Tag: windows 10

ShutUp10 is one of my favorite tweakers for Windows 10 and 11. The base version is free, it does not need to be installed, and it is super-easy to use but also comes with a good amount of tweaks to turn off features that you don’t need on Windows PCs.

The last version, released yesterday by O&O Software, adds some mighty options to the application’s already impressive arsenal. The new options deal largely with recent Windows changes, like AI in Notepad or File Explorer, denying apps access to generative AI, and taming annoyances, like Windows Search with Bing, Settings app account notifications, or Start menu recommendations.

Here is the full list:

• Disable Click to Do
• Disable the Settings agent
• Disable AI features in Notepad
• Disable AI actions in File Explorer
• Disable Find My Device
• Disable Microsoft account cloud content search (
• Disable work or school cloud content search
• Disable device search history
• Disable Start menu recommendations for tips, shortcuts and new apps
• Disable Start menu account notifications
• Disable Settings app account notifications
• Disable extension of Windows search with Bing
• Deny app access to generative AI
• Deny app access to generative AI
• Deny app access to presence sensing
• Deny app access to presence sensing
• Do not send device name in diagnostic data
• Windows Insider Program conflict detection: when the PC is enrolled in the Windows Insider Program, a notice explains that certain diagnostic-data settings prevent participation, and a dialog offers to disable those settings

Using the app is straightforward. Just download the latest version from the developer website and run it on a Windows machine. The app loads immediately and displays its tweaks in the interface. O&O Software uses colors to distinguish between tweaks that are enabled already and those that aren’t. Furthermore, you gain recommendations for each tweak which range from “yes” to “no”. However, no does not necessarily mean that a tweak is bad, but users should read the description to find out about potential issues that may be experienced after applying it.

“Yes”-Tweaks should be save to apply, but it is always a good idea to read the description to make sure. You can speed things up by selecting Actions to apply all “recommended tweaks”, “recommended and somewhat recommended” or “all tweaks”. I would not recommend doing so unless you are certain that the selection does not cause any issues. If you have the time, it may be better to go through the tweaks one-by-one just to make sure nothing unwanted comes out of it.

The app has a couple of other sections of interest. You can switch to other tabs, e.g. AI, to get a bit of extra control over certain features, or “Secure Boot” to check the status and whether the latest certificates are already used on the system.

If you are a home user running Windows 10 on a PC, you may know that support for the operating system is coming to an official end. While Microsoft ended support back in October 2025 officially, it introduced an Extended Security Updates (ESU) program for home users for the first time.

Once joined, Windows 10 would get another year of security updates until October 2026. Now, with the deadline looming over the heads of millions, Microsoft announced an extension of support.

In short: Windows 10 machines that joined ESU will receive security updates until October 2027 now. That is valid for Home and Pro editions only, as Enterprise customers get other, mostly paid, options to extend support by up to three years.

If the Windows 10 PC receives security updates via ESU already, then it will continue to receive updates after October 2026.

Microsoft confirmed the extension on the official Windows blog. It updated the original article about Windows 10’s future with the information:

This post has been updated to reflect that the Windows 10 Extended Security Updates (ESU) program for personal use devices is being provided for an additional year, with coverage now available through Oct. 12, 2027. This extension provides customers with more time to transition to a new Windows 11 PC while continuing to receive critical security updates.

The decision makes sense on several levels. While Microsoft claims that this is done to give Windows 10 customers more time to migrate, which it does, it is likely that other reasons have played a role.

For one, Microsoft has received some regulatory pressure to extend support for Windows 10, as millions of customers continue to use the operating system. Some, millions as well, can’t upgrade to Windows 11, which leaves them stranded on the older version of Windows.

While Microsoft hopes that these users will buy new PCs or components, the reality is that some won’t. They may continue to use Windows 10, even at the risk of running a system that has known security issues, or make the switch to Linux to continue using the PC and its components, which in many cases work just fine.

There are not many good reasons for being first when it comes to installing new updates for the Windows operating system. In fact, being second has the potential of avoiding the usual assortment of bugs that happen to be confirmed regularly after releases.

Take the June 2026 security updates as an example. Microsoft confirmed a new bug just days after releasing the update. It affects Windows 10 and Windows 11 systems that use custom folder icons or localized folder names that are defined by desktop.ini.

