Windows operating system Archives

Winsage

July 23, 2026

Microsoft making a new feature mandatory requirement for Windows KMS activation

Microsoft has introduced enhancements to its Windows operating system security, including an update to Entra ID authentication with default passkeys and AI-enhanced security updates. A key advancement is the KMS Hardware-Secured initiative, which uses Trusted Platform Module (TPM)-based attestation to ensure KMS hosts operate on trusted hardware for Windows volume activation. This aims to combat risks from counterfeit KMS servers. Under the new model, KMS hosts will confirm their hardware identity using TPM before activating Windows devices. Starting in August 2026, Windows Server 2025 will provide readiness messaging for KMS host compliance with new security requirements. TPM attestation will be mandatory for KMS Hardware-Secured activation with the upcoming Windows Server 2028 LTSC release. Organizations are advised to prepare for this transition.

Winsage

July 22, 2026

Microsoft is finally modernizing Windows 11’s decades-old File Explorer properties window with a new UI

Microsoft is modernizing the File Explorer app in Windows, gradually introducing modern UI elements while much of the application retains its older design. A hidden modernized File Properties window has been found in the latest Windows 11 preview build, indicating plans for a complete overhaul of the File Properties dialog. This effort is part of Microsoft's broader initiative to integrate WinUI across the Windows Shell, including enhancements to the Start menu and in-box applications, as part of the Windows K2 project. The modernized File Properties feature has not yet been officially announced, but its appearance in preview builds suggests further updates are forthcoming.

Winsage

July 21, 2026

Persistent Telemetry: Permanent Microsoft Windows Identifier

Discussions about consumer privacy in the Windows ecosystem have focused on optional diagnostic settings and telemetry controls. Recently, the Global Device Identifier (GDID), a permanent device-level token embedded in the Windows operating system, was revealed in a U.S. Department of Justice complaint related to a cybercriminal investigation. The GDID uniquely identifies a Windows installation and is used by Microsoft services. It is generated when a device is linked to a Microsoft account and resides in the Windows registry, being included in data sent to remote servers. There is no option to disable or delete the GDID, and attempts to do so can disrupt essential features. This has led privacy-conscious users to consider alternatives like Linux, which offers more control over data and does not require persistent identifiers. For Windows users, strategies to minimize data linked to the GDID include using local accounts, disabling optional diagnostics, and reviewing cloud app sync settings. Privacy advocates are calling for better user controls and opt-out mechanisms for hardware tracking tokens.

Winsage

July 18, 2026

Windows 10 still powers one in six PCs around today — and that could be a major security issue very soon

Approximately 16.9% of Windows client devices are still using Windows 10, while Windows 11 accounts for 78.8% of installations. Windows 10's market share has significantly declined from nearly 50% in mid-2025. The migration to Windows 11 is slowing, with remaining Windows 10 devices facing more complex and costly upgrade scenarios, including having three times as many active Common Vulnerabilities and Exposures (CVEs) compared to Windows 11. Legacy operating systems like Windows 7, Windows 8.1, and Windows XP are also factors in the migration challenges. Microsoft’s Extended Security Updates (ESU) program offers protection until October 2027 for consumers and until October 2028 for commercial customers.

Winsage

July 13, 2026

Windows questions? How Copilot can analyze your PC settings now

Microsoft has introduced a new feature called PC Insights within its Copilot AI, aimed at simplifying troubleshooting within the Windows operating system. This feature allows users to ask questions about their system, such as battery health, BIOS version, CPU usage, network adapters, storage availability, and printer status. Users must download and install the Copilot Windows app to utilize PC Insights. Upon asking a question, Copilot requests permission to access system resources, which can be granted for a single request or for future similar requests. The AI retrieves the necessary data without storing or using personal files for training, and permissions can be revoked through the app's privacy settings. While PC Insights can provide information and clarify technical details, it cannot autonomously fix issues or implement system changes, requiring users to resolve identified problems themselves.

