Key Takeaways
- KB5079489, released March 26, 2026, targets Windows 11 version 26H1 only (OS Build 28000.1764), not 24H2 or any earlier release
- Built-in System Monitor (Sysmon) ships natively for the first time, disabled by default, eliminating the long-standing dependency on Sysinternals
- A network speed test lives directly in the taskbar Quick Settings panel, reachable without opening a separate app or browser tab manually
- File Explorer picks up Extract All support for non-ZIP archives and a reliable Shift-click new-window behavior, two frequently requested fixes
Microsoft released KB5079489 on March 26, 2026, as an optional, non-security preview cumulative update for Windows 11 version 26H1. Preview status means it won’t install automatically; you have to select it manually under Optional updates in Windows Update. What makes this release worth paying attention to isn’t the update mechanics. It’s the feature set, which skips the usual list of minor reliability tweaks and lands two tools that power users and IT professionals have been requesting for years.
Built-in Sysmon: What It Does and Why It Matters
For over a decade, Windows administrators who needed event-level system monitoring had one real option: download Sysmon from Sysinternals, maintain a separate binary, and keep it updated independently. KB5079489 ends that on 26H1 builds by shipping native System Monitor functionality directly inside the OS.
The native implementation logs process creation, network connections, file creation, and driver loads into the standard Windows Event Log. Security tools already reading from Event Log can ingest these events without additional configuration or a separate data pipeline. The feature is disabled by default, reflecting a deliberate choice not to activate OS-level monitoring on consumer machines without user action.
Enable it through Settings under Optional Features, or via DISM from an elevated command prompt. Critically, anyone already running the Sysinternals version must uninstall it before enabling the native option. Running both simultaneously produces duplicate event entries that can break SIEM correlation rules in ways that aren’t immediately obvious from the event viewer interface.
Most reviewers are treating this as a footnote. It isn’t. For smaller IT teams managing hybrid fleets without a full EDR budget, a native, OS-integrated System Monitor removes one more unsigned third-party binary from the attack surface entirely.
Taskbar Speed Test: Faster Access to Network Diagnostics
Troubleshooting a slow connection used to mean opening a browser, navigating to a speed test site, and waiting for results. KB5079489 cuts that path significantly by placing a network speed test directly in the taskbar Quick Settings panel, also accessible by right-clicking the network icon in the system tray.
The tool measures Ethernet, Wi-Fi, and cellular connections and runs inside your default browser. Because it routes through a browser instance rather than measuring at the socket level, results will reflect browser launch overhead alongside actual network throughput. For a quick “is my connection the problem?” check during a call or download issue, it works exactly as intended.
File Explorer Fixes That Close Long-Standing Gaps
Extract All on Non-ZIP Archives
Previously, right-clicking a .tar, .gz, or .7z file in File Explorer produced no native extraction option in the command bar. KB5079489 adds an “Extract all” button on the command bar when browsing non-ZIP archive folders. Users who relied on 7-Zip or WinRAR purely for this function may find they no longer need a third-party tool for basic extraction tasks.
Reliable New Window Behavior
Holding Shift and clicking the File Explorer taskbar icon now consistently opens a second, independent window. Earlier builds produced inconsistent behavior, especially on multi-monitor setups, where the action sometimes surfaced the existing window instead of launching a new one.
Network Page Device Discovery
Network devices now populate the Network section in File Explorer more reliably, according to Microsoft’s changelog. The specific fix targets detection consistency, though Microsoft hasn’t disclosed whether the root cause was a DNS-SD timing issue or an SMB browser protocol change.
Additional Changes Confirmed in the Changelog
Several smaller but meaningful fixes shipped alongside the headline features:
- Taskbar overflow in uncombined mode: Only windows that genuinely don’t fit the taskbar now move to the overflow area, preventing large unused gaps from appearing
- WebP desktop backgrounds: WebP images can now be set as wallpaper directly from Settings or by right-clicking the file in File Explorer, without conversion software
- Camera pan and tilt controls: Supported hardware now exposes pan and tilt adjustment under Bluetooth & devices in Settings
- Search result counts: Taskbar search group headers now display how many results exist within each category
- High-volume printing: The print spooler handles sustained, high-volume print jobs more smoothly, reducing slowdowns during extended runs
- Faster sleep resume: Sleep resume times have been improved so the PC wakes faster after sitting idle, per Microsoft’s changelog
- Display stability post-sleep: Flicker artifacts when resuming with an external monitor connected have been addressed
How to Install KB5079489
Three installation paths exist depending on your environment:
- Windows Update: Settings > Windows Update > Check for updates. KB5079489 appears under “Optional updates” on 26H1 builds. It does not install automatically.
- Microsoft Update Catalog: Download the MSU package directly. The companion servicing stack update KB5085536 (Build 28000.1763) must be installed first on offline or fresh images.
- DISM (enterprise/offline): Place all MSU files in a single directory and run:
Dism.exe /Online /Add-Package /PackagePath:C:\Packages\KB5079489.msu. Install the SSU before the LCU.
To uninstall: open Settings > Windows Update > Update history > Uninstall updates and select KB5079489. Note that the servicing stack update (KB5085536) cannot be uninstalled after it has been applied.
Windows 11 KB5079473: What the March 2026 Patch Tuesday Update Actually Changes on Your PC
Considerations
Native Sysmon ships disabled, which is the right default for consumer privacy, but it creates an unresolved gap for managed deployments: Microsoft has not provided an automated migration path for teams moving from Sysinternals to the native version. Admins using GPO to enable the feature on domain-joined machines need to manually confirm the Sysinternals version is fully removed first.
The taskbar speed test routes through a browser, not a raw socket, meaning results absorb browser-launch latency. It is not a substitute for precision network benchmarking tools like iPerf3. And KB5079489 applies exclusively to Windows 11 version 26H1. Users on 24H2 or earlier will not see this update listed in Windows Update at all.
