administrators Archives

Winsage

June 25, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update to eligible Windows 11 and Windows 10 PCs ahead of the expiration of the Microsoft Corporation KEK CA 2011 on June 24, 2026. This update enhances device targeting data for automatic Secure Boot certificate updates. Secure Boot is a firmware-level security feature that verifies digital signatures of boot components to prevent rootkits and bootkits. The certificates for Secure Boot were first issued in 2011, with subsequent expirations for related certificates occurring in June and October 2026. Users can check their Secure Boot certificate status through the Windows Security app or System Information. If a PC does not receive the update, it will still boot normally but will lose the ability to receive future boot-level security updates. Multiple restarts after updates are expected due to the Secure Boot certificate process. A new folder, C:WindowsSecureBoot, is not malware but is used for staging cryptographic certificate files. Windows 10 users enrolled in the Extended Security Updates program will also receive the Secure Boot update, while those not enrolled will not. The expiration of the KEK CA 2011 means Microsoft will not be able to sign new Secure Boot revocation payloads using the old key, but existing signed payloads will remain functional.

Winsage

June 24, 2026

Point-in-Time Restore for Windows 11 is Generally Available

Microsoft has rolled out the Point-in-time restore feature for Windows 11, enhancing recovery capabilities. Users need to install the June Week D preview update to access it, and the rollout is a Controlled Feature Release (CFR), meaning availability will vary by device. This feature is available in Windows 11 Enterprise, Pro, and Home editions, allowing users to revert systems to a prior state quickly. It offers automatic restore points, improved reliability, integrated management through the Settings app, lower storage impact, and future remote management capabilities via Intune. For Windows 11 Home and Pro users, Point-in-time restore is enabled by default in versions 24H2 and 25H2, and can be managed in the Settings app under System > Recovery > Point-in-time restore.

Winsage

June 24, 2026

Windows 11 Adds Point‑in‑Time Restore for System Recovery

Point-in-time restore is a new feature for Windows 11 that allows administrators to revert systems to a previous stable state, streamlining recovery from issues like problematic updates or software conflicts. It automatically generates restore points every 24 hours, retaining them for up to 72 hours and using a maximum of 2 percent of disk space. This feature is available on Windows 11 version 24H2 and later across all editions, including Enterprise, Pro, and Home. Administrators can initiate the restore process through the Windows Recovery Environment (Windows RE) by selecting a restore point. Future enhancements will include remote restore capabilities through Microsoft Intune.

Winsage

June 24, 2026

Windows 11 Secure Boot update released to all, hours ahead of expiry

Microsoft has begun rolling out the Secure Boot 2023 certificate update for eligible Windows 11 and Windows 10 PCs ahead of the expiration of the original certificates on June 24, 2026. The update includes additional device targeting data to increase coverage for automatic updates. Devices receive the new certificates after demonstrating successful update signals. The original Secure Boot certificates were issued in 2011, with expiration dates set for June 24, 2026, June 27, 2026, and October 19, 2026. Microsoft has been distributing replacement 2023 certificates since 2024, with the June 2026 update expanding eligible devices significantly. Users can check their Secure Boot status through the Windows Security app or System Information. If a PC did not receive the update, it will still function normally but may not receive future boot-level security updates. Multiple restarts after updates are expected behavior, and the SecureBoot folder in Windows is not malware. Windows 10 users in the Extended Security Updates program are also receiving the Secure Boot update. The expiration of the Microsoft Corporation KEK CA 2011 on June 24 means no new Secure Boot revocation payloads can be signed with the old key, but existing signed payloads will continue to function.

Winsage

June 23, 2026

In 2011, Microsoft signed the Secure Boot certificates that still sit inside millions of Windows PCs, and the first one expires on June 24, 2026, leaving unupdated machines running normally while future boot-level revocations stop reaching them

Microsoft's Secure Boot certificates, including the Microsoft Corporation KEK CA 2011, will expire on June 24, 2026, followed by the Microsoft UEFI CA 2011 on June 27 and the Microsoft Windows Production PCA 2011 on October 19. New certificates issued in 2023 will replace these older ones. While devices will continue to operate and receive standard Windows updates, they will gradually lose access to critical security updates that protect against boot-level threats. After June 24, the ability to sign new disallowed signature database payloads with the old KEK will be lost, reducing the capacity to revoke compromised bootloaders. Users are advised to keep Windows and firmware updates current, while enterprises may face challenges managing diverse machine inventories for updates.

