Windows tools Archives

Winsage

September 28, 2026

Microsoft was better at software in the ’90s, and these still-useful Windows utilities prove it

Microsoft PowerToys originated during the development of Windows 95 as small programs created by engineers to test concepts and ease workloads. The first collection of PowerToys included tools like FindX, Send To X, and Tweak UI. System Configuration (MSConfig) helps isolate configuration and startup issues by allowing selective loading of services and startup components, remaining useful despite modern management shifting to Task Manager. Disk Cleanup was launched with Windows 98 to help users reclaim disk space, featuring commands that allow saving cleanup profiles, a functionality that persists in Windows 11. Task Scheduler, introduced in 1995 as System Agent in the Microsoft Plus! pack for Windows 95, automates tasks based on specific triggers. System File Checker (SFC), dating back to Windows 98, scans and repairs protected Windows resources, evolving from a graphical utility to a command-line tool. Device Manager provides an expandable tree of hardware components and reflects advancements in Microsoft's Plug and Play system from Windows 95, continuing to assist users in hardware inspection and troubleshooting. The DirectX Diagnostic Tool (DxDiag) was created for gamers in the late '90s to examine hardware and software configurations related to DirectX and remains available in Windows 11.

Winsage

September 22, 2026

Microsoft’s most useful Windows toolkit turns 30 this year, and it still doesn’t ship with Windows 11

A fresh installation of Microsoft Windows 11 includes features like Copilot but lacks certain user control tools. The Sysinternals suite, maintained by Microsoft since its acquisition in 2006, consists of over 70 utilities and has received regular updates since its establishment in 1996. Notable updates include a modern interface for DebugView and enhanced support for startup apps in Autoruns. Sysinternals tools, such as Process Explorer and Autoruns, offer advanced functionality compared to standard Windows tools. Microsoft is integrating some Sysinternals utilities into PowerToys, starting with ZoomIt, and Sysmon has been introduced in Windows 11 Insider builds. Users have expressed interest in further integration of Sysinternals tools, particularly Process Explorer.

Winsage

September 19, 2026

These 4 built-in Windows tools helped me build a self-healing PC

Windows operating systems include built-in tools for maintaining PCs, allowing users to monitor system health, repair corrupted files, and recover from boot failures with minimal intervention. Task Scheduler automates maintenance tasks by triggering them based on schedules or events, accessible via the Start menu or taskschd.msc. It can activate tasks at fixed intervals, on startup, during idle periods, or in response to Event Viewer entries. Tasks should run with the highest privileges and can be configured to execute regardless of user sign-in status. The Settings tab allows missed tasks to run as soon as possible. DISM (Deployment Image Servicing and Management) is a command-line utility that repairs the component store, essential for installing updates and restoring system files. It offers three inspection levels: CheckHealth, ScanHealth, and RestoreHealth, with the latter requiring an internet connection for downloading replacement files. DISM logs operations in C:WindowsLogsDISMdism.log. SFC (System File Checker) verifies and repairs core operating system files using Windows Resource Protection. The command sfc /scannow checks all protected files, while /verifyonly provides a report without changes. SFC's effectiveness depends on the integrity of the component store, making it essential to run DISM first. Results are logged in C:WindowsLogsCBSCBS.log. Quick Machine Recovery (QMR), introduced in Windows 11, addresses boot failures by connecting to the internet to find solutions when repeated boot failures are detected. QMR is enabled by default on unmanaged devices and can continuously check for fixes. It is designed to respond to widespread issues rather than unique problems and may not work effectively on older hardware or without a network connection. Together, these tools provide a comprehensive approach to system maintenance in Windows 11, ensuring the operating system remains healthy and efficient without additional software.

Winsage

September 13, 2026

4 classic Windows tools that did things Windows 11 still can’t

Several utilities have been left out of Windows 11, including: - Windows Easy Transfer: A tool that allowed users to transfer files and settings between PCs using a USB flash drive. It was not included in Windows 10 and remains absent in Windows 11. - Windows Media Center: An application that transformed PCs into media hubs for watching movies, listening to music, and recording television shows. It did not transition to Windows 10 and is also missing in Windows 11. - Taskbar Toolbars: A feature that enabled users to pin folders to the taskbar for quick access. This feature is not present in Windows 11. - Steps Recorder: A troubleshooting tool that recorded screen actions and documented steps taken during processes. Although initially available in Windows 11, it has been deprecated. These omissions have disappointed users who valued the functionality these tools provided.

Winsage

June 16, 2026

A Brief History Of Unix Commands On Windows: CoreUtils (Again)

The interaction between Unix/Linux and Windows has historically been marked by significant differences in their architectures and philosophies. Unix uses a fork() function for process management, while Windows employs CreateProcess(), complicating the implementation of Unix-like tools on Windows. Early solutions to bridge this gap included the MKS Toolkit, which provided Unix-like commands for Windows, and UWIN from AT&T Bell Labs, which aimed to create a Unix interface layer on Windows. Cygwin offered a compatibility DLL to run Unix software on Windows, but required rebuilding from source. Microsoft's initiatives included POSIX, Interix, and later Services for UNIX. The introduction of the Windows Subsystem for Linux (WSL) allowed users to run a Linux userland directly on Windows, with WSL 2 incorporating a real Linux kernel. Recently, Microsoft released Coreutils for Windows, providing native builds of Unix-style tools to enhance cross-platform consistency.

