LAN

Winsage
January 30, 2026
Microsoft will disable the NTLM authentication protocol by default in the next major Windows Server release and associated Windows client versions. NTLM, introduced in 1993, has been vulnerable to various cyberattacks, including NTLM relay and pass-the-hash attacks. The transition plan includes three phases: enhanced auditing tools in Windows 11 24H2 and Windows Server 2025, new features like IAKerb and a Local Key Distribution Center in late 2026, and eventually disabling network NTLM by default in future releases. NTLM will remain in the operating system but will not be used automatically. Microsoft deprecated NTLM authentication in July 2024 and has encouraged developers to transition to Kerberos or Negotiation authentication.
Winsage
December 15, 2025
Microsoft has acknowledged that recent security updates for Windows 11 are causing networking complications for enterprise users utilizing the Windows Subsystem for Linux (WSL), particularly affecting those who installed the KB5067036 update from October 28, 2025, or subsequent updates like KB5072033. Users are experiencing difficulties with certain third-party VPN applications when the mirrored mode networking feature is enabled, leading to "No route to host" errors within WSL environments. This issue primarily impacts OpenVPN and Cisco Secure Client. The root cause is the failure of VPN applications' virtual network interfaces to respond to Address Resolution Protocol (ARP) requests. Home users on Windows Home or Pro editions are unlikely to be affected. Microsoft is investigating the issue but has not provided a timeline for a resolution or workarounds. WSL, launched in March 2018, allows users to run Linux distributions natively on Windows, with WSL 2 introduced in May 2019 featuring a real Linux kernel. Microsoft open-sourced WSL at Microsoft Build 2025, making its source code available on GitHub, except for some components that remain part of Windows.
Tech Optimizer
November 13, 2025
Emotet is a Trojan Horse malware that emerged in 2014, impacting over 1.6 million devices and originally designed to steal banking credentials. Developed by the MealyBug criminal organization, it evolved into a modular Trojan-dropper, enabling it to download various payloads and act as Malware-as-a-Service on the dark web. Emotet spreads primarily through spam emails, often using malicious Word or Excel files, and has been disseminated via local area networks and password-protected zip folders. The malware operates through botnets categorized into epochs, with Epochs 1, 2, and 3 dismantled in 2021 by a coordinated international operation. Following this, Emotet resurfaced in November 2021 as Epochs 4 and 5, incorporating a Cobalt Strike beacon for enhanced propagation. Recommended precautions include keeping software updated, using two-factor authentication, and educating employees about email threats. Network administrators are advised to block unscannable email attachments, configure specific email filters, and maintain secure backups.
Winsage
October 24, 2025
Following the October 2025 Patch Tuesday updates, many Windows users experienced issues with the File Explorer preview pane, which stopped functioning for several file types. This change, implemented by Microsoft as a security enhancement, affects both Windows 11 and Windows 10 and is linked to a vulnerability associated with NTLM credential hashes. The updates, KB5066835 for Windows 11 and KB5066791 for Windows 10, disable the preview functionality for files marked with the "Mark of the Web" (MotW), indicating they originated from the internet. Instead of a preview, users receive a warning message about potential harm from the file. Microsoft has provided workarounds for users who wish to restore the preview functionality, including manually unblocking files or adjusting security settings for network shares, though these methods come with security risks. This change reflects a broader industry trend toward prioritizing security over user convenience.
Search