Windows 11 Insider Experimental (26H1) Preview Build 28120.3032

Share this post:

Hi all, last Friday Microsoft released Windows 11 Build 28120.3032 to the Experimental (26H1) Channel

Changes and improvements gradually being rolled out

  • This update includes a small set of general improvements and fixes that improve the overall experience for Insiders running this build on their PCs.

[Windows Recovery]

  • We’re introducing Cloud rebuild, a new recovery option that restores a Windows 11 PC to a clean, known-good state by performing a full OS reinstall, even when Windows won’t boot. Unlike Reset this PC, Cloud rebuild downloads both the target Windows image and the device’s drivers from Windows Update, so the device comes back fully functional without USB media, without a custom image, and without depending on the health of the currently installed OS.
  • In this preview, you can try Cloud rebuild today:
    1. Start it directly from the Windows Recovery Environment (WinRE) by selecting Troubleshoot > Recovery and uninstall > Cloud rebuild.Connect over wired Ethernet or a Wi-Fi network from within WinRE.Review the target Windows build, edition, and language, then confirm the data-loss warning before the rebuild begins.
The new Cloud rebuild option in Windows Recovery Environment (WinRE), which enables a full Windows reinstall using files downloaded from Windows Update

Feedback: Share your thoughts in Feedback Hub (WIN + F) under Recovery > Cloud rebuild.

To learn more, see Cloud rebuild.

[Hyper-V]

  • Fixed an issue where some applications that used HCS-managed virtual machines experienced issues when sharing host folders with Linux VMs using Plan9. Folders shared from the Windows host using Plan9 didn’t appear or couldn’t be accessed in the guest environment.

    source: Flight Hub

    Share this post:

    Windows 11 Insider Experimental Preview Build 26340.9502

    Share this post:

    Hi all, last Friday Microsoft released Windows 11 Build 26340.9502 to the Experimental Channel

    This build brings a new option to reset, clearing the disk thoroughly for repurposing the device without the risk of recovery of data, with the option to trigger it from intune in the future.

    Smooth upgrading on all my Experimental Channel devices, Happy FLighting!

    Changes and improvements gradually being rolled out

    [Accessibility – Mouse indicator]

    • We’re introducing a sleeker new animation for the Mouse indicator. You can enable this animation under Accessibility settings. We’ve also added the option to keep the indicator activated until you press the Esc key.

    [Magnifier]

    • A new contrast theme toggle for a lower-glare screen. If bright screens are uncomfortable, many people use color inversion to reduce glare. However, inversion changes everything on screen, including photos, charts, and videos. With this update, we’re introducing a new contrast theme toggle in Magnifier.
    • Reduce glare with a single toggle. Turn on a contrast theme directly from the Magnifier toolbar for a more comfortable viewing experience.
    • Choose the contrast theme that works best for you. The dark theme is applied by default, and you can choose which contrast theme the toggle uses under Settings > Accessibility > Magnifier.
    • Photos, videos, and charts keep their original colors. Unlike color inversion, the contrast theme recolors the interface without touching your photos, charts, or videos, so they keep their real colors.
    • Color inversion is still here. This isn’t a replacement. If you use inversion today, it works exactly as it always has. The contrast theme is a separate, purpose-built option to reduce glare when you want a darker interface without inverting colors.
    UI showing the new contrast theme toggle in Magnifier
    UI showing contrast theme settings for Magnifier.

    [Cloud rebuild]

    • We’re updating Cloud rebuild, the recovery option that restores a Windows 11 PC to a clean, known-good state by performing a full OS reinstall, with two additions.
    • Cloud rebuild can now sanitize the device’s drives as part of the rebuild. When you start a rebuild in WinRE, choose Remove files if you’re keeping the PC, or Remove & sanitize files before recycling, returning, or reassigning it. The sanitize option uses the storage hardware’s erase capability to securely erase data before Windows is reinstalled and is irreversible.
    • IT administrators can now configure and start a Cloud rebuild remotely through the Recovery CSP, using either the currently installed build or a target build you specify.
    UI showing new Cloud rebuild file removal options

      [Live Captions]

      • We’re improving Live Captions with a new Include Screen Reader audio setting, which is off by default. With the setting off, Live Captions won’t transcribe audio from screen readers such as Narrator, JAWS, and NVDA, keeping captions focused on microphone and system audio.

