Tag: windows 11

Imagine if a bad driver update or a bad update completely trashed your PC setup, but you could instantly roll the entire machine back to exactly how it was yesterday—local user files and all—in just a few minutes.

That scenario required use of third-party backup solutions until now. On June 23, 2026, Microsoft announced the general availability of its new, built-in Point-in-Time Restore feature for Windows 11 PCs (versions 24H2 and later).

According to the official release on the Microsoft Windows IT Pro Blog, this native recovery tool automatically captures full-system snapshots every 24 hours, giving Home, Pro, and Enterprise users a safety net to bypass hours of painful troubleshooting when something breaks the PC.

How Point-in-Time Restore works

Point-in-Time Restore acts as a comprehensive safety net for your operating system. Operating quietly in the background, the feature automatically captures full-system snapshots on a recurring schedule—defaulting to every 24 hours—and saves them directly to local storage.

Using it, you can roll back the PC to a previous state in minutes, according to Microsoft. That is excellent when a driver, Windows update or corrupted application affects the machine.

While it sounds similar to the classic “System Restore” tool windows users have known for decades, Microsoft built this version from scratch for modern PC management. The key upgrades include:

• Inclusion of User Files: Legacy System Restore intentionally ignored personal data. Point-in-Time Restore captures the exact state of your machine, including the Windows OS, system configurations, settings, installed applications, and your local user files.
• Smart Storage Management: To avoid eating up your hard drive, it integrates directly with Windows’ “reserved storage” (space set aside for updates). It enforces strict cleanup policies and caps its default disk footprint at just 2% of your drive.
• Native Integration: The interface is cleanly built into the modern Settings app (System > Recovery), making it accessible without digging into the legacy Control Panel.

Here is a table that Microsoft provided to compare it to System Restore:

	Point-in-time restore	System Restore
Restore points	Automatic, configurable cadence; user files are included in restore point	Event-triggered or manual only; user files are excluded from restore point
Reliability	Strict retention and cleanup policies	No retention limits
User experience	Integrated in system settings	Limited to control panel
Storage impact	Minimizes storage impact by integrating with reserved storage*	Higher impact to storage space
Management	Will support robust remote management capabilities	Limited remote management capabilities

Default Availability and Rules

The feature is turned on by default on unmanaged Windows 11 Home and Pro devices, provided that the primary drive partition is 200 GB or larger.

If disaster strikes and your PC won’t boot into the main desktop, the recovery process is designed to work securely inside the Windows Recovery Environment (Windows RE).

The feature has its shortcomings though, especially when compared to third-party backup solutions. For one, restore points are kept for up to 72 hours only. That is a big problem in some cases, as issues may occur after the period. There is seemingly no option to store a restore point indefinitely, While Enterprise admins may change the retention period, 72 hours appears to be the longest.

Means: while Point-in-time restore is easier to use and in some cases better than System Restore, it won’t replace traditional backup options due to its 72 hour retention period.

There are not many good reasons for being first when it comes to installing new updates for the Windows operating system. In fact, being second has the potential of avoiding the usual assortment of bugs that happen to be confirmed regularly after releases.

Take the June 2026 security updates as an example. Microsoft confirmed a new bug just days after releasing the update. It affects Windows 10 and Windows 11 systems that use custom folder icons or localized folder names that are defined by desktop.ini.

First spotted by Deskmodder, the issue is described on a new support page on Microsoft’s website:

After installing a Windows security update released on or after June 9, 2026, you might notice one or both of the following behaviors for some folders:

A custom folder icon defined by desktop.ini no longer appears.

A localized folder display name defined by desktop.ini no longer appears, and the folder shows its original name instead.

This behavior might occur even when the user has not changed an application or folder configuration. ​​​​​​

Microsoft notes that this behavior is expected, as it introduced a security hardening change that affects desktop.ini.

This new behavior is expected. Starting with the Windows security updates released on June 9, 2026, a security hardening change is introduced to desktop.ini handling. When Windows cannot establish that the source of a desktop.ini file is trusted, Windows ignores that file and treats it as if it is not present. However, desktop.ini files from trusted sources continue to work normally.

Microsoft did not first mention this change in the release notes, but has since then added the information.

When is desktop.ini not trusted? When it is downloaded from the Internet and carries the Mark-of-the-Web, copied from “certain” remote locations, or when “files on network paths are not classified as intranet or trusted by zone policy”.

Microsoft has a few workarounds for affected users.

