NewApp Digest
search bot

Event Viewer

Microsoft is cracking down on Windows 11 bloatware ads, forces LG to pull McAfee popup
Winsage
July 24, 2026

Microsoft is cracking down on Windows 11 bloatware ads, forces LG to pull McAfee popup

LG will disable the McAfee ad pop-up in its Monitor App Installer following consumer dissatisfaction and Microsoft's intervention. Users reported that the app was silently installed via Windows Update, leading to unsolicited McAfee trial ads. LG stated that McAfee is not installed without user consent and blamed Microsoft's distribution process, but many users experienced the pop-up without prior consent. Microsoft confirmed LG's agreement to disable the pop-up within three days, emphasizing a commitment to improving user experience. The incident highlights concerns over silent installations and the necessity of third-party antivirus software for Windows 11 users.
Windows 11's biggest updates may need multiple reboots, but that's normal, don't force shutdown
Winsage
July 20, 2026

Windows 11’s biggest updates may need multiple reboots, but that’s normal, don’t force shutdown

Users may experience double reboots when installing substantial Windows updates, such as the April and July 2026 Updates, due to factors like Secure Boot and .NET Framework updates. The July 2026 .NET Framework update specifically requires a separate reboot. Microsoft is still rolling out the Secure Boot 2023 certificate update, which may also lead to multiple reboots. Users are advised not to panic during these reboots and to allow the system time to complete the installation process. Additionally, Microsoft has warned against delaying updates for more than three days due to increasing update sizes related to security vulnerabilities. Some users may encounter SCEP certificate errors in the Event Viewer after the July 2026 Update, but these errors do not indicate a failure of the update process.
OEMs reveal Windows 11 Secure Boot fix after deadline passes, here's how to update your PC
Winsage
June 29, 2026

OEMs reveal Windows 11 Secure Boot fix after deadline passes, here’s how to update your PC

Major PC manufacturers, including HP, Dell, ASUS, Lenovo, MSI, Acer, Samsung, LG, and Microsoft’s Surface division, have provided guidance on transitioning to new Secure Boot certificates as the expiration of Microsoft’s 2011 certificates approaches. The expiration will occur in three phases: Microsoft Corporation KEK CA 2011 expired on June 24, 2026; Microsoft UEFI CA 2011 expired on June 27, 2026; and Microsoft Windows Production PCA 2011 is set to expire on October 19, 2026. Microsoft has begun rolling out replacement certificates through Windows Update, contingent on OEMs providing compatible BIOS updates. ASUS offers detailed documentation for both consumer and commercial devices, confirming that most users will receive updates automatically. Lenovo provides direct download links for BIOS updates organized by product family and specifies which products will not receive updates. Dell's support article covers its entire product lineup, noting that devices with an End of Service Life before January 1, 2026, will not receive updates. HP outlines a dual-track approach for updates, with specific timelines for commercial PCs. Microsoft's Surface devices receive updates directly from Microsoft, while MSI categorizes guidance based on processor generation for its laptops. Acer emphasizes backing up the BitLocker recovery key and provides a model table for confirmed BIOS release dates. Samsung confirms that all PCs running Windows 10 or 11 will function normally post-expiration, but security updates will cease. LG has released a guide for checking BIOS updates for its PCs. To verify if a PC has the 2023 certificates, users can check the Secure Boot section in Windows Security. A green checkmark indicates successful application, while yellow or red icons indicate pending updates or incompatibility. Microsoft has pushed the certificates to all eligible devices as of June 2026.
Microsoft released the Windows 11 Secure Boot update for all PCs, how to verify yours
Winsage
June 15, 2026

Microsoft released the Windows 11 Secure Boot update for all PCs, how to verify yours

Microsoft has expanded the rollout of the Secure Boot 2023 certificate update to more Windows 11 and Windows 10 devices with the June 2026 Patch Tuesday update (KB5094126). This update aims to ensure that most supported consumer PCs are classified as high confidence, meaning necessary certificates are either installed or will be applied automatically. Secure Boot is a firmware security feature that verifies the software attempting to load during the startup process, blocking unauthorized software. The certificates supporting Secure Boot, issued in 2011, are expiring in stages starting June 24, 2026, prompting Microsoft to deploy replacement certificates. Most home users do not need to take manual action as the updates will occur automatically via Windows Update. Users can check their Secure Boot certificate status in the Windows Security app. A yellow warning indicates pending compatibility data, while a red alert suggests a firmware incompatibility requiring a BIOS update. Multiple reboots during the update process are normal, and a new SecureBoot folder in Windows is for staging cryptographic files. Older PCs may experience longer update times, and some may not receive updates due to firmware issues. HP users should check for BIOS updates if encountering BitLocker recovery loops. IT administrators should monitor device classifications and manually initiate updates for devices not in the high confidence category. Devices with Secure Boot disabled cannot receive updates, leaving them vulnerable. The expiration of the Microsoft Corporation KEK CA 2011 certificate on June 24 does not immediately affect device functionality, but it limits Microsoft's ability to sign new bootkit blacklist updates.
Meet the hidden Windows 11 tool that reveals what Task Manager misses
Winsage
June 8, 2026

