Windows security topics

My 25+ years Microsoft account got hacked by someone with bibimail, and I can't recover it

Raznaak — Wed, 09 Sep 2026 16:10:16 GMT

My main account got hacked this morning. I have been using it since about 2000 and it is the account I've used for almost every log-ins for sites since then.

They changed my password and my recovery address (a gmail address), and they added a passkey and a new authenticator to it. I've tried the recommended method to recover my account, but it states that since two-factors authentication is activated, nothing can be done to recover it.

And along the way, I've seen this, address:

I've looked and dozens of people had the same problem sharing their experience on these forums and others such as Reddit, and ALL of them since the beginning of summer 2026 have been hacked by that bibimail address. I tried to connect to bibimail.net, but it's always down (except probably when they want to hack someone...), and every verification site says it's a high-risk address and almost certainly a scam, and I've been able to see that it has been created in June 19th 2026. I don't understand how Microsoft would accept something from such a sketchy site...

How could it be possible for a hacker to bypass and change all my security setting, and Microsoft having no problem with them doing so, but now they bar me from trying to recover it???

Please, I've been using my main address for EVERYTHING online, I have close to a hundred sites connected with this address, I've spent thousand of dollars and hours spent on these sites (all of which I will probably lose access soon), and I also don't want to lose more than twenty years of mails, including some from my dead relatives.

I only made this account to speak here, I've tried to call Microsoft, but the answering bot tells me to go to the exact site I've used that doesn't work as they've enabled two-factors authentication to block me off, and now the bot refuses to say anything else than "go to this site, bye" (it probably recognizes my phone number). I also have Microsoft 365 Family, and I don't want my family to have problems with that either...

Please, I just want to talk to a human so I can get my account back.

LDAPS authentication failed!

italb01 — Tue, 08 Sep 2026 14:01:45 GMT

Hello,

We are trying to configure LDAPS for VPN users, Active Directory infrastructure is as below.

Primary Site: 2 Domain Controllers.

DR Site: Read-Only Domain Controller

LDAPS works fine, when users trying to login using RODC as LDAPS server, but when they try to login using the other 2 DC the connection failed and they receive the error below:

Error value: 000004DC: LdapErr: DSID-0C09091F, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v2580

Thank you!

Microsoft account security issues. My account was stolen but could not be retrieved.

Ares_Xiao_Hui — Sun, 06 Sep 2026 12:31:15 GMT

I’m writing to report a serious issue with my Microsoft account (the one I’m currently using to post this). My account was recently compromised – my recovery email and phone number were changed without my authorization. My original email address and phone number were secure (I had two‑step verification enabled), but now when I try to sign in with them, the system says no account exists. However, if I try to create a new account with the same credentials, it tells me the account is already taken. This puts me in an impossible loop.

I attempted to recover my account through the standard recovery form (https://account.live.com/acsr), but the process rejected my request, stating that I didn’t provide enough evidence. This is puzzling because I can still access this account on my personal computer – thanks to Windows Hello face recognition, which is still active and logs me in automatically. This means my identity and usage patterns are clearly verifiable on that device.

I would expect that a recovery process could use additional verification factors such as:

Login IP history,
Security questions (if set),
Long‑term usage patterns and device signatures,
Or at least a secondary channel to confirm ownership.

Currently, none of these seem to be available, and the only option I’m given is the recovery form, which fails despite the fact that I’m still signed in on my trusted machine.

To be precise:

My original email was: ******@https://qq.com
The new (unauthorized) email on the account is now: ******@https://mtt8.cc

I find this situation extremely frustrating because my account is clearly active and tied to my device, yet I’m locked out of recovery. I would greatly appreciate it if a support agent could manually investigate this case using the device information, IP logs, and other internal data that should confirm my ownership.

Please let me know what additional steps I can take, or escalate this to a technical team that can look beyond the automated recovery form. I’m happy to provide any further proof needed.

Thank you for your time – I hope this can be resolved soon.

KB5121003 replaces Hotpatch KB5120994

Gokulendra — Tue, 01 Sep 2026 09:01:52 GMT

Hi Everyone,
I need urgent assistance on below;

User installed Hotpatch KB5120994 ( which we do not show in our Patch Solution )

KB5121003 is detected in the patch scan and user created a patch Job using the same.
The patch got installed successfully.