First spotted by Deskmodder, the issue is described on a new support page on Microsoft’s website:

After installing a Windows security update released on or after June 9, 2026, you might notice one or both of the following behaviors for some folders:

A custom folder icon defined by desktop.ini no longer appears.

A localized folder display name defined by desktop.ini no longer appears, and the folder shows its original name instead.

This behavior might occur even when the user has not changed an application or folder configuration. ​​​​​​

Microsoft notes that this behavior is expected, as it introduced a security hardening change that affects desktop.ini.

This new behavior is expected. Starting with the Windows security updates released on June 9, 2026, a security hardening change is introduced to desktop.ini handling. When Windows cannot establish that the source of a desktop.ini file is trusted, Windows ignores that file and treats it as if it is not present. However, desktop.ini files from trusted sources continue to work normally.

Microsoft did not first mention this change in the release notes, but has since then added the information.

When is desktop.ini not trusted? When it is downloaded from the Internet and carries the Mark-of-the-Web, copied from “certain” remote locations, or when “files on network paths are not classified as intranet or trusted by zone policy”.

Microsoft has a few workarounds for affected users.

Option 1: Add the source to Trusted Sites (Recommended)

If the affected content is stored on a known internal or managed source, add that source to the Trusted Sites list. Once the source is treated as trusted, Windows processes desktop.ini from that source normally. This keeps the protection in place for other locations and is the lower-risk option.

Option 2: Use policy to restore previous behavior

Organizations that need broader compatibility can enable the policy Allow the use of remote paths in file shortcut icons.Enabling this policy restores the pre-June 2026 behavior for affected remote or untrusted scenarios.

IMPORTANT Using a broad opt-out reduces protection against malicious remote folder-customization content. If you use a workaround, Microsoft recommends trusting only controlled internal sources and keeping trust settings as narrow as possible. ​​​​​​​

Option 3: Check for and remove the Mark of the Web (MotW)

If the desktop.ini file has a Mark of the Web (MotW), Windows may treat it as coming from an untrusted source and block customization. Verify whether MotW is present and, if appropriate, remove it from the desktop.ini file. This can restore expected behavior, but should only be done for trusted content, as it removes the associated security protection.

To remove the MotW tag, open PowerShell and run one of the following commands:

For a single desktop.ini file:

Unblock-File “C:\Your\Folder\Path\desktop.ini”

For all desktop.ini files in a folder:

Get-ChildItem “C:\Your\Folder\Path” -Recurse -Filter desktop.ini -Force | Unblock-File

If you’ve noticed a mysterious new SecureBoot folder sitting in your C:/Windows directory following the May 2026 Patch Tuesday, you are not alone.

The folder, which has a subfolder named ExampleRolloutScripts that contains several PowerShell scripts, is a harmless administrative helper introduced in the latest security updates for Windows 10 and Windows 11.

According to official Microsoft guidance, these scripts are designed primarily for enterprise IT administrators to monitor the status of the upcoming UEFI CA 2023 Secure Boot certificate updates and to safely automate their deployment across Active Directory environments.

While essential for corporate networks preparing for this critical security transition, average users can safely ignore this tiny 450 KB folder for now.

The transition to the new UEFI CA 2023 Secure Boot certificates mark a critical security change for the Windows ecosystem. It is made necessary by the impending expiration of current certificates that were issued a long time ago.

Secure Boot acts as the fundamental gatekeeper against bootkits and rootkits by ensuring that only trusted, digitally signed firmware and operating system loaders can execute during startup.

Microsoft is employing a highly controlled, phased rollout strategy—which is exactly why administrative validation tools and scripts are currently being deployed.

Why Microsoft is rolling out the folder to anyone is anyone’s guess. It seems that the folder is pushed to all devices running Windows 11, even unmanaged Windows 11 Home systems.

If April 2026 was an avalanche of patches, May brings a welcome breather from zero-days but keeps the critical severity count high.

Microsoft’s fifth Patch Tuesday of 2026 has arrived, addressing 120 vulnerabilities in total. While it breaks a long-standing streak by featuring zero publicly disclosed or actively exploited zero-day flaws, the sheer volume of severe remote code execution (RCE) bugs demands attention.

