Windows 11 build 25267 (rs wdatp edr)

Windows 11 build 25267 (rs_wdatp_edr) is an internal build of Zinc, which was released to Microsoft Collaborate partners participating in the Microsoft Defender for Endpoint program on 18 December 2022. The build was leaked on 26 March 2023 in the form of a bootable Hyper-V Generation 1 virtual hard disk image, nearly two years since the leak of build 21996, which was the previous occasion from when an internal build from an ongoing milestone had been disclosed to the public.

As the build itself comes from a development branch intended for Windows Defender's Advanced Threat Protection functionalities, it notably includes several features that were either not included by default in public branches until their public rollout later in development or are reserved for internal Microsoft use, including an internal "Experimental Features" drop-down menu included as part of the Settings application.

File Explorer
Access key shortcuts have been added to File Explorer's XAML-based context menu. It can be enabled by turning on Velocity staging key.

Windows Spotlight
The new UI, initially implemented in build 25197 and later removed in build 25206, has been re-implemented with multiple refined visuals. This feature is only available in the English (United States) language, and can be toggled on manually by enabling Velocity staging keys  and   (with the   parameter set to 0, 1 or 3 for multiple visuals).

Settings

 * An internal Experimental Features drop-down menu, intended for turning on various Velocity staging keys that are not normally available to Insiders, is included by default. It can be enabled by turning on Velocity staging key.
 * A new page that lists down changes made within the current build has been implemented. It can be enabled by turning on Velocity staging key.
 * The Graphics section found within the System > Display page has been redesigned in order to align with the Fluent design system included as part of Windows 11. It can be enabled by turning on Velocity staging key.

Miscellaneous

 * A native Win32 port of the DTrace diagnostics framework has been implemented. The framework was originally ported from FreeBSD during development of the Windows 10 May 2019 Update.
 * Support for the UnionFS virtual filesystem service has been added.