Group Policy Archives

Winsage

May 25, 2026

How I Changed the SID on My Windows Server Without Reinstalling (And Why You Should Care)

Cloning a Windows Server machine can lead to issues with duplicate Security Identifiers (SIDs). A Security Identifier (SID) is a unique string assigned to every machine, user, and group in Windows, functioning like a fingerprint. Duplicate SIDs can cause problems such as domain join failures, incorrect WSUS reporting, inconsistent Group Policy application, and licensing issues. The author initially attempted to use sysprep to change the SID after cloning, which resulted in stripping the domain join and causing SQL Server to fail. The author then discovered Wittytool Disk Clone, which includes a SID changer that successfully generated a new SID and updated all necessary references without disrupting the server's configuration or applications. The process took only six minutes and worked similarly on Windows Server 2019. It is more efficient to generate a new SID during the cloning process rather than afterward. Important precautions include taking a snapshot or backup before making changes and being aware that changing the SID on domain controllers is more complex. Reactivation of Windows may also be required after the SID change.

Winsage

May 25, 2026

Microsoft Copilot Returns as a Sidebar in Windows 11

Microsoft is updating the Copilot AI integration within Windows 11, reintroducing it as a sidebar application similar to its original design from 2024. Users can dock Copilot on either side of the screen, which adjusts the user interface to accommodate it. The redesigned Copilot integrates more seamlessly with desktop elements. Microsoft has provided two methods for users to remove the Copilot application: one involves editing the Windows Registry to create a key that instructs Windows to remove Copilot, while the other uses a group policy setting applicable only if Copilot was not user-installed.

Winsage

May 23, 2026

Windows 11 now lets you remove Microsoft Copilot app with Group Policy or Registry, as it tries to win back users

Recent feedback from Windows 11 users has led Microsoft to simplify the process of uninstalling Copilot due to dissatisfaction with its integration. A Group Policy option titled “Remove Microsoft Copilot app” has been introduced in the April 2026 Update, allowing users to remove Copilot via User Configuration > Administrative Templates > Windows Components > Windows AI. Users can also uninstall Copilot directly from the installed apps list or by right-clicking the icon, although it may reappear after a fresh installation due to certain updates. To uninstall Copilot and Microsoft 365 Copilot using Group Policy, the following conditions must be met: both apps must be installed, the user did not install them independently, and the Copilot app has not been used for over 28 days. This policy is supported on Pro, Enterprise, Education, and IoT Enterprise or LTSC versions of Windows 11. Windows 11 Home users can manually remove Copilot by creating a registry key at HKEYCURRENTUSERSoftwarePoliciesMicrosoftWindowsWindowsAI and setting a DWORD value named RemoveMicrosoftCopilotApp to 1. Alternatively, users can execute a PowerShell script to remove Copilot. Microsoft has not provided an uninstall option for Copilot in the Start menu.

Winsage

May 23, 2026

Windows 11 adds policy to remove Copilot app

A new preview build of Windows 11 introduces a Group Policy option titled Remove Microsoft Copilot app, located in User Configuration settings under Administrative Templates and Windows Components. This policy is conditional, applying only when both Microsoft 365 Copilot and Microsoft Copilot are present, the Copilot app has not been user-installed, and it has not been launched in the last 28 days. Alternative methods to control the Copilot app include the Intune Settings Catalog entry to turn off Copilot, a registry DWORD at HKEYLOCALMACHINESOFTWAREPoliciesMicrosoftWindowsWindowsCopilot, and AppLocker packaged-app rules. Community discussions indicate that PowerShell uninstall methods are temporary solutions due to potential reinstallation by subsequent updates.

Winsage

May 23, 2026

CVE-2026-45585: YellowKey BitLocker Bypass

BitLocker, a security feature for data protection, has a vulnerability identified as CVE-2026-45585, also known as YellowKey, which allows unauthorized access to encrypted data on Windows 11 versions 24H2, 25H2, 26H1, and Windows Server 2025. This flaw does not compromise BitLocker’s encryption but affects the recovery environment supporting it. The vulnerability can be exploited locally through the Windows Recovery Environment (WinRE) by an attacker with physical access, who can trigger an unrestricted shell and access the BitLocker-protected volume. Microsoft has provided two mitigation strategies: modifying the WinRE image to remove the autofstx.exe entry and transitioning from TPM-only protection to a TPM+PIN requirement at startup. The exploit poses challenges for detection, as it occurs pre-boot and currently lacks vendor-published indicators of compromise. Organizations using BitLocker for unattended devices are particularly at risk, as the vulnerability can lead to loss of confidentiality if an attacker gains access before the legitimate user.