The update contains 17 critical flaws affecting a wide range of enterprise products, including Windows Netlogon, DNS Client, Azure DevOps, and Microsoft Word.

Here is the breakdown of what you need to know, what to patch first, and what might break.

You can download an Excel spreadsheet with information about the patches that Microsoft released:

The May 2026 Patch Day overview

Executive Summary

• Release Date: May 12, 2026
• Total Vulnerabilities: 120
• Critical Vulnerabilities: 17
• Zero-Days: 0

Key Action Item: Administrators must prioritize patching network-exposed infrastructure, specifically domain controllers affected by the Netlogon vulnerability (CVE-2026-41089) and systems running the Windows DNS Client. Simultaneously, Microsoft Office installations need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities that can be triggered simply via the Windows Preview Pane.

Important Patches

• CVE-2026-41089 — Windows Netlogon Remote Code Execution Vulnerability
• CVE-2026-41096 — Windows DNS Client Remote Code Execution Vulnerability
• CVE-2026-42826 — Azure DevOps Information Disclosure Vulnerability
• CVE-2026-40364 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-40402 — Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2026-32185 — Microsoft Teams Spoofing Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5087544 (Windows 10) KB5089549 (Windows 11)	Security updates addressing OS-level RCEs in Netlogon, DNS Client, and Windows Graphics components (Win32k). Also resolves various Elevation of Privilege flaws across the Windows Kernel.

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched zero 0-day vulnerabilities this Patch Day, but addressed a heavy enterprise focus of critical remote code execution and information disclosure flaws.

Here is the critical overview:

CVE-2026-41089 (Windows Netlogon Remote Code Execution Vulnerability)

A critical stack-based buffer overflow flaw (CVSS 9.8) affecting Windows Netlogon. A remote, unauthenticated attacker could exploit this by sending a crafted network request to a Windows server running as a domain controller. If successful, this causes the Netlogon service to improperly handle the request, allowing the attacker to execute malicious code without requiring any prior access or credentials.

CVE-2026-41096 (Windows DNS Client Remote Code Execution Vulnerability)

This critical heap-based buffer overflow vulnerability (CVSS 9.8) affects the Windows DNS service. It allows remote code execution over the network and can be exploited by sending a malicious DNS response, triggering memory corruption within the Windows DNS client. Depending on the configuration, an unauthenticated attacker can achieve full RCE.

CVE-2026-42826 (Azure DevOps Information Disclosure Vulnerability)

This is the highest-rated flaw this month, boasting a perfect CVSS score of 10.0. While Microsoft withheld specific exploitation details, a perfect severity score indicates that unauthenticated attackers could potentially access highly sensitive enterprise data, credentials, and source code stored or handled in Azure DevOps.

CVE-2026-40361, CVE-2026-40364, CVE-2026-40366, CVE-2026-40367 (Microsoft Word RCE Vulnerabilities)

A cluster of critical vulnerabilities in Microsoft Word (CVSS 8.4) that allow an unauthorized attacker to execute code locally. Notably, these flaws can be triggered through the Windows Preview Pane, meaning a user only needs to preview a specially crafted document to be compromised, without ever fully opening the file.

CVE-2026-40402 (Windows Hyper-V Elevation of Privilege Vulnerability)

A severe flaw (CVSS 9.3) allowing for a guest-to-host escape in Windows Hyper-V. By targeting certain hardware device registers, an attacker operating from within a guest virtual machine can escape the isolated environment and gain SYSTEM privileges on the underlying host system.

First Steps: Your Patch Tuesday Strategy

• Prioritize Domain Controllers (Netlogon) and DNS Client services
• Address high-risk Azure deployments (DevOps, Cloud Shell)
• Update Office installations immediately to mitigate Preview Pane risks

Another one? That could be the reaction of veteran Windows users who read the headline. Microsoft confirmed another BitLocker related issue in Windows 11. This one may be caused by installing the most recent cumulative update for the operating system.

In the Known issues section of the update, Microsoft confirms that devices might boot into the BitLocker Recovery screen and not the desktop.

