IT administrators Archives

Winsage

July 22, 2026

Redmond’s reaper cometh: October 2026 set to bury a graveyard of Microsoft products

October 2026 will see the end of support for several Microsoft products, including Office LTSC 2021, which requires organizations to transition to LTSC 2024 or Microsoft 365 for continued support. Windows Server 2022 will exit mainstream support on October 13, 2026, while Windows 11 24H2 Home and Pro editions will also reach their end of life on the same date. The enterprise and education versions of Windows 11 23H2 will be supported until November 10, 2026. Publisher 2021 will be discontinued without a successor. Additionally, Entra ID Sign-In risk policies will be phased out on October 1, 2026, necessitating a transition to Conditional Access to maintain user and sign-in risk protection. SQL Server 2017 is scheduled for retirement in October 2027.

Winsage

July 20, 2026

Microsoft confirms Windows Server Update Services sync delays

Microsoft is addressing an issue impacting Windows Server Update Services (WSUS) servers, causing synchronization challenges for over a week. WSUS, used to manage updates for Microsoft products across enterprise networks, typically syncs daily with Microsoft Update servers. The ongoing issue has disrupted this process, affecting both client platforms (Windows 10 version 1607 and later) and server platforms (Windows Server 2012 and later). Microsoft acknowledged reports of increased synchronization times and sync operation timeouts, with the situation escalating on July 13, 2026. Mitigation measures were implemented to alleviate synchronization issues for newly installed or rebuilt WSUS servers, and Microsoft is working on solutions for previously affected servers. Synchronization times have been restored for new installations, but efforts continue to assist customers in removing affected metadata from older servers. This is not the first WSUS-related challenge for Microsoft; similar issues occurred in May 2025 and July 2025, with resolutions provided shortly after.

Winsage

July 19, 2026

Windows 11 Secure Boot is a messy ride on older PCs, and even Microsoft can’t fix it

Microsoft held an OEM Secure Boot Office Hours event with manufacturers like Acer, Asus, Dell, and HP to discuss issues related to the Windows 11 Secure Boot 2023 certificate rollout. Many IT administrators left with unresolved concerns, particularly regarding Secure Boot certificate errors. Participants reported persistent problems, including failures of suggested solutions from official documentation to apply to their hardware configurations. Ed Tittel shared his experience with compliance issues related to CA-2023 certificates, noting that ASUS motherboards sometimes required Secure Boot to be disabled temporarily, while MSI models exhibited erratic behavior. ASRock systems needed manual key resets, and documentation was lacking. Devices from Dell, HP, and Lenovo performed better but still faced staggered rollouts and required multiple reboots for BIOS updates. Specific issues raised included HP's BitLocker recovery loop persisting even with the latest BIOS, challenges with legacy device support from HP, devices showing Secure Boot Status as Unknown, and failures in updating the KEK on HP EliteBooks. Some questions from IT administrators regarding Dell and HP went unanswered during the session. The experiences highlighted a trend of Secure Boot issues across multiple OEMs, not limited to a single vendor. IT administrators are advised to pilot updates on representative hardware, back up BitLocker recovery keys, and consult OEM-specific advisories. The unresolved issues reflect common challenges faced by users, indicating that problems with Secure Boot certificate deployments are widespread across various manufacturers.

Winsage

July 19, 2026

Microsoft confirms WSUS service degradation impacting all versions of Windows

A significant issue has emerged with the Windows Server Update Service (WSUS), affecting all versions of Windows client and server. Microsoft acknowledged the service degradation that began before July 14, coinciding with the latest Patch Tuesday. This degradation has caused prolonged synchronization times and occasional timeouts during sync operations on WSUS servers, attributed to a buildup of publishing metadata. Microsoft is working on a resolution to improve performance and restore synchronization times. The affected platforms include various versions of Windows 11, Windows 10, and Windows Server from 2012 to 2025. An update is expected to be released shortly to address the issue.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

