sysprep Archives

Winsage

February 20, 2026

Hands on with Windows 11 26H1 and why this update is not meant for your PC

Microsoft has announced Windows 11 26H1, a release intended exclusively for new ARM devices launching in 2026, specifically those powered by the Snapdragon X2 series. This version is not a feature update for existing PCs and will not appear in Windows Update notifications for users on Intel or AMD hardware. Windows 11 26H1 is based on a new internal core designed for ARM silicon, referred to as a "hardware-optimized release," and may carry the codename Bromine. The OS Build number for 26H1 is 28020.1611, distinguishing it from previous updates. Key enhancements include full integration of semantic natural-language search within Settings, an increase in the FAT32 format limit from 32 GB to 2 TB, and UI refinements. Notable omissions include the removal of .NET Framework 3.5 as an optional feature and a safeguard preventing the System Preparation Tool from running in Safe Mode. Windows 11 26H2 is expected later in 2026 for existing PCs.

Winsage

November 3, 2025

Microsoft Sounds Windows 11 And Server Update Failure Alarm

Microsoft has confirmed that users of Windows 11 and Windows Server are experiencing authentication failures due to updates released on or after August 29. This issue, detailed in Microsoft Support posting KB5070568, is linked to duplicate Security IDs (SIDs) on devices, affecting Windows 11 versions 24H2 and 25H2, as well as Windows Server 2025. The problem arises from new security protections that enforce checks on SIDs, which are necessary to maintain user account integrity and prevent unauthorized access. Duplicate SIDs typically result from unsupported cloning or duplication of a Windows installation without using the Sysprep tool. The recent update mandates SID uniqueness, blocking authentication handshakes between devices with duplicate SIDs. To resolve this, users must rebuild their devices using supported methods for cloning or duplicating a Windows installation to ensure unique SIDs.

Winsage

October 24, 2025

Weird Authentication Failures? Could Be That Microsoft Doesn’t Like Duplicate SIDs Anymore

Microsoft has introduced a feature that requires unique Security Identifiers (SIDs) across systems, effective August 29, 2025, impacting users who previously cloned images with duplicate SIDs for Kerberos or NTLM connections. This change has led to SECENO_CREDENTIALS errors in the Event Viewer and other reported issues. Microsoft recommends using the Sysprep tool for fresh machine setups. A workaround exists through a Group Policy setting that allows duplicate SIDs, but users must contact Microsoft support to access it, as it is not available by default. This update marks the third occurrence of authentication errors associated with Microsoft updates.

Winsage

October 23, 2025

Microsoft says Windows update may have caused login problems

Microsoft has acknowledged that recent updates for Windows operating systems, specifically Windows 11 versions 24H2 and 25H2, and Windows Server 2025, may have caused login complications for some users. The problematic updates are KB5064081 (OS Build 26100.5074) released on August 29, 2025, and KB5065426 (OS Build 26100.6584) released on September 9, 2025. These updates can lead to authentication failures related to Kerberos and NTLM protocols, particularly on devices with duplicate Security IDs (SIDs). Symptoms include repeated prompts for credentials, failed access requests, inability to access shared network folders, challenges in establishing Remote Desktop connections, and specific error messages logged in the Event Viewer. The root cause is enhanced security measures that enforce checks on SIDs, which can block authentication handshakes when devices have duplicate SIDs, often due to unsupported cloning methods. There is no automated fix; administrators are advised to rebuild devices with duplicate SIDs using supported cloning methods or to configure a special Group Policy for a temporary workaround.

Winsage

October 23, 2025

Microsoft Confirms Recent Updates Causing Login Issues Across Windows Versions

Microsoft has identified a significant issue affecting users of Windows 11 version 24H2, version 25H2, and Windows Server 2025, where many users experience persistent login failures due to duplicate Security Identifiers (SIDs) after installing updates released on or after August 29, 2025. Reports indicate that after installing the preview update KB5064081 or the cumulative update KB5065426, devices with identical SIDs struggle to complete Kerberos or NTLM authentication, leading to repeated prompts for credentials and common error messages such as "Login attempt failed" and "Your credentials didn’t work." Shared network folders become inaccessible, and Remote Desktop connections fail. The root cause is enhanced security checks enforcing SID uniqueness, which block authentication handshakes when duplicate SIDs are detected. Duplicate SIDs typically occur when administrators clone Windows installations without using Sysprep, which is necessary to assign unique SIDs. Microsoft recommends rebuilding devices with duplicate SIDs using supported methods and running Sysprep prior to capturing images for deployment. As a temporary measure, administrators can install a specific Group Policy provided by Microsoft Support for Business.