Winsage

June 22, 2026

Windows 11 version 26H2: Microsoft details rollout strategy

Microsoft is enhancing its enterprise offerings with Microsoft Intune, a cloud-based service for managing mobile devices and applications. Intune allows IT administrators to control device usage, ensuring compliance with corporate policies, securing sensitive data through application management, and providing employees with flexible access to corporate resources from personal devices. Additionally, Microsoft promotes Microsoft Learn, an educational platform to help users understand Intune and other services.

Winsage

June 22, 2026

Microsoft Urges IT Admins to Prepare for Windows 11 Version 26H2 Rollout

Microsoft is preparing for the release of Windows 11 version 26H2, which aims to streamline the upgrade process for organizations. This version will be available for testing through the Windows Insider Program and utilizes a compact enablement package for a quicker transition from supported versions like 24H2 and 25H2. Devices on Windows 11 version 26H1 will not be able to upgrade to 26H2, as it is based on a different core. Upgrading to version 26H2 resets the support lifecycle, providing 24 months of support for consumer and standard business editions and 36 months for enterprise and education editions. Organizations are encouraged to test the update for compatibility and use deployment tools for a phased rollout.

Winsage

June 22, 2026

Microsoft says it’ll force install Microsoft 365 Copilot on Windows 11 with MS 365 Business in the next 30 days

Microsoft is reintroducing the Microsoft 365 Copilot app, which will automatically install on eligible Windows PCs with Microsoft 365 desktop applications between mid-June and mid-July. Users in the European Economic Area will not be affected by this automatic installation. Admins can opt out of the automatic integration. The app will be activated by default, requiring no user intervention. Microsoft is not using the Windows Store for this installation; instead, it relies on the built-in Microsoft 365 Apps updater. Users can disable Copilot features on a case-by-case basis in specific Office apps or change privacy settings to block Copilot functionalities. Microsoft has also made Classic plans available in select regions for users who want a version without Copilot. Administrators can use Office policy settings to block connected experiences that drive Copilot functionalities but must opt out through the Microsoft 365 Apps admin center to prevent installation.

Winsage

June 22, 2026

Microsoft Auto-Installs Microsoft 365 Copilot on Windows

Microsoft has recommenced the automatic installation of the Microsoft 365 Copilot application on eligible commercial Windows devices as of June 2026. The rollout targets devices running Windows 10 (22H2 or later) and Windows 11 with existing Microsoft 365 desktop applications, focusing initially on tenants with Copilot add-on licenses, expected to conclude by late July 2026. Enterprise administrators can manage this installation through a policy titled 'Disable Microsoft 365 Copilot auto-install,' introduced in May 2026. Users can manually uninstall the app, which will not be reinstalled for 90 days if removed. The rollout will not affect the European Economic Area due to exemptions under the Digital Markets Act. This resumption follows a previous halt in March 2026 due to a configuration error and backlash from users regarding the original rollout plan set for October 2025.

Winsage

June 21, 2026

Microsoft reveals how to verify Windows 11’s Secure Boot update, what to do if your PC missed it

The expiration of Microsoft's Secure Boot 2011 certificates on June 24 will not prevent older Windows PCs from booting, as confirmed by Microsoft. Devices will continue to operate normally, but they will miss future boot-level security updates, including updates to the Windows Boot Manager and mitigations for newly identified vulnerabilities. The ability to receive the Secure Boot 2023 update depends on the device firmware's compatibility, with many manufacturers, including Dell, HP, Lenovo, and ASUS, having cutoffs for BIOS updates based on the device's End of Service Life. Older PCs using Legacy BIOS or Compatibility Support Module (CSM) mode do not utilize UEFI Secure Boot, making the update irrelevant. Users running Windows 11 on unsupported hardware may have Secure Boot disabled or improperly configured. Without the 2023 certificates, devices cannot receive future revocation updates to the Secure Boot DBX, which lists compromised bootloaders. Users on Windows 10 with supported OEMs may receive the update if a compatible BIOS is available, while those on older PCs without updates can continue using their devices but will lack future security updates. The Secure Boot status can be checked through the Windows Security app, with color-coded badges indicating the status of the certificates.