But KB5121003 replaced the Hotpatch KB5120994 - Is this an expected behavior?

KB5120994 [ Hotpatch ]

https://support.microsoft.com/en-us/servicing/os/hotpatch/windows-11/2026/kb5120994-windows-11-24h2-25h2-security-update

KB5121003
https://support.microsoft.com/en-us/servicing/os/windows-11/2026/08/kb5121003-windows-11-24h2-25h2-security-update

I know both are released on 11th Aug 2026
Is the Hotpatch KB5120994 released before KB5121003 ?

How can I tell if I'm enrolled in ESU with my Windows 10? I want to extend my enrollment period.

edcarballo — Thu, 13 Aug 2026 15:43:53 GMT

Driver digital signature authentication issues

Sewing — Thu, 13 Aug 2026 06:44:02 GMT

I am currently developing a desktop application for my company with a kernel driver (which is just a single .sys file). Since drivers must have a Microsoft digital signature to run starting with Windows 10, I have some questions about digital signature authentication.

On this webpage (https://learn.microsoft.com/zh-cn/windows-hardware/drivers/dashboard/driver-signing-offerings#hardware-lab-kit-tested-and-dashboard-signed-drivers), I saw a solution for driver signing. The first method requires testing with HLK and submission to Windows Hardware Quality Labs for certification. The second method, according to its description, only requires submitting the driver for signature verification, without HLK testing. What are the differences between these two solutions? Which solution should I choose?

Usage of GetRuntimeAttestationReport

robertbiggs — Tue, 04 Aug 2026 12:05:57 GMT

Hello Community!

I would like to get more information about the function GetRuntimeAttestationReport.

It seems like it is signed via a key from the Secure Kernel, but the key's getter function is unknown to me. How does one query this key? Also, how does one verify the key's root of trust?

Sincerely

Robert

Secure Boot Q&A opportunities continue in July

Heather_Poulsen — Tue, 23 Jun 2026 23:32:56 GMT

If you're still working through Secure Boot certificate update rollouts, Microsoft is continuing the conversation throughout July with three opportunities to get your questions answered by the people closest to the technology.

Whether you're focused on Windows Server deployments, virtualization platforms, or OEM updates, these upcoming events are designed to help you navigate planning, validation, troubleshooting, and implementation questions in a live, interactive format. Microsoft engineers and subject matter experts will be available to respond directly to questions from the community.

Coming up in July:

July 1 - Windows Server Secure Boot AMA
Ask Microsoft engineers about Secure Boot certificate updates in Windows Server environments, including deployment planning, monitoring, troubleshooting, and more.
July 8 - Secure Boot Office Hours for virtualized environments
Bring your questions about Hyper-V, Azure offerings, Windows 365, VMware, and other virtualization scenarios.
July 15 - OEM Secure Boot Office Hours
Connect with experts to discuss OEM-specific questions, such as firmware considerations, as you prepare for or validate Secure Boot certificate updates.

Questions don't have to wait until the events start. With community events, you can post your questions and comments ahead of time, then join the discussion live or catch up when it's convenient for you. Hope you find these events helpful.

You can also catch up on demand with the series of Secure Boot AMAs that have taken place over the past several months. Here are the three most recent editions:

Companion guide: Transitioning to post-quantum cryptography

Heather_Poulsen — Mon, 23 Mar 2026 17:44:03 GMT

Whether you joined us live or are catching up afterward, this companion guide brings together all the resources, links, and deeper dives referenced during the Microsoft Technical Takeoff session on Transitioning to post-quantum cryptography. Think of it as your follow‑along toolkit: everything you need to explore key topics, revisit demos, and continue learning at your own pace. Use it to jump straight to the details that matter most to you or to share highlights with your team.

Industry standards:

NIST standardized the first set of PQC algorithms

FIPS 203 Key Encapsulation Mechanism (ML-KEM)

FIPS 204 Digital Signature Standard (ML-DSA)

FIPS 205 Hash Based Digital Signature Standard (SLH-DSA)

NIST SP 800-208 Stateful Hash-Based Signature Schemes (LMS, XMSS)

Last year, Microsoft added post-quantum cryptography algorithms to SymCrypt, Microsoft’s core cryptographic library.