Option 1: Add the source to Trusted Sites (Recommended)

If the affected content is stored on a known internal or managed source, add that source to the Trusted Sites list. Once the source is treated as trusted, Windows processes desktop.ini from that source normally. This keeps the protection in place for other locations and is the lower-risk option.

Option 2: Use policy to restore previous behavior

Organizations that need broader compatibility can enable the policy Allow the use of remote paths in file shortcut icons.Enabling this policy restores the pre-June 2026 behavior for affected remote or untrusted scenarios.

IMPORTANT Using a broad opt-out reduces protection against malicious remote folder-customization content. If you use a workaround, Microsoft recommends trusting only controlled internal sources and keeping trust settings as narrow as possible. ​​​​​​​

Option 3: Check for and remove the Mark of the Web (MotW)

If the desktop.ini file has a Mark of the Web (MotW), Windows may treat it as coming from an untrusted source and block customization. Verify whether MotW is present and, if appropriate, remove it from the desktop.ini file. This can restore expected behavior, but should only be done for trusted content, as it removes the associated security protection.

To remove the MotW tag, open PowerShell and run one of the following commands:

For a single desktop.ini file:

Unblock-File “C:\Your\Folder\Path\desktop.ini”

For all desktop.ini files in a folder:

Get-ChildItem “C:\Your\Folder\Path” -Recurse -Filter desktop.ini -Force | Unblock-File

If you’ve noticed a mysterious new SecureBoot folder sitting in your C:/Windows directory following the May 2026 Patch Tuesday, you are not alone.

The folder, which has a subfolder named ExampleRolloutScripts that contains several PowerShell scripts, is a harmless administrative helper introduced in the latest security updates for Windows 10 and Windows 11.

According to official Microsoft guidance, these scripts are designed primarily for enterprise IT administrators to monitor the status of the upcoming UEFI CA 2023 Secure Boot certificate updates and to safely automate their deployment across Active Directory environments.

While essential for corporate networks preparing for this critical security transition, average users can safely ignore this tiny 450 KB folder for now.

The transition to the new UEFI CA 2023 Secure Boot certificates mark a critical security change for the Windows ecosystem. It is made necessary by the impending expiration of current certificates that were issued a long time ago.

Secure Boot acts as the fundamental gatekeeper against bootkits and rootkits by ensuring that only trusted, digitally signed firmware and operating system loaders can execute during startup.

Microsoft is employing a highly controlled, phased rollout strategy—which is exactly why administrative validation tools and scripts are currently being deployed.

Why Microsoft is rolling out the folder to anyone is anyone’s guess. It seems that the folder is pushed to all devices running Windows 11, even unmanaged Windows 11 Home systems.

It only took half a decade for Microsoft to remember how to build a functional user interface. On May 15, 2026, the tech giant took to the Windows Insider Blog to announce Preview Build 26300, a supposedly major update designed to give users “more flexibility” over their Taskbar and Start menu.

However, beneath the marketing spin, these groundbreaking additions—like the ability to finally shrink the taskbar, move it to the side or top of the screen, and independently toggle off intrusive file recommendations—are nothing more than basic features Microsoft stripped out of Windows years ago.

Rather than pushing the operating system forward, this long-overdue update rolling out to the Experimental channel feels less like innovation and more like a reluctant apology to power users who have been fighting a restrictive, dumbed-down user interface since 2021.

This is what build 26300 brings back from the dead

Let’s look exactly at what Preview Build 26300 actually brings to the table. The headline “feature” of this update is the reinstatement of taskbar mobility. After years of being glued to the bottom of the screen, users can once again click and drag the taskbar to the left, right, or top edges of their monitors—a decades-old Windows function that was axed during the initial jump to Windows 11.

Accompanying this is the return of taskbar resizing, allowing users to finally shrink the increasingly bloated bar to save precious vertical screen real estate, or expand it for better touch visibility.

Meanwhile, the Start menu receives what is arguably the most highly requested fix: a dedicated, single-click toggle to permanently disable the “Recommended” section. Instead of being forced to look at a useless blank void or unwanted cloud documents, users can now reclaim that entire bottom half of the menu for their own pinned applications.

Pavan Davuluri, Microsoft’s head of Windows and Surface, championed these tweaks on X as a testament to the company “deeply listening to Insiders” and “empowering personalized workflows.”

