- Windows 11 builds 28020.3532 (Beta) and 28120.3542 (Experimental) let users configure a BitLocker preboot PIN on managed devices without administrator privileges.
- The Experimental build introduces an optional redesigned Run dialog with updated visuals, a cleaner interface, and new Settings controls.
- The Beta build fixes a Remote Desktop connection issue caused by a certificate mismatch.
Microsoft is making available Windows 11 Insider Preview builds 28020.3532 and 28120.3542 for version 26H1 through the Beta and Experimental channels in the Windows Insider Program. These flights introduce a small set of improvements and fixes.
Windows 11 builds 28120.3542 (Experimental) and 28020.3532 (Beta) introduce a shared BitLocker improvement that allows standard users on managed devices to configure a preboot PIN without administrator privileges.
The Experimental release also introduces an optional redesigned Run dialog with updated visuals, a cleaner interface, and new controls available through Settings. Meanwhile, the Beta release fixes an issue that could cause Remote Desktop Protocol connections to fail because of a certificate mismatch.
Windows 11 26H1 is not a version for current devices. Microsoft has explicitly stated that version 26H1 is not an upgrade path for Windows 11 26H2 or earlier releases.
According to the company’s Microsoft Health Dashboard page, version 26H1 is a hardware-optimized release designed for next-generation silicon and will be available exclusively as a preinstalled experience on select new devices.
The company is referring to the new ARM64 PCs, starting with devices powered by the Snapdragon X2 Plus, Elite, and Extreme processors. If you own a computer running on Intel or AMD hardware, Windows 11 26H1 will not be offered to your system.
What’s new on Windows 11 build 28120.3542 (Experimental)
These are the new features and improvements rolling out in the Experimental channel.
Redesigned Run dialog
Windows 11 build 28120.3542 introduces a refreshed Run dialog with a more modern appearance, updated visuals, and a cleaner interface. The update also adds new controls that make it easier to manage the experience directly from Settings.
The redesigned Run dialog is an optional experience currently rolling out to Windows Insiders in the Experimental channel.
To enable it, open Settings > System > Advanced and turn on the new “Run dialog” option.
BitLocker allows standard users to configure a preboot PIN
Microsoft is improving BitLocker by letting standard users on managed devices configure a preboot PIN without administrator privileges.
Previously, users without administrative permissions couldn’t add the TPM+PIN protector themselves. With this change, standard users can set up the PIN when the appropriate device management policies are configured.
When the required policies apply to a device that doesn’t already have a preboot PIN, Windows displays a notification prompting the user to configure one. Selecting the notification opens a setup window where the user can enter and confirm the PIN.
To enable this functionality, administrators must configure the following existing BitLocker policies through Microsoft Intune or another device management solution:
- AllowStandardUserEncryption: ON
- AllowWarningForOtherDiskEncryption: OFF
- RequireDeviceEncryption: ON
- SystemDrivesRequireStartupAuthentication: ON
Microsoft warns administrators to target startup authentication and device encryption policies only to standard user test groups with this feature enabled in the Windows Insider Program.
Standard users without access to this feature cannot add the required TPM+PIN protector. As a result, device encryption can fail under this configuration. Devices already encrypted with TPM only can also report as non-compliant with the policy.
What’s new on Windows 11 build 28020.3532 (Beta)
These are the new features and improvements rolling out in the Beta channel.
BitLocker allows standard users to configure a preboot PIN
The Beta release also lets standard users on managed devices configure a BitLocker preboot PIN without administrator privileges.
When administrators configure the required BitLocker policies, Windows 11 notifies users without a PIN and prompts them to set one. Selecting the notification opens a setup window where users can enter and confirm their preboot PIN.
This change lets organizations enforce TPM+PIN protection while letting standard users complete setup themselves.
Remote Desktop fixes certificate mismatch issue
Microsoft is also addressing a problem affecting Remote Desktop connections.
In this release, build 28020.3532 fixes an issue that could cause Remote Desktop Protocol (RDP) connections to fail on the client because of a certificate mismatch after installing previous Insider builds.
Download Windows 11 update previews
To download and install these Windows 11 builds, enroll your device in the Experimental or Beta channels through the “Windows Insider Program” settings from the “Update & Security” section. Once you enroll the computer in the appropriate channel, you can download the build from the “Windows Update” settings by turning on the “Get the latest updates as soon as they’re available” option and clicking the “Check for Updates” button.
Mauro Huculak is a Windows How-To Expert and founder of Pureinfotech in 2010. With over 23 years as a technology writer and IT Specialist, Mauro specializes in Windows, software, and cross-platform systems such as Linux, Android, and macOS.
Certifications: Microsoft Certified Solutions Associate (MCSA), Cisco Certified Network Professional (CCNP), VMware Certified Professional (VCP), and CompTIA A+ and Network+.
Mauro is a recognized Microsoft MVP and has also been a long-time contributor to Windows Central.
You can follow him on YouTube, Threads, BlueSky, X (Twitter), LinkedIn and About.me. Email him at [email protected].