      [Hyper-V]

      • Fixed an issue where some applications that used HCS-managed virtual machines experienced issues when sharing host folders with Linux VMs using Plan9. Folders shared from the Windows host using Plan9 didn’t appear or couldn’t be accessed in the guest environment.

      [Other]

      • Fixed an issue where backing up using File History unexpectedly failed with an error saying, “No usable drives found.”

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental (Future Platforms) Preview Build 29667.1000

      Share this post:

      Hi all, last Friday Microsoft released Windows 11 Build 29667.1000 to the Experimental (Future Platforms) Channel

      Smooth upgrades to this build, the Lost Pin access has not been fixed yet (Feedback Hub: https://aka.ms/AA13dolt)

      Changes and improvements gradually being rolled out*

      • This update includes a small set of general improvements and fixes that improve the overall experience for Insiders running this build on their PCs.

      [Windows Update]

      • Fixed an underlying issue resulting in some Insiders on Arm64 PCs not being able to upgrade to the latest builds and automatically rolling back. As a reminder, 0xc1900101 is a generic error code that can have multiple root causes. If you continue having issues, file a new piece of feedback.

      [Emoji]

      • We’re adding support for Emoji 17.0. This includes new emoji such as distorted face, fight cloud, and hairy creature. To try the new emoji, press the Windows key plus Period (.) to open the emoji panel and insert them from there.
      Examples of new emoji added with Emoji 17.0
      • As part of this effort, we’ve also made some slight adjustments to the design of some of our current emoji to improve consistency across platforms. This includes the saluting face, face with peeking eye, goose, lotus, and kissing cat emoji.
      Before-and-after examples of updated emoji designs

      [Touchpad]

      • Fixed an issue causing touchpad zoom gestures to not work correctly in certain apps after the latest updates.

      [Remote Desktop]

      • Fixed an underlying issue causing some Insiders to see graphics card error 0x11 when attempting to use Remote Desktop in the latest updates.

      [Run]

      • Improved Run reliability for Insiders using the modern Run dialog.

      [Taskbar]

      • Improved reliability of loading the system tray area of the taskbar.

      [Network]

      • Fixed an issue resulting in some Insiders seeing an unexpected “The service to detect this status is disabled” message when opening Network and Sharing Center after the latest updates.
      • Fixed an underlying issue resulting in some Insiders not being able to connect to certain Wi-Fi types after the latest updates. File a new piece of feedback if you continue experiencing issues, including a recording of the issue if possible.

      [Settings]

      • The Bluetooth quick settings page is now navigable using gamepad input.

      [Known issues]

      • We’re investigating an issue where VMware Workstation Pro 17.6.4 may display a blank window when reopening a virtual machine after it has been created and closed. We are working on a fix and will provide an update in a future build.
      • We’re also aware of and investigating reports of VMWare devices green screening

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental (26H1) Preview Build 28120.3002

      Share this post:

      Hi all, last Friday Microsoft released Windows 11 Build 28120.3002 to the Experimental (26H1) channel

      A quick 2nd flight for this channel too, the Windows share option is very nice!

      Happy Upgrades!

      Changes and improvements gradually being rolled out*

      • This update includes a small set of general improvements and fixes that improve the overall experience for Insiders running this build on their PCs.

      [Settings]

      • The Bluetooth quick settings page is now navigable using gamepad input.

      [Windows Share]

      • Added the ability to pin your favorite apps in the Windows share window.

      Known issues

      • We are aware Easy Anti-Cheat (EAC) might fail to launch and display the error, “The application was unable to start correctly (0xc000007b).” We continue to work on a fix for this issue.

      [Brightness]

      • Fixed an underlying issue resulting in some Insiders experiencing issues with brightness after the latest flights, including brightness settings being unexpectedly grayed out. File a new piece of feedback with as many details as possible if you continue experiencing issues.

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental Preview Build 26340.9482

      Share this post:

      Hi all, last Friday Microsoft released Windows 11 Build 26340.9482 to the Experimental Channel

      A 2nd flight in the same week smooth install here on all devices.

