Windows 11 in 2026 has one change that makes enterprise IT administrators less comfortable:Operating systems began to "evolve silently" like cloud services, and the parts that evolved were not released.
This is not alarmist. Copilot+ PC users received two special update packages this year-KB5124890 (update Phi Silica model for Qualcomm platform) and KB5124888 (update image processing model for AMD platform), version number 1.2607.840.0. They are special:No release instructions, no user confirmation, silent installation, no independent uninstall.
26 What H2 brings: several practical changes
AI aside, Windows 11 26 H2 itself has several improvements that users have long been calling for:
| function | Notes | real value |
|---|---|---|
| Taskbar position adjustable | You can move the taskbar to the top of the screen or to the left or right (features that have been removed since Windows 11 release are finally returning) | Multi-screen and vertical screen users benefit significantly; people who connect to the hairtail screen or vertical secondary screen finally don't have to be awkward |
| natural language search | File Explorer supports natural language queries such as "Zhang sent my quote last week", which are handled locally by NPU | It is really useful for positions with a large amount of documents (sales, administration, legal affairs); but relying on NPU, the old machine cannot be used. |
| NPU Native AI Capability Expansion | Real-time subtitles, call noise reduction, image enhancement, Studio Effects and other functions are fully decentralized to NPU execution | Power consumption is greatly reduced (NPU execution saves 65-80% more power than GPU), and laptop life benefits |
| Settings Interface Reconstruction | More Control Panel items migrate to modern settings apps | Simplified for regular users, cumbersome for enterprise scripting and automation (old path and control panel items removed) |
The improvements themselves are fine. The problem is that they are bundled with AI models, which are partially opaque.
Silent AI Update: Technical Details and Threshold
Details of KB5124890 and KB5124888:
- applicable conditions: Only available on Copilot+ PC (NPU computing power ≥40 TOPS) and the system version is Windows 11 26H1 and above. Ordinary PCs will not receive it at all and cannot install it.
- contentPhi Silica model for Qualcomm platform (Microsoft is an end-side optimized language model responsible for natural language search, text understanding, summarization, etc.); image processing model for AMD platform (responsible for Studio Effects, image enhancement, super-segmentation, etc.).
- version number: 1.2607.840.0, belongs to the "AI component version" and is independent of the Windows system version number.
- push mode: Delivered silently through Windows Update, no user interaction prompt, no release instructions after installation, no entry into the general list of "update history"(you need to go to the specific component page to see).
- roll-back: Separate uninstall is not supported. The problem can only be resolved by a system restore point or by rolling back the entire Windows Update.
Why is this a problem for businesses?Three specific risks:
- Change management is not possible.Formal enterprise IT processes require that all system changes be documented, evaluated, and rolled back. A model update without release instructions cannot be evaluated by IT departments as affecting business software (e.g., an industry software that relies on OCR or image processing, and the model change may change the recognition results).
- You can't predict behavior changes.A model update means that the output of AI features may change. The ranking of results for natural language search, the effect of image enhancement, and the accuracy of caption recognition may all change after a silent update. For ordinary users, it is "Hey, it seems different". For business processes that rely on these features, it is an accident.
- Compliance and audit difficulties.Financial, medical, government and other regulated industries need to prove that the system state can be traced. A model update with unclear content and no time can be explained during audit.
Enterprise IT Response: Five Layers of Governance
The good news is that these changes can be managed, the bad news is that they need to be configured in advance, and remediation is passive afterwards.
1. Taking over update approval with WSUS/SCCM
This is the most fundamental layer. Point the Windows Update of all terminals to the WSUS server (or use MECM/Intune) inside the enterprise. All updates (including AI component updates) must be approved by the administrator before being distributed. Configuration path: Group Policy → Computer Configuration → Administrative Templates → Windows Components → Windows Update → Manage updates provided from Windows Update → Specify the location of intranet Microsoft update service.
Key points:Verify that all categories are checked in WSUS Product Categories and Update CategoriesEarlier versions of WSUS do not support the classification of such AI component updates perfectly, and WSUS itself needs to be updated to the latest version.
2. Group Policy turns off specific AI features
If AI functions are not needed (many enterprises 'production environments are not used at all), they can be turned off directly to eliminate risks from the source:
| strategic path | effect |
|---|---|
| Computer Configuration → Manage Templates → Windows Components → Windows Copilot → Close Windows Copilot | Disable Copilot sidebar |
| Computer Configuration → Manage Templates → Windows AI → Turn off AI Model Automatic Update | Prevent silent model push (26H2 new policy item) |
| User Configuration → Manage Templates → Start Menu and Taskbar → Close Search Highlights/Natural Language Search | Disable related UI and background indexing |
| Computer Configuration → Manage Templates → Windows Components → Camera → Turn off Windows Studio Effects | Disable AI image processing for video calls |
Note: Some policies only take effect on the professional/enterprise version, and the home version cannot be controlled by group policies. All enterprise procurement terminals choose the professional version, and this price difference (about RMB 300–500/set) cannot be saved.
3. Grayscale in batches, don't upgrade all of them synchronously
Divide the terminal into three rings: IT department test machine (1-2 sets) → pilot group (5-10 sets, select non-key positions in different departments) → all staff. Each ring interval is 2-4 Zhou, observe whether the business software is normal. Especially, industry software (medical imaging, financial bill recognition, CAD plug-in) that relies on system-level OCR, voice, and image processing must be measured.
4. Establish AI function usage specifications
In addition to technical control, there should also be system control: clearly define which data cannot be input into AI function (customer personal information, quote cost, unpublished drawings), Recall (review function, screen capture record user operation) must be disabled in confidential positions, and the index range of natural language search should exclude sensitive directories. These are not technical problems, but management problems, but IT departments must take the lead in writing them into the system.
5. NPU capability of asset ledger annotation
After 2026, the terminal asset ledger will add an additional column of "NPU computing power" because it determines whether the machine will receive AI updates, whether it can use AI functions, and whether it needs to be replaced in the next three years. Older machines without NPU (the vast majority of pre-2024 devices) will not receive these updates, but will gradually lose support for the new system-this is another account, see Windows 10 End of Support.
Simplified advice for individual users
- If your computer is Copilot+ PC (Snapdragon X, Core Ultra 200V/300, Ryzen AI 300 models after 2024), these AI functions are turned on by default, and if you feel that they are easy to use, you can keep them. If you feel redundant, you can turn them off in Settings → Privacy and Security.
- Unneeded features are recommended to be turned off, especially Recall and Search Indexing, which continue to consume disk and CPU resources and may record things you don't want to be recorded.
- Older computers (no NPU) are completely unaffected and won't receive these updates, so don't worry about "will my computer be secretly loaded with AI?"
ACCPC provides enterprise IT outsourcing and operation and maintenance services: WSUS/domain control deployment and update policy configuration, group policy batch distribution, terminal asset account establishment, Windows version upgrade evaluation and gray level implementation, AI function compliance control scheme design. Guangzhou on-site, monthly/annual service fee (RMB 1500–3000/month for small and micro enterprises with less than 20 people, including unlimited remote support and on-site inspection once a month). Also do Windows 11 Professional batch licensing and brand machine procurement. Telephone 020-39029800.