BitLocker Archives

Winsage

July 23, 2026

Windows 11 – The system restore that also includes your files

Since June 23, Microsoft has been implementing a point-in-time restore feature on Windows 11, which is enabled by default for Home and Pro editions when the system drive exceeds 200 GB. This feature captures a complete snapshot of the machine approximately every 24 hours using the Volume Shadow Copy service, including system, applications, settings, and local files. Users can revert to a previous state in case of issues, but restoring from a snapshot older than 48 hours will erase all changes made since then, except for OneDrive data. The feature retains snapshots for up to 72 hours and reserves 2% of drive space, capped at 50 GB. If free space drops below 20 GB, older snapshots are deleted. Restoration occurs locally through WinRE, and users need a BitLocker recovery key if the drive is encrypted. After a restore, the feature pauses and requires user consent to resume. Snapshots from upgraded editions are not accessible, and only the Enterprise edition allows adjustments to snapshot settings. The feature can be disabled in system settings. It is not a backup solution, and users are advised to maintain separate backups for important files.

Winsage

July 23, 2026

Microsoft making a new feature mandatory requirement for Windows KMS activation

Microsoft has introduced enhancements to its Windows operating system security, including an update to Entra ID authentication with default passkeys and AI-enhanced security updates. A key advancement is the KMS Hardware-Secured initiative, which uses Trusted Platform Module (TPM)-based attestation to ensure KMS hosts operate on trusted hardware for Windows volume activation. This aims to combat risks from counterfeit KMS servers. Under the new model, KMS hosts will confirm their hardware identity using TPM before activating Windows devices. Starting in August 2026, Windows Server 2025 will provide readiness messaging for KMS host compliance with new security requirements. TPM attestation will be mandatory for KMS Hardware-Secured activation with the upcoming Windows Server 2028 LTSC release. Organizations are advised to prepare for this transition.

Winsage

July 23, 2026

Mac users can get Microsoft Office and Windows 11 Pro for life for $165

Microsoft has introduced a bundle that includes Microsoft Office 2024 and Windows 11 Pro for a price of .97, reduced from .99. Office 2024 is compatible with Mac systems and includes applications like Word, Excel, PowerPoint, Outlook, and OneNote, functioning offline with automatic syncing. It features advanced AI tools such as Smart Compose for Word and Dynamic Arrays for Excel. Windows 11 Pro offers security features like BitLocker for drive encryption and Hyper-V for creating virtual machines. This bundle serves as an alternative for users transitioning from Microsoft 365 subscriptions.

Winsage

July 21, 2026

This week, you can get Windows 11 Pro and Microsoft Office for life together for just $33

A lifetime license for Windows 11 Pro and Microsoft Office Pro is available for .97 until July 26 at 11:59 p.m. PT, significantly reduced from the regular price of 9.99. This bundle includes essential applications such as Word, Excel, and PowerPoint, and allows installation on a single Windows PC without recurring fees. Windows 11 Pro offers features like BitLocker encryption, Hyper-V, and Windows Sandbox, along with core functionalities like Snap layouts and DirectX 12 Ultimate.

Winsage

July 20, 2026

Today’s the last day to get Windows 11 Pro for just $7.97

Windows 11 Pro is available for .97, reduced from its standard price of 9, with a promotion expiring tonight at 11:59 p.m. PT. The operating system includes features like Hyper-V, Windows Sandbox, BitLocker encryption, Azure AD integration, and an AI-powered assistant called Copilot.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 19, 2026

Windows 11 Secure Boot is a messy ride on older PCs, and even Microsoft can’t fix it

Microsoft held an OEM Secure Boot Office Hours event with manufacturers like Acer, Asus, Dell, and HP to discuss issues related to the Windows 11 Secure Boot 2023 certificate rollout. Many IT administrators left with unresolved concerns, particularly regarding Secure Boot certificate errors. Participants reported persistent problems, including failures of suggested solutions from official documentation to apply to their hardware configurations. Ed Tittel shared his experience with compliance issues related to CA-2023 certificates, noting that ASUS motherboards sometimes required Secure Boot to be disabled temporarily, while MSI models exhibited erratic behavior. ASRock systems needed manual key resets, and documentation was lacking. Devices from Dell, HP, and Lenovo performed better but still faced staggered rollouts and required multiple reboots for BIOS updates. Specific issues raised included HP's BitLocker recovery loop persisting even with the latest BIOS, challenges with legacy device support from HP, devices showing Secure Boot Status as Unknown, and failures in updating the KEK on HP EliteBooks. Some questions from IT administrators regarding Dell and HP went unanswered during the session. The experiences highlighted a trend of Secure Boot issues across multiple OEMs, not limited to a single vendor. IT administrators are advised to pilot updates on representative hardware, back up BitLocker recovery keys, and consult OEM-specific advisories. The unresolved issues reflect common challenges faced by users, indicating that problems with Secure Boot certificate deployments are widespread across various manufacturers.

Winsage

July 19, 2026

The 200GB catch hiding in Windows 11’s new recovery feature

Microsoft has introduced point-in-time restore for Windows 11 users, enhancing the traditional System Restore. This new recovery tool allows users to recover their PCs from software issues, problematic drivers, or faulty updates, even when Windows won’t boot. It uses the Volume Shadow Copy Service (VSS) to automatically generate restore points every 24 hours, which include both system and user files, unlike System Restore. Point-in-time restore manages storage by deleting restore points after 72 hours and integrates seamlessly into Windows Settings, being activated by default for volumes over 200GB. Users with smaller volumes must activate it manually. It also incorporates Reserved Storage to ensure restore points do not consume regular disk space. The feature is available on Windows 11 Home and Pro editions with the installation of the optional Preview Update KB5095093. Users can access point-in-time restore through Windows Settings under System > Recovery, and initiate recovery via the Windows Recovery Environment (Windows RE).

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 18, 2026

Windows 11’s massive July 2026 update fixes 570 vulnerabilities and shows how AI is quietly reshaping Patch Tuesday itself

Microsoft's July 2026 Patch Tuesday update for Windows 11, identified as KB5101650, addresses 570 vulnerabilities and upgrades Windows 11 to version 25H2 (build 26200.8875) and version 24H2 (build 26100.8875). The update includes critical fixes for BitLocker and File Explorer, targeting vulnerabilities that could enable remote code execution. Microsoft's MDASH tool, which uses AI for vulnerability analysis, has helped uncover 16 vulnerabilities in networking and authentication components. The update also introduces non-security enhancements like Point-in-time restore and improved Bluetooth reliability. Microsoft emphasizes the need for users to install updates quickly due to the rapid evolution of AI technology that benefits malicious actors.