Winsage

May 20, 2026

Microsoft confirms Windows 11’s May 2026 update is failing to install with error 0x800f0922 and outlines a mitigation for affected PCs

Microsoft has acknowledged installation issues with the May 2026 Security Update for Windows 11, specifically error code 0x800f0922, affecting devices on versions 24H2 and 25H2 after installing update (KB5089549) released on May 12. The failures occur during the reboot phase, often around 35 percent, primarily on devices with 10MB or less free space in the EFI System Partition (ESP). For consumer and unmanaged business devices, Microsoft has implemented a Known Issue Rollback (KIR), and restarting the computer may resolve the issue. For managed devices, network administrators must manually deploy a Group Policy workaround. Microsoft suggests modifying a Registry value to decrease reserved padding in the EFI partition as a potential fix, along with restarting the computer and checking for updates. A permanent solution is planned for a future Windows update.

Winsage

May 19, 2026

Microsoft confirms patching issues in restricted Windows networks

Microsoft has issued a service alert indicating that customers in restricted network environments may encounter Windows Update failures, specifically error code 0x80010002, after installing the January 2026 optional non-security preview updates. Affected devices might download the February monthly Windows security update but could struggle with updates released in March and beyond due to changes in download timeout requirements. Microsoft is working on a resolution, and IT administrators can use Known Issue Rollback (KIR) as a workaround by configuring the appropriate Group Policy for their Windows version. A device restart is required to apply these settings. Historical issues include a bug fixed in April 2025 affecting WSUS installations and another issue resolved in August 2025 related to the Windows 11 24H2 cumulative update. Additionally, a KIR fix was provided for a known issue causing the May 2026 Windows 11 security update to fail with error code 0x800f0922.

Winsage

May 18, 2026

Windows boot partition runs out of space for Microsoft’s May security update

Microsoft has acknowledged a potential issue with its May 2026 security update, which may fail to install properly due to insufficient space in the EFI System Partition (ESP). If the available space in the ESP drops below 10 MB, users may encounter a 0x800f0922 error code, leading to installation failures during the reboot phase. This issue affects Windows 11 versions 25H2 and 24H2. Microsoft has proposed two solutions: a registry edit or a Known Issue Rollback (KIR), which has already propagated to consumer and non-managed business devices. The update addresses several critical Microsoft CVEs, although there have been no reports of active exploitation.

Winsage

May 18, 2026

Microsoft confirms Windows 11 security update install issues

Microsoft has acknowledged a significant issue with the May 2026 Windows 11 security update, KB5089549, where users are encountering difficulties in installation, specifically the 0x800f0922 error code. This issue is primarily due to insufficient free space on the EFI System Partition (ESP), especially for devices with 10 MB or less available. The installation may fail during the reboot phase at around 35–36% completion, with users receiving notifications like "Something didn't go as planned. Undoing changes." Log entries may indicate insufficient ESP free space, such as "SpaceCheck: Insufficient free space" and "ServicingBootFiles failed. Error = 0x70." Microsoft recommends affected users utilize the Known Issue Rollback feature to reverse problematic updates and advises IT departments to install and configure the relevant Group Policy to address the issue.

Winsage

May 17, 2026

I got tired of hunting through Windows for every setting, so I built my own control center

The utility created simplifies Windows management by consolidating various settings and diagnostics into a single interface. It provides an overview of system metrics such as DNS latency, system uptime, and temporary file accumulation. The application includes dedicated pages for health checks, network insights, services, scheduled tasks, drives, drivers, power plans, gaming toggles, privacy settings, and taskbar configuration. Each diagnostic is executed through PowerShell scripts, with results displayed in a user-friendly format. The utility maintains transparency by creating .reg backups before modifying the registry and allows users to revert changes easily. It is open-source, lightweight, and designed for personal use rather than debloating. The program's structure enables users to inspect and modify scripts, ensuring clarity and control over system adjustments.