Windows 11 Insider Preview Build 28020.1611 has been released to the Canary Channel, associated with KB 5077221. The desktop watermark currently displays an incorrect build number, which will be corrected in a future build.
New features include:
- Built-in Sysmon functionality for capturing system events related to threat detection, which is disabled by default and requires activation through Settings or PowerShell. Users must uninstall any previous Sysmon installations before enabling the built-in version.
- Enhanced sharing options for OneDrive files via the Windows share window, available for Insiders signed in with Microsoft accounts outside the EEA.
- The desktop watermark has been corrected to show the accurate build number.
Insiders in the Canary Channel should note that features may change or be removed before wider release, and some may appear in the Dev and Beta Channels first. A clean installation of Windows 11 is required to exit the Canary Channel.