"This update accelerates app launch and core shell experiences such as Start menu, Search, and Action Center," Microsoft said in a Tuesday support document.
What KB5089573 is and how Microsoft is rolling it out
KB5089573 is the May 2026 preview cumulative update for Windows 11 versions 25H2 and 24H2. It is part of Microsoft's non-security preview schedule that ships at the end of each month so IT teams and users can test changes ahead of the following month's Patch Tuesday. The preview contains 30 changes and is optional; unlike regular Patch Tuesday cumulative updates, these monthly preview updates do not include security fixes.
Sign-in changes: Windows Hello becomes the default
The update makes a notable change to sign‑in behavior. When Windows Hello face or fingerprint is configured and available, it becomes the default sign‑in method every time you sign in, even if a different method was used previously. If a user prefers the Windows PIN and enters it three times in a row, the OS will continue to use the PIN until the user switches to another sign‑in method. Microsoft also says the update improves sign‑in behavior on both the lock screen and the sign‑in screen, and it reduces the number of unexpected blocks during Windows Hello Enhanced Sign‑in Security authentication.
Shell, search, Task Manager and standby: targeted performance fixes
Microsoft highlights a set of general OS performance upgrades in KB5089573: app launch and core shell experiences such as Start menu, Search, and Action Center should be faster after installation. The update also targets reliability problems in File Explorer, on sign‑in and lock screens, when changing themes in Settings, and when using touch gestures on touchscreen devices. For virtual machines, Task Manager's Performance page will no longer show higher‑than‑expected CPU speed numbers after resuming from hibernation. The update additionally improves performance when resuming from Modern Standby.
Sensors, HID and battery: power hygiene improvements
Several of the 30 changes address power consumption and device resilience. The update improves resiliency against apps that could keep the sensor hub powered on and drain battery life. It also improves Human Interface Device (HID) and input stack battery life for failed HID devices and tightens power hygiene against applications that might initiate HID transfers during standby.
Secure Boot certificate refresh and build numbers
Microsoft notes that Windows quality updates now include additional high‑confidence device targeting data to increase coverage of devices eligible to automatically receive new Secure Boot certificates. Devices will receive the new certificates only after demonstrating sufficient successful update signals, maintaining a controlled, phased rollout. The company also reminded users that updated Secure Boot certificates are rolling out to replace original 2011 certificates set to expire in late June. Microsoft first revealed plans to refresh expiring Secure Boot certificates in January and had warned users and IT admins in November 2025 to update security certificates before they expire.
Once installed, KB5089573 upgrades Windows 11 25H2 devices to build 26200.8524 and 24H2 devices to build 26100.8524.
What IT admins, end users, and enterprises should watch
- IT admins: Because this is an optional preview update that does not include security fixes, administrators can use KB5089573 for targeted testing ahead of Patch Tuesday rollouts. Microsoft provides installation via the Microsoft Update Catalog or through Settings → Windows Update → Check for Updates; optional updates require clicking "Download and install" unless the "Get the latest updates as soon as they're available" option is enabled, which prompts automatic installation. Admins should also note Microsoft's confirmation of a known issue affecting Windows Server 2016: domain controller lookup failures after installing the KB5087537 May 2026 security update.
- End users: Consumers who want the described performance and sign‑in improvements can install KB5089573 manually or enable the option to receive updates automatically. Remember that preview updates are optional and do not replace security updates.
- Enterprises and device managers: The phased Secure Boot certificate rollout means devices will receive replacements only after showing sufficient successful update signals; device targeting in quality updates has been expanded to support this. Enterprises with many device models should monitor certificate rollout signals and any related device eligibility changes ahead of the 2011 certificates' late‑June expiry.
KB5089573 bundles a mix of responsiveness fixes, sign‑in refinements and power‑management adjustments intended for testing before broader distribution. For organizations balancing stability, security and feature testing, the update is an option to validate these targeted fixes now rather than waiting for the next Patch Tuesday deployment.
