Windows 11 build 25267 (rs_wdatp_edr)

10.0.25267.1001.rs_wdatp_edr.221212-0900
Build of Zinc
Screenshot
OS familyWindows 11 (NT 10.0)
Version number10.0
Build number25267
Build revision1001
ArchitectureAMD64
Build labrs_wdatp_edr
Compiled on2022-12-12
Expiration date
Timebomb2023-09-15 (+277 days)
SKUs
SE
Pro (Single Language, China)
Pro Education
Pro for Workstations
Education
Enterprise (multi-session)
IoT Enterprise
About dialog
25267-wdatp-winver.png

Windows 11 build 25267 (rs_wdatp_edr) is an internal build of Zinc, which was released to Microsoft Collaborate partners participating in the Microsoft Defender for Endpoint program on 17 December 2022. The build eventually leaked and was shared to the public on 26 March 2023 in the form of a bootable Hyper-V Generation 1 virtual hard disk image, nearly two years since the leak of Cobalt build 21996, which was the previous occasion from when an internal build from an ongoing milestone had been disclosed to the public.

As the build itself comes from a development branch intended for Microsoft Defender's Advanced Threat Protection functionalities, namely as it pertains to the built-in enterprise-specific Endpoint Detection and Response utilities,[1] it notably includes several features that were either not included by default in public branches until they were later rolled out to Windows Insiders or are reserved for internal Microsoft use, including an internal "Experimental Features" drop-down menu that is part of the Settings application.

New features and changes[edit | edit source]

Windows Spotlight[edit | edit source]

The new Windows Spotlight user interface, initially implemented in build 25197 and later removed in build 25206, has been re-implemented with multiple refined visuals. This feature is only available in the English (United States) language, and can be toggled on manually by enabling Velocity staging keys 39880030 and 40268500 (with the variant parameter set to 0, 1 or 3 for multiple visuals).

System-wide Dark Theme[edit | edit source]

A work in progress version of a System-wide Dark Theme has been added. It looks very incomplete with certain dialogs not having the dark theme and a few others like property sheets in File Explorer looking unfinished. This feature needs to be enabled manually by enabling Velocity staging key 26338762.

Settings[edit | edit source]

  • An internal Experimental Features drop-down menu, intended for turning on various Velocity staging keys that are not normally available to Insiders, is included by default. It can be enabled by turning on Velocity staging key 40062046.
  • The Graphics section found within the System > Display page has been redesigned in order to align with the Fluent design system included as part of Windows 11. It can be enabled by turning on Velocity staging key 31267642.
  • Two re-designed setting dialogs have been added for Enabling Remote Desktop and displaying the WiFi Network password. These can be enabled by enabling these Velocity Staging Keys 41457515, 40637063 and 36390579 .
  • A new page in Sound settings called Soundscapes, which replaces the older Sound properties dialog. This can be enabled by turning on Velocity Staging Key 40046693.

Miscellaneous[edit | edit source]

  • A native Win32 port of the DTrace diagnostics framework has been implemented. The framework was originally ported from FreeBSD during development of the Windows 10 May 2019 Update.[2]
  • Support for the UnionFS virtual filesystem service has been added.

Gallery[edit | edit source]

Windows Setup[edit | edit source]

Interface[edit | edit source]

Settings[edit | edit source]

References[edit | edit source]

  1. Raya, Thomas et al. Overview of endpoint detection and response, Microsoft Learn. 18 December 2020.
  2. Marshall, Don et al. DTrace on Windows, Microsoft Learn. 4 November 2019.