reinstallation Archives

Winsage

July 14, 2026

Thinking About Installing Windows on Your Steam Machine? Read This First

Valve has released Windows drivers for the Steam Machine, allowing users to replace SteamOS with Windows for greater software flexibility. This transition requires a complete OS overhaul and may result in performance issues due to reliance on generic AMD graphics drivers, as Valve does not provide official support for Windows on the Steam Machine. Users have encountered a hardware issue known as the “Red Bar of Death,” which can often be resolved through power resets and ensuring proper ventilation. The upcoming Steam Frame VR headset is designed to operate independently of a PC, featuring standalone capabilities and enhanced SteamOS integration, but its success will depend on competitive pricing and developer support. The Steam Machine faces challenges such as high pricing, aging hardware, and limited official support, impacting its competitiveness in the gaming market.

Winsage

July 12, 2026

We explain why Cloud Rebuild is one of Windows 11’s most important new features, and how it lets you recover your PC without a USB drive or complicated steps

Microsoft has introduced a new recovery feature for Windows 11 called Cloud rebuild, currently in preview mode. This feature allows users to restore their systems by downloading the Windows 11 image and necessary device drivers directly from Windows Update, eliminating the need for USB installation media or custom recovery images. OneDrive remains unaffected during the recovery process, enabling users to restore their files after signing back in. For organizations, devices managed via Windows Autopilot and Microsoft Intune can automatically re-enroll and restore settings post-rebuild. However, Cloud rebuild requires compatible hardware, a healthy Windows Recovery Environment, and internet connectivity. Currently, it can only be initiated from the Windows Recovery Environment or an elevated Command Prompt, with remote deployment not yet supported. The feature aims to simplify recovery processes and reduce reliance on USB drives, although it is not intended to replace existing recovery tools.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Tech Optimizer

July 10, 2026

Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

Cybercriminals are exploiting the VLC media player to install ValleyRAT, a remote access trojan, by embedding malware in a seemingly harmless file linked in phishing emails. The attack starts with an email that prompts the victim to download a ZIP archive containing a fake VLC executable and a malicious DLL named libvlc.dll. This method uses DLL sideloading to execute the malware under the guise of a legitimate application. Once executed, the malware establishes persistence by creating a registry entry and connects to a remote server to retrieve the final payload. ValleyRAT employs evasion tactics to avoid detection, including assessing system characteristics before executing harmful actions and using a fileless approach to deliver the payload directly into memory. Researchers have identified indicators of compromise, including specific SHA1 hashes and URLs associated with the malicious campaign.

Winsage

July 8, 2026

Windows 11’s new Cloud Rebuild can fix your PC even when it won’t boot

Microsoft has introduced a new recovery feature for Windows 11 called Cloud Rebuild, aimed at simplifying the restoration of non-booting PCs without the need for physical recovery drives. Announced at the Ignite 2025 conference, it is available in the Windows 11 Insider Experimental Preview Build 26300.8772. Cloud Rebuild allows users to restore their PCs to a clean state by performing a full OS reinstall, downloading the necessary Windows image and drivers directly from Windows Update. This feature is designed for recovery scenarios and can be accessed even when the system is unresponsive. It may first attempt a Quick Machine Recovery, and if that fails, it will transition to a cloud-based reinstallation. To use Cloud Rebuild, users must navigate to Troubleshoot → Recovery and Uninstallation → Cloud Rebuild within the Windows Recovery Environment (WinRE), and it will erase all existing files on the computer. Currently, it is primarily aimed at system administrators, and users of Windows 11 Home may consider upgrading to Windows 11 Pro to utilize its features.

Winsage

July 8, 2026

You can soon restore Windows 11 from scratch even if it can’t boot up

Microsoft is previewing a recovery tool called Cloud rebuild for Windows 11, which allows for a clean reinstallation of the operating system even if it fails to boot. This tool automatically downloads the latest updates and drivers, eliminating the need for manual installations after recovery. Unlike the existing "Reset this PC" feature, Cloud rebuild does not retain personal files, settings, or applications, requiring users to restore these independently. To use Cloud rebuild, users need the latest Windows 11 insider build (Preview Build 26300.8772 or higher) and must follow specific steps in the Windows Recovery Environment. The timeline for broader availability of Cloud rebuild is uncertain, depending on ongoing testing and feedback. Other recovery options in Windows 11 include recovery drives, reset functions, Quick Machine Recovery, and a testing feature called Point-in-Time restore.

Winsage

July 7, 2026

Companies are now using automatic Windows installers to display Adware through the Microsoft Store when you install new hardware — customer immediately gets McAfee ads on their PC after connecting new LG monitor; here’s how to block the new ads

LG monitors are displaying unsolicited advertisements for McAfee, which users find intrusive and frustrating. This issue arose when the LG Monitor App Installer was automatically added to users' PCs, similar to how some motherboard software integrates during Windows reinstallation. Reports indicate that this is not an isolated incident, as other users have experienced the same problem. Additionally, other manufacturers like Alienware and Samsung may be engaging in similar practices, facilitated by a Microsoft policy that allows automatic downloads of related monitor software. This trend raises concerns about user consent and the prevalence of unwanted software installations.

Winsage

July 7, 2026

Microsoft Windows telemetry identified hacker despite VPN use

Microsoft's telemetry capabilities helped identify Peter Stokes, a 19-year-old suspected member of the Scattered Spider hacking group, despite his use of a VPN. The investigation revealed a significant cybersecurity breach in May 2025 at a luxury jewelry retailer, leading to the theft of approximately 77 GB of sensitive data and a ransom demand. Investigators linked Stokes to the breach through a Global Device Identifier (GDID) associated with a Windows device that created an ngrok account used in the attack. This device accessed various online platforms and shared IP addresses with Stokes' accounts on Apple, Snapchat, and Facebook, corroborated by travel records and social media posts. The evidence included server logs from Scattered Spider's infrastructure and records from ngrok and other providers.