Personalization and customization is in Windows' DNA. It always has been. Reading through your feedback and meeting with Windows Insiders over the past few months reminded us just how deeply people care about this. You wanted more control, more customization with taskbar and… https://t.co/YpexnoDyGD

— Pavan Davuluri (@pavandavuluri) May 16, 2026

But celebrating the restoration of basic functionality as a triumph of active listening is a massive stretch. While it is undoubtedly a relief to have these customization options back where they belong, packaging them as a bold new step forward highlights a recurring, frustrating cycle in Microsoft’s development ethos: breaking something that works perfectly fine, ignoring the immediate community outcry, and then expecting applause when they finally patch it back together five years later.

If April 2026 was an avalanche of patches, May brings a welcome breather from zero-days but keeps the critical severity count high.

Microsoft’s fifth Patch Tuesday of 2026 has arrived, addressing 120 vulnerabilities in total. While it breaks a long-standing streak by featuring zero publicly disclosed or actively exploited zero-day flaws, the sheer volume of severe remote code execution (RCE) bugs demands attention.

The update contains 17 critical flaws affecting a wide range of enterprise products, including Windows Netlogon, DNS Client, Azure DevOps, and Microsoft Word.

Here is the breakdown of what you need to know, what to patch first, and what might break.

You can download an Excel spreadsheet with information about the patches that Microsoft released:

The May 2026 Patch Day overview

Executive Summary

• Release Date: May 12, 2026
• Total Vulnerabilities: 120
• Critical Vulnerabilities: 17
• Zero-Days: 0

Key Action Item: Administrators must prioritize patching network-exposed infrastructure, specifically domain controllers affected by the Netlogon vulnerability (CVE-2026-41089) and systems running the Windows DNS Client. Simultaneously, Microsoft Office installations need immediate updates to mitigate several highly critical Remote Code Execution vulnerabilities that can be triggered simply via the Windows Preview Pane.

Important Patches

• CVE-2026-41089 — Windows Netlogon Remote Code Execution Vulnerability
• CVE-2026-41096 — Windows DNS Client Remote Code Execution Vulnerability
• CVE-2026-42826 — Azure DevOps Information Disclosure Vulnerability
• CVE-2026-40364 — Microsoft Office Word Remote Code Execution Vulnerability
• CVE-2026-40402 — Windows Hyper-V Elevation of Privilege Vulnerability
• CVE-2026-32185 — Microsoft Teams Spoofing Vulnerability

Cumulative Updates

Product, Version	Links	Notes
Windows 11 & Windows 10	KB5087544 (Windows 10) KB5089549 (Windows 11)	Security updates addressing OS-level RCEs in Netlogon, DNS Client, and Windows Graphics components (Win32k). Also resolves various Elevation of Privilege flaws across the Windows Kernel.

Deep Dive: The Critical Vulnerabilities

Microsoft confirmed that it patched zero 0-day vulnerabilities this Patch Day, but addressed a heavy enterprise focus of critical remote code execution and information disclosure flaws.

Here is the critical overview:

CVE-2026-41089 (Windows Netlogon Remote Code Execution Vulnerability)

A critical stack-based buffer overflow flaw (CVSS 9.8) affecting Windows Netlogon. A remote, unauthenticated attacker could exploit this by sending a crafted network request to a Windows server running as a domain controller. If successful, this causes the Netlogon service to improperly handle the request, allowing the attacker to execute malicious code without requiring any prior access or credentials.

CVE-2026-41096 (Windows DNS Client Remote Code Execution Vulnerability)

This critical heap-based buffer overflow vulnerability (CVSS 9.8) affects the Windows DNS service. It allows remote code execution over the network and can be exploited by sending a malicious DNS response, triggering memory corruption within the Windows DNS client. Depending on the configuration, an unauthenticated attacker can achieve full RCE.

CVE-2026-42826 (Azure DevOps Information Disclosure Vulnerability)

This is the highest-rated flaw this month, boasting a perfect CVSS score of 10.0. While Microsoft withheld specific exploitation details, a perfect severity score indicates that unauthenticated attackers could potentially access highly sensitive enterprise data, credentials, and source code stored or handled in Azure DevOps.

CVE-2026-40361, CVE-2026-40364, CVE-2026-40366, CVE-2026-40367 (Microsoft Word RCE Vulnerabilities)

A cluster of critical vulnerabilities in Microsoft Word (CVSS 8.4) that allow an unauthorized attacker to execute code locally. Notably, these flaws can be triggered through the Windows Preview Pane, meaning a user only needs to preview a specially crafted document to be compromised, without ever fully opening the file.

