Trusted Platform Module Archives

Winsage

July 23, 2026

Microsoft making a new feature mandatory requirement for Windows KMS activation

Microsoft has introduced enhancements to its Windows operating system security, including an update to Entra ID authentication with default passkeys and AI-enhanced security updates. A key advancement is the KMS Hardware-Secured initiative, which uses Trusted Platform Module (TPM)-based attestation to ensure KMS hosts operate on trusted hardware for Windows volume activation. This aims to combat risks from counterfeit KMS servers. Under the new model, KMS hosts will confirm their hardware identity using TPM before activating Windows devices. Starting in August 2026, Windows Server 2025 will provide readiness messaging for KMS host compliance with new security requirements. TPM attestation will be mandatory for KMS Hardware-Secured activation with the upcoming Windows Server 2028 LTSC release. Organizations are advised to prepare for this transition.

Winsage

July 20, 2026

Enable BitLocker on Windows 11: 11 Steps, 45 Min [2026]

A stolen laptop can lead to a significant data breach, particularly when taken from public places. Windows 11 has introduced BitLocker, a full-disk encryption feature that became mandatory for Australian businesses in 2026. The Office of the Australian Information Commissioner reported 766 notifiable data breaches in the latter half of 2024, with unauthorized access to devices being a major cause. Full-disk encryption is crucial for compliance with the Essential Eight framework, which mandates data protection on portable devices. BitLocker ensures that data on an encrypted drive becomes unreadable if the drive is removed and connected to another computer. It aligns with the Essential Eight framework, requiring evidence of encryption rather than just claims of protection. There are three types of encryption on Windows 11: Device Encryption, BitLocker Drive Encryption, and File-Level Encryption. BitLocker is available only on Windows 11 Pro and higher editions. To use BitLocker, certain prerequisites must be met, including having Windows 11 Pro or higher, a Trusted Platform Module (TPM) 2.0, UEFI firmware with Secure Boot enabled, and local administrator rights. The process to enable BitLocker involves confirming the edition, checking TPM status, enabling BitLocker through Windows Settings or PowerShell, and backing up the recovery key. Organizations can deploy BitLocker fleet-wide using Microsoft Intune, and additional security measures like TPM+PIN can be implemented for pre-boot authentication. Common pitfalls during BitLocker rollout include skipping recovery key backup and assuming that Home edition machines are covered. Troubleshooting common BitLocker issues involves identifying symptoms and applying appropriate fixes. Advanced tips for enhancing security include suspending BitLocker before maintenance and auditing compliance at the fleet level. BitLocker is integral to protecting data on portable devices, and compliance documentation is essential for proving that every device has an active recovery key.

Winsage

July 20, 2026

Windows 11’s biggest updates may need multiple reboots, but that’s normal, don’t force shutdown

Users may experience double reboots when installing substantial Windows updates, such as the April and July 2026 Updates, due to factors like Secure Boot and .NET Framework updates. The July 2026 .NET Framework update specifically requires a separate reboot. Microsoft is still rolling out the Secure Boot 2023 certificate update, which may also lead to multiple reboots. Users are advised not to panic during these reboots and to allow the system time to complete the installation process. Additionally, Microsoft has warned against delaying updates for more than three days due to increasing update sizes related to security vulnerabilities. Some users may encounter SCEP certificate errors in the Event Viewer after the July 2026 Update, but these errors do not indicate a failure of the update process.

Winsage

July 19, 2026

Windows 11’s big 2026 update is almost here, and these 10 things you need to know before upgrading could save you time and frustration

Microsoft is set to launch the 2026 Update for Windows 11, known as version 26H2, later this year. This will be the fifth feature update for the operating system. The upgrade from version 25H2 to 26H2 will utilize an Enablement Package (eKB), allowing for a transition similar to a standard monthly cumulative update without requiring a full reinstallation. Users can also upgrade from Windows 10 using an ISO file or Microsoft installation media, which ensures files, applications, and settings remain intact. Upgrading to version 26H2 extends the support lifecycle of devices by an additional year, with Microsoft providing 24 months of support for Home and Pro editions and 36 months for Enterprise and Education editions. Version 25H2 will continue to receive support until October 2027, and users are advised to plan upgrades before this support ends. Windows 11 version 26H2 has the same hardware requirements as version 25H2, which include a 1GHz processor with at least two cores, 4GB of RAM, 64GB of storage, UEFI firmware with Secure Boot, TPM version 2.0, DirectX 12 compatible graphics, and a high-definition display. The rollout of the update will be gradual, following a Controlled Feature Rollout (CFR) strategy, meaning not all devices will receive the update immediately.