July 17, 2026

Windows 11 Gets Policy to Automatically Grant SSO Permissions

Microsoft has introduced a new policy to simplify the Windows sign-in process for IT administrators by allowing automatic approval of Single Sign-On (SSO) permissions on eligible managed devices. This feature will be available with the July 2026 security update for Windows 11 versions 24H2 and 25H2. Users in the European Economic Area (EEA) have been facing prompts for consent due to regulatory changes, prompting Microsoft to streamline access for managed devices. IT administrators can use a specific registry setting (HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, Value: AutoAcceptSsoPermission (DWORD) = 1) to automatically grant SSO permissions. This feature is designed for managed enterprise devices linked to Microsoft Entra ID and does not affect personal accounts or unmanaged devices. Organizations must ensure their devices are updated and can enable the feature through various enterprise management tools.

Winsage

July 16, 2026

Microsoft makes Windows SSO prompts easier to manage

Microsoft is introducing a registry-based policy to improve the management of Single Sign-On (SSO) permissions for devices running Windows 11 versions 24H2 and 25H2, specifically for those managed through Microsoft Entra ID. This policy allows IT administrators to automatically accept SSO permissions, enhancing the user experience in corporate environments. Users with personal Microsoft accounts or unmanaged devices will still receive prompts for SSO permissions. The change aims to provide users, particularly in the European Economic Area (EEA), with more control over their account usage across Microsoft applications. Deployment options for IT administrators include Group Policy, Microsoft Intune, other mobile device management solutions, Microsoft Configuration Manager, and any management tool that supports registry policy deployment. Administrators are advised to validate SSO behavior after deployment.

Winsage

July 16, 2026

Windows 11 gets new registry policy to give IT admins more control

Microsoft will introduce a new registry policy in Windows 11 in July 2026 that allows IT administrators to enable automatic acceptance of single sign-on (SSO) prompts on managed devices. This policy will streamline user authentication by using Windows sign-in credentials automatically for Microsoft apps or services, reducing the need for manual authentication. The registry path for this policy is HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, with the value AutoAcceptSsoPermission (DWORD) set to 1. It can be deployed using Group Policy Objects (GPO), Intune, Microsoft Configuration Manager, or mobile device management (MDM) tools. This setting is applicable only to Windows 11 versions 25H2 and 24H2 that have received the July 2026 Patch Tuesday updates (KB5101650 and KB5094126) and is designed for managed devices using Entra ID accounts, not personal Microsoft accounts or unmanaged devices.

Winsage

July 15, 2026

Dell PCs are shutting down after Windows 11’s July update, Microsoft admits and blocks it

Microsoft has blocked the Windows 11 July 2026 update (KB5101650) on certain Dell PCs due to issues causing unexpected shutdowns, diminished performance, excessive heat, and battery drain. The problems are linked to the Intel Innovation Platform Framework Processor Participant driver, which affects power management. The complications stem from an optional June 2026 update (KB5095093) that introduced changes impacting the performance of some Dell PCs. Microsoft has not provided a list of affected models but is working with Dell to resolve the issue. The July update has been preemptively blocked from installation on incompatible devices, and a resolution is expected soon.

Winsage

July 13, 2026

Microsoft demystifies how Windows updates work

Microsoft has released a guide on the Windows servicing model, detailing monthly security updates, optional preview releases, hotpatch updates, and feature rollout mechanisms. Patch Tuesday occurs every second Tuesday of the month, delivering cumulative security updates to supported Windows versions. For consumers and small businesses, updates are managed through Windows Update, while enterprises can use various tools like Windows Autopatch and WSUS. Hotpatch updates, which focus on security fixes, can be installed without a restart, unlike quarterly baseline updates that require one. Optional non-security preview updates are released in the fourth week of each month for testing upcoming fixes and new features, available only for the latest supported Windows versions. Unmanaged devices can access these updates through Windows Update settings, while IT-managed devices depend on organizational policies. Microsoft also issues out-of-band updates to address urgent issues, which can be deployed through enterprise management tools. New features for Windows 11 are rolled out throughout the year via various channels, with a gradual rollout strategy to monitor quality and compatibility, using the Controlled Feature Rollout approach.