Windows IT Pro Blog articles

Keep Windows activation automation working with PowerShell

Monika_Kumar — Thu, 10 Sep 2026 16:00:00 GMT

If your organization uses slmgr.vbs to automate Windows activation, now is the time to identify dependencies and prepare for a move to PowerShell. VBScript has been deprecated and will eventually be removed from future Windows releases, which means any automation that depends on slmgr.vbs will need to change.

While you can continue with existing activation processes during the transition phase, automation that depends on slmgr.vbs should be identified, tested, and migrated before VBScript is removed. The OSLicense PowerShell module is now the recommended way to perform common Windows activation tasks. The steps outlined in this article can help you get started.

Note: Availability of the OSLicense PowerShell module varies by Windows release. Please confirm support for each segment of your device population before changing your production automation approach.

VBScript deprecation gives you time to prepare

VBScript deprecation is occurring in phases. The sequence matters more than a single date:

Current phase: VBScript is available as part of Features on Demand (FOD) and is enabled by default on applicable Windows releases.
Later phase: VBScript will no longer be enabled by default. Workflows that still depend on it may require the feature to be enabled while migration is completed.
Final phase: VBScript will be removed from future Windows releases. At that point, slmgr.vbs will no longer be available as a fallback.

For the published VBScript lifecycle and timeline, see VBScript deprecation: Timelines and next steps.

Check availability of the PowerShell module before you migrate

The availability of the OSLicense PowerShell module differs between Windows client and Windows Server. Before updating your production scripts, confirm that the target device is running a supported release and has the required servicing update installed.

Platform	Required Windows update
Windows 11	August 27, 2026 (KB5120998) Preview or later
Windows Server	Planned for the next major version of Windows Server. If interested in early validation, use Windows Server vNext Preview Build 29651 or later.

Replace common slmgr.vbs tasks with PowerShell

The following examples show the intended mapping for three common tasks. Validate the final command names and parameters against the published OSLicense PowerShell reference before using them in production.

Task	Current command	OSLicense PowerShell equivalent
Activate Windows	slmgr.vbs /ato	Invoke-OSLicense -ActivateOnline
Install a product key	slmgr.vbs /ipk <key>	Invoke-OSLicense -InstallProductKey <key>
View licensing status	slmgr.vbs /dlv	Get-OSLicenseInfo

For the complete command reference—and to learn more about migration scenarios, parameters, and output details—see our OSLicense Module documentation.

Start preparing your activation automation now

Inventory dependencies: Search scripts, runbooks, task sequences, management policies, deployment tooling, and support procedures for slmgr, cscript, wscript, and .vbs references.
Confirm prerequisites: Identify the Windows client and Windows Server versions in scope, then verify OSLicense PowerShell availability and servicing requirements for each.
Pilot the replacement: Update representative scripts in a test environment. Validate command behavior, exit handling, output parsing, permissions, remoting, and logging before broad deployment.
Deploy and monitor: Roll out the transition through your standard change management process. Keep rollback guidance until the new automation is validated across the intended device population.

Move critical workflows first

You do not need to replace every slmgr.vbs call at once. Start by inventorying dependencies and identifying the activation workflows most important to your organization. Then confirm OSLicense availability, test representative scripts, and deploy validated changes through your normal change-management process. Inventory your slmgr.vbs, cscript, wscript, and .vbs dependencies, then select one representative workflow for a migration pilot.

The earlier you begin planning and validation, the easier it will be to modernize your activation workflows before VBScript reaches its final phase of removal.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Retiring NTLM: Frequently asked questions

mariam_gewida — Wed, 09 Sep 2026 16:10:54 GMT

NTLM has been a loyal companion to Windows since 1993. It helped us log in and share files, but it also quietly fueled a generation of red-team demos and incident reports. We're grateful for the service. We're also, respectfully, showing it the door.

This FAQ collects the questions we hear most often from customers, partners, and the community as we move Windows to a Kerberos-first, NTLM-optional (and eventually NTLM-free) future. If you've emailed us, cornered us at a conference, or filed a support case that started with "so, about this weird auth thing…", chances are that your question is answered here.

If your question isn't answered here, please reach out to ntlm@microsoft.com or work with your Microsoft account team, Customer Success Account Manager, or Microsoft Support to route feedback to the product group.

Strategy, timeline, and roadmap

What is "NTLMless"?
NTLMless is Microsoft's multi-phase effort to move Windows to a secure-by-default authentication posture by disabling NTLM as the default fallback and expanding Kerberos to cover the scenarios that historically forced NTLM usage. It is a platform shift, not a single feature or policy.

Why is Microsoft doing this now?
NTLM is deprecated and no longer under active feature development. It relies on weak cryptography, has no mutual authentication, and remains a leading vector for credential relay and pass-the-hash attacks that continue to drive real-world breaches. Reducing NTLM usage strengthens security posture and aligns with modern identity standards and post-quantum cryptography (PQC) readiness.

Is NTLM being removed or just disabled?
NTLM is being disabled by default, not removed outright. The underlying code will remain in Windows for a period after default disablement so administrators can re-enable it via policy for exceptional or edge-case scenarios where it's still required. Complete removal is a longer-term goal and will only happen after known dependencies have been addressed and viable Kerberos-based migration paths are broadly available.

When will NTLM be disabled by default?
Our current target for default disablement is the next major release of Server and Client (subject to change). Interim milestones (IAKerb and LocalKDC, enhanced auditing, blocking policies) will roll out ahead of that date. We publicly announced this direction in early 2026.

Does this mean NTLM will stop working on my existing Windows Server 2019/2022/2025 or Windows 10/11 devices?
No. Default disablement applies to the future release train. In-market versions of Windows client and Windows Server will continue to support NTLM. However, Microsoft strongly encourages customers to begin reducing NTLM usage now using the enhanced auditing and Kerberos improvements that are already shipping to supported versions of Windows.

What happens after NTLM is disabled by default? Can I re-enable it?
Yes, at least initially. When we ship default disablement, administrators will be able to re-enable NTLM via Group Policy or registry configuration to accommodate legacy applications and edge scenarios. Over time, as customer environments mature and dependencies are eliminated, the ability to re-enable NTLM will be narrowed. Our long-term objective is a Windows platform that doesn't need NTLM at all.

Kerberos enhancements replacing NTLM

What is IAKerb?
Initial and Pass-through Authentication using Kerberos (IAKerb) is a Kerberos extension that lets a client authenticate to a Key Distribution Center (KDC) when the client does not have direct line-of-sight to a domain controller. The target server acts as a proxy, securely passing Kerberos messages between the client and the KDC. That matters most in the scenarios KDC Proxy was never really designed for: machine-to-machine SMB, standalone servers, and (paired with LocalKDC) local-account authentication where there's no domain KDC in the picture at all.

What is LocalKDC?
LocalKDC is a lightweight KDC embedded in Windows that issues Kerberos tickets for local accounts. It removes one of NTLM's longest-standing dependencies by allowing Kerberos to be used for local-account authentication in workgroup, non-domain-joined, standalone-server, small-business, and peer-to-peer.

Note: NTLM in the enterprise (domain accounts, lateral movement, relay, credential theft against high-value identities) and NTLM for local accounts are different risk profiles with different urgency. For most enterprises, the domain-account case is the one that shows up in your threat model, your pen test report, and your board deck. LocalKDC doesn't address that. The enterprise work is IAKerb, the SPN and DFS improvements, and the blocking policies covered elsewhere in this FAQ. LocalKDC closes a different, narrower gap: it means "local account" no longer automatically means "NTLM." That's real cleanup, but it's not the enterprise headline.

When will IAKerb and LocalKDC be generally available?
Both features are currently available in Windows Insider preview builds. They will be generally available for Windows Server 2025 and Windows 11 in the coming months. Official release announcements will be made through the Windows IT Pro Blog and Microsoft Learn.

What about SPN, IP-address, and cross-domain scenarios where Kerberos historically failed?
These are the "stubborn" NTLM fallback cases, and they fall into two buckets: the ones we're fixing in the platform, and the ones only you can fix in your environment. Being honest about that split is important for your planning. These improvements are targeted for the same Windows Server and Windows client releases that brings default disablement.

What we're addressing in the platform:

Domain-based DFS namespaces — historically a reliable source of NTLM fallback, because the client's target resolution and the referral path didn't line up with a Kerberos-resolvable SPN. We're addressing this so DFS access can stay on Kerberos end to end.
Cross-domain and trustless scenarios, and broader, safer target-resolution behavior generally.

What you'll need to address yourselves:
We want to be direct here: we cannot fix missing, duplicate, or malformed SPNs in your directory. If a service account has no SPN, or the same SPN is registered on two accounts, or the client is requesting an SPN that doesn't match what's registered, Kerberos will fail and NTLM will pick up the slack. No platform change makes that go away. This is directory hygiene, and it is work that needs to start now rather than when default disablement lands.

The good news:
This is well-trodden ground with mature guidance. Start with Kerberos authentication troubleshooting guidance. To troubleshoot specific SPN failures, see Kerberos generates KDC_ERR_S_PRINCIPAL_UNKNOWN or KDC_ERR_PRINCIPAL_NOT_UNIQUE error, which walks through finding the offending SPN with setspn -Q / setspn -X and correcting it.

What are the new NTLM blocking policies?
NTLM blocking is being consolidated into a centralized, policy-driven engine. Administrators will have consistent controls to allow, audit, block for single sign-on only, or block NTLM entirely using policies that consider account type, device state, target characteristics, and whether the request is SSO or credential-based. Stay tuned for more information on this one in the coming weeks!

Scope, impact, and compatibility

Which scenarios may break when NTLM is disabled?
The most common failure patterns fall into four categories:

Hardcoded NTLM: An application explicitly requests NTLM and does not attempt Negotiate/Kerberos. Auto-Redirect and application updates address most of these.
Missing Kerberos prerequisites: The app uses Negotiate, Kerberos fails (missing SPN, IP address, no DC line-of-sight), and NTLM previously succeeded as fallback. IAKerb, LocalKDC, and SPN/IP support close these gaps.
Legacy protocol / device dependency: The client talks to a legacy server, embedded device, or third-party appliance that only supports NTLM end-to-end. Vendor updates will be required.
Local-account or special identity flows: The application authenticates using local accounts over the network. LocalKDC addresses the majority; a small subset (e.g., local interactive logon) is out of scope for LocalKDC.

Is NTLM only used on Windows endpoints?
Primarily, yes. NTLM is a Windows authentication protocol. However, non-Windows clients (macOS, Linux, Android, iOS, network appliances) can and do use NTLM when connecting to Windows resources such as SMB file shares, on-premises Exchange, or Windows-hosted web apps. This is especially common with third-party SMB clients, Outlook for Mac, and mobile device management scenarios. These clients will continue to work if they can negotiate Kerberos with the Windows server. The goal is to make Kerberos possible in more of these scenarios via IAKerb and LocalKDC.

What about cross-domain authentication without a trust?
Cross-domain authentication without a configured trust is a scenario that today requires NTLM. We're aware customers avoid cross-forest trusts for ransomware-containment reasons. This is one of the scenarios being addressed in the same Windows Server and Windows client release that brings default disablement so that trustless cross-domain authentication can succeed on Kerberos.

What about IP-address-based authentication?
Kerberos does not natively understand IP addresses, so authentication requests made using an IP address (rather than an SPN) fall back to NTLM. The single most important thing to know: do not wait for a platform fix here. Start auditing and eliminating IP-based authentication now. The majority of the transition is addressable today and every instance you remove is one less thing to unblock later.

Start here:

Audit it: Enhanced NTLM auditing will tell you not just that an IP address was used, but which process used it. That process name is your remediation worklist - it turns a vague "we have some NTLM" into a specific, assignable list of owners.
Fix hardcoded IPs in applications: This is consistently the largest bucket. In-house and line-of-business apps with connection strings, config files, or scripts pointing at literal IP addresses. Route them through DNS names instead. This is usually a configuration change, not a rewrite.
Educate users: \\10.1.2.30\share in a bookmark, a mapped drive, or a runbook is a small habit with a real cost. Names, not numbers.
Use TryIPSPN where you genuinely can't change the target: Windows supports IPv4 and IPv6 hostnames in SPNs when the client registry value TryIPSPN is set under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters, with the corresponding SPN registered via Setspn -s host/<ip.address> <account>.

Note: This must be set on each client that needs it, and IP-based SPNs should have static leases. See Configuring Kerberos for IP Address for the full procedure and caveats.

What's left after that? Only the genuinely irreducible cases: targets you don't control, appliances that can't be changed, scenarios where no name exists. Those scenarios are what our in-flight work is designed for: effectively an allow list for Kerberos over IP address, scoped deliberately so it stays an exception rather than becoming the new default. The smaller you make that list through the steps above, the smoother your path to default disablement.

Will Microsoft apps still use NTLM after disablement?
No, Microsoft is running a broad internal effort to identify and remove hardcoded NTLM from first-party Windows components. This ensures Windows itself is not silently re-introducing NTLM through hardcoded paths and gives our components the benefit of Kerberos wherever possible.

Will there be a list of Microsoft apps still dependent on NTLM?
We don't plan to publish such a list. Our commitment is that Microsoft-owned dependencies are being fixed as part of the platform work. What matters for your environment is identifying NTLM usage (your own apps, third-party apps, appliances, and services). Enhanced NTLM auditing is designed specifically for this work.

Auditing, visibility, and discovery

How do I find out where NTLM is being used in my environment?
Enhanced NTLM auditing is the recommended starting point. It's a major upgrade to the legacy NTLM event logging that has been available in Windows for years. The new events answer the three questions we hear most from customers:

Who is using NTLM - the account, the machine name, the machine IP, and the process
Why NTLM was used instead of Kerberos - including structured fallback reason codes (missing SPN, no DC line-of-sight, local account, IP address, hardcoded, etc.)
Where the NTLM authentication is happening - both the source and the target of the request

Which Windows versions have enhanced NTLM auditing?
Enhanced NTLM auditing is available for Windows 11, versions 25H2 and 24H2 and Windows Server 2025. We are also working on bringing back enhanced auditing to Windows Server 2019 and Windows Server 2022.

What about NTLMv1 specifically. Is anything changing there?
Yes. NTLMv1 was blocked and rendered non-functional starting with Windows Server 2025 and Windows 11, version 24H2, with related changes rolling out through recent updates. NTLMv1-derived credentials are still used by some higher-level protocols (Wi-Fi, Ethernet, VPN via MS-CHAPv2), so SSO in those scenarios may be affected. See Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025 for more details.

What you can do today

How can I tell if my code is using NTLM?
Two ways. First, look at what your code says. Second, look at what it actually does at runtime. You need both sets of information because a lot of NTLM usage isn't explicitly requested; it's inherited by accident.

For explicitly hardcoded NTLM (the easy ones to find, once you look). search your source for the literal string NTLM and NTLMSSP. In most cases, the fix is the same one-line change: ask for Negotiate instead of NTLM. Negotiate will use Kerberos when it can and gives you a clean migration path; hardcoding NTLM guarantees you can't.

For accidental NTLM (the ones that hurt), you are looking for code that never mentions NTLM but gets it anyway. This can include:

Connecting to a literal IP address rather than a hostname (no SPN, no Kerberos)
Connecting to a target whose SPN is missing, duplicated, or malformed
Passing explicit credentials where SSO with the ambient identity would work
Reaching a target the client has no KDC line of sight to

To confirm what is happening at runtime, you have options. The NTLM Operational log records outgoing and incoming NTLM, and Security Event ID 4624 shows the authentication package used. Enhanced NTLM auditing goes further and surfaces the process and target behind each event, which is what converts a log into a fix list. Running the klist command on the client is a fast sanity check. If you expected Kerberos and there's no ticket for the target, you have your answer.

