Group Policy Archives

Winsage

July 24, 2026

Microsoft is cracking down on Windows 11 bloatware ads, forces LG to pull McAfee popup

LG will disable the McAfee ad pop-up in its Monitor App Installer following consumer dissatisfaction and Microsoft's intervention. Users reported that the app was silently installed via Windows Update, leading to unsolicited McAfee trial ads. LG stated that McAfee is not installed without user consent and blamed Microsoft's distribution process, but many users experienced the pop-up without prior consent. Microsoft confirmed LG's agreement to disable the pop-up within three days, emphasizing a commitment to improving user experience. The incident highlights concerns over silent installations and the necessity of third-party antivirus software for Windows 11 users.

Winsage

July 23, 2026

LG monitors are reportedly automatically installing bloatware on Windows 11 PCs, but there’s an apparent fix

LG monitors are automatically installing McAfee bloatware on Windows 11 PCs without user consent, as indicated in the changelog of the LG Monitor App Installer on the Microsoft Store. This installation occurs when an LG monitor is connected, leading to a McAfee pop-up due to automatic installation triggered by Windows Update, which is logged by the Windows Reliability Monitor. Users can prevent this by enabling a setting in the Group Policy Editor to stop automatic downloads of applications linked to device metadata. It is recommended that users who have manually installed the LG monitor app remove it, as McAfee is a core component of the application. Microsoft has not commented on this issue.

Winsage

July 21, 2026

LG admits its monitor app installs bloatware via Windows Update, and Microsoft is letting it happen

A growing number of LG monitor users have reported that connecting their devices to Windows systems results in the automatic installation of the LG Monitor App Installer, which prompts users with a McAfee trial advertisement. YouTuber Gamers Nexus found that connecting an LG UltraGear monitor led to the installation of LG's driver package and the LG Monitor App Installer, with the McAfee pop-up appearing 31 times over 32 boots. This automatic installation is facilitated by device metadata, which Windows uses to download associated applications without user notification. Users must be signed into the Microsoft Store and connected to the internet for this to occur, leading to frustrations about transparency. Reports of unsolicited McAfee pop-ups have been shared on platforms like Reddit, with users confirming the app's installation was logged as part of a Windows Update. LG has acknowledged the inclusion of McAfee in their app updates, promoting a free trial, which has raised privacy concerns. The app's rating on the Microsoft Store has dropped to around 1 out of 5 due to user dissatisfaction. Users can prevent automatic installations by adjusting Group Policy settings, while macOS requires manual approval for third-party applications. Neither Microsoft nor LG has formally addressed the concerns regarding silent installations and McAfee pop-ups.

Winsage

July 20, 2026

LG’s monitors come with an unwanted addition for Windows: McAfee pop-up ads

The LG Monitor App Installer installs itself by default, resulting in unwanted ad notifications for users. When connecting a new LG UltraGear monitor to a Windows 11 PC, the LG driver updates and the Monitor App Installer are installed silently via Windows Update without user notification or permission. The app does not provide unique controls but redirects users to other LG applications and promotes McAfee antivirus. Complaints about the app's auto-installation have increased, particularly regarding large pop-up ads. Microsoft allows developers to pair a Hardware Support App with the Windows Store for automatic installation, but this can confuse users. Similar practices exist with Dell's Alienware Command Center app. Users can prevent the LG app from auto-installing through group policy settings or by opting out of automatic downloads in system settings. The LG Monitor App Installer requests extensive permissions and collects device data, internet activity, and geolocation information without explicit user consent.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 20, 2026

July 2026 Patch Tuesday: KB5101650 Windows 11 Update

On July 14, 2026, Microsoft released cumulative update KB5101650 for Windows 11 versions 25H2 and 24H2, addressing OS Builds 26200.8875 and 26100.8875. This update includes essential security fixes, updates to Secure Boot certificates, and enhanced Remote Desktop Protocol (RDP) defenses against phishing attacks. It consolidates July 2026's security content, addressing known vulnerabilities and introducing functional improvements. The update is critical for minimizing exposure to identified threats and is prioritized for systems managing remote access or nearing certificate expiration. The update enhances Remote Desktop security by supporting SHA-2 certificate thumbprints while retaining SHA-1 for legacy compatibility. It includes new Group Policy options to mitigate phishing risks associated with malicious .rdp files. The curl upgrade to version 8.21.0 incorporates security patches for command-line tools in Windows environments. Secure Boot certificates are automatically updated through Windows updates, ensuring boot security across various hardware. KB5101650 installs primarily through the Windows Update interface, requiring a restart to activate changes. Enterprise environments can use the Microsoft Update Catalog for manual distribution. A temporary restriction affects certain Dell devices with Intel Innovation Platform Framework drivers, which Microsoft plans to address in a future update. The cumulative update resolves a total of 622 Microsoft CVEs, including 416 affecting Windows components. Users are advised to verify and install the update promptly to secure the full suite of improvements.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 17, 2026

Windows 11 Gets Policy to Automatically Grant SSO Permissions

Microsoft has introduced a new policy to simplify the Windows sign-in process for IT administrators by allowing automatic approval of Single Sign-On (SSO) permissions on eligible managed devices. This feature will be available with the July 2026 security update for Windows 11 versions 24H2 and 25H2. Users in the European Economic Area (EEA) have been facing prompts for consent due to regulatory changes, prompting Microsoft to streamline access for managed devices. IT administrators can use a specific registry setting (HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, Value: AutoAcceptSsoPermission (DWORD) = 1) to automatically grant SSO permissions. This feature is designed for managed enterprise devices linked to Microsoft Entra ID and does not affect personal accounts or unmanaged devices. Organizations must ensure their devices are updated and can enable the feature through various enterprise management tools.

Winsage

July 16, 2026

Microsoft makes Windows SSO prompts easier to manage

Microsoft is introducing a registry-based policy to improve the management of Single Sign-On (SSO) permissions for devices running Windows 11 versions 24H2 and 25H2, specifically for those managed through Microsoft Entra ID. This policy allows IT administrators to automatically accept SSO permissions, enhancing the user experience in corporate environments. Users with personal Microsoft accounts or unmanaged devices will still receive prompts for SSO permissions. The change aims to provide users, particularly in the European Economic Area (EEA), with more control over their account usage across Microsoft applications. Deployment options for IT administrators include Group Policy, Microsoft Intune, other mobile device management solutions, Microsoft Configuration Manager, and any management tool that supports registry policy deployment. Administrators are advised to validate SSO behavior after deployment.

Winsage

July 16, 2026

Windows 11 gets new registry policy to give IT admins more control

Microsoft will introduce a new registry policy in Windows 11 in July 2026 that allows IT administrators to enable automatic acceptance of single sign-on (SSO) prompts on managed devices. This policy will streamline user authentication by using Windows sign-in credentials automatically for Microsoft apps or services, reducing the need for manual authentication. The registry path for this policy is HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, with the value AutoAcceptSsoPermission (DWORD) set to 1. It can be deployed using Group Policy Objects (GPO), Intune, Microsoft Configuration Manager, or mobile device management (MDM) tools. This setting is applicable only to Windows 11 versions 25H2 and 24H2 that have received the July 2026 Patch Tuesday updates (KB5101650 and KB5094126) and is designed for managed devices using Entra ID accounts, not personal Microsoft accounts or unmanaged devices.