Winsage

June 27, 2026

Whew! Windows 10 Users Get a Year’s Extension for Security Updates

Microsoft has extended its Extended Security Updates (ESU) program for Windows 10 until October 14, 2027, after the original end-of-life date was set for October 13, 2023. The ESU program is the only way for users to receive security patches after Microsoft ceased support for Windows 10 in October 2025. Users must be running at least version 22H2 and have a Microsoft account to enroll in the ESU program. The extension aims to provide customers more time to transition to new hardware, which requires a Trusted Platform Module (TPM) for upgrading to Windows 11. Additionally, the prices of laptops and desktop PCs have increased due to demand from artificial intelligence and data centers, although budget-friendly laptops have started to emerge in the market.

Winsage

June 26, 2026

Microsoft extends extended updates for Windows 10 in the most muted way imaginable

Microsoft has extended its offer of extended security updates for consumer users of Windows 10 until October 12, 2027, following the official end of support for the operating system on October 14, 2025. Users can acquire an extra year of patches for a modest fee, while business users have the option for an additional three years of support until 2028. Approximately 30 percent of HP's customers and 26 percent of all Windows users are still operating on Windows 10, which translates to hundreds of millions of PCs globally. The minimum requirements for running Windows 11 include a Trusted Platform Module (TPM) 2.0, 4GB of RAM, and 64GB of storage.

Winsage

June 26, 2026

Microsoft adds another year to Windows 10 extended update program

Windows 11 introduced new hardware requirements, including specific CPU technologies and a Trusted Platform Module (TPM), leading to criticism from users and concerns as 2026 approaches. An AI-driven shortage of storage and memory has increased upgrade costs, complicating the transition to newer operating systems. Approximately 26 percent of PCs are still running Windows 10, while Windows 11 has a 72 percent market share. Windows 10 will remain up to date for at least another year. Users can join the Extended Security Updates (ESU) program for continued support, with enrollment available through the Windows Update menu. The ESU program allows coverage for up to 10 devices for personal use and will be available until 2028, with the possibility of updates continuing beyond that timeframe.

Winsage

June 11, 2026

Microsoft fixes BitLocker recovery bug on Windows Server 2025

Microsoft has resolved an issue affecting certain Windows Server 2025 devices that were booting into BitLocker recovery mode after the April 2026 security update. This issue was linked to specific BitLocker Group Policy configurations and required users to input their BitLocker recovery key upon the first restart after the update. However, this key would only need to be entered once for subsequent restarts, provided the group policy configuration remained unchanged. The problem primarily affected enterprise systems rather than personal devices. The issue arose under specific conditions: BitLocker was enabled on the operating system drive, a particular Group Policy was set, the Secure Boot State PCR7 Binding was "Not Possible," the Windows UEFI CA 2023 certificate was present, and the device was not already using the 2023-signed Windows Boot Manager. Microsoft released fixes in the KB5094125 and KB5093998 updates to address this problem, preventing devices with incompatible group policy configurations from installing the 2023-signed Windows Boot Manager. Event ID 1032 in the System event log indicates the issue when Windows updates are installed. For IT administrators unable to deploy the latest updates, it is recommended to remove the Group Policy configuration before installing updates or to implement a Known Issue Rollback (KIR) on affected devices. Additionally, Microsoft had previously addressed similar BitLocker recovery issues in August 2024 and May 2025.

Winsage

May 15, 2026

Microsoft fixes a major BitLocker bug… but leaves Windows 10 users hanging (for now)

Microsoft confirmed a BitLocker-related issue caused by the April 2026 Security Update (KB5083769) for Windows 11, which led some devices to boot into the BitLocker recovery screen. A fix has been released, but it is currently available only for Windows 11, version 25H2, with Windows 10 and Windows Server users awaiting a solution. Administrators are advised to remove the "Configure TPM platform validation profile for native UEFI firmware configurations" Group Policy setting before installing the April 2026 update. Additionally, a security researcher named Chaotic Eclipse has developed a zero-day exploit called YellowKey, which can bypass BitLocker security using a USB stick, affecting Windows Server 2022 and 2025 but not Windows 10.

Winsage

May 15, 2026

Zero-day exploit completely defeats default Windows 11 BitLocker protections

A zero-day exploit named YellowKey allows individuals with physical access to Windows 11 systems to bypass BitLocker encryption protections. Discovered by researcher Nightmare-Eclipse, this vulnerability enables unauthorized users to access encrypted drives quickly. The exploit involves transferring a custom FsTx folder to a USB drive, connecting it to a BitLocker-protected device, and entering recovery mode to gain command prompt access without needing a BitLocker recovery key. Esteemed researchers Kevin Beaumont and Will Dormann have confirmed the exploit's functionality, although the specific mechanism within the FsTx folder that enables the bypass is not fully understood.