Where do I start?
Here is a pragmatic, phased approach that has worked well for early adopters:

Audit: Turn on enhanced NTLM auditing on clients, servers, and domain controllers. Give yourself several weeks of data to establish a baseline and identify the top NTLM callers, most-used protocols (SMB, RPC, HTTP), and highest-volume scenarios (fallback reasons, IP-based auth, hardcoded).
Prioritize: Group findings by root cause (e.g., missing SPN, hardcoded caller, legacy appliance) so you can remediate at scale rather than machine-by-machine.
Remediate the easy wins: Register missing SPNs, retire NTLMv1, replace legacy scripts that hardcode NTLM, and pilot IAKerb and LocalKDC on the workloads where they help most.
Pilot NTLM blocking: Use the ring-based approach (start with high-value/privileged accounts and non-critical services) and iterate outward.
Engage vendors: For hardcoded-NTLM in third-party products, open cases with your ISVs so they can plan their own remediation. Auto-Redirect in Windows will help, but vendor cooperation makes the transition faster and safer.

Should I wait for IAKerb and LocalKDC to be generally available before starting?
No, you can start the audit and remediation work today with in-market Windows. Enhanced auditing is already available, Kerberos hygiene work (SPN registration, credential-guard adoption, NTLMv1 removal) can begin now, and legacy-app inventories almost always take longer than expected. When IAKerb and LocalKDC are broadly available, you'll be positioned to adopt them quickly.

What are the most common blockers other organizations report?

From our readiness survey and direct customer engagements, the top blockers are:

Legacy applications and third-party devices/appliances with hardcoded NTLM or no Kerberos support.
Application dependencies whose owners are hard to reach or slow to update.
Lack of visibility into where NTLM is being used and why - the top single ask from customers is better reporting and diagnostics.
Cross-domain and non-domain-joined scenarios that historically only worked with NTLM.
Compatibility risk and the fear of causing an outage - which is why staged blocking, allow-lists, and audit-then-enforce modes matter.
Time and resource constraints and competing IT priorities.

Are there organizations who have already reduced or eliminated NTLM?
Yes. Multiple enterprises are actively reducing NTLM! Several have reported cutting NTLM usage by more than 90%, and a small number have fully blocked NTLM. Common patterns among success stories: estates running the latest versions of Windows Server and Windows 11, a willingness to invest in enhanced auditing, executive sponsorship for tackling application dependencies, and a phased, ring-based rollout rather than a "big bang" switch.

Support, feedback, and escalation

Where do I send NTLM-related questions or feedback to Microsoft
Email us at ntlm@microsoft.com. Please include details on the version(s) of Windows Server or Windows client you're running, a short description of the scenario or blocker, and whether you have enabled enhanced NTLM auditing. The team monitors this alias and prioritizes recurring themes for updating our public guidance.

What if I hit a Kerberos or NTLM issue that appears to be a product bug?
Please open a Microsoft Support case through standard support channels. Support will collect diagnostics and, if needed, escalate to the Windows product group. The support ticket path is important; it lets us track scenarios, telemetry, and reproducibility formally rather than through email threads.

How can I stay informed of upcoming NTLM-related changes?
Follow the Windows IT Pro Blog for public announcements and bookmark the Windows message center or subscribe to Windows announcements on the Microsoft 365 admin center message center for tenant-relevant notifications. If you have a non-disclosure agreement (NDA) with Microsoft, you can ask your account team about the NTLMLess newsletter and Management Advisors Program updates. Major NTLM milestones (feature general availability, default disablement dates, backport releases) will be announced through these channels.

Additional resources

Here is a short list of useful references for going deeper:

NTLM overview - protocol overview and history
Reducing NTLM dependency: IAKerb and LocalKDC in Windows Insider Preview - details on feature availability
The evolution of Windows authentication - the strategic context behind the move away from NTLM
Advancing Windows security: Disabling NTLM by default - the public roadmap announcement
Overview of NTLM auditing enhancements in Windows 11, version 24H2 and Windows Server 2025 - how to turn on and read enhanced auditing
Upcoming changes to NTLMv1 in Windows 11, version 24H2 and Windows Server 2025 - what's changing for NTLMv1 specifically
Active Directory hardening series – Part 8: Disabling NTLM - practical guidance for Active Directory administrators
Block NTLM connections on SMB – Guidance on how to block NTLM authentication on SMB clients
Eliminating NTLM in Windows - technical deep dive

Have questions? Email us at ntlm@microsoft.com.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: August 2026

Chris_Morrissey — Wed, 02 Sep 2026 21:22:37 GMT

From device recovery and unattended remote support to post-quantum cryptography readiness and Windows 365 improvements, August delivered a broad set of updates for IT admins. In this edition of Windows news you can use, explore new recovery and management tools, security enhancements designed to strengthen protection by default, Windows Server updates, AI-related improvements in Windows, and upcoming lifecycle milestones that may require action in your environment.

New in Windows update and device management

[RECOVERY] – From automated, cloud-based fixes to full device rebuilds, a new Windows device recovery guide helps you find the right recovery tools to help you address everything from mass-scale outages to isolated issues.
[BACKUP] – New PowerShell scripts available on GitHuband the PowerShell Gallery offer a simpler way to manage Windows settings backup and restore data using Microsoft Graph APIs.
[AUTOPILOT] – Windows Autopilot device preparation now supports device association, making it possible to bind a physical Windows 11 device to your organization before enrollment. Associated devices are automatically marked as corporate-owned and can receive device-targeted policy assignments, device naming, and additional out-of-box experience (OOBE) customizations.
[INTUNE] – Remote Help unattended support with remote sign-in a new Intune capability that lets helpdesk staff remotely access physical Windows devices by signing in with credentials they have access to, without requiring the user to grant access or even be logged in. Explore Remote Help on Windows for details on prerequisites and setup guidance.
[UPDATE DELIVERY] – If you've ever had to troubleshoot a content delivery issue with Delivery Optimization or Microsoft Connected Cache, the Delivery Optimization Troubleshooter can quickly help you identify why things aren't working as expected.
[W365] [AGENTS] – Currently in preview, Windows 365 for Agents Cloud PC agent pools now support linking either a Microsoft Entra group or a Windows Autopilot device preparation profile. Target security and compliance policies, deploy required applications, and maintain consistent configurations across Windows 365 for Agents using existing Intune workflows. See Cloud PC agent pool device grouping and preparation for more details.
[W365] [AUTOPILOT] – You can now assign Device Preparation policies to Windows 365 Reserve provisioning policies so required applications and configurations are applied during provisioning before users connect to their Cloud PCs. In addition, Windows Autopilot device preparation is now generally available for Windows 365 Enterprise and Windows 365 Flex in dedicated mode in Government environments.
[W365] [RESERVE] – Windows 365 Reserve now supports bulk provisioning and deprovisioning of up to 1,000 Cloud PCs in a single request.
[W365] [CONNECTIVITY] – Windows 365 has started the rollout of Modern Auto-Reconnect, a new connection recovery experience designed to improve resiliency during temporary network interruptions.
[ARM] – New signals show that momentum for Windows on Arm is accelerating. Explore the latest device announcements and trends in the expanding catalog of more than 7,000 optimized apps across key workloads.

New in Windows security

[VBS] [KERNEL PROTECTION] – Beginning in October 2026, Microsoft will expand memory integrity protection across eligible devices, helping you benefit from stronger kernel-level protection from sophisticated attacks by default with little or no additional configuration.
[PQC] [CODE-SIGNING] – Microsoft has published guidance to help software publishers, developers, and IT administrators prepare for the next generation of Windows code signing. Changes coming in the next few months will strengthen software supply chain security through modern cryptographic protections.
[W365] [AGENTS] – A dedicated security baseline for Windows 365 for Agents is now generally available in Microsoft Intune. Apply Microsoft-recommended security configurations to agent Cloud PCs, helping establish a consistent security posture and protect agent workloads from common security risks.

To explore what's new in security across the Microsoft platform, see What's new in Microsoft Security: July 2026.

New in AI

[TASK MANAGER] – Windows Task Manager now provides deeper visibility into AI workloads running on a device. Some newer devices will now see neural processing unit (NPU) or graphics processing unit (GPU) neural engine activity familiar CPU and standard GPU activity on the Processes tab, with utilization on the Performance tab.

New in Windows Server

For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server 2022 release notes.

[HARDENING] – The October 2026 monthly security updates for Windows Server will begin Enforcement mode for Active Directory Federation Service (AD FS) Distributed Key Manager (DKM) container ACL hardening, a change designed to address the elevation of privilege vulnerability documented in CVE-2026-56155. Organizations using AD FS should use the remaining Audit mode period to review DKM container permissions and address compatibility issues before enforcement begins.
[COMMUNITY] – Interested in staying informed about the latest in Azure Arc and Windows Server management, influencing product direction, and expanding your professional network? Join the Azure Arc Customer & Engineering Forum.
[PQC] – Windows Server now supports hybrid post-quantum cryptography (PQC) key exchange in Transport Layer Security (TLS) 1.3 as well as composite cryptographic formats that combine traditional and post-quantum algorithms in a single signature or key. Looking for guidance on how to plan for new cryptosystems and prepare for future cryptographic changes? Watch Transitioning to post-quantum cryptography.

New in productivity and collaboration

Install the August 2026 security update for Windows 11, versions 25H2 and 24H2 to get these and other capabilities, which will be rolling out gradually:

[FILE EXPLORER] – File sizes in the Details view now display using appropriate units (KB, MB, GB) instead of KB-only. We hope it helps you understand them easier at a glance.
[ACCESSIBILITY] – Voice Access now features Voice Isolation. As such, it recognizes your voice better by reducing interference from other speakers and background noise. Voice Access also now supports Korean.

New features and improvements are coming in the September 2026 security update. You can preview them by installing the August 2026 optional non-security update for Windows 11, versions 25H2 and 24H2. This update includes the gradual rollout of:

[SECURITY] – Use Administrator protection to help reduce the risk of elevation-of-privilege attacks by using profile separation and just-in-time administrative privileges. This feature is off by default and can be enabled through Microsoft Intune (OMA-URI) or Group Policy.
[TASKBAR] – Choose whether the taskbar appears at the bottom, top, left, or right side of your screen. You can also try a smaller taskbar option to help maximize screen space on smaller devices.
[SEARCH] – Windows Search home has been simplified to reduce visual clutter and make it easier to get back to recent searches quickly. A new setting lets you choose whether web and Microsoft Store suggestions appear alongside local results. And, Windows now automatically indexes your most used folders to make those files appear in subsequent search results.
[START] – The Start menu now lets you select a small or large menu size; independently show or hide the Pinned, Recommended, and All sections; and hide your name and profile picture.
[SHARE] – Users signed in with a work or school account can now discover and install relevant apps directly from the share window.

To learn about planned productivity, security, and reliability updates for Windows 11, visit the Windows Roadmap.

Lifecycle reminders

[W11] [24H2] – On October 13, 2026, Windows 11, version 24H2 Home and Pro editions will reach end of updates. After this date, devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats. Enterprise and Education editions remain supported until October 12, 2027.
[W10] [LTSB] [LTSC]- On October 13, 2026, Windows 10 Enterprise LTSB 2016 and Windows 10 IoT Enterprise LTSB 2016 will reach the end of extended support. Windows 10 Enterprise LTSC 2021 will reach end of support (EOS) on January 12, 2027. In both cases, we recommend updating to the latest LTSC release, Windows 11 Enterprise LTSC 2024. If you need additional time to complete the transition, explore options and Extended Security Update (ESU) offerings for Windows 10 Enterprise LTSB 2016and Windows 10 Enterprise LTSC 2021.
[SERVER] [2022] – On October 13, 2026, Windows Server 2022 will reach end of mainstream support. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost. These devices will continue to receive monthly security updates through October 14, 2031. For detailed information, see the Windows Server 2022 lifecyclepage.
[WMIC] – The Windows Management Instrumentation command-line (WMIC) utility has been removed from Windows 11, version 24H2 and later. WMI itself remains supported and unaffected. If you have applications, scripts, deployment tools, or monitoring systems that use WMIC, migrate them to PowerShell or a supported WMI programming interface.

Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Windows Server 2025.

Additional resources

Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs? Find out this and more through the following resources:

Windows Roadmap for new Windows features – filter by platform, version, status, and channel or search by feature name
Microsoft 365 Copilot release notes for latest features and improvements
Windows Insider Blog for what's available in the Beta and Experimental channels
Windows Server Insider for feature preview opportunities
Understanding update history for Windows Insider preview features, fixes, and changes to learn about the types of updates for Windows Insiders

Join the conversation

Is this update missing areas or topics you want us to include? Drop us a note in the Comments and share your thoughts on what you'd like to see.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Expanding memory integrity protection across Windows devices

Peter_Waxman — Tue, 01 Sep 2026 16:00:00 GMT

Security works best when protection is built in, not bolted on.

Beginning in October 2026, Microsoft will expand memory integrity protection across eligible devices, helping you and your organization benefit from stronger kernel-level protection from sophisticated attacks by default with little or no additional configuration. This change reduces security complexity while helping you establish a stronger security baseline across your environment.

Built on Virtualization-based Security (VBS), memory integrity helps protect critical parts of Windows from tampering. It forms a foundation for modern security innovations such as hotpatch updates that improve user experience and productivity, as well as protection.

Making advanced security the easier choice

More devices will soon receive stronger protection by default, with no additional setup required. Windows quality updates will begin enabling memory integrity protection on eligible devices. If not already enabled, these updates will also enable VBS, helping make additional security capabilities available and reflecting our commitment to making Windows secure by design and secure by default.

To help ensure a reliable device experience, Windows automatically evaluates readiness before enabling memory integrity. Readiness signals include hardware capabilities, compatibility, and performance considerations. For more detail on requirements, see our Memory integrity and VBS enablement documentation.

Recommended by Microsoft, controlled by you

Windows provides a recommended security baseline, while respecting organizational choice. While most eligible devices will benefit automatically from memory integrity protection, you retain full control over your security configuration. Existing administrator and user decisions and policies remain in effect. This means that devices where memory integrity has already been disabled won't be automatically changed by this rollout.

If memory integrity is not enabled by default, users and organizations can still review, configure, and enable it using existing Windows security and management tools. For step-by-step guidance, see Enable memory integrity.

Stronger protection today, a foundation for tomorrow

By expanding memory integrity protection across eligible Windows devices, Microsoft is helping you establish a stronger security foundation, reduce configuration burden, and prepare for the next generation of Windows security innovations. Soon, more devices will be protected against attacks that attempt to compromise the Windows kernel and gain control of critical operating system functions. Memory integrity helps make this possible by allowing only trusted kernel-mode code and drivers to run. More protection. Less complexity. A stronger foundation for what's next.

For more information on memory integrity, see:

Securing today. Preparing for what's next.
Learn more in the Windows Security book and Windows Server Security book. To stay up to date on the latest in security features and enhancements, visit the Microsoft Security site, follow the Microsoft Security Blog, or connect with Microsoft Security on LinkedIn and @MSFTSecurity.