Read the announcement: Microsoft's quantum-resistant cryptography is here

Direct callers can leverage Cryptography API: Next Generation (CNG) libraries and Certificate and Cryptographic messaging functions in Windows Server 2025 (and later) and Windows 11.

Request ML-DSA server certificates with Microsoft Active Directory Certificate Services (ADCS).

Windows TLS Stack (Schannel): TLS hybrid key exchange per the latest IETF internet draft is now available for preview in the Windows Insider Program and coming soon to Windows Server.

Additional algorithms coming to SymCrypt as global standards and compliance regulations mature.

When available, ML-KEM hybrid groups can be enabled and prioritized on devices using the same mechanisms as existing TLS ECC curves. To learn more, see Manage Transport Layer Security (TLS) in Windows Server.

Additional resources:

Post-Quantum Cryptography APIs Now Generally Available on Microsoft Platforms

Windows 11 Security Book

Désinscription Windows ESU (Windows 10)

Cléon — Mon, 02 Mar 2026 19:29:05 GMT

Bonjour,

A la suite de problème sur mon matériel à la suite d'une mise à jour de sécurité (KB5071546) du programme de mise à jour de sécurité étendu (Windows ESU), j'ai fait une demande sur le support pour qu'on me désinscrive de l'ESU.

Le billet est le numéro 7098812524

Après échange on m'a indiqué que je pouvais le faire depuis mon compte Microsoft.

Mais sur mon compte Microsoft, je ne trouve pas d'onglet dans la partie "Abonnement" qui se réfère à l'ESU et donc je n'arrive pas à me désinscrire par mes propres moyens.

Pouvez-vous m'aider, s'il vous plaît ?

Je suis à disposition si vous avez besoin d'informations complémentaires.

Hyper-V Custom Secureboot Keys

MikeC135 — Tue, 17 Feb 2026 05:33:41 GMT

I'm looking to do local development work with secure boot and was wondering if anyone has any idea how to add custom secure boot keys to Windows 11 Enterprise Hyper-V?

Windows update made dell laptop into a brick

nerdyplayer — Fri, 30 Jan 2026 13:08:08 GMT

Last security update on Jan 13th broke my laptop.

Every program keeps freezing and doesn't do anything. Even when I open task manager it may run for a minute but soon it will freeze, and can't even end task.

Only thing that is working is my browser. Yesterday I managed to reinstall windows using a USB and it was working again. While i was away, it forced an update and once again the same issues arise.

laptop is too old to install 11, and going to try and reinstall windows again.

There a way I can turn off the windows 10 update before this happens again?

there is a patch, but i cannot install it. When it automated update, it bricks again and i can't install the most recent patch. it's in a never ending loop of hoping it doesn't auto update when i leave the computer on, or reinstall the OS with a usb.

Dell inspiron 15 7559

Error during scanning for Virus

unapulitan — Fri, 21 Nov 2025 12:06:35 GMT

Good Day, I've problem during the scanning for virus

I started the complete scanning but the timer remain on 00.00 and 0 file were checked

Also i can't eneble "real time protection"

Any way that i can fix this?

Thanks

Local user management password policy inconsistent behaviour

ssentanoe — Tue, 18 Nov 2025 05:51:18 GMT

Hi all,

Maybe some of you can enlighten me regarding the windows 10 + 11 local user password policy.

The part that I want to question is "not contain parts of the user's full name".

Then, let's say I want to create a new user with the following detail:

Fullname: Max Mustermann
Username: TESTUSER1
Pass: MaxPassword12345678

When I try to create that user via cmd or powershell, either using "net" or "New-LocalUser", it will not succeed and it will show the error "the password does not meet complexity....", which is expected.

However, if I try to create the same user with the same credential via lusrmgr, it will be created without any error.

So, why there is a different behaviour between lusrmgr and CLI?

Then, if we have the existing user, and try to change the password of that user via lusrmgr, and the password contains the part of the user's full name, then the error will be thrown as expected.

So, why is it only affect the lusrmgr and only when we create a new user?

Is this a bug?

Thanks!

Microsoft account linked to a deleted e-mail address

DBR97 — Sun, 24 Aug 2025 08:50:20 GMT

I'm trying to help a friend who has a Microsoft account which is linked to an e-mail address that was deleted some years ago.

