Microsoft Archives

Winsage

July 16, 2026

Windows 11 has more recovery options than ever, and here’s exactly when I would use each one to fix a broken PC

Microsoft has enhanced Windows 11 with various recovery tools that allow users to address system issues without needing to perform a complete reinstall. Key features include: - Reset This PC: Offers two options: "Keep my files" (reinstalls Windows while retaining personal files) and "Remove everything" (wipes the computer before reinstalling). Users can choose between a Local reinstall or Cloud download. - Cloud Rebuild: Accessible via the Windows Recovery Environment (WinRE), it reformats the OS partition, downloads a fresh Windows image, and restores the original setup without relying on local recovery images. - Go Back (Rollback): Allows users to revert to a previous installation after an upgrade if issues arise, utilizing the Windows.old folder, but is time-sensitive (files purged after about ten days). - Uninstall Updates: Enables users to remove recent updates that may cause problems without a full system reset. - System Restore: Creates restore points to revert to a stable state without affecting personal files. - Startup Repair: A tool in WinRE that scans for and fixes common startup issues. - Safe Mode: Starts Windows with essential drivers and services to troubleshoot problems. - Quick Machine Recovery: Automatically connects to Microsoft's recovery service to download fixes if Windows fails to start due to a faulty update or driver. - Point-in-Time Restore: Automatically reverts the system to a previous working state when updates fail. Other tools include the Windows Recovery Environment (WinRE), Recovery Drive for bootable USB access, Command Prompt, Startup Settings, and the Windows Backup app for restoring settings and files. The legacy Backup and Restore (Windows 7) tool is still available for creating backups and full system images.

Winsage

July 16, 2026

Microsoft is ending support for some versions of Windows 10 and 11 soon

Microsoft has extended support for Windows 10 Extended Security Updates (ESU) until October 2027. Windows 11 version 24H2 will reach end of support on October 13, 2026, along with Windows 10 Enterprise LTSB 2016. Windows 11 versions typically offer 24 months of support for Home and Pro editions, while Windows 10 Enterprise LTSB 2016 had five years of mainstream support followed by five years of extended support. Windows 11 version 23H2 is also expected to sunset around the same time. Users on Windows 11 version 24H2 Home and Pro are recommended to upgrade to version 25H2, with version 26H2 anticipated soon. Windows 11 Enterprise and Education SKUs of version 24H2 have an extra year of support until October 12, 2027. Organizations using Windows 10 Enterprise LTSB 2016 should consider transitioning to Windows 10 Enterprise LTSC 2024 or purchasing ESUs separately.

Winsage

July 16, 2026

Windows 11 gets new registry policy to give IT admins more control

Microsoft will introduce a new registry policy in Windows 11 in July 2026 that allows IT administrators to enable automatic acceptance of single sign-on (SSO) prompts on managed devices. This policy will streamline user authentication by using Windows sign-in credentials automatically for Microsoft apps or services, reducing the need for manual authentication. The registry path for this policy is HKLMSOFTWAREPoliciesMicrosoftWindowsAAD, with the value AutoAcceptSsoPermission (DWORD) set to 1. It can be deployed using Group Policy Objects (GPO), Intune, Microsoft Configuration Manager, or mobile device management (MDM) tools. This setting is applicable only to Windows 11 versions 25H2 and 24H2 that have received the July 2026 Patch Tuesday updates (KB5101650 and KB5094126) and is designed for managed devices using Entra ID accounts, not personal Microsoft accounts or unmanaged devices.

Winsage

July 16, 2026

See how the iconic Windows XP Bliss wallpaper location has changed over the years

Windows XP's default wallpaper, known as Bliss, was photographed by Charles O’Rear in January 1996 while he was driving on Highway 121 in Sonoma County, California. The image was taken after a storm, showcasing vibrant grass and fluffy clouds, using a medium-format Mamiya RZ67 camera with Fujifilm Velvia film. Microsoft acquired the rights to the photograph through Corbis and made it the default desktop background for Windows XP starting in 2001. The landscape has evolved over the years, with vineyards being removed due to a phylloxera infestation, resulting in a lush green hill that has changed with cycles of planting and removal.