Task Manager features for visibility into AI workloads

Larry_Hu — Wed, 19 Aug 2026 16:05:51 GMT

Windows Task Manager now provides deeper visibility into AI workloads running on a device. Previously, the Processes tab didn't show per-process activity for the neural processing unit (NPU) or graphics processing unit (GPU) neural engine. Now, on some newer devices, this data appears alongside familiar central processing unit (CPU) and standard GPU activity on the Processes tab, while the Performance tab shows overall utilization. Whether you're an IT pro, developer, or power user, this data can help as follows:

For IT professionals: Troubleshoot and report on performance.
For developers: Validate whether AI models are landing on the intended NPU or GPU neural engine instead of CPU or standard GPU compute.
For power users: Understand and improve performance and battery life.

Let's look at these use cases more closely.

Note: In this post, we distinguish standard GPU compute from the newest GPU equipped with dedicated AI matrix engines, called the GPU neural engine. The NPU and GPU neural engine are new pieces of hardware that perform AI math more efficiently than the standard GPU.

Enterprise helpdesk support

As the demand for AI based tooling increases, it's important to have a built-in way to determine what processing resources an app is using.

If you're an IT helpdesk professional, you support hundreds to thousands of corporate devices. When a user reports a problem with an AI-enabled app, you can use the improved Windows Task Manager to troubleshoot.

On supported devices, the Processes and Performance tabs show exactly how background tasks are interacting with processing engines. For example, here is how to tell if a workload designed to reach the dedicated NPU and GPU neural engine is instead falling back to general CPU and GPU compute.

In Task Manager, go to the Processes tab.
Choose which data to view. Right-click (or select and hold) in the column area and select any (or all) of the following columns: NPU, NPU engine, GPU, and GPU engine.

The Processes tab in Task Manager shows a popup menu of available columns to display. The NPU shows high usage from an AI-enabled application in the top row.
Locate the desired software or enterprise agent in the Name column. If your application takes advantage of hardware designed for AI workloads, you can see utilization across the different areas.

The GPU Neural engine shows usage from an AI-enabled application in the top row.
To visualize usage over time, navigate to the Performance tab.
Select NPU or GPU. Alternatively, view the NPU or GPU by right-clicking (or selecting and holding) anywhere in the graph space. Select View, then choose among CPU, Memory, Disk, Network, GPU, or NPU views.

The NPU performance graph shows usage from an AI-enabled application.The GPU performance graph shows usage from an AI-enabled application in the Neural engine.

To evaluate whether an application takes advantage of dedicated hardware appropriately, check if the application offloads to the NPU or the GPU's matrix arrays. If you see that the application mostly uses the CPU or runs on the GPU's rendering pipeline, that application might be misconfigured or it might not have been designed to take advantage of this hardware.

Once you identify whether the workload is running on the NPU, GPU, or CPU, you can spot-check individual devices for further details. For example:

Is a device's AI workload reaching the NPU? Or is it falling back to the GPU rendering pipeline or general CPU compute?
Which applications on the device are actually using the NPU or the GPU's neural engine?

Real-time validation for AI-driven app development

When building AI applications with frameworks like ONNX Runtime or Windows DirectML, you write code to target specific hardware execution providers (i.e., CPU, NPU, or GPU). If an application encounters an unsupported data type or driver mismatch, the framework can silently fall back to a higher-overhead compute pipeline to prevent the application from crashing.

To help you identify and correct these issues, as well as to track appropriate AI model performance, we've introduced more granular views in Task Manager specific to the NPU and the GPU neural engine.

Hardware use verification

You can use Task Manager for basic runtime verification to confirm what processing resources your AI workload is actively using.

In Task Manager, open the Details tab.
Right-click (or select and hold) on any column header and select Select columns.
Check any of the following to monitor active execution: NPU, NPU engine, GPU, and/or GPU engine.
Look at the active use data to identify any workloads that fall back to the CPU and, therefore, don't use the device's resources appropriately. They show the following symptoms: the NPU column stays at 0%, the NPU engine remains blank, while the GPU engine column shows no activity from its neural engine.
(Optional) Enable Dedicated NPU memory, Shared NPU memory, Dedicated GPU memory, or Shared GPU memory to track weight allocations and memory overflow.
The Task Manager Details tab shows a pop-up menu to select additional columns.

Reasons for unexpected AI model performance

If your local AI model is running unexpectedly slow, the system might be silently falling back to the CPU or the standard GPU compute pipeline. There are two main reasons for this:

A device might lack a specific driver.
There might be a data type mismatch (for example, trying to force an FP32 model onto an INT8-optimized NPU or an unsupported operation in the model not compatible with the neural engine or NPU).

Modern silicon architectures integrate dedicated matrix accelerators right inside the graphics processor. Therefore, it's critical to track whether your math lands on the GPU 0 - Neural engine versus the NPU as you debug your execution provider bindings.

Another dimension that can explain variable AI model performance is through the new columns: Shared NPU memory and Dedicated NPU memory. These columns show how much memory an AI workload is using and which pool it comes from.

Shared NPU memory: The NPU draws from system memory alongside the CPU and GPU. On a system with both Dedicated and Shared NPU memory, watch for rising shared NPU memory usage. It's your indicator that dedicated memory is filled, and allocations are spilling over to shared NPU memory, which can reduce performance.
Dedicated NPU memory: Memory belonging to the NPU alone. A workload that fits within it doesn't compete with the rest of the system. This column is empty on integrated NPUs, which have no separate pool.

Live tracking

As the previous screenshots show, the Performance tab brings multiple details together into a live tracking view. This means you can run your tuned model, look at Task Manager, and instantly verify:

The success state: Matrix multiplication executes on the NPU and/or the GPU neural engine as expected.
The fallback state: If the NPU and the GPU neural engine both show zero usage while CPU or general GPU usage is increasing, the fallback is happening. Proceed to re-quantize your model.

Task Manager now makes execution provider fallback visible at a glance, in real time, alongside what the rest of the system is doing.

Power profile insights for power users

If it's not your job to build or troubleshoot AI applications, the enhanced Task Manager experience still offers workload transparency and proactive battery management.

AI workloads are computationally heavy. When a local application runs a background blur, a video upscale, or an image manipulation model, it has two main ways to execute these tasks.

The CPU and standard GPU route: Power-hungry workloads kick the fans into overdrive and drain your battery in about two hours.
The NPU and GPU neural route: Highly efficient workloads sip milliwatts and keep your laptop cool on your lap.

Imagine you're working on battery power and running a suite of creative or collaboration tools. They don't drain your battery as quickly if they're optimized to use modern hardware acceleration pipelines. And you no longer have to guess how your applications are impacting your system resources. To verify feature optimization using Task Manager:

In Task Manager, open the Processes tab.
Select an active application.
Compare the data in the GPU engine, NPU, and NPU engine columns. That's where you can see exactly which execution engine the app is using in real time.

The Task Manager Details tab shows the NPU engine and dedicated and shared NPU data for Python.

An application can be optimized to use both the NPU and the GPU, but it might not be optimized to use either.

If an application is optimized to use the NPU, you'll see either NPU - Compute or NPU - Neural under the NPU engine column. Depending on your processor and driver version, Task Manager labels active NPU workloads as NPU – Compute or NPU – Neural. Both indicate that on-device AI acceleration is actively running on the NPU.
Similarly, if an application is optimized to use the GPU's hardware, the GPU engine column lists GPU – Neural.
Apps that aren't optimized for either of these dedicated resources show one of the following symptoms:
- The CPU column shows high usage while the NPU column is idle.
- The GPU engine column doesn't show GPU - Neural.

More explicitly, Power usage and Power usage trends reflect and can confirm the impact.

A closeup of the Task Manager Details tab compares NPU, NPU engine, and power usage data for an app.

Task Manager gives you instant operational awareness. It allows you to adjust your behavior constructively. For example, you can pause heavy background tasks until you're connected to a power outlet. Or, you can continue using apps that are already fully native for your unplugged, on-the-go workflows.

Visibility drives optimization

As AI workloads become more common on Windows devices, visibility into NPU and GPU neural engine utilization can help you make better informed decisions. With the latest Task Manager improvements, you can monitor AI processing activity alongside CPU, memory, storage, and networking data from a familiar interface.

Explore the new metrics in Task Manager to evaluate application performance, troubleshoot resource bottlenecks, and better understand how your devices use AI-capable hardware. Importantly, these growing capabilities today provide a foundation for future hardware innovation across the ecosystem.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Collecting Delivery Optimization logs the easy way

Andy_Rivas — Tue, 18 Aug 2026 16:00:00 GMT

You've deployed Delivery Optimization settings and perhaps even a Microsoft Connected Cache node to reduce network traffic on Patch Tuesday. But things aren't working as expected. You aren't seeing good content peering efficiency. You notice peers reaching across the internet to other sites or find that content isn't coming from a Connected Cache. What do you do next?

If you've ever had to troubleshoot a content delivery issue with Delivery Optimization or Connected Cache and or needed to send logs to Microsoft support — or just wanted to dig in yourself — let's talk about a free tool that can make the process easy.

The Delivery Optimization Troubleshooter is a Microsoft diagnostic tool designed to quickly help you identify why Delivery Optimization or Microsoft Connected Cache isn't working as expected. It collects configuration details, network diagnostics, service status, performance data, and logs into one support-ready bundle, making troubleshooting faster and easier.

How to use the Delivery Optimization Troubleshooter to collect diagnostic and debugging information

The first step is to download and install the Delivery Optimization Troubleshooter from PowerShell Gallery on the device you want to debug and run the following command using the PowerShell console:

Install-Script -Name DeliveryOptimizationTroubleshooter

To collect the logs, all you have to do is run this one-line command:

DeliveryOptimizationTroubleshooter.ps1 -GenerateSupportBundle

This command collects a full snapshot: Delivery Optimization service logs, configuration, network info, and event logs — packaged into a zip file and ready to share. Pretty easy, right?

What if you want to reproduce a live issue? Add ReproduceIssue to the GenerateSupportBundle command as shown in this example:

DeliveryOptimizationTroubleshooter.ps1 -GenerateSupportBundle -ReproduceIssue

How the Delivery Optimization Troubleshooter works

At a high level, here is what this troubleshooter does and how it can be used to debug a live issue:

The tool switches Delivery Optimization tracing to verbose logging and increases log limits.
The tool stops the Delivery Optimization service, wipes old log files (creating a clean slate), and restarts with verbose logging enabled.
You reproduce whatever was failing (e.g. trigger the download or run Windows Update), then press Enter.
The script stops Delivery Optimization again, captures the verbose reproduction logs, disables verbose logging, and moves on.

Here's a detailed description of what happens throughout the support bundle generation process:

Step	What it captures
1	Existing Delivery Optimization logs
2	Delivery Optimization service status
3	Delivery Optimization performance snapshot
4	Delivery Optimization configuration details
5	Network configuration details (ipconfig /all)
6	Network List Manager (NLM) data (which networks Windows sees and their states)
7	NLM cost data (shows whether the connection is metered)
8	Proxy settings
9	DoSvc registry key
10	Troubleshooter diagnostics output
11	Interactive pause (waits for you to reproduce the issue)

In the final step, the tool creates the zip file and stores it in %TEMP% as dosvc-diag-[username]-[machinename]-[timestamp].zip.

Here are the typical files produced after running the troubleshooter, and what each one tells you:

File	What's in it
troubleshooter-output.txt	Structured pass/fail diagnostic checks (the fastest file to start with)
status-dosvc.txt	Per-job download breakdown: every file Delivery Optimization has touched, bytes from each source (HTTP, peers, Microsoft Connected Cache), download duration, caller app
logs-dosvc-repro.txt	Verbose logs captured during your reproduction window
logs-dosvc-existing.txt	Pre-existing Delivery Optimization logs (large, but useful for history before the issue)
network-nlm-data.txt	Full NLM network data (connected networks, interface states)
network-ipconfig.txt	Full ipconfig /all output
config-dosvc.txt	All Delivery Optimization policy values and their source (MDM, GPO, or default)
dosvc-registry.reg	Raw DoSvc registry key export
network-nlm-cost.txt	Connection cost (unrestricted vs. metered; Delivery Optimization throttles aggressively on metered)
network-proxy-settings.txt	WinHTTP + IE proxy config
perfsnap-dosvc.txt	Monthly bandwidth totals by source: HTTP, LAN peers, Microsoft Connected Cache, internet peers

I have the output from the Delivery Optimization Troubleshooter. What's next?

Start with the troubleshooter-output.txt file. It runs structured checks and surfaces failures immediately. Example from a real run:

Name : Download Mode Result : Pass Details : LAN - 1 Name : CacheHost server configured Result : 10.1.1.101 Name : Download from CacheHost server Result : Fail Details : Unable to connect to the remote server 10.1.1.101:80

In this example, the last detail instantly tells you Microsoft Connected Cache is configured, but is not reachable on the device.

The perfsnap-dosvc.txt shows your monthly Delivery Optimization bandwidth split at a glance:

DownloadHttpBytes : 27,171,761,913 ← 27 GB straight from CDN DownloadCacheHostBytes : 0 ← 0 bytes from MCC this month DownloadLanBytes : 747,999,564 ← ~700 MB from LAN peers

If DownloadCacheHostBytes is 0 on a machine that should download from a Microsoft Connected Cache, this confirms what the Troubleshooter output had shown.

Status-dosvc.txt tells you per-download where bytes came from, which caller app triggered it (PredefinedCallerApplication: IntuneAppDownload, WindowsUpdate, etc.), and how long the download took. This can be useful for showing that a specific content type isn't routing through Microsoft Connected Cache.

When analyzing the bundle, here are the things I look for first:

HRESULTerror codes: These tell you what failed (e.g., 0x80D03002 = no peers found, 0x80D02002 = timeout reaching CDN). See Delivery Optimization Return Values for more details.
DownloadMode: This value confirms whether P2P/Microsoft Connected Cache is enabled. See the Download Mode documentation for more details.
GroupID: Misconfigured group IDs are a surprisingly common cause of peers not finding each other. For more information, see the Group ID documentation.

Note: The current DeliveryOptimizationTroubleshooter version 1.3.0 contains a built-in list of 72 error definitions. There is a JSON array embedded as $errorsObj inside the script's Get-DOErrorsTable function. With a standard installation, you can inspect it at: C:\Program Files\WindowsPowerShell\Scripts\DeliveryOptimizationTroubleshooter.ps1 The source and latest version are available at aka.ms/do-fix

Below are some real-world examples from customer logs that demonstrate cases where content came from Connected Cache or didn't come from Connected Cache.

Example 1: 100% downloaded from Connected Cache

caller: IntuneAppDownload cacheHost: GP:192.168.10.5 cdnIp: [192.168.10.5]:80; X-CCC:...; X-CID:10000 File: 157504 DOINC: 157504 conns: [CDN: 0, DOINC: 1] timeMs: 1482 sessionTimeMs: 619

All 157,504 bytes came through Microsoft Connected Cache, confirmed by the private "cdnIp" (Delivery Optimization sees Microsoft Connected Cache is just another CDN) and X-CID:10000 (X-CID 10000 = Enterprise Connected Cache). This is a very clear example of the device downloading 100% of the content from a local Connected Cache server.

Example 2: No downloads came from Connected Cache

caller: MDMSW Job cdnUrl: https://naprodimedatapri.azureedge.net/IntuneWindowsAgent.msi cdnIp: [13.107.246.73]:443 cacheHost: GP:192.168.10.5 File: 7901184 DOINC: 0 conns: [CDN: 1, DOINC: 0] timeMs: 94571 sessionTimeMs: 1176

Intune-related content bypassed using Connected Cache for downloads, but why did the client not use Connected Cache even though it was configured? Hint: What port was used for the download? 🤔

Digging deeper into the logs you will see more details on the actual download event, which confirms the suspicion.

