Windows Insider Canary Channel

[Corrine]

Announcing Windows 11 Insider Preview Build 28020.1611 (Canary Channel)

Note:  the desktop watermark is showing the wrong build number and will be addressed in a near term build). (KB 5077221).

What's new in Canary Build 28020.1611

Changes and Improvements gradually being rolled out with toggle on

[Built-in Sysmon]
Previously announced here, Windows now brings Sysmon functionality natively to Windows. Sysmon functionality allows you to capture system events that can help with threat detection, and you can use custom configuration files to filter the events you want to monitor. The captured events are written on the Windows event log, enabling them to be used with security applications and a wide range of use cases.

Built-in Sysmon is disabled by default and must be explicitly enabled.

• Go to Settings > System > Optional features > More Windows features > checking Sysmon or in PowerShell or command prompt:
• Dism /Online /Enable-Feature /FeatureName:Sysmon
• To complete the installation, from PowerShell or command prompt run:
• sysmon -i

Note: If you've already installed Sysmon from the website, it must be uninstalled before enabling the built-in Sysmon.

Documentation will be added to Windows soon. The functionality of Sysmon remains unchanged, learn more https://learn.microsoft.com/sysinternals/downloads/sysmon.

[Windows Share]

• When you share a OneDrive cloud file by right-clicking to share on the file – new options for sharing that link through other apps will be provided under "Share using" when the "Copy link" button is clicked. This experience is rolling out to Windows Insiders signed in with their Microsoft accounts not in the EEA.

[General]

• Fixed the desktop watermark to show the correct build number.

[Corrine]

Announcing New Optional Windows 11 Insider Preview Build for Canary Channel 29531.1000

As part of this ongoing development, Canary Channel will move forward on two update paths. This will help validate platform changes at different stages while continuing to deliver new features and experiences to Insiders in the Canary channel.

Available starting today, Insiders can take an optional update under Settings > Windows Update > Advanced options > Optional updates which will move your device to a new active development Build 29531.1000. Once you opt in to this path, future builds will be identified as 29500 series builds and newer. Please note, because of the focus on platform development for this path, you may notice a temporary loss in some features that you have today. These features will return to this new active development build.

Going forward, each Canary Channel build will be announced in its own blog post, so you'll always know exactly what's new—and what to expect—based on the build you're receiving. You can always confirm which build you're running by typing winver into the Windows search box and selecting About Windows. This will show your exact build number and version.

Choosing the right path for you
We generally recommend that Insiders continue on the update path they're already on, as this helps maintain stability and predictability within each build population.

That said, some Insiders—especially those who prefer getting the newest platform changes as early as possible—may choose to move to a newer development path when available.

This flexibility allows us to experiment, learn quickly, and incorporate feedback before changes move further along in development.

As a reminder – Insiders can't switch to a channel that is receiving builds with lower build numbers without doing a clean installation of Windows 11 due to technical setup requirements. This means Insiders can't go back to 28000 series builds after taking the optional update.

What's new in Canary Build 29531.1000

Changes and Improvements

• This update includes platform changes in moving to a new active development build.