NewApp Digest
search bot

enterprise environments

Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability
Winsage
March 17, 2026

Microsoft to Block Windows 11 and Server 2025 Automated Installation After Critical RCE Vulnerability

Microsoft is implementing a two-phase initiative to disable the hands-free deployment feature in Windows Deployment Services (WDS) due to a critical remote code execution vulnerability (CVE-2026-0386) identified on January 13, 2026. This vulnerability arises from improper access control related to the Unattend.xml file, which is transmitted over an unauthenticated RPC channel, allowing attackers on the same network segment to exploit it. Successful exploitation could grant SYSTEM-level privileges and compromise OS deployment images. The initiative includes: - Phase 1 (January 13, 2026): The hands-free deployment feature will remain operational but can be disabled. New Event Log alerts and registry key controls will be introduced to enforce secure practices. - Phase 2 (April 2026): The hands-free deployment feature will be completely disabled by default for administrators who have not modified registry settings. Administrators can temporarily re-enable the feature by setting AllowHandsFreeFunctionality = 1, but this is not secure. Recommendations include reviewing WDS configurations, applying security updates, setting registry keys for secure behavior, monitoring Event Viewer for alerts, and considering alternative deployment methods. Microsoft’s KB article 5074952 provides further guidance for impacted organizations.
Windows 10/11 Patch Day March: Microsoft delivers the big security update, but as usual, the real message is in the fine print
Winsage
March 12, 2026

Windows 10/11 Patch Day March: Microsoft delivers the big security update, but as usual, the real message is in the fine print

In March, Microsoft released cumulative security updates for Windows 10 and Windows 11, with support for certain versions continuing until March 2026. The updates include KB5079466 for Windows 11 version 26H1, KB5079473 for versions 24H2 and 25H2, KB5078883 for version 23H2, and KB5078885 for Windows 10 version 22H2. These updates will be distributed via Windows Update, the Microsoft Update Catalog, and WSUS for enterprise environments. This month, Microsoft combined the Servicing Stack Update (SSU) with the Latest Cumulative Update, simplifying the update process. Key enhancements include improvements to Secure Boot, with expanded device target data for new certificates, and security enhancements for Explorer’s search functionality in Windows 11 versions 24H2 and 25H2. A fix for Windows Defender Application Control (WDAC) was also implemented, addressing issues with COM objects under certain policy configurations. The Windows System Image Manager received a new warning dialog for confirming the trustworthiness of catalog files, which is important for enterprise environments. Updates for Windows 10 22H2, despite its end-of-life status, included fixes for secure boot issues and improvements for file version history in the Control Panel. An SSU for Windows 11 (KB5077869) was also released to maintain update stability. Microsoft's updates scheduled for March 2026 will address vulnerabilities in components like the Windows App Installer, SQL Server, and Microsoft Office. The Security Update Guide provides detailed information on specific vulnerabilities and affected components.
Microsoft to enable Windows hotpatch security updates by default
Winsage
March 11, 2026

Microsoft to enable Windows hotpatch security updates by default

Microsoft will enable hotpatch security updates by default for eligible Windows devices managed through Microsoft Intune and the Microsoft Graph API starting with the May 2026 Windows security update. This change aims to enhance security and reduce the time to achieve 90% patch compliance by half. The updates will be managed through Windows Autopatch, which allows organizations to apply updates without manual intervention. Administrators can manage hotpatch updates at the tenant level and can opt-out starting April 1, 2026. A Hotpatch quality updates report will be available in Intune to ensure devices are ready for the updates. Windows Autopatch became generally available in July 2022 and is currently operational on over 10 million production devices.
Microsoft's Secure Boot certificates expire in June 2026, but older PCs may never get the fix
Winsage
March 7, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011, embedded in the motherboard's firmware, to ensure a secure boot process. The first of these certificates will expire on June 24, 2026, which will affect the ability to receive future security updates for critical components of the Windows startup process. Microsoft is rolling out replacement certificates through Windows Update, marking a significant security maintenance effort. Secure Boot operates as a chain of trust with certificates stored in the motherboard's UEFI firmware, validating software before the operating system loads. The Platform Key (PK) is at the top of this chain, followed by the Key Exchange Key (KEK) and the Signature Database (DB). The replacement certificates introduced in 2023 restructure certificate management, separating responsibilities among different certificate authorities to enhance the trust model. Not all PCs are affected by the upcoming expiration; newer devices manufactured since 2024 already have the new certificates. Windows 10 users face challenges as support for this version ends in October 2025, and they will not receive the new certificates unless enrolled in Extended Security Updates. Home users should ensure their PCs are set to receive updates automatically, while enterprise environments require coordination for firmware updates before the Windows certificate update.
silver Android smartphone
Winsage
March 6, 2026