DownloadError: hr = 80072efd, httpCode = 0, url = https://192.168.10.5/...IntuneWindowsAgent.msi … Unresponsive cache host 192.168.10.5 ErrorCode: -2147012867 # 0x80072EFD Ban count for 192.168.10.5 is 1 … Establishing HTTP Connection to https://naprodimedatapri.azureedge.net/IntuneWindowsAgent.msi … cacheHost = 192.168.10.5 bytes: [File: 4995, CDN: 4995, DOINC: 0] … Connecting to ... naprodimedatapri.azureedge.net, IP: []:443 HTTP download request complete(hr = 0)

Further evidence can be seen in the logs of the download source:

{CHttpPeerConn::Initiate} initiating HTTP connection, IP: 13.107.246.73 {CConnMan::ConnectionComplete} connected to https://naprodimedatapri.azureedge.net/IntuneWindowsAgent.msi (httpConnection) {CHttpPeerConn::_OnComplete} HTTP connection: [13.107.246.73]:443

Aha! The download happened over https, but why did it not come from the Connected Cache? The key is the download error (DownloadError: hr = 80072efd) which is ERROR_WINHTTP_CANNOT_CONNECT. The bottom line is the Connected Cache server is not configured for https downloads, a requirement for Intune content. For more details, see Reminder: Intune-managed Win32 app delivery will be HTTPS-only, affecting Connected Cache customers.

There are many more examples I could share, but I hope this has been helpful to get you started. What Delivery Optimization issues are you seeing most in your environment? Drop a comment — we would be happy to help!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Windows device recovery in 2026: A guide for IT pros

Lia_Vargas — Thu, 13 Aug 2026 22:36:00 GMT

Windows device recovery is fundamentally stronger today than it was a year ago. Thanks to your feedback, you have a comprehensive set of tools available to help you restore user productivity quickly. From automated, cloud-based fixes to full device rebuilds, let's explore the newest recovery tools that keep you in control while helping you address a broad range of scenarios:

Mass-scale outage
Recent, isolated issue or widespread disruption
Deep OS corruption
Hardware failure or device unavailability

Existing solutions—such as Get Help troubleshooters, Uninstall updates, Reset this PC, System Restore, and the command prompt in WinRE—remain available and continue to serve specific roles. To learn more about these tools, please visit their respective documentation.

Windows device recovery: scenarios and solutions

The following framework summarizes how to choose the right recovery approach for your scenario. The scenarios appear roughly in order from more common to less common and we highlight the newer tools alongside the other alternatives.

Scenario	Solution	Tools
Individual device issues after an update	User reinstalls the current Windows version (or if needed, go back to previous version) if the PC can boot. User uninstalls the update if the PC cannot boot or issues persist beyond 10 days. For some known issues listed on the Microsoft 365 admin center, IT can use Known Issue Rollback.	Reinstall the current version of Windows Go Back Uninstall a Windows Update Use Group Policy to deploy a Known Issue Rollback
A single malfunctioning component (audio, networking, printing, etc.)	User runs targeted diagnostics and remediation for the affected components.	Get Help troubleshooters^[1]
Recent, isolated issue or widespread device issue	User (sometimes under IT supervision) rolls back the system to its exact state from a past point in time. Requires a recent restore point.	New! Point-in-time restore for Windows
Persistent device issues after targeted recovery attempts (unknown cause)	User reinstalls Windows while removing apps and settings. Optionally, keep user files.	Reset this PC
Deep OS corruption	User (sometimes under IT supervision) initiates clean OS install that downloads a target Windows image and device drivers and applies it to the device for a fresh start.	New! Cloud rebuild (preview) Create a recovery drive Manufacturer-created recovery media
Hardware failure or device unavailability (lost, stolen, or isolated during a security investigation)	IT provisions a temporary Cloud PC. Settings, documents, and managed apps are restored on a new device. Recommended for immediate user productivity.	New! Windows 365 Reserve
A mass-scale outage affecting boot (rare)	When a device repeatedly fails to boot and enters WinRE, it automatically checks for and applies a Microsoft-provided fix from Windows Update. No user action is required.	New! Quick machine recovery

Each recovery scenario has at least one tool that can be used to remediate the device. In practice, start with the least disruptive, fastest option and reach for a heavier tool only when the situation calls for it.

Recovery scenarios: meet the newest solutions

Now let's do a more detailed walkthrough of the scenarios you can address using the newest recovery tools.

Mass scale outage: Quick machine recovery

When Microsoft identifies a mass scale outage that prevents devices from booting, we become your first line of defense. Microsoft develops, validates, and publishes a targeted fix that quick machine recovery delivers directly to affected devices.

How it works:

The device fails to boot and enters Windows Recovery Environment (WinRE).
Microsoft identifies, builds, and publishes a remediation package.
WinRE establishes a network connection.
The device scans Windows Update, downloads, and applies the remediation package automatically.
The device restarts safely to Windows.

Availability: Generally available on Windows 11, version 24H2 and later. Enabled by default on Windows Home. For managed Pro, Enterprise, and Education devices, you can enable quick machine recovery through policy.

Prerequisites: Enable the feature and ensure devices will be able to connect to a supported network. To learn more about WinRE requirements, see the WinRE documentation.

Impact to data: None

Alternative solutions: Startup Repair remains the first automatic response to boot failures. Quick machine recovery builds on Startup Repair by adding cloud-based remediation when local repair is not sufficient.

Additional capabilities for best results: Recovery CSP

Recent, isolated issue or widespread disruption: Point-in-time restore

Most disruptions aren't mass-scale outages. A single device or group of devices can break due to a bad application installation, an incompatible driver, or a misconfigured setting. If quick machine recovery doesn't have a fix yet, point-in-time restore lets you roll the entire device back to a previous state in minutes. Here's how it works.

Point-in-time restore automatically captures comprehensive restore points of the full system state (the OS, applications, settings, and local files) at a configurable frequency and retention^[2]. The default is every 24 hours. Restore points use the Volume Shadow Copy Service (VSS) and are stored locally for up to 72 hours.

When a disruption occurs, initiate restoration from WinRE. (BitLocker recovery key is required)
Select a restore point. The device rolls back to that exact state.

The entire process typically completes in a matter of minutes. The goal is to return the device to a stable state without requiring advanced troubleshooting.

Availability: Available on Windows 11 Home, Pro, and Enterprise, version 25H2 and later. Remote management capabilities are planned for a future release.

Prerequisites: Enable the feature and configure it for your environment using the Recovery CSP and back up local files to the cloud.

Impact to data: Point-in-time restore is a comprehensive rollback. Any local changes made after the selected restore point, including files, settings, passwords, certificates, and keys, will be lost. Data stored in cloud services like OneDrive is not affected.

Alternative solutions: System Restore provides event-triggered or manual restore points for system files and settings. Point-in-time restore modernizes this concept with automatic, comprehensive restore points (including local user files), strict retention policies, and a path toward remote management.

Additional capabilities for best results: OneDrive for work or school (for cloud storage to minimize data loss).

Deep OS corruption: Cloud rebuild

There are two main reasons to “start from scratch.” Sometimes a device is too deeply corrupted for a targeted fix or rollback to resolve the issue. Whether the OS is corrupted or drivers are in conflict, the system might be beyond restoration. If you've already tried quick machine recovery and point-in-time restore, start fresh with a clean operating system. Another reason to start fresh is for planned resets. You might want to reset devices for purposes of compliance, hygiene, or reuse by new users.

Cloud rebuild (preview) restores a Windows 11 PC to a clean, last known good state by performing a full operating system reinstallation from the cloud. Unlike Reset your PC, Cloud rebuild downloads both the target Windows image and the device drivers from Windows Update. This way, the device can come back fully functional without custom images, USB media, or physical access to the device. Here's how it works.

Start a Cloud rebuild from the “Troubleshoot” menu in WinRE. Do this directly on the device.
The device downloads a clean Windows OS, matching the device's current Windows release, edition, and language. It also downloads and applies the latest monthly security update.
The device downloads all required system drivers directly from Windows Update.
The system disk is formatted and Windows is installed fresh, landing the device in the out-of-box experience (OOBE).
If enrolled in Windows Autopilot, the device is automatically provisioned during OOBE. It also re-enrolls in your management environment with the right policies, apps, and configurations provisioned on the device.
If configured, Windows settings backup and restore (formerly Windows Backup for Organizations) restores the user's Windows settings and Microsoft Store app list. OneDrive for work or school then restores their files. This way, the user returns to a device that feels familiar, not factory fresh.

Availability: Available to Windows Insiders enrolled in the Experimental channel. Designed for cloud-managed, Intune-enrolled devices. Coming soon is the ability for IT Admins to customize the rebuild and initiate it remotely from their MDM.

Prerequisites: Before initiating Cloud rebuild, confirm that the target device meets the prerequisites listed in the Cloud rebuild documentation.

Impact to data: High. As the system disk is formatted during this process, all apps and data are lost.

Alternative solutions: Create a recovery drive or use manufacturer-created recovery media.

Additional capabilities for best results: Windows settings backup and restore, Windows Autopilot, Microsoft Intune, OneDrive for work or school (for cloud storage to prevent file loss)

Hardware failure or device unavailability: Windows 365 Reserve

If the hardware itself is the problem, no software recovery tool can help. This scenario occurs with a failed storage drive, damaged motherboard, or a device that simply won't power on. Other scenarios include devices that are lost, stolen, isolated during a security investigation, or otherwise unavailable during a broader incident. In these cases, the priority shifts from fixing the device to unblocking the user.

While you resolve the hardware issue, consider investing in Windows 365 Reserve for a fast, temporary solution. While point-in-time restore and cloud rebuild (preview) focus on restoring the affected physical device, Windows 365 Reserve helps maintain secure user productivity. Here's how it works.

Provision a Cloud PC to give the user immediate, temporary access to a full Windows desktop from any device. You can use existing Microsoft Intune policies or create a new provisioning setup beforehand.
(Optional but recommended) Enforce OneDrive cloud storage to help ensure that users' files are available. Additionally, Windows settings backup and restore can re-apply their personalized settings (desktop layout, accessibility preferences, language settings, and more) so they can pick up right where they left off.
Users sign in with work credentials to the Windows App or web portal on any device and connect to their Cloud PC. They immediately access a clean, cloud-isolated Windows environment with corporate apps, settings, and security policies already applied to stay productive.
Users can track their access using the Windows App or web portal. You can use Intune to monitor licensing and usage as well as to deprovision Cloud PCs.

Availability: Available on supported Windows 11 Enterprise devices. Designed for cloud-managed, Intune-enrolled devices.

Prerequisites: Requires an active Windows 365 Reserve license managed through Microsoft Intune. Preconfigure Windows 365 Reserve Cloud PC.

Impact to data: None

Alternative solution: New or replacement device is always an option to unblock the user. Provide a new device and use Windows Autopilot for zero-touch provisioning. The device enrolls in your management environment, receives policies and apps, and is ready for the user without manual IT setup.

Additional capabilities for best results: Microsoft Intune, OneDrive for work or school (for cloud storage to prevent file loss), Windows settings backup and restore, Windows Autopilot

Get started today

Device disruptions come in many shapes. A misconfigured policy can render thousands of PCs unbootable overnight. A user accidentally modifying critical system settings can disrupt a single laptop. An aging device can have a random hardware failure and simply stop cooperating. That's why this tiered recovery framework includes a series of tools designed for a specific class of problem. New and pre-existing tools as well as supporting capabilities, work together to give your IT team a clear path to recovery.

Here's what you can do right now to prepare your organization:

Use Microsoft Intune as a centralized management platform for recovery and resiliency capabilities. Through Intune, you can configure and deploy the policy settings exposed through Windows CSPs, including settings for quick machine recovery, point-in-time restore, cloud rebuild, Windows Autopilot, and Windows settings backup and restore. Enable quick machine recovery on your managed devices via the Recovery CSP. Configure Wi-Fi credentials, scanning intervals, and test the experience using test mode before production deployment.
Test point-in-time restore. Explore the settings locally and via the Recovery CSP, perform a test restore, and share your feedback through Feedback Hub.
Enable Windows settings backup and restore to streamline device transitions. Use Intune to enable backup and restore policies to preserve user settings: accessibility preferences, personalization, language and regional settings, and the list of installed Microsoft Store apps. When a device is reset, rebuilt, or replaced, these settings are automatically restored during the out-of-box experience (OOBE) or first sign-in for Microsoft Entra hybrid joined devices and Cloud PCs.
Configure OneDrive for work or school for your organization. Cloud file storage helps ensure that user documents, photos, and other files are continuously synced and protected. Whether you roll back a device with point-in-time restore, rebuild it from scratch, or replace it entirely, cloud-synced files remain accessible and unaffected. This is especially important with point-in-time restore, where local files are reverted to the restore point state. To begin, enable Known Folder Move regardless of which recovery path you use. It syncs the latest file state with its versions down to your device when connected to the cloud.
Configure Microsoft 365 Backup for point-in-time recovery to protect all OneDrive accounts, mailboxes, and SharePoint sites. That way, you can roll back malicious or accidental data modifications and deletions. The combination of OneDrive with Microsoft 365 Backup provide file protection beyond the device itself and are a recommended resiliency plan.
Set up Windows Autopilot profiles for zero-touch device provisioning. Autopilot automatically enrolls devices in your management environment, applies policies, and installs apps during OOBE. After a cloud rebuild or on a new replacement device, Autopilot helps get users back to productivity on a fully configured and compliant device without requiring manual IT intervention.

Solutions to device recovery challenges

Windows recovery is no longer a single tool or a last resort– it's a comprehensive framework designed to match the right solution to every scenario. Whether you're defending against the next widespread outage or helping a single user get back to work, these capabilities work together to reduce downtime, minimize data loss, and keep your organization productive.

This blog reflects the current state of Windows recovery capabilities at the time of publication. As new features and improvements become available, the accompanying Windows device recovery framework documentation will be updated to provide the latest guidance, feature availability, and deployment recommendations. If you are a consumer, please visit Recovery options in Windows on Microsoft Support.

For additional strategies to prevent, respond to, and recover from endpoint disruptions, see the Windows Resiliency e-book.

^[1] When live assistance is needed and the device can boot, Intune customers can use Remote Help so support staff can securely troubleshoot a managed device with the user. Quick Assist remains available for everyone who needs remote assistance.

^[2] You can configure restore point frequency and retention on systems running Enterprise editions of Windows.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Plan for Windows 10 Enterprise LTSC 2021 end of support

Jason_Leznek — Wed, 05 Aug 2026 17:40:18 GMT

Windows 10 Enterprise LTSC 2021 is approaching an important milestone. This release reaches end of support (EOS) on January 12, 2027.

Devices running this version will receive a final monthly security update on that date. After that, they will no longer receive Windows security updates, non-security updates, bug fixes, technical support, or online technical content updates.

Staying on a supported version of Windows

Upgrade to Windows 11 Enterprise LTSC 2024 for the latest security capabilities for these devices.

If you need additional time to complete your migration, you can use the Extended Security Updates (ESU) program. ESU coverage for Windows 10 Enterprise LTSC 2021 will be available for purchase starting September 1, 2026. This way, you can plan and enroll well ahead of the end-of-support date.

Note: This Extended Security Update offer isn't for Windows 10 IoT Enterprise LTSC. These devices remain in support through January 13, 2032.

What is the Extended Security Update program?

The ESU program isn't intended to be a long-term solution but rather a temporary bridge.

