PowerShell scripts Archives

Winsage

August 12, 2026

Microsoft shares details of a clever old Windows trick it no longer needs

Microsoft's WINSTART.BAT file is a batch file that predates Windows 95 and was documented in the Windows 3.1 Resource Kit. Its primary function is to load terminate-and-stay-resident (TSR) programs for use by Windows applications, while these TSRs are not accessible to individual MS-DOS virtual machines. WINSTART.BAT is executed after the virtual machine manager (VMM) initializes, giving it an advantage over AUTOEXEC.BAT, which runs during the MS-DOS startup phase. TSRs loaded via AUTOEXEC.BAT are available to both Windows and MS-DOS environments, while those loaded through WINSTART.BAT are limited to Windows applications only.

Winsage

August 8, 2026

There’s an x64 Port of Microsoft Word 1.1a for Windows

Developer John Marshall has successfully ported Microsoft Word for Windows 1.1a to run on Windows 11 as a native 64-bit executable. This project involved reconstructing the original application from the early 1990s by translating 16-bit Assembly language into C/C++ code and adapting it to modern Win32 APIs. Marshall's work was made possible by Microsoft's release of the source code for Word for Windows 1.1a in 2014. Users interested in setting up the port will need Visual Studio with the C++ workload, the latest Windows SDK, CMAKE version 3.25 or newer, and to execute specific PowerShell scripts provided by Marshall.

Winsage

July 29, 2026

Missed Windows 11 Secure Boot? Don’t panic, Microsoft is still pushing it in the coming months

Microsoft reassured Windows 11 and Windows 10 users that their PCs will continue to boot normally and receive updates even if they have not yet received the new Secure Boot 2023 certificates. The rollout of these certificates is expected to continue over the upcoming months. The initial Secure Boot certificate expired on June 24, 2026, and Microsoft has been replacing older 2011 certificates since 2024. The latest update, KB5101650, transitioned Windows 11 to OS builds 26200.8875 and 26100.8875 for versions 25H2 and 24H2, respectively. The 2023 certificates replace older certificates with modern cryptographic standards, allowing Microsoft to deliver DBX revocation updates without interruption. Devices using the 2011 KEK can only receive DBX updates signed with that key, which is no longer valid after June 24. Microsoft has been rolling out the 2023 certificates for the past two years, and many devices remained in a yellow or red status by the June deadline. To check Secure Boot status, users can navigate to Windows Security > Device Security. A green checkmark indicates successful application of the certificates, while yellow and red alerts indicate compatibility issues or firmware incompatibility. PCs that are older or operating in Legacy BIOS mode will not receive the updates. Windows 10 also receives Secure Boot updates, but enrollment in Extended Security Updates (ESU) is required.

Winsage

July 18, 2026

Windows 11 Secure Boot certificates have expired, and Microsoft says what to do next

Microsoft held its OEM Secure Boot Office Hours event on July 15, where engineers collaborated with OEM representatives from companies like Acer, Asus, Cisco, Dell, and HP. IT administrators were able to ask live questions about the Secure Boot 2023 rollout. The discussion thread became a detailed technical record, especially following the expiration of the first certificates three weeks prior. Concerns raised by IT admins included BitLocker recovery loops, stuck confidence ratings, and unhelpful Intune error codes. Key facts include: - Devices offline for long periods will still receive the 2023 certificates upon reconnecting to Windows Update. - Devices with existing 2023 certificates in firmware will switch to the new boot manager after the latest Windows patches are installed. - A new script, Detect-SecureBootCertUpdateStatus.ps1, is available in Windows for checking certificate status. - BIOS updates may reset a device’s confidence rating to unrated, which is normal and does not indicate certificate failure. - Admins should edit the AvailableUpdates registry key, not the AvailableUpdatesPolicy, which is managed by Intune and Group Policy. - A licensing bug affecting AvailableUpdatesPolicy on devices upgraded from Pro to Enterprise was resolved by Microsoft in 2026. - BitLocker recovery is not typically linked to the certificate update process but may relate to firmware or PCR issues. - Dell and HP provided guidance on which BIOS versions include the 2023 certificates for their newer models. - Older HP EliteBook 840 G5 units require a manual update package for the new certificates. - Eligible devices can still receive the 2023 certificates in the future, and Surface devices released from 2024 onward come pre-equipped with them. - Microsoft confirmed that devices running 2011 certificates will not lose the ability to receive the 2023 chain. - The Microsoft Corporation KEK CA 2011 and Microsoft UEFI CA 2011 certificates have expired, with the Microsoft Windows Production PCA 2011 set to expire on October 19, 2026.