Winsage

April 2, 2026

Malwarebytes highlights Microsoft findings on WhatsApp attachments used in Windows attacks

A campaign targeting Windows users exploits WhatsApp attachments to execute a malicious .vbs script. Victims receive what appears to be a harmless attachment, which, when opened, duplicates legitimate Windows tools into a hidden folder and renames them to avoid detection. These tools are then used to download additional malware from reputable cloud services, disguising the malicious activity. The malware seeks administrator privileges by altering User Account Control settings and registry entries for persistence. It ultimately installs remote-access software and other payloads to maintain control over the compromised device. Malwarebytes recommends safety measures such as avoiding unsolicited attachments, enabling file extensions, using updated anti-malware tools, downloading software from official sites, being cautious of unexpected UAC prompts, and keeping systems updated.

Winsage

April 1, 2026

WhatsApp on Windows users targeted in new campaign, warns Microsoft

Microsoft researchers have identified a campaign that exploits WhatsApp attachments to infiltrate Windows machines, allowing attackers remote control. The attack uses social engineering tactics, where users receive a seemingly benign .vbs (Visual Basic Script) file that can be executed on Windows. This method does not rely on software vulnerabilities but on persuading victims to execute the malicious file. Attackers manipulate built-in Windows tools to download further malware, employing a technique known as living off the land (LOTL) to avoid detection. The malware seeks to elevate its privileges to administrator status, modifying User Account Control (UAC) prompts and registry settings for persistence. An unsigned MSI (Microsoft Installer) is deployed to establish remote-access software, granting continuous access to the compromised machine.

Winsage

March 2, 2026

Fake Xeno and Roblox Utilities Used to Install Windows RAT, Microsoft Warns

Cybersecurity experts at Microsoft Threat Intelligence have identified a trend where attackers distribute counterfeit gaming tools that install a remote access trojan (RAT) on users' systems. These trojanized executables, such as Xeno.exe or RobloxPlayerBeta.exe, are shared through browsers and chat platforms. The initial executable acts as a downloader, installing a portable Java runtime environment and launching a harmful Java archive, jd-gui.jar. Attackers use built-in Windows tools to execute commands via PowerShell and exploit trusted system binaries, minimizing detection risk. The embedded PowerShell script connects to remote locations, downloads an executable as update.exe, and executes it. The malware erases evidence of the downloader and modifies Microsoft Defender settings to allow RAT components to function undetected. It establishes persistence through scheduled tasks and a startup script named world.vbs, enabling prolonged access to the compromised device. Microsoft Defender can detect the malware and its behaviors, and organizations are advised to monitor outbound traffic and block identified domains and IP addresses. Users are encouraged to scrutinize Microsoft Defender exclusions and scheduled tasks for irregularities and remain cautious about downloading tools from unofficial sources.

Winsage

January 21, 2026

Tanium named Leader in IDC report on Windows tools

Tanium has been recognized as a Leader in endpoint management software for Windows devices in the latest IDC MarketScape vendor assessment for 2025-2026, marking the second consecutive time it has received this designation. The IDC assessment evaluates vendors providing tools for managing Windows endpoints, including desktops, servers, and specialized devices. Tanium's core offering is the Tanium Autonomous IT Platform, which integrates endpoint management, exposure management, and security operations. The platform supports Windows 10, Windows 11, Windows Server, and Windows IoT endpoints, and is noted for its synergy with Microsoft's tools. Tanium's approach, termed Autonomous IT, consolidates IT and security operations under a unified model, featuring tools like Tanium Ask, Tanium Confidence Score, and Adaptive Actions. Additionally, Tanium has been recognized as a Leader in Gartner's Magic Quadrant for Endpoint Management Tools.

Winsage

January 7, 2026

Hackers Use Fake Windows BSOD To Spread Malware

Security researchers have identified a social engineering campaign that mimics the Windows Blue Screen of Death (BSOD) to deceive users into installing a remote access Trojan (RAT). The campaign, named PHALT#BLYX, begins with phishing emails that appear to be legitimate cancellation notices from travel websites, leading victims to a fake login page and an interactive CAPTCHA. This culminates in a full-screen imitation of the BSOD, prompting users to follow instructions that ultimately allow attackers to gain control of their computers. The attackers use a “ClickFix” process that involves executing commands through native Windows tools like PowerShell and MSBuild, making detection more challenging. The malware delivered is an obfuscated version of DCRat, which provides attackers with remote control capabilities, keylogging, and the ability to download additional malware. The campaign primarily targets hotels and hospitality businesses in Europe, exploiting the urgency of front-desk staff to respond to apparent technical issues. Indicators of a fake BSOD include the ability to interact with the screen, requests to execute commands via Windows tools, and the presence of CAPTCHA prompts. Organizations are advised to train employees, implement application control, enhance email and web defenses, and prepare for incident response to mitigate risks associated with such attacks.