What Extended Security Updates are: The ESU program offers critical and important security updates only (as defined by the Microsoft Security Response Center). Technical support is limited to help you activate the ESU licenses, install ESU monthly updates, and address issues arising from an update.
What Extended Security Updates are not: Extended Security Updates don't include new features, quality fixes, or design change requests. The ESU program doesn't extend technical support for Windows 10 Enterprise LTSC 2021.

Extended Security Updates are available for purchase for up to three years after the end-of-support date. For Windows 10 Enterprise LTSC 2021, that means ESU coverage can run through January 8, 2030.

Pricing and availability: Extended Security Updates for Windows 10 Enterprise LTSC 2021 will be available for purchase starting September 1, 2026. You can get them through Volume Licensing or a Microsoft Cloud Solution Provider. The cost of the Year 1 license is $61 USD per device.^[1]

For organizations using a Microsoft cloud-based update management solution (i.e., Microsoft Intune or Windows Autopatch), there is a ~25% discount, costing $45 USD per device for Year 1. These Extended Security Updates are also available through Volume Licensing.^[1]

Note: The price of the ESU program for Windows 10 Enterprise LTSC 2021 doubles every consecutive year, for a maximum of three years. ESUs are cumulative. Therefore, if you decide to enroll devices in the ESU program in Year 2, you'll also need to pay the Year 1 costs.

More time to complete your migration

If some of your devices might remain on Windows 10 Enterprise LTSC 2021 after it reaches end of support, consider the ESU program. However, we recommend that you upgrade to Windows 11 Enterprise LTSC 2024 for the best experience.

Follow this article and the Windows message center for more details, when available.

To learn more about Extended Security Updates, see the ESU FAQ. To review lifecycle support dates for any Microsoft product, see our Microsoft Lifecycle documentation.

^[1] All prices are in US dollars. Regional prices will vary based on foreign exchange rates at the moment of ordering SKUs.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: July 2026

Chris_Morrissey — Mon, 03 Aug 2026 21:00:00 GMT

July delivered a wide range of Windows updates for IT admins, with new capabilities across security, device management, Windows Server, Windows 365, accessibility, and lifecycle planning. In this edition of Windows news you can use, find the changes most likely to affect your planning and operations. This includes AI-powered vulnerability management and passkeys in Microsoft Entra ID, Windows settings backup, RDP Multipath, Arc-enabled hotpatch updates, and new Windows 11 experiences.

New in Windows update and device management

[WINDOWS 365] [AI] – New details are available to help you explore Windows 365 for Agents. Learn more about building secure, managed Cloud PC environments that extend enterprise identity, security, compliance, and governance controls to agentic workloads.
[BACKUP] – Windows 11, version 26H2 will enable Windows settings backup by default on eligible devices. Improve resiliency by automatically backing up user settings and Microsoft Store app lists. Unfamiliar with the Windows settings backup and restore experience? Take a quick video tour.
[INTUNE] – As of July 1, advanced Microsoft Intune Suite capabilities are included in Microsoft 365 E5, with select capabilities available in Microsoft 365 E3.
[INTUNE] – The updated per-device sync experience in the Intune admin center now shows progress. Confirm more easily that actions are running and understand where they are in the process.
[WINDOWS 365] [AZURE VIRTUAL DESKTOP] [NETWORKING] – Windows 365 and Azure Virtual Desktop now support RDP Multipath with redundant TCP. Check out a more resilient remote desktop experience with improved connectivity and fewer disconnects.
[SERVICING] – Looking for a quick refresh on monthly update types and release schedules? To help you make informed decisions about your update management strategy, check out Understanding Windows monthly updates: Servicing explained.
[TOOLS] – The latest Sysinternals updates add new tools. These include JPEG and WEBP snip support for ZoomIt and a new timeout option for ProcDump. Additionally, security protections in LiveKD help prevent non-administrators from viewing potentially sensitive debugging data in dump files.

New in Windows security

[AI] – As AI accelerates vulnerability discovery, Windows is investing in AI-powered tools. They can identify security issues earlier, accelerate remediation, help strengthen validation processes, and deliver fast, high-quality security updates.
[SSO] – A new Windows policy gives you greater control over sign-in experiences. You can now automatically accept single sign-on (SSO) permissions on managed devices.
[PASSKEYS] [ENTRA] – Microsoft Entra ID is updating its authentication experience by making passkeys the default phishing-resistant authentication method. This lets you reduce reliance on phishable methods such as SMS and voice.
[KMS] [TPM] – Upcoming KMS enhancements use TPM-backed hardware attestation to strengthen activation integrity by tying activation to a trusted host rather than only to a software configuration. TPM attestation helps prove that the KMS host is a real, trusted server and has not been tampered with before it is allowed to activate Windows devices.
[AI] – Microsoft introduces Project Perception, a next-generation security platform that uses AI to continuously perceive, reason about, and respond to threats. With it, defenders can better keep pace with the speed and scale of AI-era attacks. For details on how Microsoft is using AI to proactively identify security risks, strengthen platform defenses, and advance quantum-safe security across products and services, check out the latest Secure Future Initiative report.

To explore what’s new in security across the Microsoft platform, see What’s new in Microsoft Security: July 2026.

New in Windows Server

For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes.

[HOTPATCH] – Arc-enabled hotpatch updates for Windows Server 2025 are now available at no additional cost. Use them to apply most security updates without restarting servers. This feature helps reduce downtime while maintaining security compliance through Azure Arc and Azure Update Manager.
[TPM] – Trusted Launch for virtual machines (TVMs) is now available in the Windows Server Insider Program. Strengthen VM security with Secure Boot and vTPM protections against sophisticated firmware and boot attacks.
[SECURITY] – New guidance is available for managing RDP file security through Group Policy. Help your organization reduce phishing risks by controlling which .rdp files users can open.
[HARDENING] – The July 2026 security update introduces a security hardening change that enforces TDI transport registration requirements. As applications that use sockets over unregistered third-party TDI transports might stop working after installing this update, learn how to determine if you’re affected and manage the behavior.
[HARDENING] – Starting with the October 2026 security update, AD FS Distributed Key Manager (DKM) container ACL hardening remediations will run by default on supported versions of Windows Server.

New in productivity and collaboration

Install the July 2026 security update for Windows 11, versions 25H2 and 24H2 to get these and other capabilities, which will be rolling out gradually:

[START] – A redesigned Start menu is available on commercial and managed Windows devices. Customize the experience for your organization using the Start Policy CSP and Start policy settings.
[ACCESSIBILITY] – Accessibility improvements make it easier for people to work their way. Now available are the new full-screen color overlay for greater visual comfort, more precise zoom controls in Magnifier, and expanded voice access and voice typing support in French, German, and Spanish.
[WIDGETS] – A quieter, more focused Widgets experience helps reduce interruptions and improves default settings and notification controls.
[NETWORKING] – Connections used by apps and system features, such as the NetUseAdd function, now work more reliably, including unauthenticated (null session) connections. This makes it easier for devices to access shared network resources.

New features and improvements are coming in the August 2026 security update. You can preview them by installing the July 2026 optional non-security update for Windows 11, versions 25H2 and 24H2. This update includes the gradual rollout of:

[FILE EXPLORER] – File sizes in the Details view now display using appropriate units (KB, MB, GB) instead of KB-only. We hope it helps you understand them easier at a glance.
[ACCESSIBILITY] – Voice Access now features Voice Isolation. As such, it recognizes your voice better by reducing interference from other speakers and background noise. Voice Access also now supports Korean.
[SECURITY] – Windows Hello Enhanced Sign-in Security (ESS) support for peripheral fingerprint sensor is now beginning to roll out. Start using fingerprint sensors for desktops and other Windows 11 PCs, including Copilot+ PCs.

To learn about planned productivity, security, and reliability updates for Windows 11, visit the Windows Roadmap.

Lifecycle reminders

[W11] [24H2] – On October 13, 2026, Windows 11, version 24H2 Home and Pro editions will reach end of updates. After this date, devices running these editions will no longer receive monthly security and non-security preview updates containing protections from the latest security threats. Enterprise and Education editions remain supported until October 12, 2027.
[W10] [LSTB] - On October 13, 2026, Windows 10 Enterprise LTSB 2016 will reach end of updates. We recommend updating to the latest LTSC release, Windows 11 Enterprise LTSC 2024. If you need additional time to complete the transition, Extended Security Updates (ESU)will be available.
[SERVER] [2022] – On October 13, 2026, Windows Server 2022 will reach end of mainstream support. After this date, Windows Server 2022 will transition to extended support, which includes security updates at no additional cost. These devices will continue to receive monthly security updates through October 14, 2031. For detailed information, see the Windows Server 2022 lifecycle page.

Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Windows Server 2025.

Additional resources

Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs? Find out this and more through the following resources:

Windows Roadmap for new Windows features – filter by platform, version, status, and channel or search by feature name
Microsoft 365 Copilot release notes for latest features and improvements
Windows Insider Blog for what’s available in the Beta and Experimental channels
Windows Server Insider for feature preview opportunities
Understanding update history for Windows Insider preview features, fixes, and changes to learn about the types of updates for Windows Insiders

Join the conversation

Is this update missing areas or topics you want us to include? Drop us a note in the Comments and share your thoughts on what you’d like to see.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Strengthening Key Management Service - (KMS) with Hardware-Based Trust

Monika_Kumar — Wed, 22 Jul 2026 16:00:00 GMT

For years, organizations have relied on Microsoft’s Key Management Service (KMS) to activate Windows devices at scale. While KMS helped enable broad deployment scenarios, modern organizations increasingly require stronger assurances around device identity and activation integrity. Microsoft has continued to enhance activation capabilities with innovations that leverage hardware-backed validation to provide stronger protection against activation misuse and improve trust in device identity.

As attackers have exploited fake or cloned KMS servers, organizations face increased compliance and licensing risk. Microsoft is now further strengthening defenses with KMS Hardware-Secured, which uses Trusted Platform Module (TPM)-based attestation to help verify that a KMS host is running on trusted hardware before it can activate Windows devices.

Build trust into every activation

The cornerstone of this modernization is TPM-based attestation. Starting with upcoming Windows Server releases, KMS hosts must prove they are running on verified, uncompromised hardware before activating clients. This is achieved through TPM – a hardware root of trust that provides cryptographic proof of integrity.

TPM attestation delivers:

Stronger security: Help ensure only verified servers can issue activation licenses.
Tamper resistance: Help protect activation secrets from theft or spoofing by binding them to hardware.
Future-ready compliance: Help ensure the infrastructure is ready for future activation security requirements.

The result is a more trustworthy activation model that helps reduce spoofing risk today while preparing organizations for future security requirements.

How TPM attestation works:

Hardware identity: The KMS host uses TPM-backed attestation to prove its hardware identity. Microsoft verifies this proof before the host can activate devices.
Platform integrity: The TPM confirms the KMS host has not been subject to tampering.
Activation flow: Once verified, the KMS host can securely serve activation requests for Windows devices in the organization.

For customers, this means activation can be tied to a trusted host, not just a software configuration that can be copied or spoofed.

	KMS Hardware-Secured	Legacy KMS
Basis of trust	Hardware root-of-trust via TPM	Software-only; vulnerable to spoofing
Deployment requirement	TPM	No hardware requirement
Operational outcome	Greater trust and simpler long-term operations	Increased risk and operational overhead

Getting ready for KMS-Hardware Secured requirements

Preparing now helps ensure your KMS environment is ready for the transition to hardware-based trust. The following steps can help you assess readiness and plan any required updates.

Inventory your KMS hosts:
- For physical KMS host, confirm the host is certified for Windows Server on Windows Server Catalog. Ensure TPM is installed and enabled.
- For virtual KMS host, guidance for virtualized environments will be provided in future blogs.
Validate TPM attestation: In an elevated Windows PowerShell session, run

Get-TpmSupportedFeature -FeatureList "Key Attestation”

A successful response that displays “Key Attestation” confirms the server supports the TPM attestation capability for KMS Hardware-Secured.

Plan: Inventory your KMS hosts and identify any hardware upgrades needed to support KMS Hardware-Secured.
Communicate: Share readiness plans with IT teams and monitor upcoming enforcement timelines.

Coming soon: KMS Hardware-Secured readiness check

Starting August 2026, Windows Server 2025 will provide readiness messaging to help administrators assess whether a KMS host is ready for hardware-based security, giving teams time to plan upgrades before enforcement begins.

Where you’ll see them

Command line (slmgr /dlv)

✅ “This device is eligible to serve as a KMS host with hardware-based security.”

⚠️ “This device does not meet the requirements for using KMS host with hardware-based security.”

Event logs

Warning entries under Applications and Services Logs > Key Management Service.

Plan your transition now

With the next Windows Server LTSC release, TPM attestation will become mandatory for KMS Hardware-Secured activation. Taking action now gives your organization time to prepare and transition on your own schedule.

As Windows security continues to evolve, trusted activation infrastructure will play an increasingly important role. KMS Hardware Secured helps position your environment for the future while aligning with Microsoft's continued investment in hardware-rooted trust.

Securing today. Preparing for what’s next.

Security in Windows is built into the platform - continuously maintained and designed to evolve as threats change.

Learn more in the Windows Security book and Windows Server Security book or explore Windows 11, Windows Server, and Copilot+ PCs. For broader solutions, visit the Microsoft Security site, follow the Security blog, or connect with Microsoft Security on LinkedIn and @MSFTSecurity.   

Now available: Admin control for SSO prompts in Windows

Justin-Ploegert — Tue, 21 Jul 2026 20:42:06 GMT

IT administrators can now automatically accept SSO permissions on managed Windows devices using a supported registry setting. In this context, SSO, or single sign-on, refers to using the Microsoft credentials from a user’s Windows sign-in to access other Microsoft apps and services without seeing any prompts. This new capability is available beginning with the July 2026 monthly security update (KB5101650) for Windows 11, version 24H2 and 25H2.

Background: What changed and why

In the European Economic Area (EEA), Microsoft updated the Windows sign-in experience so that users are not automatically signed in to other Microsoft applications and services after signing in to Windows. Instead, Windows asks users whether they want to use the same credentials to sign in to additional apps or services — giving users choice over how their Windows account is used for sign-in.

For managed enterprise environments, some organizations wanted additional flexibility to manage the SSO prompt experience on devices where their organizations already manage sign-in policies and trust relationships. To support those scenarios, we’ve developed a registry-based control that lets IT administrators automatically accept SSO permissions on eligible managed Windows devices.

What’s new: Enterprise admin control for sign-in behavior

Starting with the July 2026 monthly security update for Windows 11, version 24H2 and 25H2, IT administrators can deploy the following registry policy to automatically accept SSO permissions on managed devices:

Registry Path: HKLM\SOFTWARE\Policies\Microsoft\Windows\AAD
Value: AutoAcceptSsoPermission (DWORD) = 1

This policy can be deployed via:

Group Policy (GPO)
Microsoft Intune or similar mobile device management (MDM) tool
Microsoft Configuration Manager
Any management tool that supports registry policy deployment

Important details

Scope: Applies only to managed enterprise devices with Microsoft Entra ID accounts
Personal accounts: Prompts remain for personal Microsoft accounts (MSA)
Unmanaged devices: Not affected —prompts remain for non-policy-controlled environments
Supported OS: Windows 11, version 24H2 and 25H2

Getting started

To get started:

Ensure that your devices are running Windows 11, version 24H2 and 25H2 or later.
Install the July 2026 monthly security update.
Deploy the registry policy via GPO, Intune, or your preferred management tool.
Validate SSO behavior across your managed device fleet.

For detailed deployment guidance, visit Admin control for SSO prompts in Windows.

