Posted in

Windows 11 Build 26300.7733 Adds Native Sysmon

by ailona•

Windows 11 Insider Preview Build 26300.7733 (KB5074178) adds native Sysmon (disabled by default), Voice Access Dutch support, File Explorer accessibility fixes, and resolves app freezes with OneDrive/Dropbox. Features roll out gradually via controlled feature rollout for Dev Channel insiders.

Windows 11 Insider Preview Build 26300.7733 for the Dev Channel introduces native Sysmon integration and several targeted fixes. This update rolls out features via controlled feature rollout, with some changes gated behind the toggle in Settings.

Main feature and impact

Built-in Sysmon functionality is now included in Windows 11. It captures system events for threat detection and writes them to the Windows Event Log. Administrators can enable Sysmon via Optional Features or PowerShell and complete setup with sysmon -i. The feature is disabled by default and requires explicit activation. Existing Sysmon installs must be removed before enabling the built-in option.

Practical implications

Security teams gain native telemetry without separate Sysmon downloads. Event data becomes consumable by SIEMs and EDR tools through standard Windows logs. Enablement requires admin rights and an explicit install step, allowing staged deployment. Controlled feature rollout limits exposure while Microsoft monitors feedback and stability across Insider devices.
“Built-in Sysmon is disabled by default and must be explicitly enabled.”
This build also includes accessibility and stability fixes. File Explorer keyboard navigation, folder renaming, and Add to favorites icon issues were fixed. App freezes related to OneDrive and Dropbox file operations, and Outlook PST hangs, were addressed. Voice Access added support for the Netherlands locale. Documentation for built-in Sysmon will be published soon. Windows Insiders should test Sysmon enablement workflows and validate event ingestion to downstream security tools. Keep the toggle on in Settings > Windows Update to receive gradual rollouts, or leave it off to wait for broader distribution. Report telemetry, localization, and stability issues through Feedback Hub for tracking and prioritization.

Key points from the article:

  • Built-in Sysmon added, disabled by default.
  • Enable Sysmon via Settings or PowerShell commands.
  • Voice Access gains Netherlands locale support.
  • File Explorer keyboard navigation and icon fixes.
  • Resolved app freezes when using OneDrive or Dropbox.

    • Related Coverage:

    From the Windows Blog