KB5132059: Cumulative update for Windows 11, version 26H1, November 2026. NTLM signing becomes the default for client connections

• There is no non-security preview update in the second half of December 2026. Monthly security and preview updates resume in January 2027.¹

• The update includes security improvements.²

For: supported PCs and non-managed business devices

• More eligible devices can receive new Secure Boot certificates automatically. Certificate deployment continues over the coming months.³
  Additional high confidence device targeting data increases coverage. Deployment continues across supported PCs and non-managed business devices.

For: Windows clients

• NTLM clients now offer message signing by default for non-anonymous connections. This helps reduce exposure to relay attacks.⁴
  The change also provides auditing to identify connections that are not using signing.

For: devices using Cuba time

• Cuba remains on UTC-04:00 through the 2026–2027 daylight saving time period. It returns to UTC-05:00 in November 2027 and resumes its regular seasonal schedule in 2028.⁵
  The update adjusts daylight saving time rules for Cuba. Cuba does not observe the November 2026 and March 2027 transitions.

For: people using signed PowerShell scripts

• Some signed scripts with invalid UTF-8 encoding might fail signature checks, even if they were accepted before.⁶
  Stricter encoding validation applies to PowerShell script signing and signature verification. Review affected scripts, save them using valid UTF-8 encoding with a byte order mark (BOM), and sign them again.

• AI components receive an update. These components apply only to Copilot+ PCs and do not install on other Windows client PCs or Windows Server.⁷
  Image Search, Content Extraction, Semantic Analysis, and Settings Model are updated to version 1.2610.1071.0.

For: Windows 11 version 26H1 devices

• The included servicing stack update improves the reliability of the Windows update installation process.⁸
  The update includes KB5132687, build 28000.3501.

• USB Audio 1.0 devices that might fail to start after a recent security update get a fix.⁹
  The issue could cause error code 10 in Device Manager.

For: devices adding printers published in Active Directory

• Adding some printers published in Active Directory no longer fails with error 87. The issue did not generally affect existing printers or printing.¹⁰
  The failure could occur when adding a published printer through Settings > Bluetooth & devices > Printers & scanners > Add device. The issue was introduced by the October 2026 update.

• Remote Desktop connections that might fail because of a certificate mismatch after the October 2026 preview get a fix.¹¹
  The issue could affect Remote Desktop Protocol (RDP) connections.