What’s next

We’re continuing to evaluate additional admin controls and transparency features that will give your organization greater confidence in managing authentication experiences across your device fleet. Have feedback? Share your ideas in the Comments.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Understanding Windows monthly updates: Servicing explained

Chris_Morrissey — Thu, 09 Jul 2026 16:00:00 GMT

Windows updates help keep devices secure, reliable, and productive. Whether you're an IT admin or a general user, understanding the different types of Windows updates can help you keep devices protected, productive, and continuously improving.

Most individuals and organizations regularly deploy monthly security updates, released on the second Tuesday of each month. Windows also provides optional non-security preview updates, which give IT teams and early adopters an opportunity to validate upcoming fixes before they're included in the next monthly security update.

This guide explains the purpose of each update type, when updates are released, and how they fit into the modern Windows servicing model.

Monthly security updates

For many of you, the second Tuesday of each month (often referred to as "Patch Tuesday") is a regular part of Windows servicing for client and server endpoints. On this day, we publish monthly security updates for supported versions of Windows.

Monthly security updates are designed to help you maintain security, compliance, and device health. These updates are cumulative. They include security and non-security content introduced in the prior month's security and optional non-security preview updates (see below). In other words, deploying the latest update brings a device up to date with all previously released fixes for that version of Windows. This helps simplify update management and reduce fragmentation across devices.

Note: People tend to use "B release," quality update, security update, monthly cumulative update, and latest cumulative update (LCU) interchangeably.

You can deploy updates through a variety of channels depending on your scenario. General users and some small business environments rely on the built-in Windows Update, allowing Microsoft to manage your updates. Enterprise environments use any combination of Windows Update, Windows Autopatch, Microsoft Intune, Windows Server Update Services (WSUS), Microsoft Configuration Manager, the Microsoft Update Catalog, and/or non-Microsoft tools.

IT admins can also enroll devices in hotpatch updates for a faster time to compliance. Hotpatch updates include security fixes only. They don't include the additional features and enhancements contained in monthly security updates. A quarterly baseline (a monthly security update with restart) is required to bring devices up to date on all the features. After that, the design is that the two subsequent monthly security updates are installed without requiring a restart.

Optional non-security preview updates

Typically released during the fourth week of the month, optional non-security preview updates provide an opportunity to validate upcoming fixes before they become part of the next monthly security update. Optional non-security preview updates are also cumulative and are only offered for the most recent supported versions^[1] of Windows. These updates are intended primarily for early preview of new features before broader rollout, as well as for testing and validation.

New features, like point‑in‑time restore for Windows 11, might initially be released in an optional non-security preview update, then roll out broadly in the following month's security update. Please note that some features roll out gradually, so you might not see them on your devices immediately upon installing an update.

To access optional non-security preview updates on non-IT-managed devices, navigate to Settings > Windows Update > Advanced options > Optional updates. Select from the available updates and select Download and install. Additionally, see how to get Windows updates as soon as they're available for your device. The behavior of IT-managed devices depends on admin controls and policies.

Note: The term "optional non-security preview update" replaces what was formerly referred to as a "C" or "D" release. You might still see lettered shorthand references in IT management tools or documented release information. Inside Windows Update, you'll find them in the format of YYYY-MM Preview Update (KB number) (update build number). Learn more about Simplified Windows Update titles.

Out-of-band update

In exceptional cases, Microsoft releases an out-of-band (OOB) update outside the normal monthly servicing cadence. These updates are designed to help resolve a known issue or to address an immediate, high-risk security concern. Some of these are optional, while others are recommended as security updates. OOB updates are typically cumulative, meaning they include all previously released fixes for the supported version of Windows in addition to the targeted fix. In enterprise environments, these updates are available for deployment through quality update approval and scheduling in Windows Autopatch, the Microsoft Update Catalog, and other enterprise update management tools.

New features and improvements in Windows 11

Windows 11 uses multiple delivery mechanisms to bring new features, experiences, and improvements to supported devices throughout the year. New capabilities can reach you through the annual feature update, monthly updates, or Microsoft Store updates, depending on the scenario or applicable IT controls. This enables us to deliver enhancements when they're ready while maintaining quality and reliability.

In some cases, features become available to devices gradually over time, helping validate quality and compatibility before broader rollout. Aside from using optional non-security preview updates to release new capabilities before enabling them more broadly, Microsoft also uses Controlled Feature Rollout (CFR) technology. Capabilities released via CFR technology are typically disabled by default for organizations. If your organization needs greater control over when certain features become available, you can use commercial management controls.

Recommendations

Keeping devices up to date is critical for security. We recommend that organizations install the latest security updates as soon as they become available.

We also encourage you to take advantage of optional non-security preview updates to internally validate features and fixes ahead of the following month's security update. For early access to the latest Windows features and to give feedback, join the Windows Insider Program.

To help manage updates across your organization, bookmark these:

Update history and release notes: Windows 11, versions 25H2 and 24H2
Windows release health (also available in the Microsoft 365 admin center)
Additional tips and resources in Your Windows release information toolbox
The updated reference onthe Update release cycle for Windows clients

Whether you're updating your personal device or deploying updates across your organization, understanding the Windows servicing model can help you make informed decisions. Now you can manage updates better, prepare for new features with confidence, and keep devices protected and productive throughout the year.

^[1] As of July 9, 2026, "most recent supported versions" refers to Windows 11, versions 26H1, 25H2, and 24H2.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

RDP Multipath with redundant TCP is now generally available for Windows 365 and Azure Virtual Desktop

Rinku_Dalwani — Tue, 21 Jul 2026 16:42:03 GMT

Reliable connectivity is essential for delivering a productive Cloud PC and virtual desktop experience. Network variability—whether caused by packet loss, ISP instability, restrictive firewalls, proxy configurations, VPN routing, or UDP-restricted environments—continues to be one of the most common causes of session interruptions across enterprise remote desktop deployments.

Today, we're excited to announce the general availability of RDP Multipath with redundant TCP support for Windows 365 and Azure Virtual Desktop. This enhancement extends the resiliency benefits of RDP Multipath to TCP-based connections, helping organizations maintain a more reliable and consistent connectivity experience across a broader range of network environments.

RDP Multipath continuously evaluates multiple available connection paths and dynamically selects the most reliable route for each session. If the active connection experiences degradation or becomes unavailable, RDP Multipath can automatically transition to an alternate path, helping reduce session interruptions and improve the overall user experience.

How RDP Multipath works

RDP Multipath establishes and maintains multiple available connection paths between the client device and the Windows 365 Cloud PC or Azure Virtual Desktop session host.

When UDP-based RDP Shortpath connectivity is available, UDP remains the preferred transport protocol for optimal performance and reliability. RDP Multipath can establish multiple UDP paths using STUN (Simple Traversal Underneath NAT) and TURN (Traversal Using Relays around NAT) protocols, enabling sessions to dynamically transition between alternate UDP routes if degradation or failure is detected.

With the addition of redundant TCP support, Windows 365 and Azure Virtual Desktop can now establish standby TCP paths alongside existing UDP connectivity. This means customers connecting through restrictive network environments can benefit from the same resiliency capabilities previously available only across UDP-based connections.

If the active connection becomes unavailable or experiences degraded performance, RDP Multipath automatically transitions to the next available path—UDP or TCP—without requiring user intervention or reconnection. In situations where all paths are lost, such as a temporary network outage, the session attempts to reconnect once connectivity is restored.

Many organizations operate in environments where UDP connectivity is restricted or unavailable because of firewall, proxy, or security requirements. In these scenarios, remote desktop sessions often rely on TCP-based Reverse Connect transport.

Previously, these environments generally relied on a single TCP connection. With redundant TCP support, Windows 365 and Azure Virtual Desktop can now maintain standby TCP paths and dynamically transition between them if the active connection becomes degraded or unavailable. This extends the resiliency benefits of RDP Multipath to customers operating in restrictive network environments.

Key Benefits:

Improved connection reliability: Multiple connection paths are maintained throughout the session. If the active path becomes unstable or unavailable, RDP Multipath can automatically switch to a backup path, helping reduce session interruptions.
Enhanced resiliency across network environments: Organizations can benefit from RDP Multipath whether connections are established through UDP-based RDP Shortpath or TCP-based Reverse Connect transport.
Seamless user experience: Path selection and failover occur automatically and transparently, helping users stay connected and productive without requiring any action.
No additional configuration required: RDP Multipath works automatically when prerequisite requirements are met, simplifying deployment and adoption for IT administrators.

Understanding RDP Multipath connectivity

The diagram above illustrates one example of how RDP Multipath can establish and manage multiple connection paths between a client device and a Windows 365 Cloud PC or Azure Virtual Desktop session.

The exact paths available for a connection depend on factors such as network topology, firewall and proxy configuration, NAT behavior, and whether UDP-based RDP Shortpath connectivity is available.

In the scenario shown above:

A UDP-based RDP Shortpath connection is used as the primary active path.
Additional UDP transport paths can be established through STUN or TURN when supported by the network configuration.
Redundant TCP transport paths can also be maintained as standby paths to improve resiliency.
RDP Multipath continuously evaluates available transport paths and monitors connection health.
If the active transport path becomes unavailable or experiences degradation, RDP Multipath can transition traffic to another available transport path to help maintain session continuity.

When UDP connectivity is available, it remains the preferred transport protocol for optimal performance and reliability. Redundant TCP transport paths extend Multipath resiliency to environments where UDP connectivity may be restricted or unavailable due to firewall, proxy, or network policies.

How to enable RDP Multipath

By default, this feature is enabled for everyone providing seamless integration and enhanced connectivity without requiring any changes from IT departments or end users. Redundant TCP transport paths are currently supported only on Windows devices using Windows App on Windows client, version 2.0.1069.0 or later.

Learn more

To learn more about RDP Multipath, visit:

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Windows 365 for Agents: A secured execution environment for AI agents

Aarthi_Sukumar — Wed, 08 Jul 2026 16:00:00 GMT

AI agents are rapidly evolving from answering questions to performing tasks across enterprise systems. As organizations move from experimentation to production, one question continues to rise to the top for security leaders: how do you run agents securely at scale?

Today, many agents operate in fragmented environments: local machines, shared virtual machines, or unmanaged cloud infrastructure. That can make it hard to consistently enforce identity, apply policies, and maintain the visibility security teams need.

Windows 365 for Agents changes that.

A Cloud PC for enterprise agents, with security built-in

Windows 365 for Agents provides secured, managed Cloud PCs built for AI agents. As your organization governs and protects your human users today, Windows 365 for Agents enables you to apply the same enterprise security and compliance controls to agentic workloads.

Windows 365 for Agents works with Microsoft Entra, Microsoft Intune, Microsoft Defender, Microsoft Purview, and Microsoft Agent 365¹ to provide identity, device management, security, and data governance capabilities for agentic workloads. Agents are designed to operate within enterprise security and compliance boundaries, running in a managed environment with identity, compliance, and security controls.

These core security tenets make it possible.

1. Reduced identity risk with distinct agent identity

Agents running in Windows 365 for Agents are provisioned with their own identity in Microsoft Entra, separate from any human user.

When an agent is hired, a unique agent identity is automatically assigned, helping ensure:

Every action is attributable to a specific agent
Permissions can be scoped precisely
Access can be revoked when necessary

This separation is foundational to Zero Trust. It reduces identity crossover risks and helps ensure agents operate only with the permissions they are explicitly granted. Agents can be governed with full lifecycle management, role-based access control, and auditability built in.

With Entra Conditional Access, organizations can enforce access policies by allowing access to organizational resources only when the Windows 365 for Agents Cloud PC is compliant with the organization’s security requirements. This helps ensure agents access enterprise resources only from managed and compliant Cloud PCs.

By combining identity-based access control with Intune device compliance, organizations can extend Microsoft’s Zero Trust policy engine to agents with the same rigor used for human users.

2. Reduced access risk with agent-only access

Windows 365 for Agents Cloud PCs are reserved exclusively for agents and run on isolated and enterprise-managed compute environments built for agent operations. By providing agents with a dedicated and contained execution environment, organizations can mitigate risks such as privilege escalation, accidental human-agent crossover, and lateral movement across shared accounts. IT administrators can further reinforce these boundaries through Intune provisioning policies that assign Cloud PCs only to agent users, helping ensure these environments are used for their intended purpose.

3. Consistent security and compliance enforcement

Every Windows 365 for Agents Cloud PC is Entra-joined and Intune-enrolled. Such Cloud PCs are managed by Microsoft Intune¹, applying the same security posture your organization already relies on for employee devices.

That means:

Security baselines and compliance policies can be applied from the moment of provisioning
Configuration, hardening, and updates are centrally managed

Agents inherit endpoint security controls, including antivirus, encryption, and device compliance checks. Because these Cloud PCs are managed like any other endpoint, you can extend your existing security investments directly to agentic workloads, simplifying operations while strengthening protection and governance.

4. Network protection with Global Secure Access

Windows 365 for Agents also extends agent security to how agents access the network. Windows 365 for Agents integrates with Microsoft Entra Global Secure Access (GSA) to provide an identity-driven network security layer for agents. This helps organizations apply the same Zero Trust principles they already use for users and devices to agent traffic.

With GSA, organizations can route internet traffic through secure, policy-enforced profiles to help protect agents from malicious destinations, risky connections, and unsafe web activity. Security teams can apply controls for web content filtering, URL-based access policies, and inline threat protection.

By combining network signals with identity and device context, organizations can extend Zero Trust protection beyond authentication and into every network connection an agent makes, while maintaining full visibility into how agents interact with enterprise and external resources.

Read our network security with Global Secure Access learn article to learn more.

5. Governance and visibility into Agent Activity

Security is more than prevention; it is also about governance, visibility, and control. By integrating with Microsoft Agent 365¹, organizations gain visibility into agent activity and can apply governance and policy controls across agent execution environments. Windows 365 for Agents is exposed as a model context protocol (MCP) server in Agent 365, and the telemetry flows into the tools your security teams already use such as Microsoft Defender and Microsoft Purview.

Resilience against threats with Microsoft Defender

Agent activity integrates into Microsoft Defender's AI agent inventory and protection, letting security administrators discover Agent 365 enabled agents in your estate. For agents, Defender offers:

Advanced hunting across all agent activity
Traceability of agent identity, tools, and actions
Threat detection and investigation workflows

Protection of sensitive data with Microsoft Purview¹

On the data side, Microsoft Purview extends your existing security and compliance controls to agentic workloads.

Data Security Posture Management (DSPM) for AI continuously assesses how agents interact with your data and helps you evaluate alignment with your policies.
Activity Explorer delivers granular visibility into agent data usage, including what was accessed, classified, or shared, so sensitive information stays within your policy boundaries.
Existing sensitivity labels, Data Loss Prevention (DLP), and retention policies apply to agent actions similar to human users.
Insider Risk Management (IRM) detects risky agent behaviors, identifies elevated risk levels, and prioritizes investigations before sensitive data is exposed or misused.

Together, Agent 365, Defender, and Purview provide organizations with governance, visibility, and security capabilities for agent activity on Windows 365 for Agents Cloud PCs.

This Windows 365 for Agents demo shows how agents execute in a secure, managed environment.

Are you ready for enterprise-ready agentic computing?

Windows 365 for Agents brings identity, device management, and observability together into a unified, secure platform built for AI agents. In summary, this includes:

Distinct identity to establish the Zero Trust foundation
Agent-only environments to reduce risk of misuse by design
Intune management that enforces a consistent security posture
Identity-aware, real-time network protection with Global Secure Access
Governance and visibility with Agent 365

As your organization scales AI adoption, this model provides governance, compliance, and security capabilities designed to help manage agent workloads throughout their lifecycle.