CVE-2026-40402 (Windows Hyper-V Elevation of Privilege Vulnerability)

A severe flaw (CVSS 9.3) allowing for a guest-to-host escape in Windows Hyper-V. By targeting certain hardware device registers, an attacker operating from within a guest virtual machine can escape the isolated environment and gain SYSTEM privileges on the underlying host system.

First Steps: Your Patch Tuesday Strategy

• Prioritize Domain Controllers (Netlogon) and DNS Client services
• Address high-risk Azure deployments (DevOps, Cloud Shell)
• Update Office installations immediately to mitigate Preview Pane risks

The time to go brew a coffee whenever you start a taxing program on Windows could soon be a thing of the past. Reports by Windows Central and other sources suggest that Microsoft is testing a new Low Latency Profile feature that could speed up the start of apps by up to 70 percent.

The idea behind the feature is straightforward: Boost the processors frequency for certain taxing tasks on the system to speed them up. Examples are the opening of apps, system flyouts, or the display of menus on the system.

According to Windows Central, app starts could be boosted by up to 40 percent while the launch times of interfaces could be boosted up to 70 percent.

Depending on the PC that you are using, these things may happen near instantly already all the time. Deskmodder tested the feature in an Insider build recently and concluded that it does not really help, if the PC in question is modern.

However, when a PC is older, it could indeed speed up certain options noticeably.

The new feature is part of Microsoft’s effort to improve the performance and stability of the operating system. It is but one of the changes that Microsoft is testing currently. Others include optimizing apps or code, or switching to modern interfaces.

The new Low Latency Profile feature runs in the background automatically. Whether there will be an option in Settings or elsewhere to disable the feature remains to be seen. It is likely that there will be at least a Group Policy and Regedit option to manage that.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826 https://t.co/VW4xXmGdEa

— phantomofearth 🌳 (@phantomofearth) May 7, 2026

Phantom of Earth posted the relevant IDs for the feature on X.

If you want to try out Low Latency Profile in recent Insider builds and see if it makes any difference, enable these feature IDs:

LowLatencyProfile: 60716524
LowLatencyProfileForApplicationLaunch: 61391826

Run .\vivetool /enable /id:60716524,61391826 in Terminal (elevated) to enable these.

Imagine trying to secure your PC’s most important files, only to discover that your trusted backup software has been actively locked out by the operating system itself. That is exactly what is happening to Windows 11 users this week, as Microsoft has officially confirmed in a recently updated support document that its latest patches (KB5083769 and KB5083631) are intentionally blocking popular third-party backup applications like Macrium Reflect.

The Redmond giant explained that this disruptive change is the result of a strict new security hardening measure, which actively adds the psmounterex.sys kernel driver to the Microsoft Vulnerable Driver Blocklist to protect systems from known exploits—leaving affected users dealing with timeout errors and broken disk image mounting.

Microsoft confirms the change and that third-party backup software may be affected on a new support page. However, the company has not added any information about potential issues to the official KB release notes, making it difficult for affected users and also system administrators to investigate the issue.

According to the company, users and IT administrators may observe the following behavior after installing April 2026 or later updates for Windows 11:

What new behavior should I expect?
Users and IT administrators might observe the following behavior after installing the update:

Backup applications that rely on the kernel driver psmounterex.sys might fail to mount backup image files as virtual drives.

Attempting to browse or restore from a backup image might result in errors or timeouts.

Failures might be followed by error messages, such as “The backup has failed because Microsoft VSS has timed out during the snapshot creation” or VSS_E_BAD_STATE.

Event Viewer might show Code Integrity errors indicating that psmounterex.sys was blocked from loading.

Backup creation (full image backups) may still succeed, but image-mount operations will fail.

Microsoft claims that the change is “designed to protect devices against known vulnerabilities in the psmounterex.sys kernel driver. That is exactly the driver that some backup apps, including Macrium Reflect, use for managing and mounting disk images.

The vulnerability that Microsoft mentions was discovered in certain versions of the driver in late 2023 already. If exploited, bad actors can use this flaw to escalate their privileges and execute arbitrary malicious code at the kernel level, completely compromising the system.

The result for users who run backup apps that rely on the driver: When a user tries to mount a backup image, the backup app attempts to load the psmounterex.sys driver. Windows Code Integrity enforcement steps in and actively blocks the driver from loading because it’s on the blacklist. Without the driver, the backup app cannot complete its task, leading to Volume Shadow Copy Service (VSS) timeouts and mounting errors.

In short, Microsoft is deliberately breaking the functionality of these apps to stop a known security loophole from being exploited at the kernel level.