New Windows 11 Build 25951 – New 23H2 Apps and New Lock Screen Design (Canary)

In this article, we will talk about the latest Windows 11 Insider Preview Build for the Canary Channel, which is Build 25951.

SMB NTLM Blocking

Starting with this build (Build 25951), the SMB client now supports blocking NTLM for remote outbound connections. This changes legacy behavior, where Windows SPNEGO would negotiate Kerberos, NTLM, and other mechanisms with the destination server to decide on a supported security package. NTLM in this case refers to all versions of the LAN Manager security package: LM, NTLM, and NTLMv2.

With this new option, an administrator can intentionally block Windows from offering NTLM via SMB. An attacker who tricks a user or application into sending NTLM challenge responses to a malicious server will no longer receive any NTLM data and cannot brute force, crack, or pass a password, as they will never be sent over the network. This adds a new level of protection for enterprises without a requirement to entirely disable NTLM usage in the OS. You can configure this option with Group Policy and PowerShell. You can also block the use of NTLM in SMB connections on demand with NET USE and PowerShell.

For more information on configuring and troubleshooting NTLM blocking, review https://aka.ms/SmbNtlmBlock.

SMB Dialect Management

Starting with this build (Build 25951), the SMB server now supports controlling which SMB 2 and 3 dialects it will negotiate. This changes legacy behavior, where Windows SMB always negotiated the highest matched server dialect from SMB 2.0.2 to 3.1.1 clients. Beginning in Windows 10, support was added for controlling SMB client dialects, but not server dialects.

With this new option, an administrator can remove older SMB protocols from usage in the organization, blocking older, less secure, and less capable Windows devices and third parties from connecting.

You can configure this option with Group Policy and PowerShell. Both SMB client and server now include complete management support (previously the client support was only manual registry editing).

For more information on understanding and configuring SMB dialects, review https://aka.ms/SmbDialectManage.

New Lock Screen Design

• We’ve adjusted the network flyout on the Lock screen to better match the UI of the network flyout from quick settings in system tray on the taskbar.

New 23H2 Apps

Microsoft is Updating the Photos Apps, Snipping Tool, and Phone Link in the Canary and Dev Channels. More info about those soon.

Known Issues

• Some popular games may not work correctly on the most recent Insider Preview builds in the Canary Channel. Please be sure to submit feedback in Feedback Hub on any issues you see with playing games on these builds.
• [NEW] We’re investigating reports that the print queue is no longer accessible.

For more information about this Build, you can check this article from the Microsoft Blog.

For a more in-depth presentation, you can watch the video below from the YouTube channel.