Windows feature Archives

Winsage

September 30, 2026

How to get the Windows 11 2026 Update

Windows 11, version 26H2 is now available for eligible devices running Windows 11, versions 25H2 and 24H2. The update is delivered via a small enablement package that activates new features already integrated into the operating system. The installation process is similar to a monthly update, requiring a minor download and a quick restart. The update includes enhancements in quality, reliability, and security. For commercial and educational customers, it can be accessed through existing management tools like Windows Autopatch and the Microsoft 365 admin center. Version 26H2 offers 24 months of support for Home and Pro editions and 36 months for Enterprise and Education editions. Some features that were disabled in version 25H2 will now be enabled by default in version 26H2.

Winsage

September 23, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted an unnamed manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers accessed the network through a compromised domain account via FortiGate SSL VPN on April 11, escalated privileges to domain administrator by April 13, and created a malicious Group Policy Object (GPO) named "PAYLOAD." This GPO was linked at the root of the domain, allowing it to affect nearly all domain-joined Windows workstations. The attackers distributed ransom notes, altered desktop images, displayed ransom messages at login, and disabled local administrator accounts. A second GPO, "win Firewall Off," was deployed to disable Windows Firewall across all profiles. The malicious policies activated on April 14 after systems were rebooted, causing widespread disruption. The attackers also exfiltrated data from file servers and published it on the dark web, while Kaspersky found no evidence of Windows file encryption or active malware processes. Recommendations for organizations include monitoring GPO creation, checking for unexpected changes, implementing multi-factor authentication for VPN access, and protecting privileged accounts.

Winsage

September 22, 2026

PAYLOAD ransomware hijacks Windows Group Policy in encryption-less attacks

A sophisticated PAYLOAD ransomware attack targeted a manufacturing organization in the Middle East, exploiting vulnerabilities in Microsoft Active Directory Group Policy. The attackers gained initial access on April 11 by compromising a domain account through the company's FortiGate SSL VPN. By April 13, they escalated privileges to a domain administrator and created a malicious Group Policy Object (GPO) named “PAYLOAD,” which was linked at the root of the domain. This GPO allowed them to distribute a ransom note, change desktop images, display a ransom message during login, and disable the local administrator account. A secondary GPO, “win Firewall Off,” was used to disable Windows Firewall across all profiles. The malicious changes activated on April 14 after system reboots, causing widespread disruption. The attackers also exfiltrated sensitive data, which was later released on the dark web. Kaspersky's investigation found no evidence of file encryption or active malware processes, indicating the attack was contained within Active Directory. Recommendations for organizations include monitoring GPO modifications, implementing multi-factor authentication for VPN access, and safeguarding privileged accounts.

Winsage

September 20, 2026

The hidden Windows feature quietly filling up your SSD—and how to rein it in

Microsoft introduced a feature called point-in-time restore in Windows 11, which creates snapshots of the system every 24 hours to enhance recovery options. This feature began rolling out in late June 2026 and is typically enabled by default for boot drives of 200GB or larger. It uses the Volume Shadow Copy Service to generate restore points that are available for 72 hours before being purged. The feature can consume significant storage space, initially occupying 3.9GB and potentially increasing to over 18GB within two months, reaching a maximum of 2% of the total disk space. Users can adjust the storage usage settings or disable the feature entirely to reclaim space. The default maximum usage can be modified to as low as 0.2%. There are concerns that this feature should have been opt-in rather than opt-out due to its storage implications.

Winsage

August 31, 2026

Microsoft proves Windows 11’s modern UI can beat legacy Win32, if it works hard enough

Microsoft is modernizing Windows by transitioning legacy features to its WinUI framework, including a redesign of the Run dialog. The new Run dialog, implemented with C#/WinUI 3, shows improved performance with a median time-to-show of 94 milliseconds, compared to 103 milliseconds for the legacy version, reflecting an 8.7% speed increase. Despite this improvement, Microsoft acknowledges that WinUI requires further performance enhancements in various areas. The development of the Run dialog utilized .NET AOT compilation to achieve native code speed while maintaining C# flexibility. Concerns about performance on lower-end machines persist, as seen with the Task Manager and File Explorer. Microsoft aims to modernize Windows features without sacrificing performance, with the Run dialog serving as a potential model for future updates.

