Windows 11 KB5120998: What a Non-Security Preview Update Still Means for Security Teams

KB5120998 is an optional, non-security preview for Windows 11 24H2 and 25H2 — no CVE fixes. But two changes matter to security teams: Administrator Protection starts rolling out, and WMIC is finally removed. Here's what to pilot and what to weigh before deploying.

Microsoft's KB5120998 is an optional preview update for Windows 11 24H2 and 25H2, carrying 35 changes across the taskbar, Start menu, and search. It is a non-security release, so it ships quality and feature improvements rather than CVE fixes. That is usually a cue for security teams to move on, but this one has two changes worth noting and a couple of known issues worth weighing before you deploy.

The two security-relevant changes

Administrator protection is starting to roll out. This feature lets users perform admin tasks with just-in-time privileges backed by profile separation, which hardens Windows against elevation-of-privilege attacks. Two caveats matter. Microsoft is explicit that it is not a formal security boundary, so treat it as defense-in-depth rather than a hard control. And it is off by default, enabled through Intune OMA-URI or Group Policy, so it does nothing until you turn it on. If you manage a Windows fleet, this is worth piloting.

WMIC is being removed. Starting this month, the Windows Management Instrumentation Command-line utility is no longer included in 24H2 and 25H2, and it is no longer available as a Feature on Demand. WMIC has long been a favorite living-off-the-land binary for attackers running commands and reconnaissance with a trusted, signed tool. Removing it shrinks that attack surface. If you have detection rules or legacy scripts that depend on WMIC, now is the time to migrate them to PowerShell.

Known issues to weigh before deploying

Microsoft is investigating two problems tied to recent updates. Some machines see mouse cursor personalization settings unexpectedly revert to defaults after installing, including custom and high-DPI cursors being replaced. Separately, Microsoft Defender can show a false warning that antivirus protection is turned off after a restart, even when it is running normally. The Defender notification issue is broader than one client update, appearing across supported Windows 10, Windows 11, and Windows Server versions.

Neither is a vulnerability, but the false Defender alert is the kind of thing that generates helpdesk tickets and erodes user trust in a real security signal. There is also a one-time extra restart on some devices tied to a Secure Boot certificate update rolling out over the coming months.

The takeaway for IT and security teams

Because KB5120998 is an optional, non-security preview, there is no urgency to rush it onto production machines. The security fixes will arrive in next month's Patch Tuesday regardless. The sensible move is to pilot it on test devices, validate the mouse-cursor and Defender behavior against your environment, and plan the administrator-protection rollout and any WMIC-dependent migrations on your own schedule.

Preview updates are for testing ahead of the security releases that actually close vulnerabilities. Keeping those two categories straight — feature previews versus the CVE fixes that matter — is half of good patch management. (New to the terminology? See our plain-English guide to CVEs, CVSS, and KEV.)

The CVE fixes are what you actually need to track. Tell VulnTracker what you run and you'd get alerted on the vulnerabilities that hit your stack — Windows and everything else — within hours of disclosure, ranked by real-world risk (KEV/EPSS). Start a 5-day free trial, or get our daily digest free without setting anything up.

Quick reference

References: Microsoft KB5120998 · BleepingComputer