      Changes and improvements gradually being rolled out

      [Security]

      • Memory Integrity protection expands automatically to more eligible devices. As outlined in our recent blog, Windows might now enable Memory Integrity (HVCI) during updates on supported PCs to help improve security and prepare devices for advanced Windows security features, while respecting existing user or IT administrator choices.

      [Context menu]

      Building on the work we’ve been doing to improve the context menu experience:

      • We’ve added a new teaching tip you might see as a first-time experience to help you learn about the customization options.
      • In theme with giving you more control, you can also now turn off the customize context menu entry in the new context menu settings.
      • We’ve fixed a few small issues with the Send To option in the context menu not working as expected.

      [File Explorer search]

      • Search from This PC in File Explorer is now indexer-based, making it much faster and consistent with search from File Explorer Home.

      [Taskbar]

      • Improved how the IME icon scales in the taskbar when using small taskbar icons.

      [Screen capture]

      • We updated the visual indicator shown during screen capture, changing the capture border from yellow to
      • red to make active capture sessions easier to identify.
      Screen capture displaying a red border around the captured area.

      [Settings]

      • Made some small visual adjustments to improve the design of the Temporary files page under Settings > System > Storage.
      • Fixed an issue causing mouse cursor customization to not work correctly after the latest flights.
      • Fixed an issue causing desktop background customization to not persist after a reboot after the latest flights.

      [Brightness]

      • Fixed an underlying issue resulting in some Insiders experiencing issues with brightness after the latest flights, including brightness settings being unexpectedly grayed out. File a new piece of feedback with as many details as possible if you continue experiencing issues.

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental (Future Platforms) Preview Build 29661.1000

      Share this post:

      Hi all, last Tuesday Microsoft released Windows 11 Build 29661.1000 to the Experimental (Future Platforms) Channel

      A few fixes for this flight, smoothly processed on my devices in this channel except for 1 the last access to the hello Pin (Feedback Hub: https://aka.ms/AA13dolt )

      Happy updates!

      Changes and improvements gradually being rolled out

      • This update includes a small set of general improvements and fixes that improve the overall experience for Insiders running this build on their PCs.

      [Kerberos enhancements]

      • IAKerb is now enabled by default for Windows client. IAKerb is a Kerberos extension that allows Windows authentication to succeed in scenarios where traditional Kerberos can’t be used because a direct connection to a domain controller is unavailable. This extension helps reduce reliance on NTLM while improving compatibility for modern authentication scenarios. For additional background, implementation details, and early preview information, see Reducing NTLM Dependency: IAKerb and LocalKDC in Windows Insider Preview.

      [Input]

      • Fixed an issue in the latest builds that caused the mouse cursor to get into a state where it blinked repeatedly for some Insiders.
      • Fixed an issue in the latest builds that caused the mouse cursor not to be visible in certain apps.
      • Fixed an issue in the latest builds where the mouse pointer speed option in Settings didn’t work.

      [Windows Update]

      • Fixed an issue causing some Insiders to be unable to update to the latest builds and see error 0x80070005.

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental (26H1) Preview Build 28120.2912

      Share this post:

      Hi all, Last Tuesday Microsoft released Windows 11 Build 28120.2912 to the Experimental (26H1) Channel.

      A few fixes in this flight, all went fast and smoothly.

      Enjoy your Flight!

      Changes and improvements gradually being rolled out

      • This update includes a small set of general improvements and fixes that improve the overall experience for Insiders running this build on their PCs.

      [Input]

      • Fixed an issue that caused zoom not to work in certain apps when using a touchpad after the latest flights.
      • Fixed an issue causing the mouse cursor to move in the wrong direction on portrait monitors for some Insiders after the latest flights.

      Known issues

      • We’re investigating reports that some games that use Easy Anti-Cheat (EAC) might fail to launch and display the error, “The application was unable to start correctly (0xc000007b).” We’re working on a fix and expect the issue to be resolved by the next build.

      source: Flight Hub

      Share this post:

      Windows 11 Insider Experimental Preview Build 26340.9354

      Share this post:

      Hi all, Last Tuesday Microsoft released Windows 11 Build 26340.9354 to the Experimental Channel.

