmon]
As previously announced, Windows has integrated Sysmon functionality natively. This feature enables users to capture system events that are instrumental in threat detection. With the ability to utilize custom configuration files, users can filter the events they wish to monitor. The captured events are logged in the Windows event log, making them accessible for security applications and various use cases.
It’s important to note that the built-in Sysmon is disabled by default and requires explicit activation:
- Navigate to Settings > System > Optional features > More Windows features and check Sysmon, or use PowerShell or command prompt.
- To finalize the installation, execute the following command in PowerShell or command prompt:
Note: If you have previously installed Sysmon from the website, it must be uninstalled prior to enabling the built-in version. Documentation will be available soon, and the functionality of Sysmon remains unchanged. For further details, visit this link.
[Windows Share]
- When sharing a OneDrive cloud file via right-click, new options for sharing that link through other applications will be presented under “Share using” upon clicking the “Copy link” button. This enhancement is currently rolling out to Windows Insiders signed in with their Microsoft accounts outside of the EEA.
[General]
- The desktop watermark has been corrected to display the accurate build number.
Reminders for Windows Insiders in the Canary Channel
- The builds released to the Canary Channel showcase the latest platform changes early in the development cycle. Features and experiences included in these builds may not ultimately be released, as we explore various concepts and gather feedback. Over time, features may evolve, be removed, or replaced without ever reaching a broader audience. Some of these innovations may appear in future Windows releases when they are fully ready.
- Many features in the Canary Channel are rolled out using Control Feature Rollout technology, starting with a select group of Insiders and gradually expanding as we monitor feedback to assess their performance before wider distribution.
- The desktop watermark displayed in the lower right corner of the screen is standard for Windows Insider pre-release builds.
- Some features may debut in the Dev and Beta Channels prior to their arrival in the Canary Channel.
- Features currently in active development may not be fully localized; localization will occur over time as features are finalized. If you encounter localization issues in your language, please report them through the Feedback Hub.
- To exit the Canary Channel, a clean installation of Windows 11 is necessary. Insiders cannot switch to a channel that is receiving builds with lower build numbers without performing a clean installation due to technical setup requirements.
- For a comprehensive overview of which builds are in each Insider channel, please refer to Flight Hub.
Thank you,
Windows Insider Program Team
*Functionality will vary by device and market; text actions will be available across markets in select character sets. See aka.ms/copilotpluspcs.