Winsage

May 28, 2026

Your Windows PC has a security deadline in June 2026

A Secure Boot certificate refresh is being deployed across supported Windows devices via Windows Update. The Secure Boot certificates from 2011 will begin to expire in June 2026, prompting Microsoft to introduce new 2023-dated certificates to maintain security. Most users will require minimal action if their PCs are updated, but older devices may face challenges. The current certificates include: - Microsoft Corporation KEK CA 2011: expires June 24, 2026 - Microsoft UEFI CA 2011: expires June 27, 2026 - Microsoft Windows Production PCA 2011: expires October 19, 2026 The new certificates will remain valid until 2038, with plans for post-quantum cryptography around 2030. While PCs using the 2011 certificates will continue to function, they will lose access to new security protections, making them vulnerable to emerging threats. A notable example of such a threat is the BlackLotus bootkit, which exploited vulnerabilities to bypass Secure Boot. Microsoft's rollout strategy involves a staged update process that typically takes around 48 hours and may require restarts. Users are advised to keep Windows updated and check their Secure Boot status. Known issues may arise for older PCs, systems that bypassed Windows 11 requirements, Legacy BIOS systems, and custom firmware configurations. IT teams managing devices should inventory their systems, monitor specific event IDs, test updates, and document devices that cannot be updated.

Winsage

May 17, 2026

I got tired of hunting through Windows for every setting, so I built my own control center

The utility created simplifies Windows management by consolidating various settings and diagnostics into a single interface. It provides an overview of system metrics such as DNS latency, system uptime, and temporary file accumulation. The application includes dedicated pages for health checks, network insights, services, scheduled tasks, drives, drivers, power plans, gaming toggles, privacy settings, and taskbar configuration. Each diagnostic is executed through PowerShell scripts, with results displayed in a user-friendly format. The utility maintains transparency by creating .reg backups before modifying the registry and allows users to revert changes easily. It is open-source, lightweight, and designed for personal use rather than debloating. The program's structure enables users to inspect and modify scripts, ensuring clarity and control over system adjustments.

Winsage

May 16, 2026

I got tired of hunting through Windows for every setting, so I built my own control center

The utility developed streamlines access to Windows diagnostics and tweaks, consolidating functionalities typically spread across various settings panels into a single interface. It features an overview page with key system metrics and organized sections for health checks, network details, services, scheduled tasks, drives, drivers, power plans, gaming settings, privacy options, and taskbar adjustments. Each diagnostic is executed via PowerShell scripts that output JSON data for display. The application ensures transparency in registry changes by creating .reg backups before modifications and allows users to revert changes easily. It focuses on practical tweaks rather than debloating, maintaining a lightweight design without extensive features. The tool is open source and available on GitHub.

Winsage

May 12, 2026

Hackers Can Hide Malware Inside Images to Hack Windows

Researchers at Cyfirma have identified a cyberattack campaign named Operation SilentCanvas that targets Windows systems using deceptive JPEG files to infiltrate devices. The attack begins with victims receiving a file named sysupdate.jpeg, which contains a PowerShell script instead of an image. This script establishes staging environments and downloads additional malicious components while avoiding detection. The malware reconstructs command strings at runtime and downloads a secondary payload called access.jpeg, executed in memory. It exploits Microsoft's .NET compiler to create a custom launcher named uds.exe on infected machines. The malware takes control of a registry key to create a hidden desktop environment for undetected execution of malicious tools and installs a persistent Windows service, OneDriveServers, to maintain activity after reboots. Additionally, it can intercept usernames and passwords at the Windows login screen and create hidden local administrator accounts for long-term access. Security teams are advised to monitor the execution of commonly abused Windows binaries like csc.exe and ComputerDefaults.exe to mitigate risks.

Winsage

April 28, 2026

Microsoft Releases Enterprise Policy Option to Disable Windows 11 Copilot

Microsoft has introduced a new enterprise policy setting that allows IT administrators to silently uninstall the Microsoft Copilot app from managed Windows 11 devices. The RemoveMicrosoftCopilotApp policy became available after the April 2026 Patch Tuesday security updates and is compatible with enterprise management solutions like Microsoft Intune and System Center Configuration Manager (SCCM). Administrators can find the policy in the Group Policy Editor under User Configuration > Administrative Templates > Windows AI > Remove Microsoft Copilot App. It specifically targets Windows 11 Pro, Enterprise, and Education SKUs, excluding Home edition users. The uninstallation process is triggered when three conditions are met: Microsoft 365 Copilot is installed on the device, it was provisioned (not user-installed), and it has not been launched by the user in the last 28 days. The policy was initially available for Windows Insiders in January 2026 and became generally accessible afterward. However, future updates or user reinstalls from the Microsoft Store may reintroduce the Copilot app, necessitating ongoing policy enforcement for permanent removal. Organizations seeking broader exclusion may need to use PowerShell scripts or additional MDM configurations.

Winsage

April 10, 2026

“This is exactly the kind of thing driving me away from Windows”: even Edge users don’t want this new feature

Recent polling data shows that Microsoft Edge users dislike the browser's automatic launch upon logging into Windows 11. Microsoft is testing a feature that would have Edge open automatically at startup, which has sparked significant discussion and frustration among users. A banner notifying select users of this change has been observed, and the behavior has been confirmed in the latest Edge Beta build. User reactions on Reddit include strong negative sentiments, with some users threatening to abandon Windows 11 if this feature is enforced. Despite the backlash, Microsoft Edge is viewed as a competent browser, though its aggressive promotion tactics may alienate potential users.