Ready to put agents to work securely? Learn more about Windows 365 for Agents security on our support page and start running enterprise-ready agentic workloads today.

Footnote: 1. Access to and use of Microsoft Entra, Microsoft Intune, Microsoft Defender, Microsoft Purview, and Microsoft Agent 365 capabilities are subject to applicable licensing requirements and may require separate purchases.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on  LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

Windows settings backup becoming a new resilience baseline

Miranda_Leschke — Mon, 06 Jul 2026 21:45:48 GMT

Resilience is about to get easier for the Windows devices you manage! Eligible devices will now have the backup function on by default with Windows settings backup and restore (previously called Windows Backup for Organizations). Today, it's available to Windows Insiders and will be generally available starting with Windows 11, version 26H2. A recoverable list of settings and Microsoft Store apps is becoming a baseline part of the Windows experience rather than an opt-in configuration step.

Note: Restore behavior is unchanged and isn't enabled by default. You still need explicit admin configuration to restore Windows devices

A baseline designed with IT admins in mind

Staying resilient today is no longer a nice-to-have for businesses. Resetting, replacing, and reimaging a PC is fundamental to onboarding and user experience. It's also a baseline for staying resilient.

Imagine a lost laptop, a hardware refresh, or an unexpected reset. These are some of the moments when your users need backup most. And that's rarely when anyone wants to discover that backup was never turned on.

Making backup the baseline shifts it from a best-effort configuration step to a standard capability across your eligible fleet.

Recovery without configuration: Eligible devices with the backup policy in a Not Configured state under Windows settings backup and restore^[1] will back up automatically. Users' settings and Microsoft Store app list are captured out of the box. Note: Restore behavior still requires configuration to be enabled.
Explicit policy always wins: If you have already enabled or disabled the policy, your setting is honored. The default applies only when policy state is Not Configured.
Restore stays admin-managed: The default-on change applies to backup only. The restore function continues to require explicit admin configuration and is off by default.
User choice preserved:End user settings are protected automatically, and they keep full flexibility — they can run a backup at any time from the Windows Backup app and choose which settings are included from the Windows Settings page, all in line with the admin's policy.

We've experienced these benefits first-hand at Microsoft, when we made backups automatic for employees across the organization.

"Windows Backup for Organizations^[1] is changing how device refresh works. Pressure tested inside Microsoft on a global scale, it enables Microsoft Store apps and user settings to move seamlessly with our people and free IT teams from the heavy lifting of device reimaging. The result is a simpler, more resilient experience." - Brian Fielder, Vice President, Microsoft Digital

The operational benefit is simple: When a device needs to be reset, replaced, or reimaged, you can move forward immediately. No need to rush checking whether backup was ever configured for the users. Their familiar setup is already captured and ready to come back with them.

The scope of the default-on Windows backup

The default-on behavior applies to devices that meet all these conditions:

Running Windows 11, version 26H2^[2] or later
In countries or regions not regulated by the EU Digital Markets Act (DMA)Not in sovereign or restricted cloud environments
With the backup policy in a Not Configured state under Windows settings backup and restore*

Devices outside this scope keep their existing behavior:

Devices in privacy sensitive countries or regions remain off by default.
Devices in sovereign or restricted cloud environments remain off by default.
Devices with the backup policy explicitly enabled or disabled continue to honor that explicit setting.
Devices running previous supported Windows 11 versions (except for version 26H1) remain off by default.
Devices originally running Windows 11, version 26H1 will receive the same default-on treatment starting with the following feature update.

Getting started

If your environment is already in scope and in the state you want, you're ready. No action required. Otherwise, here's how to pick the behavior that fits your organization:

Keep backup on (recommended): No action required. Eligible devices with the backup policy in a Not Configured state under Windows settings backup and restore* will enable backup automatically at general availability of Windows 11, version 26H2.
Opt out: Explicitly disable the backup policy through Microsoft Intune, Group Policy, or your MDM solution. Explicit disablement always takes precedence over the default.
Make intent explicit: Set the backup policy to enabled today. This is functionally equivalent to the new default but provides an unambiguous, audit-friendly admin signal, and the ability for user-targeted enablement only.
Control restore behavior separately: Configure the restore policy on its own. The default-on change applies to backup only.

You can validate the experience early. The default-on behavior is available with Windows 11, version 26H2 in Windows Insider Program Experimental channel starting July 2026. It takes broad effect for eligible devices at Windows 11, version 26H2 general availability later this year. Devices originally running Windows 11, version 26H1 will receive the same default-on treatment starting with the following feature update.

Watch this video for a quick tour of the experience:

Ready for broader Windows resiliency

Thank you for your feedback that shaped this change. Making backup the baseline is one step in a broader Windows resiliency effort. We'll keep sharing what's coming next, so you can plan with confidence.

Catch up and learn more:

^[1]Windows Backup for Organizations is now Windows settings backup and restore. You'll start seeing the new name alongside the original name while we update documentation and policy surfaces.

^[2]Windows 11, version 26H2 is the annual feature update for Windows 11, versions 25H2 and 24H2. It will be released in the second half of the 2026 calendar year.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: June 2026

Chris_Morrissey — Wed, 01 Jul 2026 22:00:00 GMT

Earlier this month, we announced that Windows 11, version 26H2—the next annual feature update for Windows 11—is now available for early testing and validation via the Windows Insider Program. As this release will share the same servicing branch as versions 25H2 and 24H2, devices can be updated using an enablement package, quickly and with minimal disruption to users. Microsoft also announced major Windows 365 updates at Build 2026, introducing ready-to-code Cloud PCs, expanded developer-focused capabilities, and new support for secure enterprise AI agents.

Now let's dive into more developments in the world of Windows for IT admins from the month of June.

New in Windows update and device management

[RECOVERY] – Now generally available, point‑in‑time restore for Windows 11 can help users recover in minutes instead of hours by safely rolling a device back to a previous state. This built-in recovery capability is available for Windows Enterprise, Pro, and Home editions of Windows 11.
[W365] – An optimized Teams experience for Remote App scenarios is now available, offering improved audio and video performance, reliability, and security.
[PRINTING] – What was formerly the Modern Print Platform is now Windows Ready Print. It's now Windows preferred means of communicating to printers, including the Internet Printing Protocol (IPP), eSCL scanning, and Universal Print. Starting in July 2026, new printer installations will default to Windows Ready Print where supported, enabling a simpler and more reliable setup experience.
[APPS] – Auto-updates in Microsoft Intune Enterprise Application Management are now available. Keep managed applications on the latest incremental release, such as 4.1 to 4.2, without manual packaging or admin intervention.

New in Windows security

[SECURE BOOT] [TIPS] – If your organization hasn't yet finished updating Secure Boot certificates for client devices, servers, or virtual machines, find out which best practices can help. If you run into devices that are blocked from receiving updated Secure Boot certificates, explore actions you can consider.
[SECURE BOOT] [LINUX] – New guidance is now available to help you manage Secure Boot certificate updates for Linux on Azure virtual machines. This includes Trusted Launch and Confidential VMs with Secure Boot enabled.
[SECURE BOOT] [EVENTS] – In response to your feedback, two specialized Q&A events for Secure Boot will take place in July. Join Secure Boot Office Hours for virtualized environments (July 8). During OEM Secure Boot Office Hours (July 15), get answers from the OEM ecosystem, Broadcom, and Windows cloud experience experts. (Note: There is no on-camera or meeting component to these events. All Q&A will take place in the comments on the Tech Community.)
[IDENTITY] – IAKerb and LocalKDC are new capabilities that expand Kerberos authentication across enterprise and local account scenarios. That's how Microsoft is advancing efforts to reduce NTLM dependency and strengthen security. Available today in the Windows Insider Program, a public preview is coming for both client and server.
[W365] [DATA PROTECTION] – Context-based redirections for Windows 365 can now be explored in public preview. Apply more granular controls to device and resource redirection based on contextual signals. Available signals are device management state, compliance posture, user or group membership, and network conditions.
[HARDENING] – The final deployment phase for Kerberos RC4 hardening begins with the July 2026 Windows security update. This phase completes the transition from legacy encryption types such as RC4. It removes Audit mode and leaves Enforcement mode as the only supported behavior for Kerberos RC4 usage on Windows domain controllers.

To explore what's new in security across the Microsoft platform, see What's new in Microsoft Security: June 2026.

New in AI

[AGENTS] [SECURITY] – At Build 2026, Windows introduced new security foundations for AI agents. They're designed to provide governance, containment, and enterprise-grade controls for autonomous agent workloads.
[AGENTS] [W365] – Windows 365 for Agents is generally available within Agent 365. With this update, Cloud PCs that enable AI agents can execute multi-step workflows across software. Use it to open apps, navigate interfaces, enter inputs, and process data.

New in Windows Server

For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes.

[NETWORKING] – DoH support for Windows DNS Server is generally available on Windows Server 2025. You can now deploy encrypted and authenticated client-to-resolver DNS traffic directly within your existing on-premises DNS infrastructure.
[HOTPATCH] – Hotpatch update support for Windows Server 2022 Datacenter: Azure Edition has been extended through October 2027.

New in productivity and collaboration

Install the June 2026 security update for Windows 11, versions 25H2 and 24H2 to get these and other capabilities, which will be rolling out gradually:

[AUDIO] – Shared Audio can keep people productive on the move. Two people can now to listen to the same audio from a single Windows 11 PC at the same time.
[SECURITY] – When Windows Hello face or fingerprint is set up and available, it's now the default sign-in method every time you sign in. Even if you used a different method previously.
[FILES] – Windows Search will now find and prioritize files with as few as two characters.
[BATTERY] – This update improves resiliency against apps that could keep the sensor hub powered on and drain power. Enjoy a better battery life.

New features and improvements are coming in the July 2026 security update. You can preview them by installing the June 2026 optional non-security update for Windows 11, versions 25H2 and 24H2. This update includes the gradual rollout of:

[WIDGETS] – A quieter, more focused Widgets experience helps reduce interruptions and improves default settings and notification controls. For example, Widgets no longer open on hover, and notifications and taskbar badges are minimized by default.
[ACCESSIBILITY] – You can now apply a full-screen color overlay to help reduce eye strain and improve readability. You can also enter a zoom percentage directly and change it in increments in the Magnifier window for more precise, flexible control. And, you can now use voice access and voice typing in French, German, and Spanish.

To learn about planned productivity, security, and reliability updates for Windows 11, visit the Windows Roadmap.

Lifecycle reminders

[SERVER] – DirectAccess has been deprecated and will be removed in a future version of Windows Server. It has been replaced by a more modern, flexible solution: Always On VPN. For migration guidance, see Remote Access Always On VPN migration.
[WINDOWS 10] [ESU] – The Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year. Coverage is now available through Oct. 12, 2027.

Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025.

Additional resources

Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs, and more? Check out these resources:

Windows Roadmapfor new Windows features – filter by platform, version, status, and channel or search by feature name
Microsoft 365 Copilot release notesfor latest features and improvements
Windows Insider Blogfor what's available in the Beta and Experimental channels
Windows Server Insiderfor feature preview opportunities
Understanding update history for Windows Insider preview features, fixes, and changesto learn about the types of updates for Windows Insiders

Join the conversation

We are always looking to improve this monthly summary. Drop us a note in the Comments and let us know what we can do to make this more useful for you!

Continue the conversation. Find best practices. Bookmark the Windows Tech Community. Looking for support? Visit Windows on Microsoft Q&A.

Best practices for deploying Secure Boot certificate updates

Nuno_Costa — Tue, 23 Jun 2026 21:00:00 GMT

Deploying Secure Boot certificate updates across the Windows ecosystem has required coordination across operating systems, device manufacturers, and firmware vendors. The steady and coordinated rollout is strengthening the platform root of trust worldwide.

Many individuals and organizations have already successfully updated certificates for client devices, servers, and virtual machines, with others close behind. Proven deployment and validation tools, automatic certificate installation via Windows updates, and firmware support from our OEM partners are helping us all move forward with confidence. However close you are, finishing Secure Boot certificate deployment remains important. If you're still on the path to finishing your Secure Boot certificate deployment, stay the course.

What we've seen work in practice

Every individual device and organization's environment is different.

In the commercial realm, across customer conversations, Ask Microsoft Anything (AMAs) events, and hands-on deployments, a few consistent patterns have emerged:

Early testing builds confidence. Many organizations start with pilots, validate results, and expand rollouts as confidence grows for both Windows and IT teams.
Layered deployment approaches work best. Teams have successfully deployed OEM firmware updates with Windows security updates, using a mix of automation and staged rollout.
Multiple tools can lead to success. From Microsoft Intune to Group Policy, Azure automation, and PowerShell, there isn't a single "right" tool, only the right fit for your environment.

From talking with many of you, we learned that the diversity of tools and deployment approaches is a key reason the transition has succeeded at scale. Organizations are using a flexible resource set that meets their needs where they are.

For home users and organizations that allow Microsoft to manage Windows updates, the experience has been equally straightforward. A few takeaways stand out:

Keeping devices up to date delivers the best experience. Individuals running supported versions of Windows and receiving regular Windows updates have generally received the newer certificates automatically. Don't pause Windows updates; keep them coming!
Built-in protections simplify the update. Secure Boot is enabled by default on most modern PCs, helping these devices receive the newer certificates without manual configuration. Simply keep Secure Boot enabled or re-enable it if needed.
Built-in tools help you be ready. The Windows Security app can help you track progress. It can show whether the new certificates have reached your device and whether Secure Boot remains enabled. If anything is preventing devices from receiving and applying the certificates, you can follow embedded instructions to make progress. Note: In enterprise environments, the Windows Security app is disabled by default.

Overall, for most supported Windows Home and Pro PCs and business devices managed by Microsoft, staying protected has been as simple as keeping Windows up to date and Secure Boot enabled.

NOTE: While most Secure Boot-enabled PCs receive the newer certificates through the monthly Windows update process, a small number might require a firmware update from the device manufacturer. The Windows Security app can help identify whether your device is waiting for a firmware update. In some cases, the firmware updates needed to support these changes might not be available for older device models, depending on the manufacturer's support lifecycle. Reach out to your device manufacturer if you encounter this case.

Our experience at Microsoft

Microsoft's internal deployment followed many of the same principles described throughout this post. We began with limited deployments, used validation and deployment signals to build confidence, and expanded over time. This phased approach helped us identify issues early, validate readiness, and scale deployment in a measured way.

Along the way, we encountered many of the same edge cases and scenarios that many of you are navigating. Those experiences shaped the tools and guidance we've continued to share externally, including:

New Secure Boot status messages in the Windows Security app that help users understand certificate readiness and identify issues that might require attention.
Secure Boot certificate update playbooks for both Windows Client and Windows Server, along with tailored guidance for Windows 365 and Azure Virtual Desktop.
Multiple Ask Microsoft Anything sessions, now available on demand.
Expanded tools for IT-managed environments, including event logs, PowerShell scripts, Microsoft Intune remediations, Microsoft Defender insights, and Windows Autopatch reporting.

Microsoft has been learning alongside you and turning those lessons into resources that you can use.

Keep going; you're on the right path

If you're an IT administrator still deploying Secure Boot certificate updates, you're not alone. Organizations and individuals are progressing at different speeds, based on their environments and requirements. This flexibility is intentional.

