Group Policy Archives

Winsage

October 8, 2026

Microsoft confirms a Windows update can close games that use AC-3 audio

Microsoft has acknowledged an issue related to a Windows update (KB5124010) released on September 22, 2026, which has caused unexpected closures of various games that rely on AC-3 audio decoding. This issue affects Windows 11 versions 24H2, 25H2, and 26H2, while server editions remain unaffected. The problem primarily impacts legacy applications that depend on Windows' built-in audio decoding, particularly older PC games using the Dolby Digital codec for pre-rendered cutscenes and licensed soundtracks. Microsoft has confirmed the issue but has not provided a list of affected titles, workarounds, or a resolution timeline. The status remains unchanged as of October 7, and the issue persists regardless of user action.

Winsage

October 3, 2026

Windows 11 Spotted Keeping Thumbnails of Deleted Photos

Windows 11 uses a thumbnail caching mechanism to store previews of images in specific databases located in %LocalAppData%MicrosoftWindowsExplorer, such as thumbcache32.db and thumbcache1024.db. When a user deletes an image, the corresponding thumbnail may remain in the cache, as deletion does not automatically remove it from the thumbnail database. The cache retains only reduced versions of images, not the original files, which is significant in digital forensics where thumbnails can provide insights even when original files are missing. Users can manage their thumbnail cache using the cleanmgr tool to clear saved thumbnails or disable thumbnail caching through the Local Group Policy Editor or File Explorer settings.

Winsage

October 1, 2026

Microsoft Enables Windows Settings Backup by Default

Microsoft has announced that Windows settings backup will now be enabled by default on eligible Windows 11 version 26H2 devices. This feature, previously known as Windows Backup for Organizations, automatically preserves users’ Windows settings and Microsoft Store app lists, facilitating restoration after device resets, replacements, or reimages. The change aims to minimize disruptions during device recovery and ensures more devices have recovery data readily available. Administrators will still control the restore process, which requires explicit configuration. The default-on behavior applies only to Windows 11 version 26H2 or later, devices with the backup policy in a “Not Configured” state, and excludes certain environments. Administrators can disable the backup feature if necessary.

Winsage

October 1, 2026

Microsoft enables Windows settings backup by default for orgs

Microsoft has updated its Windows settings backup and restore functionality, now automatically enabled for all enterprise systems joined to Microsoft Entra or operating in a hybrid environment after upgrading to Windows 11 version 26H2. The backup tool, previously known as Windows Backup for Organizations, is designed to facilitate the backup and restoration of essential Windows settings for enterprise users during device resets, replacements, upgrades, or reimaging. Originally introduced in November 2024, it became generally available by August 2025. The backup policy will be activated by default for eligible devices following the release of Windows 11, version 26H2 on September 29, 2025, unless administrators have previously configured the policy. The automatic backup feature applies to devices running Windows 11 26H2 in regions not governed by the EU Digital Markets Act and does not require explicit admin configuration for restoring Windows devices. IT administrators can control the backup policy through mobile device management solutions like Microsoft Intune or Group Policy.

Winsage

September 28, 2026

Windows 11 preview update causes black screen after sign-in; Microsoft publishes workaround

On September 24, Microsoft reported an issue affecting devices that installed the August 27 preview update for Windows 11, causing a black screen after sign-in and preventing the desktop from loading correctly. This issue primarily impacts Azure Virtual Desktop (AVD) hosts using FSLogix with existing user profiles. The affected OS versions are Windows 11 versions 26H1, 25H2, and 24H2, and the causal update is KB5120998. Microsoft has issued interim workarounds, including a manual desktop launch and a Known Issue Rollback (KIR), which will be automatically delivered to non-enterprise devices. Affected enterprise-managed devices require manual deployment of the KIR policy. The black screen issue is part of a series of update-related problems for Windows 11 in 2026, while Windows 10 has experienced fewer issues during the same timeframe.

Winsage

September 26, 2026

Windows finally let me rip Bing out of my desktop. The speed boost is undeniable

Windows 11 users previously experienced a dual-search environment where local and web results were mixed, often leading to cluttered searches. Many resorted to registry edits to disable web results, but these workarounds were not fully effective. The search interface was complicated by irrelevant web links, making it difficult to find local files. With the introduction of version 26H2, Microsoft added a toggle in Settings that allows users to manage web searches independently, improving the search experience by prioritizing local files. This feature began rolling out after the September 2026 Patch Tuesday update. Disabling web results streamlines the search panel but removes the Copilot entry and may not be immediately available to all users.

Winsage

September 26, 2026

Microsoft: Recent Windows updates cause desktop loading issues

Microsoft has acknowledged that some users may experience desktop loading issues, specifically black screens, after installing the August 2026 preview updates and subsequent releases. This problem mainly affects Azure Virtual Desktop (AVD) hosts using FSLogix. Symptoms include a black screen post-sign-in and crashes related to Windows Explorer, which can be temporarily resolved by manually launching Windows Explorer through Task Manager. For enterprise customers, Microsoft has introduced a mitigation strategy via Known Issue Rollback (KIR), allowing IT administrators to reverse problematic updates by applying specific group policies. Additionally, Microsoft has addressed issues related to the loss of mouse and desktop settings on certain Windows 11 systems caused by the KB5120998 update.

Winsage

September 25, 2026

Windows update leaves some virtual desktops staring into the void

Microsoft has acknowledged an issue affecting some Windows 11 users utilizing virtual desktops, where a black screen appears after sign-in, requiring manual launch of Explorer to regain access. This glitch is linked to devices operating on the August 2026 non-security preview update or later. It has been predominantly observed on Azure Virtual Desktop (AVD) hosts using FSLogix, with crashes of Windows Explorer noted in the Application event log. A temporary workaround involves using Task Manager to initiate explorer.exe as a new task. Microsoft has implemented a Known Issue Rollback (KIR) via Group Policy to disable the problematic change until a permanent fix is released. Versions 26H1, 25H2, and 24H2 of Windows 11 are affected, while Windows 10 and Windows Server do not appear to be impacted.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.