According to the description, the issue is caused by an “unrecommended BitLocker Group Policy configuration”. Only a “limited number of systems” are affected according to Microsoft. The company says that the issue affects only systems for which all of the following conditions are true:

• BitLocker is enabled on the OS drive.
• The Group Policy “Configure TPM platform validation profile for native UEFI firmware configurations” is configured, and PCR7 is included in the validation profile (or the equivalent registry key is set manually).
• System Information (msinfo32.exe) reports Secure Boot State PCR7 Binding as “Not Possible”.
• The Windows UEFI CA 2023 certificate is present in the device’s Secure Boot Signature Database (DB), making the device eligible for the 2023‑signed Windows Boot Manager to be made the default.
• The device is not already running the 2023-signed Windows Boot Manager.

Devices that meet the conditions may boot into recovery mode after installing the KB508376 for Windows 11, versions 24H2 or 25H2.

A workaround is available to remove the Group Policy configuration before installing the update.

1. Open Group Policy Editor (gpedit.msc) or your Group Policy Management Console.
2. Navigate to: Computer Configuration > Administrative Templates > Windows Components > BitLocker Drive Encryption > Operating System Drives.
3. Set “Configure TPM platform validation profile for native UEFI firmware configurations” to “Not Configured“.
4. Run the following command on affected devices to propagate the policy change: gpupdate /force
5. Run the following command to suspend BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -disable C: 
6. Run the following command to resume BitLocker (where BitLocker is enabled on the C: drive): manage-bde -protectors -enable C: 
7. ​​​​​​​This updates the BitLocker bindings to use the Windows-selected default PCR profile.

Microsoft plans to release a permanent fix in the future to address this. Windows users who use a Microsoft Account can look up the recovery key for BitLocker online.

If March 2026 was a marathon of infrastructure updates, April is a massive avalanche of patches.

Microsoft’s fourth Patch Tuesday of 2026 has arrived, addressing a massive 165 vulnerabilities in total. The sheer volume demands attention. It contains two 0-day vulnerabilities — one of which is actively exploited in the wild — and eight critical flaws affecting a wide range of products, including Office, SharePoint, Microsoft Defender, and Azure.

Here is the breakdown of what you need to know, what to patch first, and what might break.

The April 2026 Patch Day overview

Executive Summary

• Release Date: April 14, 2026
• Total Vulnerabilities: 165
• Critical Vulnerabilities: 8
• Zero-Days: 2 (SharePoint [Actively Exploited], Microsoft Defender [Publicly Disclosed])

Key Action Item: Administrators must prioritize patching internet-facing SharePoint servers due to the actively exploited spoofing zero-day. Simultaneously, network infrastructure and Active Directory components need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities.

Important Patches

• CVE-2026-32201 — Microsoft Office SharePoint Spoofing Vulnerability
• CVE-2026-33825 — Microsoft Defender Elevation of Privilege Vulnerability
• CVE-2026-33824 — Windows Internet Key Exchange (IKE) Extension Remote Code Execution Vulnerability
• CVE-2026-33827 — Windows TCP/IP Remote Code Execution Vulnerability
• CVE-2026-33826 — Windows Active Directory Remote Code Execution Vulnerability
• CVE-2026-23666 — .NET Denial of Service Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5082200 (Windows 10) KB5083768 (Windows 11, 26H1) KB5083769 (Windows 11, version 25H2 and 24H2)	Security updates addressing OS-level RCEs in TCP/IP, IKE, and Active Directory components. Also resolves numerous Elevation of Privilege (EoP) flaws across Windows Kernel, Boot Loader, and BitLocker.
Microsoft SharePoint Server		Patches for SharePoint 2016, 2019, and Subscription Edition to address the actively exploited CVE-2026-32201 spoofing flaw.
Microsoft Office		Security updates addressing multiple Critical Use-After-Free and Untrusted Pointer Dereference vulnerabilities resulting in local code execution

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched two 0-day vulnerabilities this Patch Day and several critical remote code execution flaws.

Here is the critical overview:

CVE-2026-32201 (Microsoft Office SharePoint Spoofing Vulnerability)

This actively exploited zero-day allows an unauthorized attacker to perform spoofing over a network due to improper input validation in Microsoft Office SharePoint. An attacker who successfully exploits this can view sensitive information and make changes to disclosed information.