      A big updated feature list, smooth updates on my devices, Happy Updates!

      Changes and improvements gradually being rolled out

      [Cross-device resume improvements]

      • We’re making it easier to continue where you left off on your PC. When you resume a webpage from your phone and the phone’s browser isn’t installed on your PC, the Resume hovercard now gives you two options: open the page directly in your PC’s default browser or install the phone’s browser for a native experience. This update helps you continue your work immediately without requiring an app installation first.
      The Resume hovercard provides an option to open the webpage in the PC’s default browser
      The Resume hovercard provides an option to install the originating phone browser

      [Settings – Home]

      • We’re beginning to expand the new Device Info Card experience for Settings Home to additional markets globally. Available for Windows Insiders signed in with their Microsoft account, the Device Info Card provides a quick snapshot of your PC’s key specifications and usage. From the card, you can go directly to Settings > System > About to see more detailed information about your PC.
      • Note: We’ve been previewing the Device Info Card with Windows Insiders in the U.S. and on Settings Home for IT-managed PCs signed in with a Microsoft Entra ID.
      The new Device Info Card in Settings Home provides a quick view of key PC specifications and storage usage

      [Settings – Privacy & security]

      • The improved Privacy & security page in Windows Settings helps you find the Camera, Microphone, and Location privacy controls more easily. It groups similar controls across the page and brings usage information from deeper linked pages onto this page.

      [Family Safety]

      • Improved family safety messaging when applications are blocked because of age-restricted parental controls.

      [Taskbar & system tray]

      • We’re restarting the rollout of enhanced taskbar preview animations, providing smoother transitions between app groups.

      [File Explorer]

      • Key file information, such as name, location, and date, now appears in a consistent layout on the File Explorer search results page, making search results easier to scan.

      [Narrator]

      Read and explore math equations with Narrator

      We’re adding math reading and navigation support in Narrator, bringing clearer and more natural math experiences to users who are blind or have low vision. Math is at the heart of STEM education and learning, and this update helps students and professionals independently read, understand, and explore equations, formulas, and scientific notation with confidence.

      With this update, Narrator can read math equations aloud in supported Microsoft 365 apps, including Word and PowerPoint. Instead of announcing every symbol individually, Narrator reads equations in a structured, natural way that reflects how they’re meant to be understood. For example, when Narrator reaches a fraction, it reads the numerator and denominator together so you can understand the relationship between them.

      You can also explore equations in more detail with a dedicated math navigation mode. Press Narrator key + Alt + N to turn on math navigation, then use the arrow keys to move through different parts of the equation, such as fractions, exponents, and roots. This mode lets you move through an equation one part at a time instead of hearing the full expression all at once. Press Esc to exit math navigation mode.

      Math reading is available as soon as you install this build, with no additional download or setup required. To try it, turn on Narrator by pressing Windows key + Ctrl + Enter, then open a supported document that contains mathematical equations and use your standard Narrator reading commands. You can also personalize the experience in Math reading settings in Narrator settings, including speech style and math navigation preferences.

      We’re continuing to refine this experience and plan to expand it to more scenarios over time. We’re beginning to roll this out to Windows Insiders, so it might not be available to everyone right away.

      Screenshot of the Narrator Math reading settings page in Windows Settings.
      The Narrator Math reading settings page in Windows Settings

      Feedback: Share your thoughts in Feedback Hub (WIN + F) under Accessibility > Narrator.

      [Magnifier]

      Magnifier now understands each of your displays

      • More and more of the work people do happens across more than one screen. You draft on one display and keep source material open on another. You fill in a form while a reference document sits beside it. Those extra displays can be more helpful when each one can do its own job, and now Magnifier supports exactly that.
      • To use this update, set your monitors to Extend in System > Display, not Duplicate, so Windows treats each screen as its own space.
      • Every screen keeps its own view at its own zoom. In earlier versions of Magnifier, zooming in stretched a single magnified view across all of your displays, so one screen’s zoom followed you everywhere and screen edges blurred together. With this update, each monitor’s boundary is respected, and each monitor can have its own zoom percentage. Your writing screen can be at 300% while your reference screen stays at 150%, and the magnified view no longer spills from one display into the next. This behavior matters because different tasks and screen resolutions often require different levels of magnification to remain comfortable to read.