What we've seen consistently is that success comes from staying the course:

Keep your devices up to date with the latest Windows updates.
Check that the latest firmware version is installed. You can visit your OEM's support page or use their official support channels.
Continue with your phased rollout. Gradual deployment of certificates, boot managers, and updated OEM firmware, along with validation, remains the most reliable approach.
Use the tools available to you. Whether built into Windows, such as the Windows Security app, or designed for IT-managed environments, these tools help you monitor progress and make informed decisions.

Focus on progress over perfection. Each step forward strengthens your environment's platform root of trust.

Devices with older certificates will continue to function and receive updates, giving you time to complete deployment. Completing this transition helps ensure that your devices stay current with evolving Secure Boot protections.

Resources to support your next steps

We're nearly finished with rolling out automatic certificate updates to individual PCs and business devices. If you are still in the process of rolling out updates in your organization, these resources can help:

In the coming weeks, there are also still opportunities to ask questions. Save the date for these upcoming events:

July 1 – Windows Server Secure Boot AMA
July 8 – Secure Boot Office Hours for virtualized environments
July 15 – OEM Secure Boot Office Hours

Device owners using Windows Personal and Family accounts can use online support channels and phone numbers for additional help.

This has been a long and meaningful journey. Together, we have strengthened the platform root of trust that modern security depends on. Wherever you are in your certificates update process, you are contributing to that shared progress.

Point-in-time restore for Windows 11 is now generally available

Lia_Vargas — Tue, 23 Jun 2026 16:00:00 GMT

When a Windows PC experiences an unexpected issue, every minute of downtime matters. Devices are constantly evolving through updates, apps, policies, drivers, and user activity, which can make recovery complex. For IT teams, getting users back to work often means time-consuming troubleshooting, or full rebuilds that take hours.

Today, we’re excited to announce the general availability of point‑in‑time restore for Windows 11 new built-in recovery capability designed to recover in minutes instead of hours, with confidence, by safely rolling a device back to a previous state. Available in Windows Enterprise, Pro and Home SKUs, point-in-time restore provides admins and employees a quick, built‑in ability to go back in time to a moment before the issue occurred.

This release marks an important step forward in Windows recovery and resilience and reflects what we’ve heard consistently from Windows users and IT admins: recovery should be reliable, simple, and easy to use when it matters most.

Point-in-time restore shown in the Troubleshoot menu for Windows Recovery Environment (Windows RE)

What is point‑in‑time restore for Windows 11 PCs?

Point‑in‑time restore automatically captures comprehensive restore points on a predictable cadence and stores them locally on the device.

With point‑in‑time restore, a device can be restored to the exact system state captured earlier, including:

Windows OS
Installed applications
System and app configurations
Settings
Local user files

Key characteristics:

Automatic and predictable: Restore points are captured on a recurring schedule (default: every 24 hours), so recent recovery points are already available if an issue occurs.
Fast, full‑system recovery: Restore the entire system to a previous state in minutes*, minimizing user and business impact.
Designed for real‑world disruptions: Useful for both one‑off device issues and wider incidents affecting many machines, such as a problematic updates, driver regressions, app corruption, configuration errors or other user or admin-initiated changes that result in system instability.
Built into Windows 11: Configuration is available within system settings, and restore operations are initiated from Windows RE, providing a trusted recovery path even when the Windows PC won’t boot.

*Note: Restore time is dependent on several factors, such as changes that have occurred on the system since restore point capture and system performance.

Point‑in‑time restore is part of Windows resiliency, focused on helping organizations prevent, manage, and recover from PC incidents more effectively. Check out the click-through demo to see the configuration and restore experience. 

How is this different from System Restore?

You may be wondering how point‑in‑time restore compares to System Restore. While both features leverage Volume Shadow Copy Service (VSS) under the hood, point‑in‑time restore is more comprehensive and is built for modern Windows PCs management and recovery.

	Point-in-time restore	System Restore
Restore points	Automatic, configurable cadence; user files are included in restore point	Event-triggered or manual only; user files are excluded from restore point
Reliability	Strict retention and cleanup policies	No retention limits
User experience	Integrated in system settings	Limited to control panel
Storage impact	Minimizes storage impact by integrating with reserved storage*	Higher impact to storage space
Management	Will support robust remote management capabilities	Limited remote management capabilities

*Note: Reserved storage is a Windows feature that sets aside a portion of disk space for successful update installation. It helps ensure that updates, temporary files, and system processes can run reliably, without requiring users to free up space.

How does this feature in Windows 11 compare to point-in-time restore for Windows 365?

Some of you are already familiar with point‑in‑time restore for Windows 365 Enterprise, which protects Cloud PCs. While these features share the same goals of fast recovery and minimal downtime, they are optimized for different environments.

Each solution is purpose‑built for its environment, and organizations may use both depending on device types.

	Windows Client	Windows 365
Feature enablement	Can be enabled or disabled	Always on
Restore point retention	Up to 72 hours	Up to 1 month
Restore point types	Short-term only	Short-term, long term, and manual
Restore point sharing	No sharing, restore points remain local	Support sharing across Windows 365 and Azure Cloud
Restore speed	Likely faster due to local storage of restore point	Speed is affected by network latency and bulk vs. single restores
Storage constraints	Bound by physical disk limits	Scalable, cloud storage

What’s included in general availability (GA)?

Since its initial public preview, point-in-time restore has been enabled on over 2M devices and the feature has continued to mature based on feedback and real‑world testing. GA signals that point‑in‑time restore is ready for production use and to become part of your Windows recovery toolkit.

Highlights in the GA release include:

Availability for all users on consumer and commercial editions of Windows 11
CSPs for remote configuration
Integration with system reserved storage to minimize local storage impact
Visibility into restore points on the system and their disk usage
Consistency in settings across feature updates and integration with OneSettings
Updated documentation and guidance

Configuring point-in-time restore

Configuration defaults for general availability are outlined below:

Configuration	Default	Options	Editions eligible to configure
Feature On/Off	See below	On, Off	Home, Pro, Enterprise
Restore point frequency	Every 24 hours	4, 6, 12, 16, 24 hours	Enterprise only
Restore point retention	72 hours	4, 6, 12, 16, 24, 72 hours	Enterprise only
Maximum usage limit	2% of disk	Percent of disk (min 2 GB, max 50 GB equivalent)	Home, Pro, Enterprise

Point-in-time restore is on by default on some systems not under enterprise management:

Windows Home edition devices
Windows Pro edition devices that are not domain joined and not enrolled in enterprise endpoint management

Point-in-time restore is off by default, until Windows 11, version 26H2 on some enterprise-managed systems:

Windows Enterprise and Education edition devices
Windows Pro edition devices that are domain joined or managed by an organization

*Note: Only devices with an OS volume size of 200GB or greater, will have the feature on by default. The feature will be off by default on devices with OS volume size below 200GB, but admins can turn the feature on if desired.

Point-in-time restore can be configured in system settings: System > Recovery > Point-in-time restore. Only local admins can view or edit point-in-time restore settings on their system.

Point-in-time restore settings page in System > Recovery

Important considerations before you restore

Point‑in‑time restore is a powerful recovery tool, and it’s important to understand its behavior and impact:

Data loss: Any changes made after the selected restore point including files, apps, and settings will be lost. Cloud data is not affected but may require resync. Microsoft recommends storing data in the cloud.
Local storage: Restore points are stored locally and require sufficient disk space. Older restore points are automatically removed when limits are reached.
BitLocker protection: A BitLocker recovery key is required when restoring encrypted devices.

For detailed requirements, limitations, and best practices, we strongly recommend reviewing the documentation.

Restoring a device

Currently, a restore can only be triggered locally by the user when the device is in Windows RE. The steps to perform a point-in-time restore are below:

In Windows RE select Troubleshoot > Point-in-time restore
Enter Bitlocker recovery key
Select a restore point to restore PC to the exact state it was at the time of the restore point
Acknowledge the risks and limitations associated with this feature by selecting Continue
Review the restore point selection, OS version and warning of data loss and select Restore to start the restore process

*Note: Microsoft has announced plans to enable remote initiation in the future, through Intune recovery, giving organizations a more scalable way to restore devices when that capability becomes available.

Start using point‑in‑time restore today and provide feedback

Point‑in‑time restore is now generally available on Windows 11 Client PCs on versions 24H2 and later.

Learn more and get started: point-in-time restore for Windows 11 Microsoft Learn.

We strongly encourage you to share feedback through Feedback Hub, within Recovery and Uninstall > Point-in-time restore as we continue investing in Windows recovery and resiliency.

Looking ahead

Point‑in‑time restore is an important foundation for the future of Windows recovery. As part of Windows resiliency, we’ll continue to enhance point-in-time restore and expand recovery options, improving manageability, and reducing the time it takes to get users back to productivity across a broad range of issues. For the latest updates on Windows, please refer to the Windows IT Pro Blog.

Get ready for Windows 11, version 26H2

Jason_Leznek — Mon, 03 Aug 2026 16:41:04 GMT

The next annual update for Windows 11 is coming soon and is already available to Windows Insiders! Windows 11, version 26H2 continues our focus on delivering a predictable, low-disruption update experience for organizations and IT professionals.

For devices already running recent versions of Windows 11, this release should be easy to adopt. It builds on the same platform and servicing approach introduced in prior releases, while continuing to improve how updates are delivered, tested, and deployed.

In this post, we'll walk through how to prepare for Windows 11, version 26H2.

A familiar update experience, refined

Windows 11, version 26H2 uses the same shared servicing model as recent releases available annually in the second half of the calendar year. Supported devices get this feature update as a small enablement package instead of a full OS replacement.

If your organization is already on Windows 11, version 24H2 or 25H2, the update to 26H2 is similar to a regular monthly update in most environments:

A small, quick installation
Minimized disruption to users
No need for full reimaging or complex deployment motions

Note: Devices running Windows 11, version 26H1 won't be able to update to version 26H2. Instead, they'll have a path to update to a future Windows release. This is because Windows 11, version 26H1 is based on a different Windows core than Windows 11, versions 24H2, 25H2, and 26H2. Here's What to know about Windows 11, version 26H1.

This is possible because multiple versions of Windows 11 share a common servicing branch, including:

The same source code base
The same security and quality updates
The same compatibility validation

The difference between versions is simply which features are enabled.

Shared servicing branch progression

Why this matters for IT organizations

The shared servicing model isn't just a technical detail. It directly impacts how you manage updates across your environment. Compared to full OS upgrades of the past, Windows 11, version 26H2 comes with reduced deployment complexity, improved compatibility confidence, and faster time to value.

Reduced deployment complexity

Because features are delivered continuously and enabled later, there's no large "upgrade event." This makes planning easier and reduces operational overhead.

Improved compatibility confidence

Devices moving between versions on the same servicing branch typically benefit from:

Existing application compatibility validation
Lower risk of regressions
Fewer surprises during rollout

Faster time to value

With smaller updates and faster installations, organizations can move more quickly to the most current release. New features reach you without lengthy deployment cycles.

Support lifecycle considerations

As with previous annual feature updates, moving to Windows 11, version 26H2 resets the Windows support lifecycle for your devices.

This provides:

24 months of support for Home, Pro, Pro EDU, and Pro for Workstations editions
36 months of support for Enterprise, Education, IoT Enterprise, and Enterprise Multi-session editions

What does it mean for your servicing strategy? The annual update becomes a key milestone for maintaining a supported and secure environment.

How to prepare for Windows 11, version 26H2

Already managing Windows 11 in your organization? Preparing for 26H2 should align with your existing update processes.

1. Validate today

Begin testing with devices running recent versions of Windows 11 to confirm compatibility with your apps, policies, and infrastructure.

If you'd like to get a peek of what's coming and begin previewing version 26H2 on devices now, the update is available through the Windows Insider Program in the Experimental channel. Otherwise, your organization might prefer to wait for the update to become available in Release Preview before doing more extensive testing. At that stage, the experience is closer to final shipping quality. We'll have more information to share when version 26H2 is in Release Preview.

2. Use your existing deployment tools

Windows 11, version 26H2 will be available through familiar channels, including:

Windows Autopatch
Microsoft Intune
Windows Server Update Services (WSUS)

3. Plan your rollout rings

Use your standard deployment rings to:

Pilot the update with a small group of devices.
Expand gradually based on validation results.

4. Stay current

Windows features are delivered continuously. Stay up to date with monthly updates to help ensure a smoother transition when the feature update becomes available.

Feature delivery over time with enablement moment

Looking ahead and staying informed

Windows 11, version 26H2 continues the move toward a more predictable and efficient servicing model. This model helps reduce disruption while helping your organization stay secure and up to date. By building on a shared platform and delivering innovation continuously, Windows enables you to focus less on large upgrade projects and more on delivering value to your users.

We'll continue to share updates and guidance as Windows 11, version 26H2 becomes available. In the meantime, test it in the Windows Insider Program's Experimental channel and use the updated plan-prepare-deploy learning path to get ready.

Be sure to follow the Windows IT Pro Blog and join us on the Windows Tech Community for the latest information and best practices.

Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Introducing Windows Ready Print and Modernized Driver Selection

elliesekine — Fri, 12 Jun 2026 16:00:00 GMT

Introducing Windows Ready Print: a simpler, more reliable path to modern printing with modern driver selection controls.

Windows Ready Print: A clearer path to modern printing on Windows

Printing on Windows is evolving.

As printing environments modernize, customers and partners are asking for solutions that are reliable, secure, and easy to manage across today’s devices. To reflect this shift and make the value of our platform clearer, we are evolving the Modern Print Platform under a new name: Windows Ready Print.

Windows Ready Print highlights what matters most: a streamlined, dependable printing experience built for modern Windows environments. It represents our commitment to simplifying printing, aligning modern standards, and delivering consistent, forward-looking experiences for users, IT admins, and partners.

Driving the transition to Windows Ready Print with driver selection controls

At the core of Windows Ready Print is a transition away from legacy, third party drive-based workflows toward modern, standards-based printing with IPP (Internet Printing Protocol) using the Windows inbox IPP printer driver.

Starting in July 2026, new printer installations will default to Windows Ready Print where supported, enabling a simpler and more reliable setup experience. This change reduces the need for traditional driver management and lays the foundation for a more scalable and predictable print experience.

However, we recognize that not all environments can move to Windows Ready Print immediately. To ensure a smooth and flexible transition, we are introducing the ability for users to configure Windows to install their printers using Windows Ready Print (if supported) or the OEM printer driver during installation.

You can find this setting under Settings > Bluetooth & Devices > Printers & Scanners > Default install printer using Windows Ready Print.

Driver selection configuration in Settings

This feature enables users and IT admins to control how Windows selects drivers when installing printers:

When “Default install printers using Windows Ready Print” is enabled, Windows Ready Print installation is preferred
When “Default install printers using Windows Ready Print” is disabled, default driver selection is used

The configuration applies to new printer installations only, without affecting existing devices.

To enable/disable this feature via group policy, go to:

Launch Group Policy Editor
Navigate to Local Computer Policy -> Administrative Templates -> Printers
Find and select 'Configure Windows Ready Print driver ranking' -> double click to open it
Select 'Enabled' (if you wish to enable Windows Ready Print driver selection) or 'Disabled' (if you wish to explicitly disable Windows Ready Print driver selection).
Select Apply
Select OK

How driver selection configuration works with Windows protected print mode

When you enable "Default install printers using Windows Ready Print", new printer installations will default to Windows inbox IPP printer driver when supported.

When you enable Windows protected print mode, printers are exclusively installed with Windows Ready Print. Devices that do not support Windows Ready Print cannot be installed.

Note: When you’ve enabled Windows protected print mode, you cannot disable “Default install printers using Windows Ready Print".