Intune Archives

Winsage

August 12, 2026

OneDrive Photos Lands on Windows 11 by Accident

A new application, OneDrive Photos, has started appearing on Windows 11 PCs since August 1, despite being incompatible with enterprise machines. Microsoft acknowledged that the rollout exceeded its intended scope and is working on a remedy. Users cannot remove the app without uninstalling OneDrive entirely. OneDrive Photos functions as a web app, scanning local photos without requiring a Microsoft account sign-in and offering features like search and albums. There is no separate uninstall option for the app; removing it necessitates uninstalling OneDrive, which also eliminates File Explorer integration. Microsoft plans to introduce separate removal controls in the future, and the app will be removed from unsupported Intune-managed PCs.

Winsage

August 9, 2026

Microsoft confirms it accidentally installed new OneDrive app on Windows 11 PCs, and there’s no easy way to remove it yet

Microsoft has unintentionally rolled out its AI-powered OneDrive Photos app on Windows 11, affecting enterprise PCs where it is non-functional. The app was initially limited to select consumer PCs but became widely available starting August 1, 2026. Microsoft confirmed that this rollout was not intended and is working on a solution to allow users to remove OneDrive Photos independently from the OneDrive sync client. Currently, the app cannot be uninstalled without removing OneDrive entirely. OneDrive Photos serves as a centralized hub for viewing images stored locally and in the cloud, integrating with OneDrive.com’s Gallery. It appears in search results above the traditional Microsoft Photos app, even on systems not part of the Windows Insider Program. IT administrators have expressed frustration over its unexpected presence on enterprise PCs, as the app is designed for personal accounts.

Winsage

August 7, 2026

Microsoft admits it force-installed AI-powered OneDrive on Windows 11, says it’s not training on your faces (really)

Microsoft has confirmed that it has force-installed the OneDrive Photos app on Windows 11 PCs, including enterprise devices managed through Intune, despite the app being designed for personal Microsoft accounts only. IT departments can either remove OneDrive entirely or keep both the sync client and the new app. Microsoft acknowledged the unintended rollout but has not provided further clarification. The OneDrive Photos app features an AI-enhanced "People" feature, which is disabled by default and does not analyze photos stored solely on users' PCs. Face grouping occurs only in the cloud on images stored in OneDrive, and any data collected is deleted within 30 days if the feature is turned off. Users currently cannot remove the app independently; doing so requires the complete removal of OneDrive. An update is expected to allow users to uninstall the OneDrive Photos app separately.

Winsage

August 6, 2026

Windows 10 LTSC 2021 has five months before security updates cost extra

Microsoft has announced that support for Windows 10 Enterprise LTSC 2021 will end on January 12, 2027, coinciding with the release of a final security update. Organizations can enroll in the Extended Security Updates (ESU) program to maintain security updates beyond this date, which will cost per device in Year 1, with prices doubling each subsequent year until the program ends on January 8, 2030. ESU sales will start on September 1, 2026, and licenses are cumulative. The ESU program does not cover Windows 10 IoT Enterprise LTSC, which is supported until January 13, 2032. Organizations using Microsoft’s cloud-based update services can receive a 25 percent discount on the Year 1 price. As of July, 16.9 percent of monitored devices were still running Windows 10, with migration to Windows 11 stalling due to compatibility issues and hardware requirements.

Winsage

August 4, 2026

Microsoft never learns, IT admins rage as a new OneDrive app invades Windows 11 and keeps coming back when you remove it

Microsoft has begun silently installing the "OneDrive Photos" app on Windows PCs, including enterprise systems managed via Microsoft Intune, without prior notification. IT professionals have expressed significant frustration over this unexpected addition, noting that the app is incompatible with Entra accounts and cannot be removed without uninstalling OneDrive entirely. The app functions as a web-based gallery feature, indexing and displaying photos stored on local machines, but its necessity is questioned due to the existing Microsoft Photos app. OneDrive Photos is linked to the OneDrive sync client, making it impossible to uninstall independently. Users have reported that the app appears in Windows Search results with an 'Uninstall' option but does not show up in the Installed apps page, leading to confusion. A script has been developed to remove the shortcut, but it often reappears due to its connection with the OneDrive sync client. Discussions with Microsoft suggest that the rollout may have been unintended, with an apology expected soon.

Winsage

August 1, 2026

Microsoft brings a long awaited “game changer” Windows 11 tool for IT admins

Microsoft announced enhancements for Windows 11 aimed at optimizing performance and resource utilization, potentially reconsidering the minimum system requirements. A new tool for IT administrators was introduced in the July Intune update (Service Release 2607), which includes native support for Registry Inventory. This feature allows administrators to assess system configurations more accurately, aiding in troubleshooting, compliance, and security. The Registry Inventory feature operates through Intune's Properties catalog, enabling administrators to monitor specific registry keys. Detailed reports are generated for each configured entry, providing information on registry key paths, value names, types, and data. The data collected is accessible from the Device inventory page, and the initial release supports common collection patterns for HKEYLOCALMACHINE (HKLM) registry paths. Registry Inventory is included with Microsoft Intune Plan 1. Other enhancements in the Intune update include management capabilities for Samsung firmware updates.

Winsage

July 29, 2026

Microsoft Intune Adds macOS Compliance and Samsung Update Controls

Microsoft's July Intune update includes enhancements for IT administrators, such as real-time monitoring of Windows device sync progress, custom compliance settings for macOS, and improved firmware update management for Samsung devices. The Intune admin center now allows real-time monitoring of sync progress for Windows devices, enabling simultaneous updates across various management aspects. Custom compliance settings for macOS enable organizations to define specific compliance requirements beyond Apple's standard checks, allowing for a unified compliance management experience across Windows, Linux, and macOS. The update also enhances Samsung Galaxy firmware management through Samsung Knox E-FOTA, allowing administrators to control firmware version deployment and update schedules. Additionally, the update clarifies that newer Windows Autopilot methods allow provisioning of Windows 11 devices without prior registration.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 19, 2026

The 200GB catch hiding in Windows 11’s new recovery feature

Microsoft has introduced point-in-time restore for Windows 11 users, enhancing the traditional System Restore. This new recovery tool allows users to recover their PCs from software issues, problematic drivers, or faulty updates, even when Windows won’t boot. It uses the Volume Shadow Copy Service (VSS) to automatically generate restore points every 24 hours, which include both system and user files, unlike System Restore. Point-in-time restore manages storage by deleting restore points after 72 hours and integrates seamlessly into Windows Settings, being activated by default for volumes over 200GB. Users with smaller volumes must activate it manually. It also incorporates Reserved Storage to ensure restore points do not consume regular disk space. The feature is available on Windows 11 Home and Pro editions with the installation of the optional Preview Update KB5095093. Users can access point-in-time restore through Windows Settings under System > Recovery, and initiate recovery via the Windows Recovery Environment (Windows RE).

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.