Winsage

October 23, 2025

Russian hackers replace malware with new tools, Windows updates cause login issues, campaign targets high-profile servers

Mark your calendars for this Friday's Super Cyber Friday, featuring the session titled "Hacking the Death of EDR." Russian state-sponsored hacking group Coldriver has introduced three new malware strains: NOROBOT, YESROBOT, and MAYBEROBOT, following the exposure of their previous tool, LostKeys. The new malware is designed to evade detection and extract sensitive data from high-value targets. Microsoft has acknowledged that Windows updates released since August 29th are causing login failures on systems with duplicate Security Identifiers (SIDs), leading to authentication failures. Microsoft recommends rebuilding affected systems or contacting support for a temporary fix. Kaspersky researchers have identified a likely Chinese-speaking threat actor behind the “PassiveNeuron” campaign, targeting government, financial, and industrial servers across Asia, Africa, and Latin America since 2024, using custom implants and Cobalt Strike. CISA has added high-severity vulnerabilities in Oracle E-Business Suite, Microsoft Windows SMB Client, Kentico Xperience CMS, and Apple JavaScriptCore to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by November 10th. Researchers from France's CEA and Soitec have unveiled a new chip architecture called Fully Depleted Silicon-on-Insulator, designed to defend against laser fault injection attacks on automotive microcontrollers. During Pwn2Own Ireland 2025, researchers exploited 34 zero-days across various devices, earning a total of 2,500 in rewards, with Team DDOS chaining eight zero-days to compromise a QNAP router and NAS. Koi Security researchers discovered a new self-propagating malware named GlassWorm, which has infected approximately 36,000 developer systems by exploiting Visual Studio Code extensions, pilfering credentials, and installing remote access tools. PolarEdge is a botnet malware targeting Cisco, ASUS, QNAP, and Synology routers, first detected in February, which installs a TLS-based backdoor to fingerprint hosts and execute tasks while employing anti-analysis techniques.

Winsage

October 22, 2025

Microsoft Confirms Recent Updates Cause Login Issues on Windows 11 24H2, 25H2, and Windows Server 2025

Microsoft has identified an authentication issue affecting users of Windows 11 versions 24H2 and 25H2, as well as Windows Server 2025, due to updates rolled out since late August 2025. These updates have caused failures in Kerberos and NTLM protocols on devices with identical Security Identifiers (SIDs), leading to widespread login disruptions in enterprise networks. Users have reported repeated credential prompts, error messages, and compromised network access, including issues with Remote Desktop Protocol (RDP) sessions and Failover Clustering operations. Event Viewer logs indicate machine ID mismatches and potential session discrepancies. The problem is particularly severe in virtual desktop infrastructure (VDI) environments where multiple machines share SIDs. Microsoft has emphasized the importance of using the Sysprep tool to ensure unique SIDs during cloning, as the recent updates now strictly verify SIDs during authentication. IT administrators can temporarily alleviate the authentication blocks with a specialized Group Policy, but a permanent solution involves rebuilding devices using approved cloning procedures. As of October 21, 2025, no broader patch has been released.

Winsage

October 22, 2025

Microsoft: Recent Windows updates cause login issues on some PCs

Microsoft has acknowledged a significant issue affecting Windows systems following updates released since August 29, 2025, which are causing authentication failures on devices with duplicate Security Identifiers (SIDs). SIDs are unique alphanumeric strings used by Windows to manage user and computer accounts. The updates enforce checks on SIDs, leading to authentication failures, particularly impacting Windows 11 24H2, Windows 11 25H2, and Windows Server 2025. Users may experience failed remote desktop connections, "Access denied" errors, and failed login attempts despite valid credentials, along with SECENO_CREDENTIALS errors in the Event Viewer. Duplicate SIDs often arise from cloning Windows installations without proper preparation using the Sysprep tool. Microsoft recommends rebuilding systems with duplicate SIDs using supported methods and offers a temporary workaround through a specific Group Policy.

Winsage

September 29, 2025

I used DISM to create a Windows installer with all my apps, and here’s how it works

To back up a Windows 11 image, start with a fresh installation and use the Sysprep tool to generalize the system, avoiding Microsoft Store apps to prevent Sysprep failure. Prepare two external drives: one for storing the Windows image (minimum 8GB) and another bootable drive configured with Windows Preinstallation Environment (Windows PE). Download the Windows Assessment and Deployment Kit (ADK) and the Windows PE add-on to create the bootable USB drive. Enter Audit Mode by pressing Ctrl+Shift+F3 at the out-of-box experience screen, disable app updates, and install desired applications for the entire system. Use Sysprep to enter Out of Box Experience (OOBE), check Generalize, and select Shutdown. Boot from the Windows PE drive, use diskpart to identify drive letters, and capture the image with the DISM command. To apply the image on a new PC, create a diskpart script for partitioning and a batch script for applying the image. Boot the new PC from the Windows PE drive, run the diskpart script to create partitions, and execute the batch script to apply the image. This method is efficient for deploying consistent applications across multiple PCs.

Winsage

December 11, 2024

Windows 10 KB5048652 update fixes new motherboard activation bug

Microsoft has released the KB5048652 cumulative update for Windows 10 22H2, which includes six fixes to improve system performance and user experience. This mandatory update addresses a critical activation issue related to motherboard replacements and includes essential security updates for December 2024. Users can install the update by checking for updates in the Windows Update settings, and it will automatically install upon checking. After installation, Windows 10 22H2 will be upgraded to build 19045.5131, while Windows 10 21H2 will be updated to build 19044.5131. The update resolves various bugs, including issues with the Sysprep command, cloud backup of Win32 shortcuts, file copying from cloud folders, activation after motherboard replacement, mobile operator profiles, and problems with IPP USB printers. Microsoft reports no known issues with this update.