Winsage

July 12, 2026

Microsoft Confirms Windows GDID Device Identifier That Cannot Be Disabled, Documented in FBI Case Filing

Microsoft has confirmed the existence of the Global Device Identifier (GDID), a unique identifier assigned to Windows installations, in a federal complaint against an alleged member of the Scattered Spider hacking group. The GDID is generated when a Windows system is set up with a Microsoft Account and remains active through various Windows updates. Disabling the GDID could disrupt Windows activation and access to Microsoft Store applications. The GDID is described as "a persistent, device-level identifier designed to uniquely identify an installation of a Windows operating system on a device." It is created during the provisioning of Windows with a Microsoft Account and is stored in the Windows registry under HKCUSOFTWAREMicrosoftIdentityCRLExtendedProperties. The GDID remains persistent through Windows updates but is not retained after a clean reinstall. A single user can possess multiple GDIDs linked through their account, OneDrive, and activation history. The FBI used the GDID to track Peter Stokes, an alleged member of the Scattered Spider group, across various VPN connections and proxy servers. The GDID was recorded visiting specific websites and was linked to Stokes's accounts on platforms like Snapchat and Facebook. Concerns have been raised regarding user privacy, as the GDID is assigned without user consent and cannot be disabled without compromising essential Windows features. Microsoft has not committed to providing user-facing controls or comprehensive documentation for everyday users regarding the GDID. Legal requests can compel Microsoft to disclose GDID activity data to law enforcement. The GDID is linked to the Microsoft Account rather than the device itself, meaning reinstalling the operating system does not sever this connection.

Winsage

July 12, 2026

Microsoft is now using AI to fix Windows bugs before hackers exploit them

Microsoft is integrating artificial intelligence into its vulnerability detection processes for the Windows operating system to enhance security. This will lead to more frequent security updates during monthly Patch Tuesday releases. The company aims to address the rise in AI-driven exploits and is refining its secure software development model to combat evolving tactics used in AI-driven attacks. While AI will assist in identifying vulnerabilities, human oversight will remain essential, with developers reviewing code and validating AI-generated findings before deploying updates.

Winsage

July 11, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes allegedly used sophisticated methods to obscure his identity during a breach at a luxury retailer, but the FBI uncovered his identity through a Global Device Identifier (GDID) linked to his Windows installation. GDID is a persistent device-level identifier that uniquely identifies a Windows installation and remains unchanged through operating system updates, only resetting upon complete reinstallation. Users cannot disable GDID, and attempts to remove it may disrupt Windows activation. To minimize data associated with GDID, users can opt for a local account, limit diagnostic telemetry, disable Activity history, and be cautious during reinstallation. VPNs do not prevent Microsoft from logging GDID, IP addresses, and URLs, making them ineffective for privacy on Windows. GDID has been described as a covert tracking beacon, and security experts advise against using Windows for sensitive tasks, suggesting alternatives like Linux.

Winsage

July 10, 2026

Windows 11 Has a Hidden Tracker – Here’s How to Limit It

Peter Stokes is involved in a breach with a luxury retailer, using tactics like VPNs and rotating IP addresses to hide his digital activity. The FBI discovered a Global Device Identifier (GDID) linked to his Windows installation, which is a persistent device-level identifier that uniquely identifies Windows installations. GDID remains unchanged through operating system updates but resets with a full reinstallation. Disabling GDID is not possible, as attempts to do so would disrupt Windows activation. Users can minimize data linked to GDID by using a local account, reducing diagnostic telemetry, disabling Activity history, and carefully managing reinstalls. VPNs do not prevent Microsoft from logging GDID, IP address, and URL data. Privacy researchers view GDID as a covert tracking mechanism, and Windows lacks user-facing options to reset this identifier, unlike Apple and Google.

Winsage

July 10, 2026

You can’t fully disable Microsoft’s GDID Windows 11 tracker, but these settings limit what it captures

A 19-year-old named Peter Stokes was detained at Helsinki airport in April 2026 while traveling to Japan, carrying two 2TB hard drives. He was subject to an Interpol Red Notice and faced a federal complaint from U.S. prosecutors by July for his alleged involvement in the Scattered Spider hacking group, which breached a U.S. luxury jewelry retailer in May 2025, leading to a ransom demand. The Global Device Identifier (GDID), developed by Microsoft, is a persistent identifier that uniquely identifies a Windows installation on a device. It links online activities back to a single identity, which law enforcement can use to trace a device's owner. The GDID is generated when a user signs into Windows with a Microsoft Account and remains through updates but does not survive a clean reinstall. Stokes' use of the same Windows device allowed investigators to trace his activities through the GDID, which linked him to the hacking incident. Privacy advocates have raised concerns about the lack of consent for GDID assignment and the potential for surveillance.