Winsage

July 15, 2026

Windows 11 finally gets an undo button for your entire PC

Microsoft unveiled its July 2026 Patch Tuesday update, identified as KB5101650, for Windows 11 versions 25H2 and 24H2. The update introduces the Point-in-Time Restore (PITR) feature, allowing users to take full backups and create snapshots every 4 to 24 hours, with snapshots retained for a maximum of 72 hours. PITR can restore local files and applications. Users can now pause Windows updates for up to 35 days. Other enhancements include discreet widget operation, optimized taskbar notifications, faster File Explorer startup, quicker disk image mounting, improved Bluetooth functionality, reduced eye strain through screen tinting, and enhancements in voice control and input capabilities. Not all features will be available immediately after installation, with security-related improvements being deployed universally.

Winsage

July 15, 2026

Microsoft patches record 570 Windows security bugs with two exploited zero days

Microsoft released its July Patch Tuesday updates, addressing 570 security vulnerabilities in Windows, a record number for the company. This update includes three zero-day vulnerabilities, two of which have been exploited in real-world attacks, affecting Microsoft’s Active Directory and SharePoint, while the third concerns BitLocker encryption. The update also enhances Windows features, including changes to the Widgets app, improvements in File Explorer speed, refined Bluetooth connectivity, and a new feature allowing users to pause updates until a specific date. However, the update has been temporarily halted for certain Dell computers due to compatibility issues, with Microsoft working on a fix.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

Winsage

July 15, 2026

Here’s how to update every app on your Windows PC with a single command

Updating Windows applications is important for accessing the latest features and protecting against vulnerabilities. Many users neglect this due to forgetfulness or the time-consuming nature of the process. The Microsoft Store and Windows Update usually provide updates for native Windows applications, but a unified method for updating all programs is lacking. Windows includes a command called winget (Windows Package Manager) that allows users to update all applications simultaneously via the command line. The command to update all apps is:


winget upgrade --all

This command updates both traditional installers and Microsoft Store apps. Users can also update individual apps by specifying the app ID, for example:


winget upgrade "Chrome"

To view all applications managed by winget, the command is:


winget list

To skip confirmation prompts during updates, users can use:


winget upgrade --all --accept-source-agreements --accept-package-agreements

For complete automation, users can create a task in Task Scheduler to run at startup with the following setup: 1. Open Task Scheduler and create a basic task named "Winget Auto Update." 2. Set the trigger to run when the computer starts. 3. Choose to start a program, entering PLACEHOLDER216a2cf34dab649d in Program/script and PLACEHOLDERbe861b18048fd836 in Add arguments. 4. Set the task to run with the highest privileges and add a 1-minute delay to ensure network connectivity. While winget does not cover every Windows application, it effectively manages most mainstream applications.

Winsage

July 15, 2026

Windows 0-day drops the same day Microsoft releases record number of patches

Will Dormann, a senior principal vulnerability analyst at Tharros Labs, discussed a vulnerability that allows attackers to gain administrator privileges by configuring a system to execute their code upon an admin user's login. This vulnerability enables non-admin users to modify the classes registry hive of an admin user, posing a significant risk. It could be exploited without user interaction and may be combined with another vulnerability that provides direct access to an administrative account. Microsoft is aware of the issue and is investigating it, encouraging coordinated disclosure from vulnerability reporters. Independent researcher Kevin Beaumont has created a detection script to help protect against this vulnerability, along with recommendations to restrict local non-user accounts, monitor the ProfSvc for unexpected hive loads, and track activity related to NTUSER.DAT and UsrClass.dat files.

Winsage

July 15, 2026

Windows 11’s 500GB storage bug is fixed. How to check if you’re good

Microsoft's July Patch Tuesday update addressed a significant storage issue for Windows 11 users related to the CapabilityAccessManager.db-wal file, which had been consuming excessive storage space, with reports of usage reaching up to 500 GB. The bug originated from the Capability Access Manager service, which normally allows the file to occupy only a few megabytes. Update KB5101650 was released to fix this issue, improving disk space usage for the file. However, it is unclear if existing oversized WAL files will automatically resize. Users are advised to check the size of their WAL file using the Command Prompt or third-party tools, and if it remains large, to delete it following the update documentation.