CVE-2026-33825 (Microsoft Defender Elevation of Privilege Vulnerability)

A publicly disclosed zero-day flaw in Microsoft Defender that allows privilege escalation to SYSTEM privileges. Microsoft has addressed the flaw in the Microsoft Defender Antimalware Platform update version 4.18.26050.3011, which should be downloaded to (most) systems automatically.

CVE-2026-33824 (Windows Internet Key Exchange (IKE) Extension RCE)

A critical double-free vulnerability in the Windows IKE extension. An unauthenticated attacker can send specially crafted packets to a Windows machine with IKE version 2 enabled to potentially achieve remote code execution. If IKE is not in use, blocking inbound traffic on UDP ports 500 and 4500 acts as a mitigation.

CVE-2026-33827 (Windows TCP/IP Remote Code Execution)

A critical race condition vulnerability in Windows TCP/IP that can result in remote code execution. An unauthenticated actor can send specially crafted IPv6 packets to a Windows node where IPSec is enabled to potentially achieve RCE.

CVE-2026-33826 (Windows Active Directory Remote Code Execution)

A critical improper input validation flaw in Windows Active Directory. It allows an authenticated attacker to execute code over an adjacent network.

First Steps: Your Patch Tuesday Strategy

• Prioritize the SharePoint zero-day
• Address network and directory risks
• Update Office installations

If you’ve ever felt completely lost in the web of Windows testing tiers or frustrated by slow A/B feature rollouts, relief may finally have arrived.

Microsoft announced a big overhaul of the Windows Insider Program this week designed to simplify how users test development builds of the operating system.

The company is cutting down the channel list to just two primary ones — Beta and Experimental — and is finally changing how experimental features land on test systems.

Here is a breakdown of the major changes:

• Two Streamlined Channels: The previously confusing multi-tier system is being condensed into just two primary tracks: Experimental (which replaces the Dev and Canary channels) and Beta (for features that are closer to being ready for the public).
• The End of A/B Testing: Microsoft is officially dropping its Controlled Feature Rollout (CFR) system for Beta channel participants. This means no more waiting in the dark while other testers randomly receive new features before you do.
• Manual Feature Flags: You are finally getting direct control over your testing experience. Moving forward, Insiders can manually toggle new features on or off directly within Windows Settings as soon as they are documented in the changelogs.
• No More “Clean Install” Trap: Historically, leaving the Insider program or dropping down to a more stable channel often required a complete, data-wiping OS reinstall. Microsoft is fixing this by allowing in-place upgrades (IPU), meaning you can transition channels or exit the program while keeping your files and apps intact.
• Clearer Communication: Release notes and documentation will be much more explicit about who features are for and which channel they belong to, giving IT admins, developers, and enthusiasts a much more transparent roadmap of what to expect.

From a testing perspective, Microsoft is launching several improvements. First, Beta users get access to features directly. No more waiting or using of third-party tools like ViVeTool to enable them.

Second, users in the experimental channel get options to turn certain features on, if they are not already enabled.

Third, switching between channels should get easier and less cumbersome.

Last but not least, more documentation is always welcome, as Microsoft’s attempts have been lackluster at best until now.

While the announcement may instill hope in Windows testers who have been disappointed by Microsoft so far, it is clear that Microsoft has to deliver. If the company does, it could improve its Windows Insider program significantly in the process.

VeraCrypt is a popular cross-platform encryption software that is available for Windows, Linux and macOS. It is one of the successors of TrueCrypt and can be used to encrypt hard drives, including system drives, and to create data containers on drive that are encrypted.

The developer of the application, Mounir Idrassi, published a project update on Sourceforge a few days ago. There, he explained why the project had been silent for the past few months.

According to his description, Microsoft terminated the account that he used to sign Windows drivers and the bootloader. This affects the Windows version of the encryption software, as updates can’t be signed anymore because of this. The Linux and macOS versions of the software are not affected by this.

To make matters worse, a screenshot with a message by Microsoft suggests that an appeal is not available. It is unclear what that means for the project. While a solution may be found eventually, likely through enough outside pressure to get a Microsoft representative to look at the case, it is certainly problematic when a company that operates its own encryption software — Microsoft with BitLocker — is blocking a competitor from releasing updates for his.