      Setting the zoom on each screen is easy. Choose whichever method feels natural:

      • Move your mouse pointer onto the screen you want to adjust, then press Windows key + Plus (+) or Windows key + Minus (-), or hold Ctrl + Alt and rotate your mouse wheel.
      • Set the percentages directly in Accessibility > Magnifier.
      • Drag the Magnifier toolbar onto a specific screen to adjust that screen from its on-screen controls.
      Screenshot of Magnifier with Zoom per display enabled, allowing each monitor to maintain its own zoom level.
      Magnifier with Zoom per display enabled, allowing each monitor to maintain its own zoom level.
      • Per-monitor zoom is turned on by default. If you prefer the classic behavior where a single zoom spans all of your displays, you can turn per-monitor zoom off at any time from either the Magnifier toolbar or Accessibility > Magnifier. You can turn it back on whenever you like.

      Keep the view that matters, right where you need it

      • As you move your mouse from screen to screen, the magnified view naturally follows your pointer. Sometimes this might cause you to lose sight of the content that you’re actively working on.
      • Viewport locking keeps that view in place. For example, you might be drafting an email based on a section of a document open on another display. Position that display so the paragraph you need is in view, press Ctrl + Windows key + K, and the screen holds its view steady while you move your cursor over to write. The locked screen stays fully live and interactive, so you can glance back, click, or copy from it whenever you need to, and its view stays put until you release it.
      • A message appears on the screen when it’s locked, so you always know what’s being held. To lock or unlock a screen, point your mouse at that screen and press Ctrl + Windows key + K again. To release everything at once, press Windows key + Esc to dismiss all locks. You can change the lock shortcut to Ctrl + Alt + P in Accessibility > Magnifier.
      Screenshot of Magnifier's multiple display controls, including independent zoom and view locking options.
      Magnifier’s multiple display controls include independent zoom and view locking options

      [Sound Settings]

      We’ve made several improvements to Settings > System > Sound. These improvements include:

      • We’ve updated the design of the volume sliders in Sound Settings so that they display audio activity on the side when audio is playing.
      The updated volume slider in Sound Settings displays active audio levels
      • If your audio device supports hardware acceleration, an option to allow hardware acceleration is now available in the Advanced section of the device’s properties.
      • You can now configure exclusive mode for an audio device in the Advanced section of the device’s properties, so you don’t have to go to Control Panel.
      • You can now configure adaptive communication sound levels, which reduce the volume of other sounds when communications activity is detected, directly in Settings.
      • The option to set an audio device as the default sound device for communication now always appears in Properties. The option is unavailable if the device is already the default instead of being hidden.
      • We’ve updated the text for allowing audio devices to make it clearer.
      • We’ve added a new banner when mono audio is enabled to make it clear that some properties don’t take effect while mono audio is active.
      • We’ve updated the All sound devices page:
        • You can now change default devices from this page.
        • We’ve adjusted the page design so that you can filter whether you’re viewing input or output devices.
        • We’ve added toggles so that you can choose whether to hide or show disabled, disconnected, and unplugged devices.
      • We’ve also updated the input and output audio properties pages in Settings to include jack information for devices that need it.

      [Fonts]

      Unicode has announced the encoding of two African writing systems in recent Unicode releases:

      • Garay was encoded in Unicode 16.0, released in September 2024.
      • Beria Erfe was encoded in Unicode 17.0, released in September 2025.

      We’re pleased to share that Ebrima is our first Microsoft font to support both Garay and Beria Erfe, continuing our work to expand support for African writing systems across Windows. Along with this support, we’ve refined and improved Adlam. The updated glyph designs reflect the current Unicode standard and improve consistency.

      Screenshot that shows a sample of Beria Erfe characters in the Ebrima font.
      A sample of Beria Erfe in the Ebrima font
      Screenshot that shows a sample of Garay text in the Ebrima font.
      A sample of Garay in the Ebrima font

      [Print Management]

      • We’re temporarily removing the modernized Print Management experience from Windows Insider Preview builds while we continue refining the experience based on feedback. The existing Print Management tools remain available and are unaffected.
      • We plan to bring the updated Print Management experience back to Windows Insiders in a future build after additional improvements are complete.

