Microsoft has quietly rolled out KB5095189, a cumulative update targeting the Out-of-Box Experience (OOBE) for Windows 11 versions 24H2 and 25H2.
Released on June 23, 2026, this update doesn’t touch your running OS in the way traditional patches do; instead, it refines the very first moments a user spends with a new or freshly reset Windows 11 device.
For IT administrators managing device provisioning at scale, and for everyday users unboxing new hardware, this update matters more than its narrow scope suggests. OOBE is the gateway experience the setup wizard that walks users through account creation, privacy settings, and initial configuration.
Bugs or friction here can cascade into support tickets, failed enrollments, or security misconfigurations that persist long after setup completes.
Unlike standard security or feature updates, KB5095189 applies exclusively to the Windows OOBE process. It doesn’t modify system files used during normal operation. Microsoft’s documentation confirms that the update is narrowly scoped: it “applies only to the Windows OOBE process and is available only when OOBE updates are installed.”
This means the vast majority of already-deployed Windows 11 machines running 24H2 or 25H2 won’t see this update through standard Windows Update channels in the traditional sense; it’s triggered specifically during the initial setup flow.
The update installs automatically during OOBE, provided the device has an active internet connection at setup time. There are no prerequisites listed, which simplifies deployment for organizations imaging new devices, though it does introduce a dependency on network availability during provisioning a detail worth flagging for environments with air-gapped or delayed-network setup workflows.
Key installation details:
- Trigger point: Automatically downloaded and installed during Windows OOBE
- Connectivity requirement: Active internet connection required at time of setup
- Prerequisites: None
- Restart requirement: Mandatory device restart after the update is applied
KB5095189 formally replaces KB5078674, the previous OOBE cumulative update. This follows Microsoft’s standard cumulative update model, where each release supersedes its predecessor rather than stacking as an independent patch.
Organizations that reference KB5078674 in their deployment documentation or imaging scripts should update those references accordingly.
Microsoft has published a CSV file detailing the specific files modified by this update, accessible via Microsoft’s file information portal for KB5095189.
This file can be opened in Notepad or Excel for administrators who need to verify file versions or hashes as part of change management or compliance audits.
One notable caveat: Microsoft flags that the English (United States) build of this update may bundle files for additional languages, a common practice for OOBE-related patches given the global nature of Windows deployment, but worth noting for organizations tracking package sizes or language-pack dependencies.
“OOBE updates rarely make headlines, but they’re a quiet indicator of how seriously Microsoft treats the first-run experience as an attack surface and support-cost variable. Every friction point in setup a failed network check, a misfired update, a hung restart translates into help desk tickets and, in enterprise environments, delayed device fleet rollouts. Patches like KB5095189 are unglamorous, but they’re foundational to a smooth Zero Touch Provisioning pipeline.”
While KB5095189 carries no CVE designation and isn’t a security patch in the conventional sense, it’s a relevant data point for:
- Device provisioning teams using Autopilot or similar zero-touch deployment tools
- OEM partners shipping new Windows 11 hardware
- Enterprise imaging teams maintaining custom OOBE workflows
- IT documentation teams tracking the KB5078674-to-KB5095189 update lineage
Administrators managing large-scale deployments should verify that new device images or provisioning packages reference the current KB5095189 build rather than the deprecated KB5078674, particularly if OOBE customization scripts hardcode specific update identifiers.
No further action is required from end users, as the update applies automatically when conditions are met.
About the Author