Microsoft’s Secure Boot certificates expire in June 2026, but older PCs may never get the fix

Every Secure Boot-enabled Windows PC relies on cryptographic certificates issued by Microsoft in 2011 for boot process integrity. The first of these certificates will expire on June 24, 2026, impacting the ability to receive future security updates. Microsoft is rolling out replacement certificates through Windows Update, requiring collaboration between Microsoft, PC manufacturers, and users. Three critical certificates will expire: the Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 in June 2026, and the Microsoft Windows Production PCA 2011 in October 2026. The new certificates introduced in 2023 have a restructured functionality to enhance security. Not all PCs are affected; newer devices manufactured since 2024 come with the new certificates. Windows 10 users face challenges as support ends in October 2025, and unsupported devices will not receive updates. Home users should ensure automatic Windows updates and check for firmware updates, while enterprise environments must verify firmware updates before applying certificate updates. The first certificate expiration is on June 27, 2026.
NTLM is going away: what Microsoft’s phaseout means for MSPs and IT teams
Winsage
March 2, 2026

NTLM is going away: what Microsoft’s phaseout means for MSPs and IT teams

The migration from NTLM to Kerberos authentication is essential for improving security in Windows systems, but it faces challenges such as legacy systems and hardcoded authentication. Organizations must identify NTLM usage, conduct testing with NTLM disabled, and make necessary adjustments or upgrades to migrate successfully. Ongoing monitoring is crucial post-migration to prevent NTLM from re-entering the network. NTLM is associated with significant security vulnerabilities and has been exploited by various threat groups, making its elimination a priority for organizations despite potential hesitations to invest in the migration process. Transitioning to Kerberos is seen as a strategic security investment.
Windows Package Manager 1.28.190 is final
Winsage
March 1, 2026

Windows Package Manager 1.28.190 is final

Microsoft has launched WinGet 1.28.190, aligning its version number with App Installer to resolve discrepancies. The previous version 1.12.470 has been replaced by this update. Key changes include consistent directory separators for portable packages, compatibility of the –suppress-initial-details option with winget configure test, corrections to the experimental “font” property, and the introduction of the experimental sourceEdit feature, which allows users to set a source for package management. The update signifies a consolidation of versioning and enhances clarity for users and administrators.
Microsoft testing Windows 11 batch file security improvements
Winsage
February 28, 2026

Microsoft testing Windows 11 batch file security improvements

Microsoft has released new Windows 11 Insider Preview builds that enhance security and performance for batch files and CMD scripts. IT administrators can now activate a secure processing mode by adding the LockBatchFilesInUse registry value, which prevents modifications to batch files while they are running. This update also requires signature validation only once per batch file, improving performance. Additionally, the Shared Audio feature has been refined, allowing users to share audio across multiple devices with individual volume sliders and a new taskbar indicator. The feature now supports more Bluetooth LE Audio accessories, including Samsung Galaxy Buds 4, Sony WF-1000XM6, and Xbox Wireless Headset. These updates are available for Windows Insiders in the Beta and Dev channels with specific preview builds installed.
Search