Winsage

August 16, 2026

Microsoft is removing a legacy Windows feature that has been around for 25 years

WMIC, a utility for IT administrators introduced in Windows XP in 2001, will be removed from Windows 11 after August 2026. It has been deprecated since 2016 and was previously removed from Windows 10 in 2021. Although it remained available as a Feature on Demand, it was disabled by default in new installations. Recent Preview builds for Windows 11 confirmed that WMIC will not be included in version 26H2. PowerShell is suggested as a prominent replacement for WMIC tasks.

Winsage

July 11, 2026

This Windows feature has been eating users’ RAM for years, Microsoft still hasn’t fixed it

Memory leaks have been reported with the Phone Link feature in Windows 11, specifically the Cross Device Service, which is consuming excessive amounts of RAM. Users have noted that this service can use between 15 to 30GB of RAM, leading to significant system slowdowns and reduced internet speeds. Complaints about this issue have been ongoing since early 2023, with users often needing to manually intervene via Task Manager to restore system performance. The Cross Device Service is intended to facilitate features like clipboard sharing and notification syncing but appears to malfunction and enter a loop that increases memory usage. Microsoft has not officially acknowledged the problem, and while generic troubleshooting steps have been suggested, they may not resolve the issue for all users. Disabling the Phone Link feature has been proposed as a potential solution to mitigate memory consumption.

Winsage

July 10, 2026

Microsoft confirms Secure Boot update failing on some Windows 11 PCs, promises a resolution

Microsoft has acknowledged that some Windows 11 PCs are facing issues with Secure Boot certificate updates, which may fail to install or be blocked. The company is working with PC manufacturers to develop a patch, while users may need to take proactive measures if their certificates are obstructed. Microsoft has temporarily halted the rollout of Secure Boot for certain devices due to complications, and affected users will receive detailed error messages in the Windows Security app regarding their Secure Boot certificates. Secure Boot certificates issued in 2011 have expired, and Microsoft is replacing them with new certificates issued in 2023. Most modern hardware is already utilizing the new certificates, but some devices may have disabled Secure Boot or faulty firmware. Users can check their Secure Boot status in the Windows Security app. HP has confirmed that Secure Boot updates are being blocked on some of its PCs due to a BitLocker issue, which prevents the installation of new certificates. Microsoft has paused Secure Boot certificate updates for devices affected by known issues while collaborating with manufacturers to identify specific devices or firmware complications. A firmware update will be necessary for affected devices, but it is not yet available. The majority of PCs have received the Secure Boot certificates via Windows Update, but compatibility issues may prevent some devices from receiving the update. Older devices or those not among the OEM’s top-selling models may not receive updates if the UEFI firmware is unsupported. Secure Boot is a security feature required for Windows 11, preventing unauthorized software from executing at boot. While an expired Secure Boot certificate does not stop a PC from functioning, it may limit long-term security protection. Microsoft advises users not to disable Secure Boot, as it would compromise security further.

Winsage

June 24, 2026

Windows 11 24H2 EOL: Resolve Version Drift with TruRisk Eliminate

Windows 11 version 24H2 will reach the end of servicing on October 13, 2026. Enterprises often face version drift, requiring different upgrade strategies for various Windows 11 builds across endpoints. Upgrade methods include enablement packages, ISO-based feature updates, or direct upgrades from Windows 10. Enablement packages are the quickest and least disruptive option for compatible Windows 11 systems. Qualys TruRisk Eliminate can standardize upgrades and minimize version drift on a large scale. Endpoints should be assessed for readiness, categorized by eligibility and current OS status. Enablement packages are recommended for recent Windows 11 builds due to their minimal download size, faster installation, and reduced operational impact. If enablement packages are unavailable, ISO-based feature updates may be necessary. Direct upgrades from Windows 10 to Windows 11 25H2 can be executed without intermediate transitions. Qualys TruRisk Eliminate provides tools for managing these upgrade processes effectively.

Winsage

May 27, 2026

Your PC’s trust in Windows has an expiration date

Microsoft will change Secure Boot certificates in June 2026, impacting Windows 11 PCs. If users do not update the certificates, their PCs may still function but will lack critical boot updates and malware blacklists, potentially compromising security. Without the new certificates, systems cannot run the latest Windows Boot Manager, making them vulnerable to bootkit malware and hindering future Windows feature updates. Older computers using BIOS are exempt from this issue. The new Secure Boot certificates are valid until 2038. Users can check their Secure Boot status in the Windows Security app; a green circle indicates readiness for the deadline.