Active Directory Archives

Winsage

September 24, 2026

Windows 11 Pro is now only $10

Windows 11 Pro includes advanced features such as BitLocker for full disk encryption, Hyper-V and Windows Sandbox for running virtual machines, and integration with Azure Active Directory for business connectivity. It also offers Snap layouts for multitasking, DirectX 12 Ultimate for gaming, biometric login options with TPM 2.0 for enhanced security, and a Copilot feature for productivity assistance. A lifetime license for Windows 11 Pro is available for .97 until October 4.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 18, 2026

Windows 11 Update Can Break Active Directory Trust Relationships

A recent security update from Microsoft, KB5124008, has caused disruptions for organizations using on-premises Active Directory, particularly affecting domain-joined Windows 11 devices with Credential Guard. After installing this update, some devices lost their secure trust relationship with the domain, preventing users from logging in with valid credentials. The issue is linked to Machine Identity Isolation, a security feature that enhances machine account credential protection but requires domain controllers to operate at the Windows Server 2025 Domain Functional Level. Organizations that enabled this feature without meeting the prerequisite may experience trust relationship failures. Microsoft has suggested a workaround to disable Machine Identity Isolation and plans to suspend its enforcement in an upcoming update while improvements are made.

Winsage

September 17, 2026

Microsoft patch gives domain-joined Windows PCs trust issues

Microsoft acknowledged a significant issue affecting Windows 11 versions 24H2, 25H2, and 26H1 related to Active Directory domain logins as of September 16. This issue stems from changes made to Machine Identity Isolation in the September 2026 security update (KB5124008), which may cause Credential Guard-protected machine accounts to lose their secure channel with an on-premises Active Directory domain, preventing users from signing in with valid domain credentials. The update activates Machine Identity Isolation but does not enforce it immediately, and it is only compatible with environments linked to domain controllers operating at the Windows Server 2025 Domain Functional Level (DFL) or higher. Microsoft advised that devices not connected to Windows Server 2025 domain controllers will need to disable Machine Identity Isolation. A workaround involves disabling the feature through Intune, Group Policy, or the Windows Registry, followed by a device restart and repairing the secure channel using the Test-ComputerSecureChannel PowerShell command. Microsoft plans to address this issue in a future update by temporarily halting Machine Identity Isolation enforcement while enhancements are made.

Winsage

August 23, 2026

Missing Link: 30 Years of Windows NT 4

Windows NT 4.0 was released in August 1996, marking a significant shift in the PC industry from 16-bit DOS to 32-bit operating systems. It combined the stability of the NT architecture with the user-friendly interface of Windows 95, featuring a familiar Start menu and a robust 32-bit kernel. NT 4.0 was available in both workstation and server variants, allowing Microsoft to compete with UNIX workstations and Novell NetWare in the network operating system market. It laid the groundwork for future operating systems, including Windows 2000 and Windows XP, by enabling a unified management interface for servers and workstations. At the time, PCs typically had at least 8 MB of memory, and installation required booting from a floppy disk with files sourced from a CD.

Winsage

July 31, 2026

Windows NT 4.0 brought the Win95 UI to servers 30 years ago today — milestone unifying modern Windows OS hi…

On July 31, 1996, Microsoft unveiled Windows NT 4.0 to its manufacturing partners. This release, codenamed Cairo, integrated the Windows 95 interface into a 32-bit enterprise OS and was the last version to support Alpha, MIPS, or PowerPC CPU architectures. The first public release of the NT line was Windows NT Server 3.1 in 1993, followed by versions 3.5 and 3.51 in 1994 and 1995, respectively. Windows NT 4.0 introduced features like My Computer and My Documents, as well as advanced components such as the cryptography API, DCOM, TAPI 2.0, and DirectX (v2). It had low minimum system requirements, recommending a CPU of 33 MHz or better, 32MB of RAM, SVGA graphics, and a 256 MB hard disk. NT 4.0 served as the foundation for Windows XP, which was released in 2001.

Winsage

July 31, 2026

Windows NT 4.0 brought the Win95 UI to servers 30 years ago today — milestone unifying modern Windows OS hit RTM in the Pentium era

On July 31, 1996, Microsoft released Windows NT 4.0, codenamed Cairo, which integrated the Windows 95 interface into a 32-bit enterprise operating system. It was the last version to support multiple CPU architectures, including Alpha, MIPS, and PowerPC. Windows NT 4.0 included features such as the Start Menu, Taskbar, Task Manager, and support for advanced functionalities like the cryptography API and DirectX (v2). The minimum hardware requirements were a CPU of 33 MHz or better, 32MB of RAM, SVGA graphics, and a 256 MB hard disk. Following its launch, Microsoft introduced versions for embedded systems and a Terminal Server edition. The release of Windows XP in 2001 marked a shift away from DOS-based consumer operating systems.

Winsage

July 31, 2026

Microsoft Ended Windows 10 Support, but You Don’t Necessarily Need a New PC

On October 14, 2025, Microsoft ceased support for Windows 10, which means it will no longer receive technical assistance, feature updates, or security patches. Microsoft has introduced the Extended Security Updates (ESU) program, which has been extended to October 2027, allowing users to continue receiving essential security updates if their device meets specific criteria. Eligibility for ESU includes running Windows 10, version 22H2 Home, Professional, Pro Education, or Workstations edition, having the latest Windows update installed, being signed in with an administrator Microsoft account, and enabling Windows Backup. ESU is free for users utilizing Windows Backup; otherwise, a one-time fee or redeeming 1,000 Microsoft Rewards points is required. For devices not qualifying for ESU, alternatives include installing third-party antivirus software, upgrading to Windows 11, or switching to Linux. To enroll in ESU, users can navigate to Settings > Update & Security > Windows Update, where an Enroll Now link will appear if eligible.

Winsage

July 28, 2026

Proof-of-concept exploit released for Certighost Windows AD CS vulnerability

A proof-of-concept exploit for a vulnerability in Windows Active Directory Certificate Services (AD CS), identified as CVE-2026-54121, has emerged, allowing authenticated attackers to compromise an entire Windows domain. Microsoft addressed this vulnerability in its July 2026 security updates. The flaw enables attackers to manipulate machine account attributes, obtaining certificates to impersonate critical domain controllers and execute privileged Active Directory operations. Researchers H0j3n and Aniq Fakhrul discovered the vulnerability and publicly disclosed it with a functional exploit that exploits a fallback mechanism in AD CS. This exploit can automate the extraction of sensitive credentials through a DCSync attack. Microsoft has since implemented additional validation measures to enhance security against this vulnerability.