Meet the hidden Windows 11 tool that reveals what Task Manager misses

Microsoft has integrated Sysmon into Windows 11 through a system update, allowing it to operate in the background and log activities in the Windows Event Log. Indicators of suspicious processes include the absence of icons or descriptions, incorrect parent processes, spelling errors in names, unsigned executable files, packed executables, suspicious DLLs or services, open TCP/IP endpoints, and unusual URLs or character strings. To install Sysmon, users must access the Control Panel, enable Sysmon, and restart their PC. Activation requires running a command in the Command Prompt. Sysmon logs can be viewed in the Event Viewer under Microsoft > Windows > Sysmon > Operational. Users can filter events using an XML configuration file. After analysis, suspicious processes should be scanned with antivirus software, and files can be uploaded to VirusTotal for further examination. Sysmon continuously logs events, while Process Monitor captures snapshots of running processes, and both tools are available for free from Microsoft.
Microsoft confirms Windows 11 update is failing on some PCs, explains if you need a workaround
Winsage
June 1, 2026

Microsoft confirms Windows 11 update is failing on some PCs, explains if you need a workaround

Microsoft has identified the root cause of installation issues related to the May 2026 update for Windows operating system and is rolling out a solution through an optional update, KB5089573. The May 12, 2026, Patch Tuesday update (KB5089549) introduced enhancements but many users faced installation failures due to error code “0x800f0922,” indicating insufficient space on the EFI System Partition (ESP). The ESP is critical for boot files and typically occupies around 256MB. Users can check ESP storage using a specific command. Low ESP space can lead to update failures, particularly when it drops below 10MB. Microsoft has rolled back problematic code and provided a fix in the optional update KB5089573, which resolves ESP space issues and ensures future updates will proceed smoothly. Users are encouraged to install this update or wait for the next scheduled Patch Tuesday update on June 9, 2026.
My Windows 11 backup broke after KB5083769 — Microsoft says this simple fix might save your files
Winsage
May 7, 2026

My Windows 11 backup broke after KB5083769 — Microsoft says this simple fix might save your files

The Windows 11 security update KB5083769, released on April 14, 2026, introduces changes to the psmounterex.sys driver, causing compatibility issues with third-party backup solutions such as Macrium Reflect, Acronis Cyber Protect Cloud, UrBackup Server, and NinjaOne Backup. Microsoft states this is a necessary security adjustment, not a bug. The update also adds known vulnerable kernel drivers to a blocklist to enhance system security. Users can check if a driver is blocked by using the Event Viewer and looking for Event ID 3077 associated with a specific Policy ID.
April 2026 Windows Update Breaks Third-Party Backup Software by Blocking Vulnerable Driver
Winsage
May 5, 2026

April 2026 Windows Update Breaks Third-Party Backup Software by Blocking Vulnerable Driver

Microsoft will include the psmounterex.sys driver in its Vulnerable Driver Blocklist in the April 2026 security update, affecting third-party backup applications that use this driver for image mounting and Volume Shadow Copy Service (VSS) snapshots. This decision addresses CVE-2023-43896, a critical buffer overflow vulnerability. Affected software includes Macrium Reflect, Acronis Cyber Protect Cloud, UrBackup Server, and NinjaOne Backup on Windows 11, Windows 10, and Windows Server platforms. Users may face issues during image-mount operations, receiving error messages related to VSS timeouts and Code Integrity errors in the Event Viewer. To check if a system is affected, users can look for Event ID 3077 in the Code Integrity Operational log. Microsoft recommends upgrading to newer versions of backup applications that do not use blocked drivers and advises against uninstalling or delaying the April update. Additionally, the update may cause certain Windows Server 2025 devices to boot into BitLocker recovery mode and has led to out-of-band updates for Windows Server update failures and restart loops on domain controllers.
Search