      [Notification Center]

      • Notification tips can now be saved to Notification Center after they’re dismissed or time out, making them easier to find again later.

      [Taskbar]

      • Fixed an issue where the taskbar app preview window might not respond correctly to dark and light mode changes.

      [Input]

      • Fixed an issue causing the mouse cursor to move in the wrong direction on portrait monitors for some Insiders after the latest flights.

      [Admin Protection]

      • Fixed an issue in the previous flight that caused the UAC dialog not to appear for some Insiders when Admin Protection was enabled.

      [Assisted Setup in OOBE]

      • Assisted Setup is a new, optional way to finish setting up a Windows PC. At the end of setup, you can choose to have Windows guide you through installing apps, personalizing your device, and getting up to date so that the PC is ready to use. The experience is entirely optional, and you can skip it to go directly to the desktop.

      [General reliability]

      • Fixed an issue that caused some Insiders to see a SYSTEM SERVICE EXCEPTION bug check after the previous flight when launching or closing certain apps.

      Known issues

      • We’re working on a fix for an issue causing mouse cursor customization not to work correctly.
      • We’re working on a fix for an issue causing desktop background customization not to persist after a reboot.

      source: Flight Hub

      Share this post:

      Windows 11 Config Refresh in Intune: The Missing Piece for Consistent Device Management

      Share this post:

      One of the biggest differences between traditional Group Policy and modern cloud management has always been policy enforcement frequency. While Group Policy refreshes every 90 minutes by default, Microsoft Intune policies typically rely on periodic device check-ins. With Config Refresh, Microsoft brings a similar “reapply and enforce” capability to Windows 11 managed through Intune.

      In this blog post, we’ll look at what Config Refresh is, why it matters, how it works, and how to configure it in Microsoft Intune.

      What Is Config Refresh?

      Config Refresh is a Windows 11 feature that periodically reapplies previously received MDM policies to a device, helping prevent configuration drift and ensuring devices remain compliant with your organization’s standards.

      Unlike a normal Intune sync, Config Refresh does not require communication with the Intune service. The device uses locally cached policies and can reapply them even when offline.

      This means that if a setting is changed locally, intentionally or accidentally, Windows can automatically restore the managed configuration according to the configured refresh schedule.

      Why Is Config Refresh Important?

      Configuration drift is a common challenge in endpoint management.

      Examples include:

      • A local administrator changes security settings.
      • A user modifies settings that should be controlled by IT.
      • Third-party software overwrites configuration values.
      • Troubleshooting activities leave devices in a non-compliant state.

      Before Config Refresh, these deviations might remain in place until the next MDM sync, which could take several hours. Config Refresh significantly reduces that window.

      Benefits

      • Faster remediation of configuration drift
      • Improved compliance and security posture
      • Works even when devices are offline
      • Similar experience to traditional Group Policy refresh
      • Configurable refresh interval between 30 minutes and 24 hours

      Config Refresh vs. Intune Sync

      Many administrators confuse Config Refresh with an Intune sync, but they serve different purposes.

      Intune Sync

      An Intune sync:

      • Downloads new policies
      • Retrieves changed assignments
      • Processes compliance updates
      • Requires communication with Intune services

      Config Refresh

      Config Refresh:

      • Reapplies policies already stored on the device
      • Does not download new policies
      • Can work without internet connectivity
      • Focuses on maintaining existing configuration state

      Think of Intune Sync as retrieving new instructions, while Config Refresh is enforcing previously received instructions.

      Requirements

      Config Refresh is supported on:

      • Windows 11 version 22H2 with the June 2024 security update or later
      • Microsoft Intune-managed devices

      Supported Policies

      Config Refresh primarily targets settings managed through the Policy CSP. Microsoft also indicates support for certain other CSP-based settings such as BitLocker.

      Supported

      • Policy CSP settings
      • Many Settings Catalog policies
      • BitLocker-related policies

      Currently Not Supported

      • Firewall policies
      • AppLocker policies
      • Personal Data Encryption (PDE)
      • Windows LAPS policies

      Always test specific policy types before relying on Config Refresh for enforcement.

