Skip to the content
The Update Bureau
Windows 11 Windows 11 Insider 26H1 Insider Preview, Experimental Channel
Windows Insider

Build 28020.1611

Build 28020.1611: Windows Insider Experimental Channel, February 2026. Built-in Sysmon and OneDrive link-sharing options

In short

Adds built-in Sysmon and more ways to share OneDrive links. It also corrects the desktop watermark’s build number.

Does it affect you? Applies to: Devices enrolled in the Canary Channel. The OneDrive sharing options are for Insiders signed in with Microsoft accounts outside the EEA.

Build
28020.1611

This is a test build for people in the Windows Insider Program. Features in it can change, be removed, or never reach regular Windows releases.

What changes

New features 2 changes

Built-in Sysmon

Gradual rollout

For: Insiders receiving the gradual rollout; people who monitor system events

  • Windows includes Sysmon functionality to capture system events that can help with threat detection. It is disabled by default and must be enabled before you can use it.1
    Enable the optional feature, then run sysmon -i to complete installation. Uninstall Sysmon from the website before enabling the built-in version.

Windows Share

Gradual rollout

For: Insiders signed in with Microsoft accounts outside the EEA

  • When you copy a link to a OneDrive cloud file, the share window offers options to send the link through other apps.2
    Available to Insiders signed in with Microsoft accounts who are not in the EEA.

Fix 1 change

Desktop watermark

Gradual rollout

For: Insiders receiving the gradual rollout

  • The desktop watermark shows the correct build number.3

Technical details

Data sheet · Security · Downloads · Components Click to collapse or expand

Data sheet

Released
2026-02-12
Type
Windows Insider build
VersionBuildChannel
— 28020.1611 Experimental Channel

Security

No vulnerabilities are listed for this update.

Sources

Updated
Cited passages from Microsoft's official notes (3)
  1. 1. Windows now brings Sysmon functionality natively to Windows. Sysmon functionality allows you to capture system events that can help with threat detection blogs.windows.com
  2. 2. When you share a OneDrive cloud file by right-clicking to share on the file – new options for sharing that link through other apps will be provided under “Share using” when the “Copy link” button is clicked. blogs.windows.com
  3. 3. Fixed the desktop watermark to show the correct build number. blogs.windows.com
Checked automatically: 8 of 8 checks passed, 3 quoted passages
  • Quotes found in the official pages: passed
  • Numbers found in the sources: passed
  • Vulnerabilities from the dossier only: passed
  • Links to allowed domains only: passed
  • Every official change covered: passed
  • Readable plain text: passed
  • Changes confirmed by the file list: passed
  • Sources agree: passed

A second AI read the text against the sources: correctness 5/5, clarity 5/5, completeness 4/5. How we work

Published by The Update Bureau. Written with AI from Microsoft's own documents, checked by rules and a second AI. How we work · Report a mistake