Microsoft’s KB5127936 (October 28, 2026 preview; builds 26300.9818 / 26200.9818 for Windows 11 26H2 / 25H2) lists a gradual-rollout [Data Protection API (DPAPI)] item: a warning before prompt-based protect and unprotect operations.
Per the KB, the warning explains that this prompt-based experience will be retired in April 2027. If you or an app use these prompts: stop creating new prompt-protected data; use a supported non-interactive protection flow; decrypt or migrate existing prompt-protected data before retirement. DPAPI operations that do not use the prompt-based flow are not affected. For more details, Microsoft points to the CRYPTPROTECT_PROMPTSTRUCT structure (dpapi.h).
The same KB notes that Windows 11 24H2 no longer receives non-security preview updates starting with the October 2026 release — so this preview track is about 25H2 / 26H2. Optional path: Settings > Windows Update > Advanced options > Optional updates. Gradual rollout means the change does not arrive on every device at once even after the package is installed.
No invented migration steps beyond the KB, no scare mongering: this is a documented warning and a retirement date for the prompt-based flow. This topic is not a second BitLocker PIN / TPM article (lot19), nor Memory Integrity (lot22), nor SAC. On a managed PC, ask IT before installing an optional preview.
Confirmed points
- Gradual-rollout [Data Protection API (DPAPI)] item on KB5127936
- Warning before prompt-based protect / unprotect
- Prompt-based experience to be retired in April 2027
- KB guidance: stop new prompt-protected data; supported non-interactive flow; decrypt / migrate existing data before retirement
- DPAPI operations that do not use the prompt-based flow are unaffected
- Microsoft pointer: CRYPTPROTECT_PROMPTSTRUCT (
dpapi.h) - Non-security preview dated 28 October 2026 for Windows 11 25H2 and 26H2
- 24H2 no longer gets non-security preview updates from the October 2026 release
Sources
- Microsoft — KB5127936 Preview (DPAPI prompt-based warning; builds 26300.9818 / 26200.9818)
- Microsoft Learn — CRYPTPROTECT_PROMPTSTRUCT structure (dpapi.h)
Question: after KB5127936 (or an equivalent preview), have you already seen the new DPAPI warning before a prompt-based protect / unprotect — and which apps still use that prompt-based flow on your PCs?