      How to Enable Config Refresh in Intune

      Step 1: Create a Configuration Profile

      Navigate to:

      Intune Admin Center → Devices → Configuration Profiles → Create Profile

      Select:

      • Platform: Windows 10 and later
      • Profile type: Settings Catalog

      Step 2: Add Config Refresh Settings

      Search for:

      Config Refresh

      You’ll find two important settings:

      • Enable Config Refresh
      • Refresh Cadence

      Step 3: Configure Refresh Cadence

      The refresh interval can be configured between:

      • Minimum: 30 minutes
      • Maximum: 1,440 minutes (24 hours)

      Microsoft’s default recommendation is 90 minutes, which mirrors traditional Group Policy behavior.

      Suggested Refresh Intervals

      High-Security Devices

      Examples:

      • Privileged workstations
      • IT admin devices
      • Security operations endpoints

      Recommended:

      30-60 minutes

      Standard Corporate Devices

      Examples:

      • General office users
      • Knowledge workers

      Recommended:

      90 minutes

      Low-Risk or Shared Devices

      Examples:

      • Kiosks
      • Meeting room devices

      Recommended:

      4-24 hours

      Balancing security and device processing overhead is important. For most organizations, 90 minutes is an excellent starting point.

      How to Verify It Is Working

      You can confirm deployment by checking:

      Registry

      Config Refresh settings are written through MDM policy configuration and can be verified in the device registry after policy deployment.

      HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Enrollments\”Intune Policy Provider GUID” \ConfigRefresh

      I searched for ‘ConfigRefresh’ in the Enrollments Key to easily find the correct GUID

      Event Viewer

      Windows logs Config Refresh activity, making Event Viewer one of the best places to validate policy reapplication and troubleshoot issues.

      check the eventviewer logs under Applications and Service Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostic-Provider and look/filter for event ID 4202

      Task Scheduler

      A Config Refresh scheduled task is created on supported devices to execute the refresh cycle at the configured interval.

      Pausing Config Refresh

      One of the newest additions is the ability to temporarily pause Config Refresh directly from Intune.

      This is useful when:

      • Troubleshooting devices
      • Testing custom configurations
      • Performing maintenance activities
      • Investigating configuration conflicts

      Administrators can pause policy enforcement for a specified number of minutes, up to 1,440 minutes (24 hours). After the pause period expires, Config Refresh automatically resumes.

      Best Practices

      Enable It Everywhere

      If you’re managing Windows 11 devices with Intune, there is little reason not to enable Config Refresh.

      Start With 90 Minutes

      This provides a familiar Group Policy-like experience without generating unnecessary processing.

      Use for Security-Critical Policies

      Settings such as:

      • Defender configuration
      • Security baselines
      • Device restrictions
      • Attack surface reduction rules

      benefit significantly from faster reapplication.

      Monitor Unexpected Drift

      Frequent policy reapplication can help identify applications or processes that continually modify managed settings.

      Final Thoughts

      Config Refresh is one of the most important improvements Microsoft has introduced for modern endpoint management. It closes a long-standing gap between Group Policy and cloud-native management by ensuring that managed settings remain enforced, even when devices are offline.

      For organizations moving fully to Intune, Config Refresh provides a more resilient and predictable management experience. If you haven’t enabled it yet, it’s worth adding to your Windows 11 configuration baseline today.

      Have you already enabled Config Refresh in your environment? If so, what refresh interval are you using and have you noticed any impact on compliance or troubleshooting?

      Share this post:

      Automatically Configure Time Zone on Windows 11 with Intune

      Share this post:

      One of the most common complaints from users who travel between countries or work across multiple regions is that their Windows device shows the wrong time zone. While Windows 11 includes an “Set time zone automatically” option, it is not always enabled by default.

      In this guide, I’ll show you how to enable automatic time zone detection on Windows 11 devices managed with Microsoft Intune using a combination of:

      1. A Settings Catalog policy to enable Location Services.
      2. An Intune Remediation to enable the Automatic Time Zone service (tzautoupdate).

      Why Location Services Matter

      Windows can only automatically determine the correct time zone if it has access to the device location.

