Microsoft Archives

Winsage

July 16, 2026

Windows 11 gets new registry policy to give IT admins more control

Microsoft will introduce a new registry policy in Windows 11 in July 2026 that allows IT administrators to enable automatic acceptance of single sign-on (SSO) prompts on managed devices. This policy will streamline user authentication by using Windows sign-in credentials automatically for Microsoft apps or services, reducing the need for manual authentication. The registry path for this policy is HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, with the value AutoAcceptSsoPermission (DWORD) set to 1. It can be deployed using Group Policy Objects (GPO), Intune, Microsoft Configuration Manager, or mobile device management (MDM) tools. This setting is applicable only to Windows 11 versions 25H2 and 24H2 that have received the July 2026 Patch Tuesday updates (KB5101650 and KB5094126) and is designed for managed devices using Entra ID accounts, not personal Microsoft accounts or unmanaged devices.

Winsage

July 16, 2026

See how the iconic Windows XP Bliss wallpaper location has changed over the years

Windows XP's default wallpaper, known as Bliss, was photographed by Charles O’Rear in January 1996 while he was driving on Highway 121 in Sonoma County, California. The image was taken after a storm, showcasing vibrant grass and fluffy clouds, using a medium-format Mamiya RZ67 camera with Fujifilm Velvia film. Microsoft acquired the rights to the photograph through Corbis and made it the default desktop background for Windows XP starting in 2001. The landscape has evolved over the years, with vineyards being removed due to a phylloxera infestation, resulting in a lush green hill that has changed with cycles of planting and removal.

Winsage

July 15, 2026

Windows 11 finally gets an undo button for your entire PC

Microsoft unveiled its July 2026 Patch Tuesday update, identified as KB5101650, for Windows 11 versions 25H2 and 24H2. The update introduces the Point-in-Time Restore (PITR) feature, allowing users to take full backups and create snapshots every 4 to 24 hours, with snapshots retained for a maximum of 72 hours. PITR can restore local files and applications. Users can now pause Windows updates for up to 35 days. Other enhancements include discreet widget operation, optimized taskbar notifications, faster File Explorer startup, quicker disk image mounting, improved Bluetooth functionality, reduced eye strain through screen tinting, and enhancements in voice control and input capabilities. Not all features will be available immediately after installation, with security-related improvements being deployed universally.

Winsage

July 15, 2026

Microsoft patches record 570 Windows security bugs with two exploited zero days

Microsoft released its July Patch Tuesday updates, addressing 570 security vulnerabilities in Windows, a record number for the company. This update includes three zero-day vulnerabilities, two of which have been exploited in real-world attacks, affecting Microsoft’s Active Directory and SharePoint, while the third concerns BitLocker encryption. The update also enhances Windows features, including changes to the Widgets app, improvements in File Explorer speed, refined Bluetooth connectivity, and a new feature allowing users to pause updates until a specific date. However, the update has been temporarily halted for certain Dell computers due to compatibility issues, with Microsoft working on a fix.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 15, 2026

Here’s how to update every app on your Windows PC with a single command

Updating Windows applications is important for accessing the latest features and protecting against vulnerabilities. Many users neglect this due to forgetfulness or the time-consuming nature of the process. The Microsoft Store and Windows Update usually provide updates for native Windows applications, but a unified method for updating all programs is lacking. Windows includes a command called winget (Windows Package Manager) that allows users to update all applications simultaneously via the command line. The command to update all apps is:


winget upgrade --all

This command updates both traditional installers and Microsoft Store apps. Users can also update individual apps by specifying the app ID, for example:


winget upgrade "Chrome"

To view all applications managed by winget, the command is:


winget list

To skip confirmation prompts during updates, users can use:


winget upgrade --all --accept-source-agreements --accept-package-agreements

For complete automation, users can create a task in Task Scheduler to run at startup with the following setup: 1. Open Task Scheduler and create a basic task named "Winget Auto Update." 2. Set the trigger to run when the computer starts. 3. Choose to start a program, entering PLACEHOLDER216a2cf34dab649d in Program/script and PLACEHOLDERbe861b18048fd836 in Add arguments. 4. Set the task to run with the highest privileges and add a 1-minute delay to ensure network connectivity. While winget does not cover every Windows application, it effectively manages most mainstream applications.

Winsage

July 15, 2026

Windows 0-day drops the same day Microsoft releases record number of patches

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, discussed a vulnerability that allows attackers to gain administrator privileges by configuring a system to execute their code upon an admin user's login. This vulnerability enables non-admin users to modify the classes registry hive of an admin user, posing a significant risk. It could be exploited without user interaction and may be combined with another vulnerability that provides direct access to an administrative account. Microsoft is aware of the issue and is investigating it, encouraging coordinated disclosure from vulnerability reporters. Independent researcher Kevin Beaumont has created a detection script to help protect against this vulnerability, along with recommendations to restrict local non-user accounts, monitor the ProfSvc for unexpected hive loads, and track activity related to NTUSER.DAT and UsrClass.dat files.

Winsage

July 15, 2026

Windows 11’s 500GB storage bug is fixed. How to check if you’re good

Microsoft's July Patch Tuesday update addressed a significant storage issue for Windows 11 users related to the CapabilityAccessManager.db-wal file, which had been consuming excessive storage space, with reports of usage reaching up to 500 GB. The bug originated from the Capability Access Manager service, which normally allows the file to occupy only a few megabytes. Update KB5101650 was released to fix this issue, improving disk space usage for the file. However, it is unclear if existing oversized WAL files will automatically resize. Users are advised to check the size of their WAL file using the Command Prompt or third-party tools, and if it remains large, to delete it following the update documentation.

Winsage

July 15, 2026

Dark patterns in Windows are steering users to Edge: Mozilla-commissioned report

A report by Mozilla, titled "Over The Edge 2.0," reveals that Microsoft is using various tactics to promote its Edge browser, including misleading banners on Bing and pre-pinning Edge on the Windows taskbar. The report indicates that Microsoft hinders users' ability to download or set alternative browsers as default. It also notes that Microsoft's AI tool, Copilot, fails to recognize the default browser when opening links, and data-sharing settings are preselected to ON in regions like the US and India. Despite these efforts, Edge's market share has declined from 13 percent in June 2025 to just over 10 percent, while Mozilla's Firefox has increased from 5.84 percent to 6.44 percent. The Browser Choice Alliance and other browser developers have criticized Microsoft's practices, calling for fair competition.

AppWizard

July 15, 2026

GOG is now my go-to storefront for buying PC games since Sony and Microsoft are seemingly against it

Major players in the gaming industry, such as Sony and Microsoft, have recently made controversial decisions, including Sony discontinuing physical game discs and removing 500 movies without refunds, and Microsoft laying off around 3,200 Xbox game developers while suspending user accounts without justification. In contrast, GOG.com has emerged as a proponent of digital preservation, offering DRM-free games that come with standalone offline installers, allowing users to own their games permanently and play them without an online store's permissions. GOG encourages users to save their games to discs for sharing and backup purposes.