He had a recent problem on his laptop when Windows 11 crashed. He went into the troubleshooting option and eventually selected the recovery option and it rebooted ok. Interestingly, when we looked at accounts he was able to select the option to login to his administrator account and could see all details like his 365 subscription etc.

The problem is he doesn't remember his Microsoft account password and as the e-mail account linked to it is an old one that was deleted a few years ago, he is unable to receive an e-mail with the authentication code to change his password and then change the e-mail address etc. We tried the other options where it asked lots of questions like previous passwords and even the card number for his subscription and when it reached the end, there was a message saying that facility isn't currently available.

We can't find a telephone number to speak to someone at Microsoft support and also don't know any support e-mail address. When he tried to contact and use a chat facility it expects him to login, but he doesn't know his password so that option wasn't helpful. We are now in a situation where we don't know how to resolve the problem.

One final option which he isn't keen on is to create a new Microsoft account,cancel his credit card and get a new number, so that way they won't charge him for the 365 renewal and then create a new Microsoft account and set up a new subscription. That is one way to work around the problem because he can't find any way to resolve the problem and so far we have found it impossible to actually speak to someone in support.

Any advice on this will be appreciated.

Thank you

David

Mangled email address (on Microsoft's side, not ours)

os65k — Wed, 25 Jun 2025 17:54:14 GMT

Ok awhile back when our company was using both Google products and Microsoft products, I already had a Google account and was told that I could use both my Microsoft account and my Google account for work (back when both companies integrated their services seamlessly). So, in order to login to both accounts simultaneously I set my default email account to my Google Account and since then everythins worked. Up until recently. Since where I live happens to be now near a Microsoft Data Center, our company recently decided to switch entirely to Microsoft products. Well, since we are now using multi-factor (as in more than dual factor) authorization I have been having issues logging into my work account. I was told by my IT Administrator that since Microsoft mangled my original (Hotmail) email account when I made my Google (Gmail) email account my primary, is has been the source of the issues with our multi-factored proxy / VPN (my IT admins words not mine). I tried contacting and talking directly to Microsoft support and was told that I needed to create a new email account (which I will not do because I have years of work related documents associated both with my Microsoft and Google accounts) because Microsoft is unwilling to go back and fix THEIR MISTAKE. I see no security reason why I cannot switch my primary email account from Google back to Microsoft (so that I can properly unlink my Google account without losing information from either account).

WDAC: Unable to deploy Vulnerable driver blocklist

s_emangard — Wed, 28 May 2025 11:43:25 GMT

Hello,

I tried to deploy the Microsoft Vulnerable driver blocklist with an Intune WDAC policy but i always faced an error using the XML provided by Microsoft : https://aka.ms/VulnerableDriverBlockList

MS doc: https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules

Thanks and regards

Windows Security blocked by local GPO settings

John2k — Wed, 21 May 2025 16:41:43 GMT

Has anyone encountered this issue after applying the CIS Windows 11 Enterprise security settings?

I have Windows 11 24H2 LTSC Enterprise 2024. Trying to create a golden image for deployment.

Thanks in advance for your help

John

2FA in Owa 2016 that authenticates via ADFS and publishes via WAP

lcc7313 — Thu, 08 May 2025 16:39:41 GMT

Hello! The company's Security department wants to implement a ManageEngine product to enable 2FA on OWA.
Our infrastructure is an Exchange 2016 that authenticates with ADFS and publishes to a WAP server.
The ManageEngine provider only says that a PowerShell can be run on the Exchange server, but this doesn't work.
Is this product compatible with this infrastructure? Or should I use another software to implement 2FA?
I hope you can clarify this question for me.
Thank you very much and best regards.

[On demand] The latest and greatest in the world of Windows LAPS

Heather_Poulsen — Thu, 06 Mar 2025 19:21:43 GMT

Windows LAPS continues to evolve. Find out what's new - from automatic account management and passphrases to disaster recovery and bug fixes.

Watch The latest and greatest in the world of Windows LAPS – now on demand – and join the conversation at https://aka.ms/LatestInLAPS.

To help you learn more, here are the links referenced in the session:

For more free technical skilling on the latest in Windows, Windows in the cloud, and Microsoft Intune, view the full Microsoft Technical Takeoff session list.