      If location services are disabled, Windows cannot detect that the user has moved to another region and will continue using the previously configured time zone.

      Therefore, before enabling automatic time zone updates, make sure Location Services are enabled through Intune.

      Step 1: Enable Location Services with Intune

      Create a Settings Catalog Policy

      Navigate to:

      Intune Admin Center
      Devices → Configuration → Create Policy

      Configure:

      • Platform: Windows 10 and later
      • Profile type: Settings Catalog

      Add the following settings

      Search for Location and configure:

      Location

      SettingValue
      Allow LocationForce Location On

      Privacy

      SettingValue
      Let Apps Access LocationForce Allow

      Depending on your organization’s privacy requirements, you can further restrict which applications are allowed to access location data.

      Assign the policy to your target device group and allow it to synchronize.

      Step 2: Create an Intune Remediation

      Even with Location Services enabled, the automatic time zone feature may still be disabled if the Time Zone Auto Update Service is not configured correctly.

      The service responsible for this is:

      tzautoupdate

      Windows expects this service to be configured as:

      • Startup Type: Manual (Trigger Start)
      • Registry Value: Start = 3

      We’ll use an Intune Remediation to detect and correct this automatically.

      Detection Script

      The detection script checks whether automatic time zone updates are already enabled.

      $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\tzautoupdate"
      $Value = (Get-ItemProperty -Path $RegPath -Name Start -ErrorAction SilentlyContinue).Start
      
      if ($Value -eq 3) {
          Write-Output "Automatic time zone enabled"
          exit 0
      }
      else {
          Write-Output "Automatic time zone disabled"
          exit 1
      }

      Detection Logic

      • Returns 0 when automatic time zone detection is enabled.
      • Returns 1 when remediation is required.

      Remediation Script

      If the detection script reports non-compliance, the remediation script configures the required settings.

      # Enable Time Zone Auto Update service
      
      $RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\tzautoupdate"
      
      if (-not (Test-Path $RegPath)) {
          New-Item -Path $RegPath -Force | Out-Null
      }
      
      Set-ItemProperty -Path $RegPath -Name Start -Value 3 -Type DWord
      
      # Set service startup type to Manual (Trigger Start)
      sc.exe config tzautoupdate start= demand | Out-Null
      
      # Start the service if possible
      try {
          Start-Service tzautoupdate -ErrorAction SilentlyContinue
      }
      catch {}
      
      Write-Output "Automatic time zone enabled."
      exit 0

      What the Script Does

      • Creates the registry key if necessary.
      • Sets the startup value to 3 (Manual).
      • Configures the service startup type to Manual (Trigger Start).
      • Attempts to start the service immediately.
      • Returns success to Intune.

      Step 3: Deploy the Remediation

      Navigate to:

      Devices → Scripts and Remediations → Remediations

      Select:

      Create Remediation Package

      Upload

      • Detection Script → Detection script above
      • Remediation Script → Remediation script above

      Recommended Settings

      SettingValue
      Run this script using logged-on credentialsNo
      Enforce script signature checkNo
      Run script in 64-bit PowerShellYes

      Schedule

      Recommended:

      • Hourly for mobile users
      • Daily for fixed office devices

      Validating the Configuration

      After the policy and remediation have run, users should see:

      Settings → Time & Language → Date & Time

      The following setting enabled:

      You can also verify via PowerShell:

      Get-ItemProperty HKLM:\SYSTEM\CurrentControlSet\Services\tzautoupdate

      Expected result:

      Start : 3

      You can also check the service:

      Get-Service tzautoupdate

      Expected:

      Final Thoughts

      Enabling automatic time zone detection is a small change that can greatly improve the experience for travelling users, remote workers, and consultants who frequently move between locations.

      By combining:

      • A Settings Catalog policy to enable Location Services
      • An Intune Remediation to configure the tzautoupdate service

      you can ensure Windows 11 devices automatically adjust to the correct time zone without requiring user intervention.

      For organizations managing fleets of Windows 11 laptops through Intune, this is a simple but effective quality-of-life improvement that reduces support calls and prevents calendar and meeting scheduling issues caused by incorrect local time settings.

      Share this post: