ConfigMgrDogs

Windows news you can use: July 2025 This month, there are several improvements based on feedback we have heard from you, our customers. You’ve told us you want Windows to start and stay up to date with minimal interruptions. I’m happy to share that new Windows media includes updated Microsoft Store apps, and that hotpatch updates are generally available for both Windows x64 and Arm64 devices. We’re also continuing to add more resources to your update management toolbox. Speaking of staying up to date, we continue to hear confusion about the lift involved with moving to Windows 11 and cloud-native management with Microsoft Intune. If you’re looking for quick, accurate information on recommended scenarios and the steps it takes to get there, check out our new guide on the Windows IT Pro Blog. And speaking of quick, accurate information, the Ask Microsoft Anything (AMA) sessions from this week’s Windows edition of Tech Community Live are now available to watch on demand. Quickly catch up on answers to frequently (or not so frequently) asked questions about Windows Autopilot, update and driver management, Microsoft Connected Cache and Delivery Optimization, and AI experiences. Now let’s move on to the latest news you can use! New in Windows update and device management * [AUTOPATCH] If you’re looking for a proven, step-by-step approach to gradually roll out Windows 11 to eligible Windows 10 devices, explore Windows Autopatch groups. Windows Autopatch groups can make the process faster and easier with phased deployments, readiness insights, and reporting so you can upgrade with confidence. * [HOTPATCH] Hotpatching is now generally available for Windows 11, version 24H2 Arm64 devices. Learn how to get your Arm64 devices hotpatch ready and start benefiting from faster security compliance and increased productivity. * [OPTIMIZATION] Microsoft Connected Cache is now generally available for enterprise and education organizations. Save significant bandwidth during Windows 11 upgrades, device provisioning, application installation, and monthly updates. * [RESILIENCY] Built to help you respond to the unexpected with speed, precision, and security, quick machine recovery is now generally available. When enabled, it automatically detects and fixes widespread issues on Windows 11 devices using the Windows Recovery Environment (WinRE). Learn how to customize the experience with the Intune Settings Catalog UI, and explore the new design that will now appear for end users during unexpected restarts, all a part of Resilience in action for Windows devices. * [BUILT-IN APPS] If you use media refreshed in or after June 2025 to install Windows 11, version 24H2 or Windows Server 2025, that media now includes up-to-date versions of Windows built-in apps. * [RESOURCES] Looking for information to help you more easily manage Windows Updates? Explore a guide to the essential documentation, communications, and resources that you need in your organizations’ update management toolbox. New in Windows security * [HPA] Enhance Microsoft 365 security by eliminating high-privilege access (HPA). Eliminating HPA helps ensure users and applications have only the necessary access rights. Learn more about how you can enhance your organization’s security posture. * [COPILOT] Security Copilot in Microsoft Intune and Microsoft Entra are now generally available. Discover how Microsoft Entra and Intune play a critical role in modern security strategies and serve as the foundation for implementing a Zero Trust model. * [INTUNE] You can use the Microsoft Intune Connector for Active Directory to join computers to an on-premises domain during Windows Autopilot provisioning. After users first sign in to the device, it will be Microsoft Entra hybrid joined. New in Windows Server For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes. * [HOTPATCH] Hotpatching for Windows Server 2025 is now generally available for on-premises and hybrid environments through Azure Arc. Learn more about hotpatching for on-prem servers, prerequisites to enroll in hotpatching for Azure Arc-connected Windows Server 2025 machines, and subscription details. New in productivity and collaboration Here are highlights from the July 2025 security update for Windows 11, version 24H2 and version 23H2: * [TASKBAR] [24H2] The taskbar now resizes icons to fit more apps when space runs low, keeping everything visible and easy to access. * [SETTINGS] [24H2] The Settings homepage for managed devices now includes cards tailored for enterprise use. * [SHARE] [24H2] [23H2] When users share links or web content using the Windows share window, they’ll see a visual preview for that content. * [ACCESSIBILITY] [24H2] In addition to a redesign, the Accessibility menu in Quick settings features text descriptions for assistive technologies like Narrator and Voice access. For additional details, please refer to the June 2025 non-security preview update release notes for Windows 11, version 24H2 and version 23H2. If you want to preview what’s coming in the August 2025 security update release, install the July 2025 optional non-security update for Windows 11, version 24H2, which starts the gradual rollout of: * [START] [24H2] Apply Start menu pins only once with the Configure Start Pins policy. On first sign-in, users receive the Start menu pins you set as the IT admin. They can then personalize their pinned layouts. Lifecycle milestones Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025. * [WINDOWS 11 22H2] Windows 11, version 22H2 (Enterprise and Education editions) no longer receives non-security preview updates. Monthly security updates will continue through October 14, 2025, when version 22H2 officially reaches end of servicing. * [WINDOWS 11 23H2] Windows 11, version 23H2 (Home and Pro editions) will reach end of servicing on November 11, 2025. Enterprise and Education editions will continue to be serviced through November 10, 2026 per the Modern Lifecycle Policy. * [JSCRIPT9LEGACY] Beginning with Windows 11, version 24H2, JScript9Legacy—based on JScript9—is enabled by default to handle scripting processes and operations. It provides improved security and performance features, and it’s more compatible with modern web standards. Learn more from these FAQs. * [EOS] Windows 10 end of support (EOS) is now three months away. Find resources to help you get ready, check if current devices are eligible for the upgrade, and learn more about the Extended Security Update (ESU) program. For extra insights, watch the Technical Takeoff session on myths and misconceptions around Windows 10 EOS. * [WIN10 EOS] [IOT] One size does not fit all when it comes to Windows 10 EOS for Windows 10 IoT Enterprise. Find out which versions of Windows 10 IoT Enterprise are impacted on October 14, 2025. Additional resources Looking for the latest news and previews for Windows, Copilot, Copilot+ PCs, the Windows and Windows Server Insider Programs, and more? Check out these resources: * Windows Roadmap for new Copilot+ PCs and Windows features – filter by platform, version, status, and channel or search by feature name * Microsoft 365 Copilot release notes for latest features and improvements * Windows Insider Blog for what’s available in the Canary, Dev, Beta, or Release Preview Channels * Windows Server Insider for feature preview opportunities Thanks for reading! We’ll be back next month with even more news you can use. If I can make this monthly summary more helpful to you, please leave a comment below. Our goal is to make it easier to plan for and manage Windows in your organization. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

Windows news you can use: July 2025: This month, there are several improvements based on feedback we have heard from you, our customers. You’ve told us you want Windows to start and stay up to date with minimal interruptions. I’m happy to share that new Windows media includes updated… #WindowsITPro

Windows 11 cloud-native migration with Microsoft Intune Have Windows 10 domain-joined and co-managed devices, but ready to migrate to Windows 11 and cloud-native management with Microsoft Intune. Here’s a quick guide to Microsoft-supported scenarios and the steps you can take to ensure a secure, efficient, and seamless migration. Note: By cloud-native management we mean managing Microsoft Entra joined devices with Microsoft Intune. As a result, the steps outlined here also apply if you’re transitioning away from hybrid joined Windows 11 devices. Step 1: Prepare your environment * Verify hardware compatibility. Confirm that devices meet the Windows 11 requirements (TPM 2.0, Secure Boot, CPU, RAM, storage) using Microsoft Configuration Manager or Endpoint analytics in Microsoft Intune. * Update Windows 10 devices. To facilitate a smooth upgrade to Windows 11, first check that all your Windows 10 devices are on the latest supported release (Windows 10, version 22H2) and have all updates installed. Use existing update tools, such as Windows Autopatch, Microsoft Configuration Manager, or Windows Server Update Services (WSUS). To validate that the devices are on the latest cumulative update, use the Quality update status report. Complete the following actions in any order: * Synchronize identities. Install and configure Microsoft Entra Connect to synchronize users and devices from Active Directory to Microsoft Entra ID. * Configure and validate hybrid join. Use Group Policy to enable automatic hybrid join for existing devices. See Configure Microsoft Entra hybrid join and Verify Microsoft Entra hybrid join state for detailed guidance. * Prepare the Intune environment. Ensure proper licensing is in place and assign admin roles. Confirm that devices meet minimum requirements, including the steps required for a device to onboard to Microsoft Entra ID and Microsoft Intune via Windows Autopilot as detailed here: Enroll devices in Microsoft Intune. * Confirm co-management. Confirm that devices report healthy status in both Configuration Manager and Intune. Move the following co-management workloads to Intune for targeted groups: o   Windows update policies o   Device configuration o   Office click-to-run apps Step 2: Transition Group Policy to Intune management * Optional: Inventory and rationalize Group Policy Objects (GPOs). A Windows 11 upgrade is an opportune time to start over with a clean sheet for device configuration. While this might seem like a monumental task, the increased stability and supportability of a clean configuration is immeasurable. To help you understand what you already have configured today, utilize Group Policy analytics in the Microsoft Intune portal. * Use co-management with Configuration Manager. Move compliance and device configuration workloads to targeted groups in Intune. Then you can target hybrid joined devices with both Intune policies and Group Policy. Double-check that Group Policy and Intune policies don’t conflict with each other. Use the built-in targeting constructs in each platform to avoid overlapping or conflicting policies. Note: We don’t recommend using the MDMWinsOverGP setting as it only applies to settings in the Policy CSP and can lead to difficulty in troubleshooting. * Consolidate and manage from the cloud. Remove redundant policies and replace unsupported settings with Intune configuration profiles, PowerShell scripts, or supported alternatives. * Adopt a phased deployment. Assign new Intune policies to pilot groups, validate results, then scale deployment organization wide. Step 3: Upgrade devices to Windows 11 * Use Windows Autopatch. Create and manage Windows Autopatch groups in the Intune admin center. Define deployment rings for phased rollout and leverage default schedules for staggered upgrades. * Monitor progress. Use Windows Autopatch reports in Intune to track update compliance, device health, and rollout status. Export data for further analysis and integration with existing dashboards as needed. Step 4: Migrate applications from Microsoft Configuration Manager to Intune * Assess current applications * Export a list of all deployed applications, including versions, dependencies, and target collections. * Assess each app’s compatibility for Intune deployment (MSI, Win32, MSIX, Microsoft Store apps) and retire obsolete software. * Package and test applications: * Wrap application installers using the Microsoft Win32 Content Prep Tool, enabling them for deployment by Intune. * Document install/uninstall commands and detection methods. Test deployments on pilot devices. * If you run into Windows 11 related compatibility issues with applications, reach out to App Assure for help. * Publish and assign applications: * Upload packages to Intune, monitor deployment status, and assign to appropriate user or device groups. * Iterate based on feedback, expanding deployments in phases. * Decommission in Configuration Manager: Remove old deployments, back up, and decommission your Configuration Manager environment. * Update internal processes and documentation: After successfully completing your migration, update existing processes and documentation on how you manage and maintain your devices. Step 5: Transition devices from domain-joined to Microsoft Entra ID joined * Leverage OneDrive known folder move to protect user data by automatically backing up desktop, documents, and pictures folders to OneDrive for Business. See if you qualify for Windows Backup for Organizations to more easily back up and restore user settings. * Monitor sync health. Use the OneDrive sync health report to ensure all devices are syncing successfully. Address issues proactively. * Migrate devices. We recommend you migrate to Microsoft Entra ID using device refresh as the most cost-effective and least disruptive approach. To learn more, see Myths and misconceptions: Windows 11 and cloud native. If you need to speed up your migration due to business needs, critical milestones (such as having less than 10% hybrid joined devices), or retiring key infrastructure, here are some alternative methods:  * Swap and go: Issue pre-configured Windows 11 devices joined to Microsoft Entra ID. This minimizes disruption and supports a seamless user transition. * Wipe and load: Reimage existing hardware to Windows 11. Join it to Microsoft Entra ID. Then restore user data and apps. * Coordinate business processes: Plan asset management and communicate migration steps. Ensure that all critical apps and data are present on new devices before handover. Why move to cloud-native management with Windows 11 and Intune? Migrating to Windows 11 and Microsoft Intune from Windows 10 domain-joined and co-managed environments positions your organization for future success. The benefits include: * Centralized management: Intune streamlines device lifecycle management across your organization. * Enhanced security: Windows 11 introduces advanced features like TPM 2.0 and Secure Boot, integrated with Microsoft security solutions. * Optimized user experience: Deliver faster performance and modern features tailored for hybrid work. * Future-ready operations: Align your organization with cloud-first strategies and reduce on-premises infrastructure dependencies. * Reduced overhead: Decrease reliance on legacy infrastructure and manual processes. * Copilot-powered productivity: Enable Microsoft 365 Copilot in Windows 11 to automate tasks, provide real-time insights, and offer proactive recommendations—empowering you and users to be more efficient and secure in the workplace. Use Microsoft Copilot in Intune to make everyday IT administration easier. Embracing migration with the tools and workflows outlined here can put your organization on a path for more secure, simplified, and future-ready endpoint management. Looking for success stories from organizations like yours? See 3 reasons why now is the time to go cloud native for device management. There are many resources to help you get started. Here are a few of our favorites: * Need a more comprehensive guide to complete this migration? Follow the guide here: Update your workloads to support cloud-native endpoints. * Skill up in 2-hour intervals with these skilling snacks: Go cloud first with Windows device management and From on premises to the cloud. * Need help communicating the changes to your organization? Download Windows 11 Onboarding Kit. * Once you migrate to Windows 11, stay up to date with the Windows release information toolbox. * Consider enabling hotpatch updates for Windows client to reduce restarts and streamline monthly updates. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

Windows 11 cloud-native migration with Microsoft Intune: Have Windows 10 domain-joined and co-managed devices, but ready to migrate to Windows 11 and cloud-native management with Microsoft Intune. Here’s a quick guide to Microsoft-supported scenarios and the steps you can take to… #WindowsITPro

Upgrade to Windows 11 with Windows Autopatch groups Have you tried Windows Autopatch groups for the gradual rollout of Windows feature updates? Windows Autopatch offers the fastest, safest way to upgrade to Windows 11—built for phased, controlled rollouts that align with IT priorities. With Windows 10 support ending on October 14, 2025, some organizations must still decide whether to enroll in Extended Security Updates or move forward with upgrading to Windows 11. For those ready to upgrade, here is a proven step-by-step approach using Windows Autopatch groups. The Windows Autopatch upgrade playbook: 4 steps to success Step 1: Assess Windows 11 readiness before grouping devices Before creating Windows Autopatch groups, use the Windows 11 readiness report to evaluate the readiness of your devices based on CPU, TPM, RAM, and app compatibility. The report will help you easily: * Identify upgrade-ready devices. * Export and filter devices based on readiness criteria. * Assign devices to Microsoft Entra ID groups. * Map device groups to Windows Autopatch rollout rings. Tip: You can export and filter the data available in the readiness report to identify upgrade-ready devices, then assign them to Microsoft Entra ID dynamic groups based on attributes like OS version, model, or readiness status. These groups then become the building blocks of your rollout rings. Step 2: Segment devices into Windows Autopatch groups Windows Autopatch groups are the engine behind phased deployments. They let you define rollout rings using Microsoft Entra ID groups and assign update policies to each ring. This gives you: * Control over rollout pace and scope * Clear visibility into update progress * Flexibility to adapt based on business needs We recommend starting with foundational Windows Autopatch groups, for example: * Windows 11 rollout group: Devices that meet upgrade criteria (e.g., TPM 2.0, supported CPU) * ESU group: Devices that will remain on Windows 10 and receive Extended Security Updates (ESUs) For phased deployments, you can define additional rollout rings using Microsoft Entra ID groups. A common distribution might look like: * Test ring (5%) – IT power users with diverse hardware * Pilot ring (10%) – Early adopters and business-critical teams * First broad ring (20%) – Broader user base * Second broad ring (30%) – Majority of remaining devices * Final ring (35%) – Remaining devices, deployed after validation Each group gets a dedicated update policy, offering full control over rollout pace and scope. To get started, visit the Microsoft Intune admin center. Under Tenant administration, navigate to Windows Autopatch > Autopatch groups > Create > Deployment rings.   Important: To prevent devices from upgrading all at once, bypassing the phased rollout, please follow these recommendations: * Don’t modify the "Windows Autopatch - Global DSS Policy" to a newer version. * When creating Windows Autopatch groups, don’t check the “Feature updates” box during configuration. Instead, create a new feature update policy, assigning the Microsoft Entra ID group and Windows Autopatch group directly to a multi-phase update policy (see next section).   Step 3: Configure how fast the feature update rolls out With your Windows Autopatch groups and rollout rings defined, the next step is to determine when each group receives the Windows 11 feature update. This is where a multi-phase feature update comes into play. With multi-phase updates, you can configure an update timeline for each ring, giving you control over rollout sequencing and deferrals. To set up a multi-phase update: * Go to Microsoft Intune admin center. * Navigate to Devices. * Under Manage updates, select Windows updates. * Under Feature updates, select + Create to create a new Windows feature update policy. * From the menu, select Create Autopatch multi-phase release.  * Set up a ring-based timeline under the Release schedule tab. For example, you might schedule your test ring to receive the update immediately, then delay the pilot ring by 7 days and the broad rings by another 10–14 days. This staggered approach can give you time to validate update quality, monitor diagnostic data, and respond to issues before they impact a larger portion of your environment.   Note: For smaller organizations or targeted upgrades, you can also use single feature update policies using Microsoft Entra ID groups. Phased deployments; however, offer more control and visibility. Step 4: Monitor your rollout with feature update reporting Windows Autopatch feature update reporting helps you track how your Windows 11 upgrade is progressing across Windows Autopatch groups and deployment rings. The Windows feature update compatibility risks report includes: * Device-level update status. See which devices are: o   Up to date (successfully upgraded) o   In progress (actively receiving the update) o   Not up to date (blocked or delayed) o   Not ready (doesn’t meet upgrade criteria) * Policy-level update status. Understand which version of Windows 11 is being deployed and how many devices have successfully upgraded. * Update trendlines. Use 30/60/90-day historical views to assess how quickly devices are progressing through the rollout and identify patterns. * Troubleshooting and remediation. Drill into specific devices to view error codes and remediation guidance. Manage ESU devices separately Devices that will remain on Windows 10 and are enrolled in ESUs should be completely excluded from any Windows 11 rollout policies. Instead, you should create a dedicated group for ESU devices and manage them separately. This avoids mixed targeting, ensures these devices continue receiving monthly security updates, and prevents accidental inclusion in Windows 11 upgrade deployments. For more details on this scenario, see When to use Windows 10 Extended Security Updates. Act now While Windows 10 end of support is coming soon, there is still time to upgrade eligible devices to Windows 11. Windows Autopatch groups can make the process faster and easier with phased deployments, readiness insights, and powerful reporting so you can upgrade with confidence. To learn more about using Windows Autopatch, see the following: * Windows feature updates * Manage Windows Autopatch groups * Use the Windows feature update compatibility risks report --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

Upgrade to Windows 11 with Windows Autopatch groups: Have you tried Windows Autopatch groups for the gradual rollout of Windows feature updates?


Windows Autopatch offers the fastest, safest way to upgrade to Windows 11—built for phased, controlled rollouts that align with IT… #WindowsITPro

Microsoft Connected Cache is now generally available We are proud to announce the general availability of Microsoft Connected Cache on July 23, 2025, to Enterprise and Education organizations. We thank partners and customers who have participated in the preview program for their valuable feedback, which has helped us refine Connected Cache into a production-ready solution. Connected Cache helps organizations realize significant bandwidth savings when performing Windows 11 upgrades, Microsoft Intune provisioning, Intune application installations, Windows Autopilot software updates, and other monthly update deployments. As more organizations move to a cloud-native approach to device management, internet bandwidth consumption has become a major pain point. Without on-premises distribution points running Configuration Manager, customers have seen their network bandwidth consumption skyrocket as all their devices attempt to download updates directly from Windows Update over the internet. Microsoft Connected Cache for Enterprise and Education is available to all organizations with Windows Enterprise (E3, E5, and F3) or Windows Education (A3 and A5) entitlements, or a more comprehensive Microsoft 365 subscription. Eligible organizations can deploy Connected Cache nodes directly to host machines running Windows Server, Windows Desktop, and Linux [Ubuntu and Red Hat Enterprise Linux (RHEL)]. One of the standout benefits of Microsoft Connected Cache is its remarkable flexibility—it can be deployed on almost any platform within your existing infrastructure, including Windows Server, Windows Desktop, and popular Linux distributions like Ubuntu and Red Hat Enterprise Linux. This versatility ensures that organizations of all sizes and architectures can take advantage of its features without the need for significant hardware changes or investments. Connected Cache works efficiently by caching only the content specifically requested by devices on your organization's network, eliminating unnecessary storage use and reducing redundant downloads. As a result, bandwidth consumption is decreased, and users benefit from faster, more reliable access to updates and applications. Connected Cache and Delivery Optimization work together to save you bandwidth While Delivery Optimization is mostly known for being a peer-to-peer delivery solution, it is also the Windows downloader component that pulls Microsoft content from the cloud and provides enterprise and education users with tools to manage bandwidth traffic, throttling capabilities, and more. Connected Cache complements Delivery Optimization peer-to-peer as a dedicated software caching solution that can be deployed within your network. Once deployed to a host machine within your network, the Connected Cache node will transparently and dynamically cache the Microsoft-published content that your organization’s Windows devices need.  Using this solution, content requests from Delivery Optimization can be served by the locally deployed Connected Cache node instead of a content delivery network. This results in fast, bandwidth-efficient delivery across connected devices on your network. Connected Cache now uses a Windows installer for cache node deployment to Windows To better streamline the installation and update process for Windows-hosted cache nodes, Connected Cache now leverages a Windows installer application for deployment to Windows host machines. The Connected Cache installer is a command line application that offers easy deployment and updating of Windows-hosted cache nodes. It also lays the groundwork for future app capabilities such as new observability and troubleshooting tools. Connected Cache can be configured to support Intune and Teams content requests via HTTPS To meet evolving content delivery requirements from Microsoft content publishers, Connected Cache now supports both HTTP and HTTPS protocols. This enhancement ensures that Connected Cache can seamlessly cache and serve content regardless of the publisher’s delivery method. The added flexibility allows organizations to adapt to changing publisher requirements without compromising performance or efficiency. Notably, this update enables access to Teams content via Connected Cache for the first time—an important expansion of supported content types. As Intune transitions to requiring HTTPS content delivery, this feature ensures continued compatibility and uninterrupted caching benefits. To enable HTTPS support, IT administrators must deploy a certificate to Connected Cache. Configuration guidance is available in the public documentation. This update reinforces Microsoft Connected Cache’s role as a secure, adaptable, and enterprise-ready caching solution aligned with modern content delivery standards. Deploy Microsoft Connected Cache for Enterprise and Education Microsoft Connected Cache is a flexible caching solution that saves bandwidth and speeds up access to updates and applications without major hardware changes, helping you keep your organization’s devices productive and secure. It is free to use for organizations with eligible Windows Enterprise and Education entitlements. To get started, customers can use the Azure Marketplace to create “Microsoft Connected Cache for Enterprise and Education” Azure resources. Once the Connected Cache Azure resource has been created, organizations can create, configure, and deploy as many cache nodes as required to support their network topologies and content delivery needs. While access to Azure is required for usage and management, the Connected Cache Azure resource does not incur any Azure cost. Please see the Microsoft Connected Cache for Enterprise and Education documentation overview page for more details. Full details on the GA release can be found in the Release Notes public documentation. Start using Connected Cache today! --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Microsoft Connected Cache is now generally available: We are proud to announce the general availability of Microsoft Connected Cache on July 23, 2025, to Enterprise and Education organizations. We thank partners and customers who have participated in the preview program for their… #WindowsITPro

RDP Multipath is now generally available for Azure Virtual Desktop and Windows 365 We’re excited to announce the  General Availability (GA)  of  RDP Multipath  for both Azure Virtual Desktop (AVD)  and  Windows 365. This new feature dynamically evaluates multiple network paths between your physical device and Cloud PC or session host to help to maintain seamless connectivity and minimize the risk of disconnections. Stay connected and productive with dynamic path management that adapts to network conditions in real-time. What is RDP Multipath? RDP Multipath continuously evaluates multiple UDP network paths and dynamically switches to the most reliable one. This ensures a more stable and consistent experience, especially in environments with fluctuating network conditions. Because redundant connections are maintained throughout the session, the system can instantly switch to a backup path if the primary one fails—without interrupting the user's experiences. Key benefits * Seamless integration: No configuration changes are needed beyond ensuring your environment supports RDP Shortpath. For more information, see our blog on optimizing RDP connectivity. * Dynamic path management: Multipath evaluates multiple UDP paths and proactively selects the best-performing one—even before a connection drop occurs. * Enhanced reliability: If one path fails, the system automatically switches to a redundant path, minimizing disruptions. * Lower user latency: Multipath unlocks the full benefits of our service front door infrastructure such as RDP Gateways and TURN relays in 40+ locations around the globe. These service front doors bring the edge of the service as close as possible to your users to minimize latency as multipath allows for multiple redundant connections across this infrastructure. Connections from these service front doors to your Cloud PC/session host and back again are then completely handled on Microsoft’s high-speed global backbone and not the internet providing the highest levels of performance and reliability wherever you choose to deploy. For more on our global TURN relay expansion, see here. * Connection Insights: Azure Virtual Desktop and Windows 365 users can now check the connection status of their remote session directly from the connection bar, which indicates when RDP Multipath is enabled. For Azure Virtual Desktop admins, detailed Multipath insights are already available through Azure Virtual Desktop Insights. For Windows 365 admins, enhanced insights are coming soon, enabling better monitoring and diagnostics of Multipath performance across Cloud PCs. Phased rollout for quality and stability RDP Multipath is being introduced through a phased rollout across both Azure Virtual Desktop and Windows 365 environments. This quality-driven approach helps each stage of deployment meet performance and reliability standards before expanding further. By gradually enabling the feature, we can monitor real-world usage and deliver a consistent, high-quality experience to all users. We are currently starting the rollout and will update this blog post once the deployment is complete. What to expect during rollout RDP Multipath is being rolled out in phases across Azure Virtual Desktop and Windows 365. Until the rollout is complete, the feature may not be available across all connections. Each phase is guided by quality benchmarks to ensure a stable and reliable experience as deployment expands. Platform support This feature is currently supported on: * Microsoft Remote Desktop Client (MSRDC): Version  1.2.6074 or later * Windows App: Version   2.0.366.0 or later Learn more To explore RDP Multipath in more detail, visit the official documentation: * https://learn.microsoft.com/en-us/azure/virtual-desktop/rdp-multipath * https://learn.microsoft.com/en-us/windows-365/enterprise/rdp-multipath --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

RDP Multipath is now generally available for Azure Virtual Desktop and Windows 365: We’re excited to announce the  General Availability (GA)  of  RDP Multipath  for both Azure Virtual Desktop (AVD)  and  Windows 365. This new feature dynamically evaluates multiple network paths… #WindowsITPro

Resilience in action for Windows devices Windows 11, version 24H2 (KB5062660), introduces two major advancements that strengthen system resilience and minimize downtime: a redesigned user experience for unexpected restarts and the general availability of quick machine recovery. Together, these updates reflect our commitment to helping users and IT admins recover from disruptions faster, with less friction and greater control. These innovations are part of the broader Windows Resiliency Initiative, designed to keep users productive and organizations running smoothly. A new user experience for unexpected restarts With Windows 11, version 24H2, we’re introducing a more streamlined user interface for unexpected restarts that’s more than just a color change. It’s part of a broader effort to make Windows more resilient, less disruptive, and faster to recover. Why change the screen? For nearly four decades, the blue screen shown during an unexpected restart has been a visual shorthand for something going wrong. But it’s also been a source of anxiety and frustration. We heard from users that the blue screen was visually disruptive, often unhelpful, and frustrating to stall on – until recently, users could sit on this screen for up to 40 seconds. That’s why we’ve redesigned the experience from the ground up. The new UI is simpler, and more aligned with Windows 11’s design language. It removes the frowny face and QR code, and instead presents a short, readable message with the stop code and faulty driver information. We’ve also added a hex version of the stop code to make it easier to search for help – a common user request. The new Windows 11 unexpected restart screen. This isn’t just about aesthetics The latest UI update is just one part of an ongoing effort to improve the entire unexpected restart experience. We’re working on reducing downtime and improving recovery. In Windows 11 24H2, we made significant improvements to crash dump collection that reduced the time users spend on the screen from 40 seconds to just 2 seconds for most consumer devices.1 Supporting diagnostics for organizations In the event of an unexpected restart, we understand error information and diagnostics can be critical, especially for IT Pros. The new screen will continue to show stop code and faulty driver information, with the added inclusion of the hex version of the stop code for easier search. Enterprises also continue to collect kernel dumps by default to support rich diagnostics, but can opt-in to the reduced downtime by configuring devices for a small memory dump. Diagnosability is preserved, while offering flexibility around dump collection and user experience. The most reliable Windows yet We’re also proud to share that Windows 11 24H2 is our most reliable version of Windows yet. Compared to Windows 10 22H2, failure rates for unexpected restarts have dropped by 24%.2 These improvements reflect deep collaboration across engineering, design, and user research teams and a commitment to making Windows more resilient for everyone. What’s next? The new UI for unexpected restarts is now generally available for all devices on Windows 11, 24H2. Announcing General Availability: quick machine recovery Quick machine recovery, a key part of the Windows Resiliency Initiative, is now generally available in Windows 11, version 24H2(KB5062660). First introduced at Microsoft Ignite 2024, this built-in capability automatically detects, diagnoses, and resolves widespread critical boot issues using a secure, always-available Windows Recovery Environment. With targeted, automated fixes delivered through the trusted Windows Update pipeline, quick machine recovery reduces downtime, eases IT burden, and helps users return to productivity, quickly, reliably, and at scale. Quick machine recovery: built for resilience Quick machine recovery is more than just a feature, it’s a system, purpose-built to respond to the unexpected with speed, precision, and security. It combines a connected recovery environment, Microsoft’s remediation response, and granular IT controls to ensure devices recover from critical widespread boot issues with minimal disruption. System flow from encountering a boot-critical issue to remediation via quick machine recovery. Key Components of the quick machine recovery System * Secure and connected Windows Recovery Environment: When enabled, quick machine recovery uses a secure, always-available Windows Recovery Environment to automatically scan Windows Update for applicable fixes, enabling recovery without requiring manual input. * Remediation response: Remediations for widespread boot issues published by Microsoft are well documented, lightweight and can be delivered globally via secure update channel. Established Windows Update policies for organization will be honored during roll-out. * Policy Controls for organizations: IT Admins maintain full control over how quick machine recovery behaves in their environments. Configuration options include: o   Enabling or disabling the feature o   Managing auto-remediation behavior o   Setting scan and reboot intervals How it works We've introduced a dedicated quick machine recovery page within the Recovery section of the Windows Settings app (System > Recovery > Quick machine recovery.) On Windows 11 Home devices, the feature is enabled by default. Today, for Windows 11 Pro, Education, and Enterprise editions, quick machine recovery is disabled by default. IT administrators are empowered to configure or enable the feature using management tools such as the Intune Settings Catalog or leverage the RemoteRemediation CSP. Once enabled, the feature activates during critical boot failures. It uses the secure and connected Windows recovery environment to scan Windows Update for applicable fixes published by Microsoft. If a matching remediation for a widespread issue is available, it is applied automatically, restoring the device without requiring manual intervention. What's next? Currently, quick machine recovery is supported on Windows 11 Home, Pro, Education and Enterprise SKUs, with connectivity over Ethernet and Wi-Fi (WPA/WPA2). Support for additional editions, including Windows Server, as well as expanded connectivity options for enterprise environments is coming soon. Future enhancements will also include advanced IT admin tools for remediation management, monitoring, additional policy and rollout controls. Get Started Today * Learn more about quick machine recovery by reading our technical documentation. * Ensure you’re on the latest Win11 24H2 build (26100.4770; see KB5062660) * Review the various options available to enable the feature on Windows Settings app (System > Recovery > Quick machine recovery.) * Simulate the quick machine recovery process through test mode to ensure readiness before deployment. We encourage you to explore the capabilities and provide feedback via Feedback Hub (file under Recovery and Uninstall > Quick machine recovery) to help us refine and optimize this feature. And as always let us know what you think in the comments. Stay tuned for future enhancements as we continue to strengthen Windows resilience and support IT admins in maintaining seamless business operations. To learn more about the Windows Resiliency Initiative, see The Windows Resiliency Initiative: Building resilience for a future-ready enterprise.   Disclaimer: This blog post is for informational purposes only and outlines Microsoft’s current product direction and plans. Product availability, licensing terms and capabilities may vary by region and are subject to change. 1Source: Internal testing of Windows 11 memory dump write speed, October 2022 2Source: Reliability telemetry collected by Microsoft, July 2025 --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

Resilience in action for Windows devices: Windows 11, version 24H2 (KB5062660), introduces two major advancements that strengthen system resilience and minimize downtime: a redesigned user experience for unexpected restarts and the general availability of quick machine recovery.… #WindowsITPro

Inbox Microsoft Store apps update in Windows media Built-in Windows apps just got a significant update through media releases of the latest versions of Windows 11 and Windows Server. When you install Windows 11, version 24H2 or Windows Server 2025 using media refreshed in or after June 2025, the system will have the newer versions of apps out-of-the-box. You won’t need immediate updates from the Microsoft Store. The result is a more secure, compliant, and user-friendly experience from day one of deployment. Key features and improvements Today, all new media for these releases come with newer versions of the inbox Microsoft Store apps preinstalled instead of the release-to-manufacturing (RTM) version. This includes updated ISO images, virtual hard disks (VHDs), and Azure Marketplace images. Newer inbox apps included The refreshed media comes with improvements! Below is the list of the inbox Microsoft Store apps that traditionally would have needed updating after operating system (OS) installation.  The Windows 11, version 24H2 media now comes with 36 updated built-in apps: * Alarms & Clock * App Installer * AV1 Video Extension * AVC Encoder Extension * Bing Search * Calculator * Camera * Clipchamp * Cross Device Experience Host * Get Help * HEIF Image Extension * HEVC Video Extension * Media Player * Microsoft Store * Microsoft To Do * Notepad * Office Hub * Paint * Phone Link * Photos * Power Automate * Quick Assist * Raw Image Extension * Snipping Tool * Solitaire Collection * Sound Recorder * Sticky Notes * Store Purchase App * VP9 Video Extension * Weather * Web Media Extensions * WebP Image Extension * Windows Security * Windows Web Experience Pack * Xbox Game Bar * Xbox Speech-to-Text Overlay The Windows Server 2025 media includes two updated apps: * App Installer * Windows Security Enhanced security and compliance By refreshing inbox apps to newer versions, Microsoft is addressing security vulnerabilities present in older app releases. Previously, a freshly deployed Windows image might contain out-of-date apps with known common vulnerabilities and exposures (CVEs). Newly built PCs or cloud virtual machines (VMs) could trigger security alerts for outdated app versions as soon as they were deployed and until those apps received updates. With the new media, refreshed monthly in or after June 2025, the apps are kept up to date, reducing vulnerability windows. This will help your organization stay compliant with security requirements (e.g., meeting cybersecurity baseline mandates). In short, the OS images now deliver a more secure baseline configuration out-of-the-box. Seamless out-of-box experience You’ll notice far fewer app updates immediately after installation on devices imaged with the latest media. These devices won’t spend their first hours fetching dozens of app updates from the Microsoft Store and updating. Instead, you’ll: * Save bandwidth and time. * Start using built-in apps immediately with the improved features and fixes in place. The onboarding experience is smoother and less disruptive since the system is essentially “day-zero updated.” There’s nothing you or users at your organization need to do post-installation to update these inbox apps! Everything is handled as part of the standard imaging process. How to get the updated media * Download the June 2025 or later updated media. Get Windows 11, version 24H2 and Windows Server 2025 ISO images by signing in to the Microsoft 365 admin center. Similarly, the images available on Microsoft websites (for example via the Media Creation Tool) and the Azure Marketplace gallery images for these OS versions have also been updated. For a general overview of Windows deployment and imaging processes, you can refer to the Windows deployment documentation. Please note Volume Licensing Service Center (VLSC) has been retired. * Deploy devices using refreshed images. When installing new PCs or provisioning VMs, use the June 2025 or later updated media. Because the media itself contains the new app versions, you don’t need any immediate Microsoft Store updates for inbox apps post-installation. This makes your deployment process faster and reduces the post-deployment workload. You can point your standard enterprise deployment tools (Microsoft Configuration Manager, etc.) to the new images just as with any regular update. Do you have any devices on Windows 11, version 24H2 or Windows Server 2025 that were set up using older (pre-June 2025) media? You can easily achieve the same up-to-date app state! Simply ensure that all Microsoft Store apps on those devices are updated to the latest versions. Do this via the Microsoft Store (if available in your environment) or via your enterprise app management tools, especially if Microsoft Store access is restricted. The interoperability of Microsoft Intune with the Microsoft Store can automatically keep apps up to date when new versions become available. This is ideal for devices where users don’t have direct Microsoft Store access. Get more secure Windows apps from day one Start benefiting from all the app fixes and features with minimal effort today. Just download the monthly refreshed media or update apps on existing installations of Windows 11, version 24H2 or Windows Server 2025 with this quick guide. Want more details on managing app updates in enterprise environments? See the Microsoft guide on adding and updating Microsoft Store apps via Intune. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q\&A.

Inbox Microsoft Store apps update in Windows media: Built-in Windows apps just got a significant update through media releases of the latest versions of Windows 11 and Windows Server.


When you install Windows 11, version 24H2 or Windows Server 2025 using media refreshed in or after… #WindowsITPro

JScript9Legacy scripting engine now enabled by default To provide a more secure experience, beginning with Windows 11, version 24H2, JScript9Legacy is enabled by default to handle all scripting processes and operations that previously used JScript. Read on to learn more about frequently asked questions for switching from Jscript to JScriptLegacy and its default in Windows 11, version 24H2. How is JScript9Legacy better than JScript? Based on JScript9, the new JScriptLegacy scripting engine offers improved performance and security features. JScript9Legacy is designed to be more compatible with modern web standards, which helps mitigate the risk of cross-site scripting (XSS) and other web-based attacks. The new engine incorporates advanced security features such as improved handling of JavaScript objects and stricter execution policies, which make it harder for malicious scripts to exploit the system. By replacing JScript.dll with JScript9Legacy.dll, the operating system can better defend against a wider range of security threats, ultimately providing a more secure environment for users. What's the impact of this change on other in-market versions of Windows? There is no impact on Windows versions earlier than 24H2. This change is limited to Windows 11, version 24H2 and above. All scripting processes that rely on JScript in Windows versions earlier than Windows 11, version 24H2 will continue to run as they have. Are there any additional steps needed to take advantage of JScript9Legacy? No additional action is required from you to benefit from JScript9Legacy, nor will it impact existing workflows. If there are incompatibility issues with JScript9Legacy, how does one roll back to JScript? Please connect with our support team through Services Hub for guidance on rolling back to JScript. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

JScript9Legacy scripting engine now enabled by default: To provide a more secure experience, beginning with Windows 11, version 24H2, JScript9Legacy is enabled by default to handle all scripting processes and operations that previously used JScript. Read on to learn more about… #WindowsITPro

Hotpatching now available for 64-bit ARM architecture Hotpatching is now generally available for your Windows 11, version 24H2 ARM64 devices. More client devices can now experience the power of security updates that don't require a restart! Since general availability on x64 (AMD/Intel) CPU devices in April 2025, hotpatch adoption continues to grow rapidly. Millions of devices and thousands of customers have been receiving updates during hotpatch release months. Thanks to those of you who have already tried hotpatching and are now enabling it across the majority of your fleets. Your overwhelmingly positive feedback highlights the strong confidence in the value it delivers: With Hotpatch and the Autopatch feature updates, we have seen a more enhanced system with minimized downtime and streamlined patch management. --Pat Macfarlane, Senior Workstation Engineer, TriNet USA, Inc. Now, your devices with 64-bit ARM architecture can get the same benefits of faster rollouts and less disruptive updates. Secure smarter. Patch faster. Restart less. With hotpatching now generally available for 64-bit ARM architecture, there's never been a better time to modernize your update strategy. Your organization will benefit from: * Faster compliance: Security updates are applied immediately, reducing the window of vulnerability. * No downtime: Users stay productive—no forced restarts or interruptions. * Smaller update payloads: Faster installs and easier update orchestration. * Enterprise-grade control: Integrated with Microsoft Intune and Windows Autopatch for streamlined management. Get started today and take advantage of faster security compliance as soon as next month. All you need to do is check your prerequisites, disable Compiled Hybrid PE (CHPE), and enroll these devices into a quality update policy with hotpatching enabled. See below for technical details. Technical guide: Get your ARM64 devices hotpatch ready Hotpatching is a Windows update technology that allows you to apply security updates without requiring a restart. It works by updating in-memory code while the system is running, ensuring that devices stay secure and productive with minimal disruption. Make sure you check off the prerequisites below to enable hotpatching on ARM64 devices. For prerequisites, you will need: * Devices running Windows 11 Enterprise, version 24H2 (Build 26100.2033 or later) with the current baseline update installed * Microsoft Intune for managing the deployment of hotpatch updates with a hotpatch-enabled Windows quality update policy (see “How to enroll devices in hotpatching” below) * One of the eligible licenses: Windows 11 Enterprise E3 or E5, Microsoft 365 F3, Windows 11 Education A3 or A5, Microsoft 365 Business Premium, or Windows 365 Enterprise * Virtualization-based security (VBS) enabled * Disabled Compiled Hybrid PE (CHPE)—a unique prerequisite for ARM64 devices One-time setup: Disable CHPE to enable hotpatch on ARM64 To enable hotpatching on ARM64 devices, you must also disable CHPE. CHPE is a compatibility layer that's not compatible with hotpatch updates. The good news? It's easy to disable with a CSP setting or a registry key. * Use the DisableCHPE policy. Apply the following configuration service provider (CSP) setting via Microsoft Intune or Group Policy, then restart the device once. Learn more at System Policy CSP. ./Device/Vendor/MSFT/Policy/Config/Hotpatch/DisableCHPE = 1 Select the “CHPE Binaries Disabled” option from the “Disabled CHPE” CSP in the Settings catalog. * Use registry keys. You can also set the following registry key value to 1 and then restart the device once: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\HotPatchRestrictions = 1 That's it. Your ARM64 devices are now hotpatch ready! What will disabling CHPE do? CHPE was originally used to support x86 emulation, but you must turn it off so that hotpatch updates apply correctly. Here's what happens when you disable CHPE: * You will be offered hotpatch updates on your eligible and enrolled ARM64 machines. * You can still run x86 applications in emulation mode on ARM64. Note: This doesn't mean that every application needs to be compiled for ARM64. * There might be performance differences depending on your workload and environment. We recommend that you validate this change in your own environment before broad deployment. Testing will help ensure that you understand and mitigate any potential performance impacts. How to enroll your ARM64 devices in hotpatching Please enroll devices into hotpatching now to benefit from it as soon as the next hotpatch release month. * Go to the Microsoft Intune admin center. * Navigate to Devices > Windows updates > Quality updates. * If you're creating a new policy, select Create Windows quality update policy. To edit an existing policy, select it from the list under Name. On the following screen, select Edit next to Settings. * Next to Automatic update deployment settings, ensure that the option “When available, apply without restarting the device” is set to Allow. * Assign the policy to your ARM64 device group. Enable hotpatch updates by creating a new policy: Create a new policy to enroll in hotpatch. Edit an existing quality policy to enable hotpatch updates: Edit an existing policy to enroll in hotpatch. See the full guide at Enroll devices to receive hotpatch updates. Additional resources to help your organization make the most of hotpatch updates: * Hotpatch for client: Frequently asked questions * Official announcement: Hotpatch for Windows client now available * Technical documentation, including prerequisites, enrollment instructions, and troubleshooting: Hotpatch updates * Windows 11, version 24H2 Enterprise hotpatch calendar: Windows 11 hotpatch calendar * Monthly update contents: Release notes for hotpatch public preview on Windows 11, version 24H2 Enterprise clients * User readiness information to share with people at your organization: Understanding security updates that get installed without a restart * Per-policy level view of the current update statuses: Hotpatch quality update report * Technical demo: The hottest way to update Windows 11 and Windows Server 2025 For more information, contact us at hotpatchfeedback@microsoft.com. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Hotpatching now available for 64-bit ARM architecture: Hotpatching is now generally available for your Windows 11, version 24H2 ARM64 devices. More client devices can now experience the power of security updates that don't require a restart!


Since general availability on x64… #WindowsITPro

Your Windows release information toolbox If you manage Windows updates for your organization, you need resources you can rely on for clear, accurate, and up-to-date information. Over the past year, we've rolled out several improvements to the way we document and communicate details related to Windows monthly and features updates. Based on your feedback, we have focused on improving accessibility, discoverability, localization, and the overall user experience across our channels. As much has changed since my last post on this topic, catch up on the resources available to you, how they can help, and when to best use them in your update management cycle. The first stop: Windows release health Looking for easy access to official information on Windows updates? Bookmark the Windows release health hub on Microsoft Learn at https://aka.ms/WindowsReleaseHealth. There you'll find the Windows 11 release information page. It lists current versions by servicing model and a list of all monthly security and non-security preview updates released for Windows 11. Quickly access release notes, details about known or resolved issues and safeguards, and important announcements related to updates and product lifecycle. The Windows release health home page shows recent announcements in the Windows message center. It features tiles with quick links for supported versions of Windows 11, Windows 10, and Windows Server. Windows release health is localized in 10 languages and is a great resource to help you plan your next update. Looking for greater technical detail about known issues and earlier reminders about important milestones like end of service? Access an enhanced Windows release health experience in the Microsoft 365 admin center. Access Windows release health and the message center in the Microsoft 365 admin center by expanding the Health section of the left navigation menu. Windows message center Bookmark the Windows message center to keep track of upcoming changes. Find new and changed features, planned maintenance, and other important announcements. You'll learn about enhancements to your Windows experience and the way we help keep devices updated. Plan for major changes with 90-, 60-, and 30-day notices about end of servicing, end of support, or security hardening requirements. If you are an IT admin managing devices on behalf of an organization, find additional details in the message center in the Microsoft 365 admin center. Want to opt in to receive a weekly digest via email for Windows-related updates posted to the message center? * Go to Preferences and select the Email tab. * Select or add the email address where you'd like to receive notifications from the message center. * Select the box for Send me a weekly digest about services I select. * You can then opt into weekly digest messages for specific services—including Windows. You can also choose to receive email messages for major updates and data privacy. (Note that you can enter up to two additional email addresses to receive those notifications.) If you are interested in retrieving the data available in the Microsoft 365 admin center experience, use the Windows updates API in Microsoft Graph. Available data includes updates from the Microsoft Lifecycle Policy site, known issues, and Windows release information pages. Recent improvements to Windows release health With hotpatching now generally available for Windows 11 Enterprise, version 24H2 clients, the Windows 11 release information page features the Windows 11 hotpatch calendar. Devices enrolled in hotpatch updates receive a baseline cumulative update the first month of each quarter in the calendar year. The hotpatch calendar lets you quickly see a list of baseline and hotpatch updates with build number and associated KB article. Working on smaller screens? Expand tables to full screen width on all pages featuring table-based information, such as the release information and known issue pages. Windows 11 hotpatch updates are displayed in a table view by calendar year on the Windows 11 release information page. Use the option at the top of the table to expand it to full-screen width. We plan to continue building new functionality for you and add more data classes in the future. If you have suggestions on how we can improve Windows release health to make it better work for your organization, leave a comment below! Keep track of monthly updates: release notes and update history pages Each month, we update Windows with fixes, quality improvements, and—as part of continuous innovation—new features and capabilities designed to keep you protected and productive. Windows release notes outline what is included in each monthly security update, optional non-security preview release, or out-of-band update. For easy access, each version of Windows has its own update history page with a convenient list of all release notes published to date. The update history page for Windows 11, version 24H2, offers a summary of what’s new in version 24H2 and provides quick access to monthly release notes for version 24H2 in the left navigation menu. Release notes and update history pages are available for all in-market versions of Windows client and Windows Server, including: * Windows 11, version 24H2 * Windows 11, version 23H2 * Windows 11, version 22H2 * Windows 10, version 22H2 * Windows Server 2025 * Windows Server 2022 * Windows Server 2019 Short on time? Check out our release note videos for Windows 11, version 24H2. They summarize key highlights from each monthly security update and feature bonus tips to help you get more from your Windows 11 experience. Recent improvements to Windows release notes We continue to enhance navigation and visual hierarchy, making sure that the release notes layout is optimized for mobile and tablet viewing. We've added expandable sections to release note pages, making it easier for you to scan the full page quickly and get detailed information when you need it. We've categorized highlights and improvements, so you can see which are available now for all devices (normal rollout) and which are rolling out gradually as part of continuous innovation. We've worked to improve screen reader compatibility, keyboard-based navigation, and support for high-contrast viewing. The Highlights section of a Windows release notes page offers expandable sections for both gradual rollout and normal rollout. Windows 11 incorporates various AI components and features to enhance the user experience, productivity, and security. Windows 11 release note pages now clearly list which AI components have been updated and to which version. The AI Components section of the Windows 11 release note page lists the AI components that have been updated and the current version number for each component. The list in this example includes Image Search, Content Extraction, and Semantic Analysis. In addition to inline links to helpful documentation, release note pages now offer tooltips that offer guidance on common actions. For example, learn how to install updates using common Windows and Microsoft release channels or how to remove the LCU if you are installing a combined SSU and LCU package. A tooltip shows that the update will automatically sync with WSUS if Products and Classifications are configured for Windows 11 and Security Updates. Finally, we've introduced separate release note pages for hotpatch updates for Windows 11 Enterprise, version 24H2. If you've enrolled devices in hotpatch updates, access these release notes and the hotpatch release calendar from the Hotpatch update history page for Windows 11, version 24H2 Enterprise clients. Windows Roadmap One of the biggest asks when it comes to Windows documentation is for greater transparency on what's coming next and when. This year, we introduced the Windows Roadmap. Use intuitive filter controls to see what's coming to a specific version of Windows for the different release channels and device types (Copilot+ PC, Windows 11 PC) or check on the latest status of improvements and new features. Specifically, you can find information on Windows 11 improvements and features that: * Are currently available to validate in the Windows Insider Program. * Are gradually rolling out. * Are generally available (fully enabled in the monthly non-security update). You'll also find instructions on how to access new features and improvements before they're enabled by default in your estate. Bookmark https://aka.ms/WindowsRoadmap and check back often for the latest. The Windows Roadmap home page is filtered to show features for 24H2 across all platforms and channels. Read, watch, and learn If you want to learn how to manage Windows updates more effectively, you can find timely practical guidance from our engineers through the Windows IT Pro Blog on the Microsoft Tech Community. Sign in to the community and follow the blog to be notified of new content. You can also follow the Windows Server News and Best Practices Blog for the latest announcements for Windows Server admins. We work to provide a rich community for IT pros managing Windows. Follow our @WindowsUpdate and @MSWindowsITPro handles on X, Windows Update on Bluesky, or Windows IT Pro on LinkedIn. There you can stay on top of important announcements about features, servicing technology advances, policy management, upcoming events, and more. You can also engage with us via a regular beat of digital events: * Join us every third Thursday of the month for Windows Office Hours! This chat-based series offers you an opportunity to submit questions in advance or live. Get answers, tips, and insights from engineering team members across Windows, Microsoft Intune, Windows 365, security, public sector, and more. * Save the date for, or catch on demand, Windows editions of Tech Community Live. That's where we assemble experts from the engineering teams for a series of live, on-camera Ask Microsoft Anything (AMA) sessions. * For the biggest product updates of the year, check out Microsoft Ignite in person or on demand. Then access digital deep dives, AMAs, and feedback sessions at Microsoft Technical Takeoff. Looking for turnkey videos to help people at your organization learn how to get more from their Windows 11 experience? Bookmark and subscribe to our Windows community channel on YouTube. Have users that are new to Windows or Windows 11? Check out Day 1 with Windows 11. A sample of Windows 11 tips available on the Windows community YouTube channel featuring videos on live captions, widgets, and quickly navigating apps, files, and settings. Troubleshooting and planning for change Even when you do everything right, there are elements beyond your control that you may need to address. It could be an issue with the latest update, a discovered vulnerability that requires hardening actions, or an important upcoming change that requires proactive planning. Here is where you can turn for information and assistance: * Known issue documentation on Windows release health – To view details about known and resolved issues for each version of Windows, visit Windows release health on Microsoft Learn or in the Microsoft 365 admin center. * Known issue email alerts – If you'd like to be proactively notified about known issues for the versions of Windows you support in your environment, sign up for email alerts in the Microsoft 365 admin center. Anytime the status of an issue changes, you'll get a notification, including recommended resolution steps. * Feedback Hub – Whether you encounter issues on a Windows client or server device, log the issue, or provide feedback, via Feedback Hub. To help your users do the same, start with our user-friendly guide. * If you need immediate help, please use the Get Help app. If you see devices in your organization not being offered a new version of Windows, use Windows Update for Business reports for insight into the active safeguard holds that are preventing devices from updating or upgrading. For safeguard holds associated with publicly discussed known issues, search Windows release health for the safeguard hold ID on the Known issues page for the relevant release. For more information, see our documentation on Safeguard holds. We'd love your feedback While we do run surveys on our release note and Windows release health experiences, we would love to hear your feedback anytime. How can we improve our documentation and information experiences to make it easier for you to manage updates for your Windows estate? Drop a comment below and keep your ideas and suggestions coming! --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Your Windows release information toolbox: If you manage Windows updates for your organization, you need resources you can rely on for clear, accurate, and up-to-date information. Over the past year, we've rolled out several improvements to the way we document and communicate details… #WindowsITPro

Windows news you can use: June 2025 There are less than four months of Windows 10 support remaining, and hopefully you're on your way to completing the migration to Windows 11. This month, several new Windows 11 capabilities were released. FOMO is real, and migrating to Windows 11 now is the best way to take advantage of new features! We also have great news about hotpatching, which is now available for non-Azure Windows Servers. Speaking of hotpatching, July is a baseline month. If you haven't configured your Windows 11, version 24H2 PCs for hotpatch updates, it's a great time to do so—they'll be ready for the next hotpatch update month in August. What else is new? Glad you asked—keep reading to find out! New in Windows update and device management * [25H2] Get ready for Windows 11, version 25H2—available now to the Windows Insider community in advance of broader availability in the second half of 2025. Discover how enablement packages (eKBs) help you update devices to the next version of Windows with a single restart that reduces downtime. * [SECURE BOOT] Take action now to prepare for the expiration of Secure Boot certificates in June 2026. Learn which new certificates will be available in the coming months to maintain UEFI Secure Boot continuity. * [ROADMAP] Interested in upcoming enhancements for improved Windows Search or accessibility or other features? Simply use the feature filter in the Windows Roadmap to navigate to the newest Windows 11 features and enhancements most relevant to you.  * [WINDOWS AUTOPATCH] Ready to simplify Windows Autopatch permissions management with role-based access control? Learn how to configure RBAC for Windows Autopatch and build on existing Microsoft Intune roles, permissions, and scope tags to manage Windows updates flexibly and securely. * [W365] Windows 365 Cloud Apps are now in private preview. Discover more about Windows 365 Cloud Apps—a new way to securely stream Windows apps to any device. * [INTUNE] Take action: Update Intune SCEP certificate profiles. All public Certification Authorities (CAs) will enforce new S/MIME Baseline Requirements by July 16, 2025. Avoid certificate request rejections by complying with new attribute requirements. * [AUTOPILOT] Don't miss this step-by-step tutorial for configuring Windows Autopilot device preparation in automatic mode for Windows 365 in Microsoft Intune. New in Windows security * [RESILIENCY] The Windows Resiliency Initiative (WRI) is a proactive, focused effort designed to embed resilience and security into the Windows platform. Discover resources to help you take action at your organization to build resilience for a future-ready enterprise. * [REMEDIATION AGENT] Identify Common Vulnerabilities and Exposures (CVEs) on your managed devices using data from Microsoft Defender Vulnerability Management and the Vulnerability Remediation Agent for Security Copilot in Microsoft Intune. Learn more about the agent and gain access to the limited public preview. * [SECURE BY DEFAULT] Enhanced secure by default capabilities for newly provisioned and reprovisioned Windows 365 Cloud PCs are coming soon. Capabilities include disabled by default redirections and enabled by default virtualization-based security (VBS) and more. * [SUVP] The Security Update Validation Program (SUVP) tests the compatibility of Microsoft products and security updates for usability, bugs, and more before releasing the update to the public. New in AI * [COPILOT] Dive into the Copilot Control System, a framework designed to help IT admins and business leaders secure data, manage Copilot and agent experiences, and measure adoption and impact. Access on-demand sessions and PowerPoint presentations from the event. * [M365 COPILOT] For the latest features and improvements for Microsoft 365 Copilot, see the release notes. Install the June 2025 security update for Windows 11, version 24H2 and version 23H2 to get these capabilities. * [COPILOT ON WINDOWS][24H2][23H2] Open Copilot on Windows with Windows key+C. You can personalize your Copilot key and Windows key+C experience at any time with the existing “Customize Copilot key on keyboard” under Settings > Personalization > Text input. For additional information, see Updated Windows and Microsoft 365 Copilot Chat experience. * [COPILOT ON WINDOWS][24H2][23H2] Start Press to talk with Copilot on Windows by holding the Copilot key—or Windows key+C—for two seconds. Press Esc or stay silent for a few seconds to end the call. Use Alt + Spacebar to talk with Copilot on Windows. Learn about new capabilities for Copilot+ PCs in the release notes. New in Windows Server For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes. * [HOTPATCH] Hotpatching for Windows Server 2025 is now available as a subscription service for Windows Servers outside of Azure. Get details about pricing and learn more about the feature. If you were using Azure Arc-enabled hotpatching for Windows Server 2025 during the preview and don't want to continue, be sure to disenroll from the service. Note: Hotpatching in Windows Server Datacenter: Azure Edition remains free of charge. New in productivity and collaboration For the latest features and improvements, which are now broadly available, see the June 2025 security update release notes for Windows 11, version 24H2 and version 23H2. Refer to the May 2025 non-security preview update for Windows 11, version 24H2 and version 23H2 for additional details and a comprehensive list of new features and improvements. Here are the highlights: * [CROSS DEVICE RESUME]​​​[24H2]​ Resume working on OneDrive files from your phone (Android and iOS) on your Windows 11 PC with a single click. Just respond to a notification inside the OneDrive file that you viewed or edited on your phone within the five minutes prior to unlocking your PC. * [VOICE ACCESS][24H2] You can now find Voice Access under Accessibility in Quick Settings. Voice Access also now includes an in-product experience that highlights new features and improvements. * [TASKBAR][24H2][23H2] Configure taskbar policies so users can unpin specific apps and ensure they aren't repinned during the next policy refresh. To turn on this feature, use the new PinGeneration option. * [SETTINGS][24H2][23H2] Find answers to questions about your PC and Windows 11 in the new FAQs section under Settings > System > About page. Topics include system setup, performance, compatibility, and more. Additional new Settings capabilities are available only for Windows 11, version 24H2. Install the June 2025 non-security preview update for Windows 11, version 24H2 and version 23H2 to get features and improvements ahead of next month's security update. Review the release notes for a comprehensive list of these new features, some of which might be rolled out gradually. Here are the highlights: * [TASKBAR][24H2] The taskbar now resizes icons to fit more apps when space runs low, keeping everything visible and easy to access. * [SETTINGS][24H2] The Settings homepage that you manage now includes cards tailored for enterprise use. * [START][24H2] The Configure Start Pins policy now includes an option to apply Start menu pins only once. * [SHARE][24H2][23H2] When you share links or web content using the Windows share window, you'll see a visual preview for that content. * [ACCESSIBILITY][24H2] In addition to the new grouping of the Accessibility menu in Quick settings, there are text descriptions for the assistive technologies like Narrator, Voice access, and more for easier identification and learning. * [SETUP][23H2] Configure whether a new device gets critical updates during the out-of-box experience (OOBE). Lifecycle milestones Review lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025. * [WIN10 EOS][REMINDER] Windows 10 end of support (EOS) is now four months away. Find resources to help you get ready for Windows 10 end of support coming up on October 14, 2025. This resource hub includes important reminders, guides, interactive assessments, and customer testimonials. Choose among several ways to transition to Windows 11, check if current devices are eligible for the upgrade, purchase new PCs as part of your refresh cycle, and learn more about the Extended Security Updates (ESU) program. For extra insights, watch the on-demand Technical Takeoff session to bust myths and misconceptions around Windows 10 EOS. * [WIN10 EOS][IOT] Some Windows 10 IoT Enterprise versions are impacted by Windows 10 end of support (EOS) on October 14, 2025. To learn more about which devices will and won't be impacted, see Windows 10 EOS for Windows IoT Enterprise. Windows preview opportunities Interested to know about what's coming to Windows or be the first one to try it? * Visit the Windows Roadmap! It's a dynamic way to see what Windows features and applications are in preview, which ones are gradually rolling out, and when they become broadly available. Just filter by platform, version, status, and channel or search by feature name! * Read the Windows Insider Blog for details on what's available in the Canary, Dev, Beta, or Release Preview Channels. Many new features are rolled out gradually and belong to different build versions. If you want to be the first to get features, you can turn On the toggle to get the latest updates as they are available via Settings > Windows Update. * Check out Windows Server Insider news for preview opportunities. We're looking to make this monthly summary more helpful to you! Please drop us a note below and let us know what information you most want to hear about. Thanks for reading and we'll be back next month for even more news you can use!   --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: June 2025: There are less than four months of Windows 10 support remaining, and hopefully you're on your way to completing the migration to Windows 11. This month, several new Windows 11 capabilities were released. FOMO is real, and migrating to Windows 11… #WindowsITPro

Get ready for Windows 11, version 25H2 How easy is it to move to Windows 11, version 25H2? As easy as a quick restart if you're on version 24H2! Today, Windows 11, version 25H2 became available to the Windows Insider community, in advance of broader availability planned for the second half of 2025. Get ready for a reset of the 36-month support lifecycle for Enterprise and Education editions and the 24-month lifecycle for Pro, Pro Education, and Pro for Workstation editions! As easy as restarting: The benefits of the shared servicing branch Over the years, you've experienced regular optimizations to the development and servicing of each version of Windows. Your installations are faster, and your experiences are more seamless. That's because combined servicing stack updates (SSUs) with latest cumulative updates (LCUs) have reduced package size by 40%. One of the most significant improvements that make these benefits possible is the Windows shared servicing branch. This capability applies the same technology used for the monthly update process to the annual feature updates. For you, it's a familiar, fast, and reliable update experience. This process is called "feature updates via servicing," and the updates are implemented through enablement packages (eKB). An eKB is an update package that helps update a device to the next version of Windows with a single restart that reduces downtime. Note: Not all Windows versions share the same servicing branch. The first update that used this process was from Windows 10, version 1903 to Windows 10, version 1909. To learn more, download and read the whitepaper Windows updates and the shared servicing model. Moving from Windows 11, version 24H2 to version 25H2 Windows 11, version 24H2 and version 25H2 use a shared servicing branch. Here's what this means for your update experience. New features we develop for Windows 11, version 25H2 are part of the version 24H2 branch. When the new code is complete, we include it in the monthly LCUs for Windows 11, version 24H2 in a Disabled state. Think of it as having the new feature code slowly staged on devices running version 24H2—yet another reason to stay up to date with monthly Windows updates! The code remains disabled on the device until it receives the eKB. The eKB changes flags in the staged code from Disabled to Enabled. When you restart the device, the new features become enabled, and you're officially on Windows 11, version 25H2! A flowchart illustrating an update from Windows 11, version 24H2 to version 25H2. To confirm that the update took place, check your version and OS build number in Windows Settings > System > About. Windows 11, version 24H2 and version 25H2 share the same source code, with only the additional features turned on. Therefore, there should be no impact on compatibility between the two. This doesn't mean that you shouldn't test, but you can focus your tests on the new features rather than a full complement of OS, application, or device compatibilities. Moving from earlier versions to Windows 11, version 25H2 Since versions earlier than Windows 11, version 24H2 do not share the same servicing branch as Windows, version 25H2, the simple update via an eKB isn't possible. The normal feature update process is the best option. Use Windows Update or Windows Autopatch. For Windows 10 devices or for new Windows 11 devices that you're deploying, first upgrade them to Windows 11, version 24H2 to make the transition to version 25H2 as simple and quick as possible when it's available. Stay protected and productive with Windows 11, version 25H2 Whichever way you get to Windows 11, version 25H2, devices will benefit from a fresh support lifecycle, which begins on the date of its general availability: Windows 11 Edition Lifecycle Windows 11 Enterprise Windows 11 Enterprise multi-session Windows 11 Education Windows 11 IoT Enterprise 36 months from release date Windows 11 Pro Windows 11 Pro Education Windows 11 Pro for Workstations Windows 11 Home 24 months from release date Interested in previewing the upcoming features? Enroll in the Windows Insider Program and join the Dev Channel today. Plan more effectively with the help of additional resources: * Plan for Windows 10 EOS with Windows 11, Windows 365, and ESU * What is an enablement package? * Download Windows updates and the shared servicing model from Official Microsoft Download Center * Windows Insider Blog * Search product and services lifecycle information We wish you smooth Windows updates now and in the future! --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Get ready for Windows 11, version 25H2: How easy is it to move to Windows 11, version 25H2? As easy as a quick restart if you're on version 24H2! Today, Windows 11, version 25H2 became available to the Windows Insider community, in advance of broader availability planned for the… #WindowsITPro

Act now: Secure Boot certificates expire in June 2026: Prepare for the first global large-scale certificate update to Secure Boot.


The Microsoft certificates used in Secure Boot are the basis of trust for operating system security, and all will be expiring beginning June 2026. The… #WindowsITPro

SUVP provides key testing of security updates prior to release The Security Update Validation Program (SUVP) is a quality-assurance testing initiative focused on Microsoft monthly security updates, which are released on the second Tuesday of each month (commonly known as Patch Tuesday). SUVP partners test these security updates prior to their release and provide feedback on usability, bugs, and results. This meticulous testing helps ensure security updates are ready to be made available to the public. Program overview Eligibility: Trusted partners under non-disclosure agreements (NDAs). All nominees must pass a stringent validation process before sharing any data. Scope: Includes any Microsoft product with a vulnerability fix (e.g., Windows, some Microsoft 365 apps, Microsoft Exchange, Microsoft SQL Server, etc.). Note: SUVP tests the compatibility of Microsoft products and security updates. It is not a vulnerability testing program. SUVP does not disclose any information regarding vulnerabilities, and reverse engineering of security updates is not allowed. Cost: Participation is free.  Benefits:  * Early availability of updates to test compatibility * Timely access to updates to help ensure seamless, rapid deployment of security updates and critical infrastructure * Direct assistance from product groups to resolve issues encountered during testing  * Advanced knowledge of potential support issues  Testing cycle Each month’s testing cycle, known as a “test pass,” begins up to one month prior to the update. Updates are continuously made available during the three to four week testing cycle. Prerelease security updates are available for download and testing through a secure site. If issues arise, feedback can be submitted through the methods provided by the SUVP team. Issues will then be escalated to the engineering team for resolution. Program requirements * Testers must provide feedback on the overall status of the update.  * If issues arise, testers must notify SUVP.  * Testing is required only for products relevant to the partner’s environment.  Additional information Considerations: There is no penalty for not testing consecutively. However, if there is consecutive nonparticipation, that will need to be addressed. If you are unable to test for more than three months but wish to remain in the program, please inform SUVP. Retrieving updates: SUVP provides secure methods for organizations to download and deploy prereleased security updates to your testing environment. Get started To express interest in joining the program, please first send an email to suvp@microsoft.com. The SUVP team will review and respond within one week. Approved participants must sign a SUVP contract and an NDA (if one is not currently in place with Microsoft). For questions, please contact us at suvp@microsoft.com.  --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

SUVP provides key testing of security updates prior to release: The Security Update Validation Program (SUVP) is a quality-assurance testing initiative focused on Microsoft monthly security updates, which are released on the second Tuesday of each month (commonly known as Patch… #WindowsITPro

Enhanced security defaults for Windows 365 Cloud PCs Today, we're excited to share details about two new secure by default capabilities for Windows 365 Cloud PCs. At Microsoft, security is our top priority, and by embedding Microsoft-recommended security settings, we make security a foundational part of the cloud experience. These capabilities for newly provisioned and reprovisioned Windows 365 Cloud PCs include: * Disabling by default redirections for clipboard, drive, USB, and printer. * Enabling by default virtualization-based security (VBS), Credential Guard, and hypervisor-protected code integrity (HVCI) for Windows 365 Cloud PCs running a Windows 11 gallery image. Select redirections disabled for newly provisioned and reprovisioned Cloud PCs Windows 365 is enhancing Cloud PC security by having clipboard, drive, USB, and printer redirections disabled by default for all newly provisioned and reprovisioned Cloud PCs. This change minimizes the risk of data exfiltration and malware injections, which provides a more secure experience and aligns with the Microsoft Secure Future Initiative (SFI) principle to have security protections enabled and enforced by default. Note: These redirection defaults are also being applied to newly created host pools for Azure Virtual Desktop. Default setting changes begin rollout soon This change will begin gradually rolling out in the second half of 2025. To help IT admins prepare, a banner (shown in the screenshot below) will be displayed in the Microsoft Intune Admin Center on the provisioning policy, individual device action, and bulk action pages. This banner will notify you of the new default settings for newly provisioned or reprovisioned Cloud PCs and link to documentation on how to override them by creating Intune device configuration policies or Group Policy Objects (GPOs). On the "Create a provisioning policy" page in the Microsoft Intune admin center, a dismissible banner provides notifications about the new redirection defaults. Newly provisioned or reprovisioned Windows 365 Cloud PCs will have clipboard, drive, USB, and printer redirections disabled by default. For example, a user accessing files on a newly provisioned Cloud PC will not be able to use the clipboard to copy files from the Cloud PC to their physical device and vice versa. Note: USB redirections are disabled by default, but USB mice, keyboards, and webcams will not be affected. These devices are managed through high-level redirection, which targets specific functionalities rather than the entire device. The disabled USB redirection specifically targets opaque low-level redirection for niche devices not supported by high-level redirection. USB redirections for devices that support high-level redirection will continue to work. For more information on supported resources or peripherals and the recommended redirection method to use for each, please visit this documentation. Reprovisioning flow for Windows 365 Frontline Cloud PCs in shared mode When existing Windows 365 Frontline Cloud PCs in shared mode are reprovisioned directly from the device overview page as shown below, the new redirection defaults will not occur because the existing provisioning policy, which has these four redirections enabled by default, still stands. From the device overview page, reprovisioning will not enable the new redirection defaults because existing policies are in place. If the IT admin wants existing Windows 365 Frontline Cloud PCs in shared mode to receive these new redirection defaults, they need to be reprovisioned from the provisioning policy page by selecting the Reprovision button as shown below. Please note if you select Schedule Reprovision, you will need to schedule the reprovisioning to take place after the new defaults go live. From the provisioning policy page, you can reprovision and enable the new redirection defaults. Manually enable redirections for new Cloud PCs as needed After the rollout begins, if IT admins want users to have one or more of the four redirections enabled, they will need to manually revert the redirection settings. Note: When new Cloud PCs are provisioned, the new defaults for disabling redirections will be applied. Subsequently, Intune will sync and implement the IT admin’s desired settings from the existing policies, overriding the default configurations. This process assumes that the new Cloud PC is being added to an existing group that has been assigned to the relevant policy. IT admins can manage settings in two ways: * In the Intune Settings Catalog * In the GPO If you need to revert redirection settings, you can use your established management controls. Alternatively, you can take advantage of the Intune built-in device groups and filters. This is the quickest way to revert the redirection settings and enable them for your organization’s Cloud PCs. For detailed instructions, refer to the section "Use the 'All devices' group and device filters" in Application deployment in Windows 365: recommended practices. This change to clipboard, drive, USB, and printer redirections being disabled by default may impact user workflows, so we recommend that you communicate this update to your teams and Windows 365 users. Additionally, we recommend that you provide instructions for requesting redirection enablement as appropriate. For additional information on the post-provisioning process, visit the Windows 365 post-provisioning configuration documentation. VBS, Credential Guard, and HVCI are enabled by default for new Cloud PCs running a Windows 11 gallery image Since May 2025, all newly provisioned and reprovisioned Windows 365 Cloud PCs running a Windows 11 gallery image have VBS, Credential Guard, and HVCI enabled by default. This "System Information" on your device shows that VBS is running and that Credential Guard and HVCI, which use VBS, are running as intended. * VBS uses hardware virtualization to create a secure memory enclave that helps protect critical system processes from advanced threats and malicious exploits. To learn more, visit our VBS documentation. * Credential Guard uses VBS to secure authentication credentials, minimizing the risk of theft and lateral attacks. To learn more, visit our Credential Guard documentation. * HVCI/memory integrity allows only verified code to run at the kernel level, preventing malicious exploits. To learn more, visit our HVCI/memory integrity documentation. These changes will strengthen protection against credential theft and kernel-level exploits, enhancing the Cloud PC security without requiring manual configuration. Learn more about Windows 365 security For an overview of security controls and concepts in Windows 365, visit our documentation. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Enhanced security defaults for Windows 365 Cloud PCs: Today, we're excited to share details about two new secure by default capabilities for Windows 365 Cloud PCs. At Microsoft, security is our top priority, and by embedding Microsoft-recommended security settings, we make security a… #WindowsITPro

Windows 365 Cloud Apps now in private preview Since the launch of Windows 365 in 2021, organizations have embraced the ability to securely stream a full Windows desktop experience to any device, anywhere. Now, we're expanding that flexibility with the Windows 365 Cloud Apps feature—a new way to help securely deliver the apps users need. What is Windows 365 Cloud Apps? The newly announced Windows 365 Cloud Apps feature allows administrators to give users secure access to individual apps hosted on a Cloud PC, without requiring a dedicated Cloud PC for every user. Windows 365 Cloud Apps is designed for enterprise customers whether they're experienced with virtual desktop infrastructure (VDI), already using Windows 365, or just starting their journey. It also gives IT teams more flexibility to support a range of user needs and scenarios, while maintaining centralized control. Organizations can use Windows 365 Cloud Apps to: * Streamline app delivery for frontline, seasonal, or remote workers. * Provide information workers with the line-of-business apps they require. * Simplify management with Windows 365 and Microsoft Intune integration. * Accelerate migration from on-premises VDI to the cloud. Windows 365 Frontline licenses entitle organizations to stream Windows 365 Cloud Apps when operating Cloud PCs in shared mode. For more information on Windows 365 Frontline in shared mode, see the documentation. Windows 365 Cloud Apps setup – the IT admin experience Deploying Windows 365 Cloud Apps is as simple as any Windows 365 setup. First, admins need to create a provisioning policy with the new "app-only" experience type. The provisioning policy determines where Cloud PCs are created, how many are provisioned, and which group of users gets access. The new "experience" type lets admins choose whether users receive a full desktop or app-only experience. Example of a Windows 365 provisioning policy setup for Windows 365 Cloud Apps in Microsoft Intune The Windows 365 Frontline Cloud PCs that are assigned to the policy will be shared among a group of users, and the number of licenses determines the maximum number of users that can connect at the same time. In the example below, two Frontline licenses in shared mode are allocated to this policy, resulting in two Cloud PCs. Only one user will be able to connect to each Cloud PC at a time, but the Cloud PCs are shared non-concurrently among all users assigned to the policy. Cloud PCs provisioned in shared mode for Windows 365 Cloud Apps in Microsoft Intune Once the provisioning policy and Windows 365 Frontline Cloud PCs in shared mode are set up, admins can begin publishing apps for end users to access. Any security policies applied to the underlying Cloud PCs will also be applied to the streamed applications. View of streamable apps in the Windows 365 blade in Microsoft Intune During private preview, the Windows 365 Cloud Apps feature will only support streaming apps discovered from the Start menu of the gallery or custom images. Additional sources for Windows 365 Cloud Apps will be supported as the feature moves toward general availability. Windows 365 Cloud Apps access – the end-user experience Once deployed, users can access Windows 365 Cloud Apps from Windows App, the gateway to securely connect to Windows on any device across Windows 365, Azure Virtual Desktop, Remote PC, Remote Desktop Services, Microsoft Dev Box, and more. When a user connects to any of the apps published from a policy, they are connected to one of the provisioned Windows 365 Frontline Cloud PCs in shared mode, streaming only the apps in their local device—without loading the full desktop environment. Windows App with Microsoft Edge, Microsoft Outlook, and Microsoft Word available as streamed apps For example, if a user connects to both Microsoft Edge and Microsoft Word, both apps will run from the same underlying Cloud PC and use an available Windows 365 Frontline license. One additional user can connect at the same time. When connecting from Windows App on Windows, cloud-delivered apps look just like local apps, seamlessly integrating with users' local desktops. Microsoft Edge and Microsoft Word as streamed applications, integrated with the user’s local Windows desktop Join the Windows 365 Cloud Apps preview The Windows 365 Cloud Apps feature is currently in preview. Complete this form or contact your Microsoft account team to express interest in participating in the preview. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Windows 365 Cloud Apps now in private preview: Since the launch of Windows 365 in 2021, organizations have embraced the ability to securely stream a full Windows desktop experience to any device, anywhere. Now, we're expanding that flexibility with the Windows 365 Cloud Apps feature—a… #WindowsITPro

How to configure RBAC for Windows Autopatch With role-based access control (RBAC), you can now help your organization better manage access permissions to Windows Autopatch resources! Help control who can do what to which devices in distributed organizations to manage Windows updates in a more flexible and secure way. Read on to see how you can build on your existing Microsoft Intune roles, permissions, and scope tags. What's RBAC in Windows Autopatch? RBAC is an access model that helps protect your organizational resources. Have you used it to help ensure least privileged access across your Windows ecosystem? You've been able to apply this model to Microsoft Intune, networking, Microsoft Defender, and more. Now, RBAC has expanded to all capabilities in Windows Autopatch. It began gradual rollout at the end of May 2025. Windows Autopatch is a cloud service designed to automate updates for Windows, Microsoft 365 apps for enterprise, Microsoft Edge, and Microsoft Teams. Use it to quickly and easily keep Windows devices secure and up to date by reducing vulnerabilities and threats with the latest updates from Microsoft. If you're part of a larger, more distributed organization with delegated administration, you might have struggled with enforcing least privileged access to further enhance security. Not anymore! New RBAC capabilities in Windows Autopatch integrated with Intune roles now enhance your update management administration including read-only access and scope of control. Use RBAC in Windows Autopatch To use RBAC in Windows Autopatch, assign the appropriate roles with the right administrative permissions. Optionally, you can also apply scope tags. Here's how. Assign the appropriate roles To manage updates with Windows Autopatch at an advanced level with full access, you need both of the following roles: * Policy and profile manager: This Intune role includes device configuration permissions for managing policies, including Windows Autopatch policies. * Windows Autopatch administrator: This new role includes permissions necessary to access and manage Windows Autopatch groups, Windows Autopatch reports, support requests, and service-related messages. Note: See the next section for additional Microsoft Entra permissions required to create Windows Autopatch groups. Now you can assign limited permissions to other admin users. Assign the following roles to support least privileged access to the Windows Autopatch resources in Intune: * Windows Autopatch reader: This new role includes read-only permissions necessary for Windows Autopatch groups, Windows Autopatch reports, support requests, and messages. It does not permit any changes. * Alternately, you can create two custom Intune roles that include any permissions that meet the requirements of the job function. Find more about how to create custom roles in Windows Autopatch and in Microsoft Intune. Windows Autopatch also supports access via Microsoft Entra roles. Find details at Role-based access control.   Assign administrative permissions for Windows Autopatch groups Both of the following permissions are required to set up RBAC to manage Windows Autopatch groups: * Device configuration permissions (assign, create, delete, read, update, view reports). You need these device configuration permissions to manage Intune policies. * Windows Autopatch group permissions (read, create, edit, delete). Use a combination of permissions for the Windows Autopatch group's experience. Important: To create a Windows Autopatch group, you'll also need permissions to create Microsoft Entra groups. If you don't have them, you won't be able to create groups when logged in. For more information, see How to set up self-service group management or Create groups permissions. Check that you have these permissions: * In the Microsoft Intune admin center, select Tenant administration in the left pane. * Under Roles, select My permissions. * Review the category of your permissions in the Resource column and the specific actions you can take in the Permission column. Screenshot of the Microsoft Intune admin center showing My permissions under Intune roles. When you create Windows Autopatch groups and assign devices, Windows Autopatch automatically creates necessary and required software update policies. They're based on the deployment settings and update types you choose. Apply Intune scope tags as needed Your roles and permissions give you access to Windows Autopatch reports, while scope determines what you can see in reports. If you've already created scope tags in Intune, you can now apply them to Windows Autopatch resources. Windows Autopatch respects any changes you make to scope tags, which are regularly synced from Intune. If you don't apply scope tags, admin users can view everything. If you do, here's what you can expect: * You can see devices that match a scope tag defined in your role assignment. * Device scope determines which devices you see in Windows Autopatch reports. * For completeness, the report includes the name of the Windows Autopatch group to which the devices belong, even if you don't have permission to manage it. So, what happens when you assign a scope tag to a Windows Autopatch group? * Update policies created in the Windows Autopatch group workflow inherit that scope tag. * Devices included in the Windows Autopatch group do not inherit the scope tags. This preserves your device scope assignment.   * Admins with matching scope can manage the Windows Autopatch groups. This prevents unintended modifications to your ring-based deployments that could potentially result in accidental deployments. * Admins with any of the assigned scope tags can view the Windows Autopatch group. The policy and profile manager role must have at minimum the same scope tags that are assigned to the Windows Autopatch administrator role. It's necessary to keep them in sync to successfully apply the update policies to Windows Autopatch groups. Note: Windows Autopatch respects Intune scope tag details that apply to Windows devices. You can also apply scope tags to policies. Manage Windows Autopatch groups as a scoped admin If you typically manage updates for specific locations, geographies, etc., you're a scoped admin, and you'll use scoped groups. As such, you'll be able to create and manage Windows Autopatch groups and manage updates for devices that are in your scope with a few additional steps. When you create a Windows Autopatch group, you also create a new Microsoft Entra group. However, the Windows Autopatch group will only become available for use after it's added to your role as a scoped group. Until then, you'll see the status of any Windows Autopatch group as “pending assignment.” This means: * The Windows Autopatch group, its deployment rings, and the software update policies have been created. * The Windows Autopatch policies are not assigned to the deployment rings because the Windows Autopatch group is not in your scoped group. * Windows Autopatch has created a parent scope group to facilitate administrative steps. * An Intune role administrator or Intune service administrator must include this group as a scoped group, in the role with device configuration permissions. Until this is done, policy assignment will remain blocked. Manage control role-based access to Windows Autopatch Windows Autopatch can now provide granular permissions with built-in Intune roles to securely manage Windows updates. Together with your existing RBAC, take full advantage of managing updates while sharing update management across geographically distributed teams. Here are some examples of how you can adapt this solution to your organizational context: * Consider granting your support and help desk teams with read-only access to areas of Windows update management that can make them successful. * Create a custom role in Windows Autopatch and include only the permissions required for administration of support teams. To learn more, check out Improved role-based access controls in Windows Autopatch and its accompanying documentation. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

How to configure RBAC for Windows Autopatch: With role-based access control (RBAC), you can now help your organization better manage access permissions to Windows Autopatch resources! Help control who can do what to which devices in distributed organizations to manage Windows updates… #WindowsITPro

Improved role-based access controls in Windows Autopatch Role-based access control (RBAC), a permissions capability that provides granular control over update management, has expanded within Windows Autopatch for organizations using Microsoft Intune. We made this change in response to feedback and requests from Windows Autopatch community members wishing to distribute update management and increase read-only access. RBAC now addresses both of these concerns. These improvements to RBAC in Windows Autopatch became generally available in late May 2025. The rollout is expected to be complete by the end of June 2025. Keep reading to learn more about: * The benefits of RBAC with Windows Autopatch. * New Windows Autopatch reader and administrator roles in Intune. * Using existing Intune scope tags with Windows Autopatch RBAC roles. Benefits of RBAC with Windows Autopatch RBAC helps strengthen your organization's security by providing more granular control over update management. With RBAC, you can target and distribute update management to specific people or groups. This reduces central administration bottlenecks while maintaining consistent security and compliance standards. RBAC's expansion within Windows Autopatch offers several improvements. Benefits include the ability to: * Authorize roles and assign permissions to specific people. * Expand or narrow read-only privileges. * Enforce least privilege access by aligning to user responsibilities. * Delegate update management to local or functional teams. These capabilities are especially useful to organizations with geographically distributed models. For example, if an organization has European and North American offices, they may also have different IT teams for each region. Now, each team can be made invisible to the other, helping to prevent an overshare of information or accidental change management. Two roles with Windows Autopatch Windows Autopatch has added two new RBAC roles that enable least privileged access for Windows Autopatch features that include groups, reports, and support requests and messages. This change allows Intune users to either read or act based on their level of permission for all Windows Autopatch features.  * Windows Autopatch reader provides read-only access to the features listed above. * Windows Autopatch administrator provides the necessary permissions to operate the features listed above. Intune device configuration permissions are still needed to manage Windows update policies. For update management, use the above roles in addition to the policy and profile administrator Intune role that you are already using. This gives you the permissions needed to manage update policies. Will existing Intune scope tags be affected? When assigning a role, you select which users and devices those permissions apply to using Intune scope tags. Once that role and scope are applied, that administrator can only see or act on devices in that scope. Intune scope tags will be respected for reports and management to prevent oversharing information. You will also be able to assign Intune scope tags to Windows Autopatch groups and filter reports based on scope tags. Existing scope tags in Microsoft Intune will not be affected. You may either reuse your existing scope tags or create new ones as you see fit. Learn more * Visit the Learn pages for Windows Autopatch to find answers to frequently asked questions about Windows Autopatch. * For more about RBAC and Windows Autopatch, visit the Role-based access control documentation. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Improved role-based access controls in Windows Autopatch: Role-based access control (RBAC), a permissions capability that provides granular control over update management, has expanded within Windows Autopatch for organizations using Microsoft Intune. We made this change in response… #WindowsITPro

Windows news you can use: May 2025 Just like this monthly newsletter, Microsoft Build highlighted the latest on Windows, AI, management, security, and more. Sessions from Microsoft Build are now available on demand. For an overview, don't miss An IT pro's guide to Windows at Microsoft Build 2025. If you're a developer, read Advancing Windows for AI development: New platform capabilities and tools introduced at Build 2025. What else is new? Keep reading! New in Windows update and device management * [WINDOWS BACKUP FOR ORGANIZATIONS][PREVIEW] Learn more and apply to participate in the limited public preview of Windows Backup for Organizations. Reduce troubleshooting time and enhance productivity as you transition from Windows 10 to Windows 11. Recover and return to previous settings thanks to saved backups. * [APP UPDATES][PREVIEW] Enroll in the private preview for the Windows Update orchestration platform. It's a unified, intelligent update platform that can support updates for apps, drivers, and more to be orchestrated alongside Windows updates. Learn about how the platform works, benefits for your organization, and how to join the private preview. * [HOTPATCH] Find answers to frequently asked questions about hotpatch for client. Browse hotpatch update definitions, availability of hotpatch updates, testing and error information, and a wealth of hotpatch resources. * [WINDOWS AUTOPATCH] Improve control and consent over data sharing. Use hotpatching to apply immediate security updates without interrupting workflow. Don't miss these updates—and more—about improved reporting and troubleshooting coming to Windows Autopatch in June. * [RBAC] Find out how to improve security and manage granular access to Windows Autopatch resources with the expanded Role-based access controls (RBAC) for Windows Autopatch. Watch for more information as the feature rolls out over the next four weeks! * [WINDOWS APP] Discover enhancements for Windows App—including the Remote App Launcher and new printing capabilities—that will increase efficiencies and ease of use. * [INTUNE] Looking for best practices to set up your Microsoft 365 Business Premium account? Don't miss six new videos that walk through the steps for configuration. These videos are based on the "Enhancing Security with Microsoft 365 Business: A Hands-on, Effective Guide." * [TECH COMMUNITY LIVE] Join Tech Community Live on June 9, 2025! Engineering teams from Windows and Microsoft Intune will be on hand to answer your questions about Windows Autopilot, Microsoft Connected Cache and Delivery Optimization, Windows update and driver management, and Windows and AI experiences. Learn more about the event and add it to your calendar. * [OFFICE HOURS] Have you attended Windows Office Hours yet? Join our continuing series of live Q&A for IT professionals. Product experts, servicing experts, and engineers will be on hand to answer your questions. RSVP for the next Windows Office Hours on June 19, 2025. New in Windows security * [ADMINISTRATOR PROTECTION] Learn how to better run applications and enhance application security with administrator protection enabled. * [AI AGENTS] Learn more about AI agents, Frontier Firms, and how Microsoft extends Zero Trust to secure the agentic workforce. Frontier Firms are organizations characterized by on-demand intelligence and a workforce where humans and agents work together. * [ZERO TRUST] Dive into key learnings from the Microsoft Secure Future Initiative (SFI) and discover ​how SFI brings Zero Trust to life. Apply practical lessons and key takeaways to improve your organization's security posture. * [CYBER SECURITY] Deep dive into SFI's expanded goals, which are guided by three security principles: secure by design, secure by default, and secure operations. These principles align with six prioritized pillars and reflect recommendations made by the Cyber Safety Review Board (CSRB) to Microsoft and all cloud service providers (CSPs). * [PASSKEY] Did you know that May 1, 2025 was the first World Passkey Day? It highlights the industry shift from vulnerable password-based systems to simpler, more secure passkeys. New in Copilot+ PCs and AI Copilot and AI * [MACHINE LEARNING][PREVIEW] Learn about Windows Machine Learning (ML), now in public preview. Windows ML is designed to support developers creating AI-infused applications for the Windows hardware ecosystem. Deep dive into the unified framework, the ONNX Runtime Engine (ORT), and much more about the future of machine learning development on Windows.   * [M365 COPILOT] For the latest features and improvements for Microsoft 365 Copilot, see the release notes. Install the May 2025 non-security update for Windows 11, version 24H2 and version 23H2 to get these capabilities, which are rolling out gradually. * [COPILOT ON WINDOWS][24H2][23H2] Open Copilot on Windows with Windows key+C. You can personalize your Copilot keyand Windows key+C experience at any time with the existing “Customize Copilot key on keyboard” under Settings > Personalization > Text input. For additional information, see Updated Windows and Microsoft 365 Copilot Chat experience. * [COPILOT ON WINDOWS][24H2][23H2] Start Press to talk with Copilot on Windows by holding the Copilot key—or Windows key+C—for two seconds. Press Esc or stay silent for a few seconds to end the call. Use Alt + Spacebar to talk with Copilot on Windows. Copilot+ PCs Install the May 2025 security update for Windows 11, version 24H2 to get these capabilities for Copilot+ PCs. * [RECALL] Use Recall (preview) to quickly find and get back to any app, website, image, or document just by describing its content on Copilot+ PCs. * [WINDOWS SEARCH] With improved Windows search, find your documents, photos, and settings across Windows 11 on Copilot+ PCs. * [CLICK TO DO] Take immediate action on text or images on your screen with Click to Do (preview). Open it with Windows key+mouse click, Windows key+Q, or the Snipping Tool menu. * [SETTINGS] You can now manage which apps Windows recommends actions for by going to Settings > Apps > Actions on Copilot+ PCs. Install the May 2025 non-security update for Windows 11, version 24H2 to get these capabilities, which are rolling out gradually for Copilot+ PCs. * [CLICK TO DO] Use Click to Do (preview) to use Ask Copilot and to perform intelligent text actions such as summarizing, creating a bulleted list, and rewriting text. Click to Do is now available in the European Economic Area (EEA) with new support for Spanish and French. * [IMPROVED WINDOWS SEARCH] Find settings on Copilot+ PCs easier by typing the setting you're looking for in the Windows search box. No need to remember the exact setting name. In the EEA you can now find cloud photos using improved Windows Search on the taskbar. * [ACCESSIBILITY] Use Narrator to ​​​​​​enhance digital accessibility with AI-powered image descriptions of images, charts, and graphs for blind and low-vision users. To turn on Narrator, pressCtrl+Windows key+Enter or search for “Narrator” in Windows search. Use Narrator key+Ctrl+D for image descriptions. Learn about additional new capabilities for Copilot+ PCs in the release notes. New in Windows Server For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes. * [SUMMIT] Interested in the latest Windows Server features and innovations? Get tips to help you strengthen security, build resiliency, improve performance, and simplify management. Don't miss the opportunity to watch sessions from the Windows Server Summit—all now available on demand. * [NANO SERVER CONTAINERS] Take advantage of Features on Demand (FoD) support for Nano Server containers. FoDs bring improved flexibility and functionality to Nano Server containers, helping to overcome the limitations of the Nano Server minimal footprint. FoDs offer a dynamic approach to container image management and enable broader application compatibility. Learn more about these and other benefits. New in productivity and collaboration For the latest features and improvements, which are now broadly available, see the May 2025 security update release notes for Windows 11, version 24H2 and version 23H2. * [PHONE LINK][24H2][23H2] Use Phone Link to access cross-device features between your mobile device and PC. For example, you can make phone calls, send SMS messages, or access your photos. * [NARRATOR][24H2][23H2] Use speech recap in Narrator to quickly access spoken content, follow along with live transcription, and copy what Narrator last said—all with simple keyboard shortcuts. * [FILE EXPLORER][24H2][23H2] Increase productivity with pivot-based curated views on File Explorer Home. Access Microsoft 365 content on Windows with ease. * [WIDGETS][24H2][23H2] If you're a web developer, use your existing content to create interactive widgets and add them to multiple widgets surfaces. See the release notes for the May 2025 non-security preview update for Windows 11, version 24H2 and version 23H2. It includes the following improvements, some of which might be rolled out gradually: * [CROSS DEVICE RESUME]​​​[24H2]​ Resume working on OneDrive files from your phone (Android and iOS) on your Windows 11 PC with a single click. Just respond to a notification inside the OneDrive file that you viewed or edited on your phone within the 5 minutes prior to unlocking your PC. * [ENERGY SAVER][24H2] To configure energy saving settings, go to the Local Group Policy under Computer Configuration > Administrative Templates > System > Power Management > Energy Saver Settings and “Enable Energy Saver to Always Be On.” * [VOICE ACCESS][24H2] You can now find Voice Access under Accessibility in Quick Settings. Voice Access also now includes an in-product experience that highlights new features and improvements. * [TASKBAR][24H2][23H2] Admins can now configure taskbar policies so users can unpin specific apps and ensure they aren't repinned during the next policy refresh. To turn on this feature, use the new PinGeneration option. * [SETTINGS] [24H2][23H2] Find answers to questions about your PC and Windows 11 in the new FAQs section under Settings > System > About page. Topics include system setup, performance, compatibility, and more. Additional new Settings capabilities are available only for Windows 11, version 24H2. * [SEARCH][24H2][23H2] Take advantage of improved support for web search providers, including higher discoverability, in Windows Search for the European Economic Area (EEA). * [SHARE] [24H2][23H2] When you drag a local file from File Explorer or your desktop, a tray will appear at the top of your screen. Drop the file into a suggested app or select More to open the Windows Share window. Additional new Windows Share capabilities are available only for Windows 11, version 24H2. * [WIDGETS][23H2] Discover updates to the new Widgets on Lock experience for devices in the EEA. There are accessibility and craftsmanship improvements, and the Lock screen weather widget now supports customization. Lifecycle milestones Check out our lifecycle documentation for the latest updates on deprecated features in the Windows client and Windows Server 2025. * [VBScript] Prepare for the next deprecation phase of Virtual Basic Scripting Edition (VBScript). Take a look at four scalable, enterprise-ready strategies to detect use and plan mitigation steps across Windows. * [WIN10 EOS][REMINDER] Windows 10 end of support (EOS) is now five months away. Find resources to help you get ready for Windows 10 end of support coming up on October 14, 2025. This resource hub includes important reminders, guides, interactive assessments, and customer testimonials. Choose among several ways to transition to Windows 11, check if current devices are eligible for the upgrade, purchase new PCs as part of your refresh cycle, and learn more about the Extended Security Updates (ESU) program. For extra insights, watch the on-demand Technical Takeoff session to bust myths and misconceptions around Windows 10 EOS. * [WIN10 EOS][IOT] Some Windows 10 IoT Enterprise versions are impacted by Windows 10 end of support (EOS) on October 14, 2025. To learn more about which devices will and won't be impacted, see Windows 10 EOS for Windows IoT Enterprise tech community blog. * [WINDOWS APP] Prepare for the Windows App replacement of Remote Desktop app for Windows. As of May 27, 2025, Remote Desktop app for Windows from the Microsoft Store will no longer be supported or available for download. Windows App will ensure continued access to Windows 365, Azure Virtual Desktop, and Microsoft Dev Box. [Note: this does not apply to the Remote Desktop client standalone installer (MSI).] * [DEVICE METADATA] Device Metadata is being deprecated and will be removed in a future release of Windows. For more information about the replacement for this functionality, see Driver Package Container Metadata. Windows preview opportunities Interested to know what's coming to Windows or be the first one to try it? * Visit the Windows Roadmap! It's a dynamic way to see what Windows features and applications are in preview, which ones are gradually rolling out, and when they become broadly available. Just filter by platform, version, status, and channel or search by feature name! * Read the Windows Insider Blog for details on what's available in the Canary, Dev, Beta, or Release Preview Channels. Many new features are rolled out gradually and belong to different build versions. If you want to be the first to get features, you can turn On the toggle to get the latest updates as they are available via Settings > Windows Update. * Check out Windows Server Insider news for preview opportunities. We're looking to make this monthly summary more helpful to you! Please drop us a note below and let us know what information you most want to hear about. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: May 2025: Just like this monthly newsletter, Microsoft Build highlighted the latest on Windows, AI, management, security, and more. Sessions from Microsoft Build are now available on demand. For an overview, don't miss An IT pro's guide to Windows at… #WindowsITPro

Introducing a unified future for app updates on Windows Developers and product teams of apps and management tools handling update experiences can now sign up for the private preview for the Windows Update orchestration platform. Updates across the Windows ecosystem can feel like a fragmented experience. To solve this, we're building a vision for a unified, intelligent update orchestration platform capable of supporting any update (apps, drivers, etc.) to be orchestrated alongside Windows updates. Let's dive into why we're building a Windows-native update orchestration platform to support all updates on Windows, how the platform works, and how you can sign up for the preview to take advantage of this capability for your app or management tool. Why we built the Windows Update orchestration platform Today, line-of-business apps, Windows components, Visual Studio, and other products are updated independently. There are costs to create, maintain, and improve your update orchestration. And, with dozens of applications using their own update mechanisms, users have fragmented experiences, and IT teams have to work to align policies and operational tasks. This can lead to: * CPU and bandwidth spikes when the device is in use. * Confusing or conflicting notifications. * Missed compliance deadlines. * Added support costs. Built on the Windows Update stack, the orchestration platform aims to provide developers and product teams building apps and management tools with an API for onboarding their update(s) that supports the needs of their installers. The orchestrator will coordinate across all onboarded products that are updated on Windows 11, in addition to Windows Update, to provide IT admins and users with a consistent management plane and experience, respectively. Key benefits of onboarding Developers and product teams that onboard their updates to the orchestrator can take advantage of the following benefits: * Eco-efficient scheduling: Updates are intelligently deferred based on user activity, system performance, connection to AC power, and sustainable times to update. * Simplified notification experience: Updates for apps will be able to use native Windows Update notifications, allowing for a seamless and coherent experience without having to build update notifications yourself. * App update history: The update history for apps can be viewed in Settings, giving users a centralized location to see this information. * Admin policy support for deadlines: Your app or management tool can support admin policy management for deadlines and notifications without having to build these out yourself. * Streamlined troubleshooting: Users can consult a single set of logs and diagnostic data for all updates. * Support for common app packaging types: The orchestrator will support MSIX/APPX and apps with custom implementation such as Win32 apps. * Automatic future enhancements: Products onboarded to the Windows Update orchestrator will automatically get future improvements and capabilities. How the platform works Apps or management tools that are part of the preview will be able to access the Windows Update orchestration platform through a set of Windows Runtime (WinRT) APIs and PowerShell commands. These APIs and PowerShell commands will enable the installer of your app or management tool to: * Register with the orchestrator as an update provider. During registration, you provide the path to an executable file that contains the logic to scan for new updates, which the orchestrator will run on a regular basis. * Tell the orchestrator about updates that need to be scheduled for installation. The APIs define an interface through which you tell the orchestrator information about your update. This includes configurations such as: * * The update title and version. * The update packaging type. * The installation deadline on managed devices. * Whether the update requires a device restart to complete installation. If your app has custom implementation and is not packaged as an MSIX or APPX app (e.g., Win32 app), you can provide the orchestrator with additional information such as: * * Executable files for downloading and installing your application, which the orchestrator will run at optimal times. * Executable files for closing processes that block app installation and relaunching them after installation. From there, the orchestrator takes care of intelligently scheduling the download and installation of your update while displaying notifications when user action is needed. * Tell the orchestrator about the success or failure of the scan, download, and install actions that it scheduled. If the scan, download, or install actions fail, the action will be rescheduled by the orchestrator. If the action succeeds, the orchestrator proceeds with scheduling the next action or marking the update as completed. Join the private preview Are you a developer or member of a product team who builds apps or management tools for updates? Join the private preview to be the first to access these capabilities by onboarding your product's installer via APIs. For more information or to join the private preview, please contact unifiedorchestrator@service.microsoft.com. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Introducing a unified future for app updates on Windows: Developers and product teams of apps and management tools handling update experiences can now sign up for the private preview for the Windows Update orchestration platform.


Updates across the Windows ecosystem can feel like a… #WindowsITPro

Announcing Windows Backup for Organizations Exciting news: Windows Backup for Organizations is now in limited public preview! Have you ever wanted the ability to back up your organization's Windows 10 or Windows 11 settings and restore them on a Microsoft Entra joined device? With Windows 10 reaching its end of support on October 14, 2025 (excluding certain LTSC editions), this new feature can simplify your transition to Windows 11. Whether you're planning a large-scale upgrade or simply looking to enhance your organization's device continuity strategy, this capability helps reduce migration overhead, minimize user disruption, and strengthen device resilience against incidents. Here's what you need to know about the limited public preview of Windows Backup for Organizations. Key benefits of Windows Backup for Organizations First announced at Microsoft Ignite in November 2024, Windows Backup for Organizations offers: * Reduced troubleshooting: Easily reset devices with confidence that users can quickly recover and return to their previous settings. * Seamless experience: Smoothly transition from Windows 10 devices to Windows 11 devices thanks to saved backups. * Enhanced productivity: Minimize downtime and maximize user productivity by restoring user settings to their preferred and familiar PC preferences. Over time, many of your peers have moved toward reducing troubleshooting time before resetting devices. There's an overall greater emphasis on "mean time to productivity." With Windows Backup for Organizations, get your users up and running as quickly as possible with their familiar Windows settings already in place. It doesn't matter if they're experiencing a device reimage or reset. Eligibility for the limited public preview Determine if you're eligible for Windows Backup for Organizations only to back up settings or also to restore them. To use the backup functionality, devices are minimally required to be: * Microsoft Entra hybrid joined or Microsoft Entra joined * Running a current supported version of either Windows 10 or Windows 11 To take full advantage of the feature and also restore settings on new or reimaged Windows devices, check that you have: * Windows 11, version 22H2 and later * Microsoft Entra joined devices * An active Microsoft Intune test tenant (required for this preview) * Microsoft Intune service administrator permissions You also need to be part of Microsoft Management Customer Connection Program (CCP). If you're not a current member, please opt in through this form: aka.ms/JoinMMCCP. What's next? Prepare for the upcoming Windows 10 end of support date on October 14, 2025! Try out Windows Backup for Organizations during the limited public preview. Simply fill in this form to nominate your organization for the program. If selected, you'll receive further steps from our team. Note: While with Windows Backup for Organizations you can easily move to Windows 11 with your settings already in place, there are circumstances that could prevent you from replacing Windows 10 devices before the end of support. Consider your options in Plan for Windows 10 EOS with Windows 11, Windows 365, and ESU. To learn more about Extended Security Updates (ESU), please visit When to use Windows 10 Extended Security Updates. This is just the beginning. As we continue to evolve this experience, more enhancements are on the horizon—ensuring your organization is always ready for what's next. Your feedback is invaluable as we shape the future of Windows Backup for Organizations and roll out exciting new features. Thank you for partnering with us to make Windows even better! --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Announcing Windows Backup for Organizations: Exciting news: Windows Backup for Organizations is now in limited public preview!


Have you ever wanted the ability to back up your organization's Windows 10 or Windows 11 settings and restore them on a Microsoft Entra joined device? With… #WindowsITPro

An IT pro’s guide to Windows at Microsoft Build 2025 This week at Microsoft Build, audiences will hear how Windows is the best platform for developers and see how we are building Windows for this new era of AI, with intelligence integrated across software, silicon and hardware. Here is a quick recap of the big announcements for Windows developers—and a guide to some of the sessions that will take you deeper into the details. New platform capabilities and tools for Windows developers * Windows Copilot Runtime has evolved into Windows AI Foundry, a unified platform that supports the AI developer lifecycle and provides developers quick access to ready-to-use open-source models on diverse Windows silicon. * Windows ML is the foundation of our AI platform and is the built-in AI inferencing runtime, offering simplified and efficient model deployment across CPUs, GPUs and NPUs. Build directly into Windows, Windows ML enables developers to ship production applications without needing to package ML runtimes, hardware execution providers, or drivers with their app. * The latest release of the Windows App SDK (version 1.7.2) offers ready-to-use AI APIs powered by Windows inbox models for key tasks like text intelligence and image processing, including language APIs like text summarization and rewrite, and vision APIs like image description, text recognition (OCR), image super resolution and image segmentation. * With the Virtualization-based Security (VBS) Enclave SDK, currently in preview, and new post-quantum cryptography (PQC) capabilities, it’s now easier for developers to develop secure solutions in an evolving threat landscape. * The Microsoft Store now offers free developer registration, Web Installer for Win32 apps, new analytics reports, and other features to help app developers expand discovery and engagement on Windows. * Finally, soon in preview in the Windows Insider Program are advanced Windows Settings that allow developers and other power users to more easily control and personalize their Windows experience. To learn more about these and other innovations announced today, see Advancing Windows for AI development: New platform capabilities and tools introduced at Build 2025. Windows sessions at Microsoft Build 2025 While labs and demos are available for in-person attendees only, Microsoft Build offers four days of breakout sessions that you can watch live or on demand. Registration for the digital experience is free so click here to register for access to the full schedule, the featured partner directory, and some cool digital swag, plus the ability to save your favorite sessions to revisit later. Start off your Microsoft Build experience with Satya Nadella and Microsoft leaders, as they share how Microsoft is creating new opportunities across our platforms in this era of AI with the Microsoft Build opening keynote then dive in to learn more throughout the week. Monday, May 19 * 1:30 PM PDT  |  8:30 PM UTC An overview of Windows AI Foundry * 3:00 PM PDT  |  10:00 PM UTC Unlock agentic interactions for your apps using MCP on Windows * 4:30 PM PDT  |  11:30 PM UTC Bring your own model to Windows using Windows ML Tuesday, May 20 * 11:45 AM PDT  |  6:45 PM UTC Boost your app's reach and engagement with AI via App Actions on Windows * 3:00 PM PDT  |  10:00 PM UTC Fastest & easiest way to integrate AI using Windows AI APIs Wednesday, May 21 * 3:30 PM PDT  |  10:30 PM UTC Boost your development productivity with Windows latest tools and tips Thursday, May 22 * 8:30 AM PDT  |  3:30 PM UTC Simplify dev setup with WinGet & Microsoft Desired State Configuration * 8:30 AM PDT  |  3:30 PM UTC Unleash developer potential with AI and Dev Box – Have questions about Microsoft Dev Box? Save the date for the Dev Box AMA on Wednesday, May 28 at 8:00 AM PDT. * 10:00 AM PDT  |  5:00 PM UTC Crafting great Windows native app experiences Lastly, for every organization, if you are using custom line-of-business apps or adopting AI applications and agents, make sure your development teams tune in to the daily lineup of security sessions at Microsoft Build 2025 so they are up-to-date on the latest secure development practices. Save your spot: Windows Tech Community Live - June 9 On Monday, June 9, we’re hosting a new Windows edition of Tech Community Live starting at 8:00 AM PDT (3:00 PM UTC). Join us as we answer your questions live with four back-to-back Ask Microsoft Anything (AMA) sessions on: * Windows Autopilot * Microsoft Connected Cache and Delivery Optimization * Windows update and driver management * Windows and AI experiences No registration is required. To get the best experience, visit https://aka.ms/TCL/Windows, sign in to the Microsoft Tech Community, then click "Add to calendar" to download an .ics file and/or "Attend" to receive an event reminder. Post your questions early and often for our Windows and Intune engineering teams that will be supporting the event! Other highlights from Microsoft Build In addition to staying apprised what’s new in Windows developer scenarios, Microsoft Build 2025 can help you get clued in on the future of Zero Trust and the continuing evolution of Microsoft 365 Copilot. Here are some quick reads to get you up to speed: * Microsoft extends Zero Trust to secure the agentic workforce * The Microsoft 365 Copilot app: Built for the new way of working * Microsoft Build 2025: How to create a "frontier" workplace powered by agents I hope you enjoy this year’s conference. I would love to hear about your personal highlights throughout the week, or updates you think your fellow IT pros should be aware of. Drop a comment below. 😊 --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us on LinkedIn or @MSWindowsITPro for updates. Looking for support? Visit Windows on Microsoft Q&A.

An IT pro’s guide to Windows at Microsoft Build 2025: This week at Microsoft Build, audiences will hear how Windows is the best platform for developers and see how we are building Windows for this new era of AI, with intelligence integrated across software, silicon and hardware. Here… #WindowsITPro

VBScript deprecation: Detection strategies for Windows Start detecting Visual Basic Scripting Edition (VBScript) across your organization in preparation for the next deprecation phase. At the current deprecation phase of VBScript, it's available as a feature on demand (FOD) and is enabled by default in Windows 11, version 24H2. Before VBScript is disabled by default on these and future OS versions, it's critical that you to identify where and how vbscript.dll is still being used within your enterprise environment. Take a look at four scalable, enterprise-ready mechanisms to detect usage and plan mitigation steps across all Windows platforms.  Strategy 1: Use Sysmon to monitor VBScript usage Use System Monitor (Sysmon) and load the tracking capability for its dynamic link libraries (.dll) to monitor enterprise-wide usage of VBScript. You can detect vbscript.dll loads by collecting and analyzing Sysmon logs across all Windows platforms. Important: Sysmon monitoring can cause performance and operational overhead, especially when deployed at scale. Before broad deployment, test on a small group of devices to evaluate performance impact. Configure .dll load tracking and deploy Sysmon Before deploying Sysmon, configure it with a minimal and focused rule set that targets .dll loads. Since Sysmon doesn't have a graphical user interface (GUI), you'll manage configurations via XML files and the command-line interface. Add a configuration to your Sysmon setup as illustrated in the following sample:         vbscript.dll    To apply this configuration: * Edit your Sysmon configuration file (typically, sysmon-config.xml). * Reload it using the Sysinternals Sysmon utility. * Open an elevated command prompt and run: Sysmon64.exe -c sysmon-config.xml * Verify the current configuration by running: Sysmon64.exe -c This configuration instructs Sysmon to generate Event ID 7 (image loaded) entries whenever any process loads vbscript.dll. The rule set sample above is sufficient to track VBScript. However, for more mature or modular configurations, consider adapting broader rule sets from these GitHub resources: * SwiftOnSecurity's baseline Sysmon config * Olaf Hartong's Sysmon Modular framework Now, you can deploy Sysmon using Microsoft Intune, Group Policy, Microsoft Configuration Manager, or scripts, depending on your organization's setup. Collect Sysmon logs of .dll loads After you configure and deploy Sysmon, collect the logs for Event ID 7. At this stage, you'll identify how many and which processes load vbscript.dll. * In the Event Viewer, go to Applications and Services Logs. * Locate Microsoft > Windows > Sysmon on the left navigation bar. * Select Operational. * In the Actions pane on the right, filter the log by Event ID 7, Sysmon. Screenshot of Event Viewer showing search results for Event ID 7 in Sysmon. Forward these events to a central log store for analysis. Do this through Windows event forwarding, security information and event management (SIEM) agents, or manual exports. You can then use standard tools like Power BI, Microsoft Excel, or custom scripts to analyze these Sysmon logs. Analysis tip 1: Trace process ancestry in desktop and script usage Sysmon's Event ID 7 (image loaded) and Event ID 1 (process creation) can help identify which process loaded vbscript.dll and its immediate parent. This gives insights into process ancestry. Learn more about the types of events that Sysmon generates. To trace deeper process lineage (e.g., grandparent processes), use endpoint detection and response (EDR) or SIEM tools with visual process graphs. For more thorough analysis, consider using PowerShell scripts to: * Parse Event ID 7 to extract Process IDs (PIDs) of processes that loaded vbscript.dll. * Use Event ID 1 to find the parent process. This allows you to gain insight into what launched the script-capable process, such as wscript.exe, regsvr32.exe, or application binaries. If you're new to PowerShell, learn how to query and filter event logs. Analysis tip 2: Solve for noise in web-hosted environments Web-hosted environments are different. These include Internet Information Services (IIS) running VBScript for server-side scripting (e.g., classic Active Server Pages known as ASP). In such environments, vbscript.dll may be loaded passively during the initial page load, even before user interaction. This can generate noise in Sysmon logs, because Event ID 7 entries are logged regardless of whether VBScript is actively invoked. Furthermore, Sysmon events do not include web-layer context such as the URL or page name. To reduce noise and improve traceability, combine Sysmon logs with IIS logs. By correlating Sysmon timestamps with IIS request entries, you can identify which specific HTTP request triggered the vbscript.dll load, providing clearer context for web-based script execution. See Advanced logging for IIS – Log filtering if this is new to you. Strategy 2: Review VBScript dependencies In many enterprise environments, VBScript dependencies may be embedded in any of the following centrally managed locations: * Group Policy logon scripts * Group Policy logoff scripts * Group Policy startup scripts * Group Policy shutdown scripts * Scheduled tasks configured to launch legacy scripts * PowerShell scripts deployed via Intune that invoke .vbs scripts indirectly With this strategy, you'll identify these scripts in preparation for their remediation and VBScript removal.  Note: You can often perform these analyses from a single admin workstation or a domain controller (DC). That is because Group Policy objects (GPOs), scheduled tasks, and Intune scripts are centrally configured either via GPO or device-management platforms. Group Policy object scripts * Check \\\SYSVOL for .vbs files.  * Extract referenced scripts (e.g., using PowerShell).  * Look for any invocation of wscript.exe, cscript.exe, or .vbs files.  Brush up on using these scripts in Group Policy if needed. Scheduled tasks List scheduled tasks and inspect command lines (e.g., using PowerShell). Pay special attention to tasks under \Microsoft\Windows or custom organization-defined folders.  Microsoft Intune–deployed scripts (PowerShell) Although Intune doesn't natively run .vbs files, PowerShell scripts deployed via Intune can still invoke VBScript indirectly (e.g., via cscript.exe). Please review any PowerShell scripts deployed through Intune for embedded VBScript execution patterns. Strategy 3: Scan for .vbs files across the system  To complement other detection strategies for your enterprise, proactively search for .vbs script files on endpoints. This helps surface any legacy script usage not tied to scheduled tasks or GPOs.  Recursively look for .vbs files in common paths like:  * C:\Users\  * C:\ProgramData\  * C:\Program Files\  * C:\Program Files (x86)\ * C:\Scripts\  * C:\Windows\ (optional: might include noise)  Caution: Avoid scanning the entire C:\ blindly in production. It can cause performance issues or access errors. Focus on user- and script-relevant paths.  To scan relevant paths, adapt the following sample PowerShell script:  $pathsToScan = @("C:\Users", "C:\ProgramData", "C:\Scripts") $logPath = "C:\VBSScriptScan\VbsFiles_$(hostname).csv" $results = foreach ($path in $pathsToScan) {    if (Test-Path $path) {        Get-ChildItem -Path $path -Filter *.vbs -Recurse -ErrorAction SilentlyContinue |            Select-Object FullName, LastWriteTime, Length    } } $pathsToScan = @("C:\Users", "C:\ProgramData", "C:\Scripts") $logPath = "C:\VBSScriptScan\VbsFiles_$(hostname).csv" $results = foreach ($path in $pathsToScan) {    if (Test-Path $path) {        Get-ChildItem -Path $path -Filter *.vbs -Recurse -ErrorAction SilentlyContinue |            Select-Object FullName, LastWriteTime, Length    } } For large enterprise deployments, you can run this command via: * Microsoft Intune * Group Policy startup script  * Remote PowerShell (Invoke-Command)  * Microsoft Configuration Manager script deployments  Store results centrally (e.g., \\AdminPC\Scans\) or log them locally and collect them later.  Strategy 4: Scan custom MSI packages for embedded VBScript Custom Microsoft Installer (MSI) packages may contain embedded VBScript through custom actions. This was a common packaging practice in older enterprise applications. These scripts are often silently executed during installation, repair, or uninstallation processes. Don't overlook them during your modernization efforts! With this strategy, you'll identify VBScript use in MSI files so you can flag legacy packages for remediation. Detect custom action * Use PowerShell to recursively scan .msi files across your software repositories. * Inspect the MSI CustomAction table for action types 6, 38, and 50. These correspond to VBScript entries. * Look for VBScript stored in binary streams, embedded inline, or referenced by path. Adapt the following PowerShell sample detection script: Get-ChildItem -Path "C:\MSIRepo" -Recurse -Filter *.msi | ForEach-Object {     $msiPath = $_.FullName     $sql = "SELECT * FROM CustomAction"     $installer = New-Object -ComObject WindowsInstaller.Installer     $database = $installer.GetType().InvokeMember("OpenDatabase", "InvokeMethod", $null, $installer, @($msiPath, 0))     $view = $database.OpenView($sql)     $view.Execute()     $record = $view.Fetch()     while ($record -ne $null) {         $actionName = $record.StringData(1)         $actionType = [int]$record.StringData(2)         if ($actionType -eq 6 -or $actionType -eq 38 -or $actionType -eq 50) {             Write-Output "⚠ VBScript Custom Action: $actionName in $msiPath"         }         $record = $view.Fetch()     } } Replace C:\MSIRepo with a local or network share that stores your MSI files (e.g., software deployment folders, Microsoft Configuration Manager package sources, or app archives). Scaling recommendations For better scaling experience, follow these recommendations: * Collect MSI files from known deployment shares (e.g., Intune or Configuration Manager package sources, network software shares). * Automate scanning using scheduled tasks or deployment tools (like Intune or Configuration Manager). * Export findings to a central log or reporting system for visibility and tracking. Avoid using Win32_Product for MSI enumeration. It can trigger a repair of all MSI-installed applications. Instead, rely on registry-based software inventory or trusted package management tools. To audit installed software, adapt the following PowerShell script. It lists installed applications from the Windows registry, showing each app's name, installation data, and publisher. Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |    Where-Object { $_.DisplayName } |    Select-Object DisplayName, InstallDate, Publisher For reference on action types, see Microsoft official MSI documentation at CustomAction Table and Custom Action Types. Remediation options for MSI packages using VBScript You need to remediate MSI packages with VBScript custom actions. Your options depend on the source of the package: * Internally packaged MSIs: You may be able to repackage the installer using tools like Orca or Advanced Installer to remove or replace the VBScript custom actions. * Third-party/independent software vendor (ISV) software: Contact the vendor to request a supported version without VBScript usage. If unavailable, consider isolating or monitoring the app until migration is possible. VBScript is detected. What next? With these four detection methods, you gain a comprehensive view of VBScript dependencies across your current Windows platforms. This insight is key to planning effective remediation and aligning with future-proof technologies. Proactively migrate away from VBScript Once you identify scripts and processes that depend on VBScript, you're ready to migrate these dependencies away from VBScript. Please refer to the section “Next steps if my app or website has dependency on VBScript” in VBScript deprecation: Timelines and next steps. Remember: During the deprecation phase, you can continue using VBScript until it's completely retired in upcoming OS versions. The deprecation phase is designed to signal the upcoming change and give you time to research and migrate to alternatives. Proactively disable VBScript on Windows 11 Now that VBScript is enabled by default on Windows 11, version 24H2 and later, you can take additional steps to prepare. Once you confirm that VBScript is unused across these devices with the detection methods above, you should proactively disable it. Use the following Deployment Image Servicing and Management (DISM) command to do so: Dism /Online /Remove-Capability /CapabilityName:VBSCRIPT~~~~  Use Microsoft Intune, GPO Startup Scripts, or Microsoft Configuration Manager to deploy this command across your fleet.  Expect the following consequences of disabling VBScript: * All processes attempting to use VBScript (e.g., cscript.exe, wscript.exe, embedded Internet Explorer) are blocked.  * Scripts relying on VBScript fail silently or with errors.  Important: Please validate capability state and commands in a controlled test environment before wide-scale automation or rollout of this DISM command. The availability and behavior of the VBScript capability vary based on system configurations and different builds. This includes enabling or disabling VBScript via DISM or PowerShell. In summary, now is the time to start proactively migrating away from VBScript. We hope this guidance helps you detect and remediate usage before VBScript becomes disabled by default in the next deprecation phase. Read VBScript deprecation: Timelines and next steps for additional context and recommendations for more advanced scripting alternatives. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

VBScript deprecation: Detection strategies for Windows: Start detecting Visual Basic Scripting Edition (VBScript) across your organization in preparation for the next deprecation phase.


At the current deprecation phase of VBScript, it's available as a feature on demand (FOD) and is… #WindowsITPro

Hotpatch for client: Frequently asked questions Interested in faster compliance for your devices running Windows 11 Enterprise or Education, version 24H2? The first hotpatch update since this technology became generally available is now here. Simply enroll your eligible devices into a hotpatch policy on Windows Autopatch via Microsoft Intune, and install the latest Windows security update that serves as a baseline. Find answers to any questions you may have in the following categories: * Hotpatch update definitions * Eligibility and availability of hotpatch updates * Hotpatching on Arm64 devices * Technical information about hotpatch updates * Testing and error information * Additional resources Hotpatch update definitions What are hotpatch updates? Hotpatch updates are monthly security updates that take effect without requiring you to restart the device. They contain a full set of security updates equivalent to the standard updates released the same day. What are standard updates? A standard update is a regularly scheduled Windows security update that relies on a device restart for it to take effect. What is the hotpatch update cycle? All eligible Windows 11, version 24H2 devices enrolled in the hotpatch update policy are offered hotpatch updates in a quarterly cycle with respect to the calendar year: * Baseline month: In January, April, July, and October, devices install the monthly cumulative security update and must restart for the update to take effect. This update includes the latest security fixes, cumulative new features, and enhancements since the last baseline. * Subsequent two months: Devices receive hotpatch updates, which only include security updates and don't require a restart for the update to take effect. These devices will catch up on features and enhancements with the next cumulative baseline month (quarterly). Diagram shows baseline and hotpatch months, illustrating that no restarts are needed on hotpatch months. Eligibility and availability of hotpatch updates When will hotpatch updates for Windows client become available? Hotpatch updates are generally available for eligible Windows 11, version 24H2 devices with x64 (AMD/Intel) CPU. Hotpatch updates are also available for Windows 365 Cloud PCs. Hotpatch updates for Arm64® devices provide a full set of security fixes, but the scenario is in public preview. What eligibility requirements do I need to meet to access and manage hotpatching for Windows client? If you meet the prerequisites for hotpatch updates, you can opt devices in (or out) for automated hotpatch update deployment using Windows Autopatch. Only Windows 11 Education and Enterprise editions support hotpatching. Hotpatching is not available for Home, Pro, or IoT editions. Check that your organization has one of the following licenses: * Windows 11 Enterprise E3 or E5 * Microsoft 365 F3 * Windows 11 Education A3 or A5 * Microsoft 365 Business Premium * Windows 365 Enterprise Additionally, devices must have the following in order to receive hotpatch updates: * Windows 11 Enterprise, version 24H2 (Build 26100.2033 or later) and on the current baseline (e.g., April 2025 security update baseline (KB5055523) * An x64 (AMD/Intel) CPU (Note: Hotpatching on Arm64 devices is still in public preview.) * Microsoft Intune for managing the deployment of hotpatch updates with a hotpatch-enabled Windows quality update policy (see below) * Virtualization-based Security (VBS) enabled How do I opt my devices into receiving hotpatch updates? If you're eligible for hotpatch updates, you can opt devices in (or out) for automated hotpatch update deployment using Windows Autopatch. * Go to the Microsoft Intune admin center. * Navigate to Devices > Windows updates > Create Windows quality update policy > Settings. * Under Automatic update deployment settings, locate the option When available, apply without restarting the device (“hotpatch”). * Toggle it to Allow. To see the hotpatch option, you should have an existing quality update policy or create a new one and add your device groups to enable hotpatch updates. Enabling hotpatch updates by creating a Windows quality update policy in the Intune admin center. For more information, see Enroll devices to receive hotpatch updates. What if some devices in my hotpatch policy aren't eligible for hotpatch updates? The Windows quality update policy can auto-detect if your targeted devices are eligible for hotpatch updates. Ineligible devices will continue to receive the standard monthly security updates, helping ensure that your ecosystem stays protected and productive. Note: Devices may be temporarily ineligible because they do not have Virtualization-based Security (VBS) enabled and running. Also, devices need to have the latest baseline release installed to receive hotpatch updates. Consult the troubleshooting guide to investigate ways to ensure that all your Windows 11, version 24H2 devices are configured properly for hotpatch updates. For more information, see Prerequisites and Ineligible devices. How is hotpatching different for Window 11 Enterprise, version 24H2 and Windows Server 2025? Hotpatch technology is similar for Windows 11, version 24H2 and the supported Windows Server editions. The key difference is how hotpatch updates are managed: * Windows 11, version 24H2 updates are managed by Windows Autopatch. * Windows Server 2025 Datacenter Azure Edition is managed by Azure Update Manager (AUM). Azure Arc connected subscriptions for Windows Server 2025 Datacenter/Standard Editions can be managed through the Azure Arc Portal, AUM, or programmatically. The eight hotpatch months and four baseline months planned each year are the same for all the hotpatch-supported operating systems (OSs). Sometimes there might be additional baseline months for one OS (e.g., Windows Server 2022), while there are hotpatch months for another OS, such as Windows Server 2025 or Windows 11, version 24H2. Watch the release notes carefully around each second Tuesday of the month for the latest information. Get to them easily from Windows release health. Hotpatching on Arm64 devices Can I use hotpatch updates on Arm64 devices? Yes, hotpatch updates are available to Arm64 devices. However, hotpatching for Arm64 devices is in public preview. In addition to general prerequisites, these devices require an additional step of disabling compiled hybrid PE usage (CHPE). Is the requirement to disable CHPE on Arm64 devices temporary? There are no plans to support hotpatch updates on Arm64 devices with CHPE enabled. The requirement to disable and test CHPE extends beyond public preview. Disabling CHPE is required only for Arm64 devices. AMD and Intel CPUs don't have CHPE. What's the impact of disabling CHPE on end-user experience on Arm64 devices? For Arm64 devices, we recommend testing hotpatch updates with CHPE disabled. The expectation is a fully working system with acceptable performance and application compatibility. As an IT admin, you have the choice to use hotpatch updates or standard updates. If you choose to disable CHPE, the device is eligible to receive hotpatch updates. If CHPE is enabled, the device is only eligible to receive standard updates. What are the best ways to disable CHPE on Arm64 devices? You can disable CHPE on Arm64 devices by manually setting the registry key: * Path: HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management * DWORD Key value: HotPatchRestrictions=1 For more information, see Arm64 devices must disable CHPE (Arm64 CPU only). Alternatively, disable the CHPE support using a configuration service provider (CSP) policy: DisableCHPE. Restart the device to ensure the operating system is enforcing the setting. You only need to set this once. Technical information about hotpatch updates How can I tell which of my devices installed a hotpatch update? Devices receiving the hotpatch update have a different knowledge base (KB) number tracking the release and a different OS version than devices receiving the standard update that requires a restart. The monthly KB release articles online indicate if the KB installed is hotpatch capable and the corresponding OS version. The user interface of Windows Update also shows the message: “Great news! The latest security update was installed without a restart.” Note: You'll only see this message after the first few hotpatch update installations. The Windows Update settings page shows a message that the latest security update was installed without a restart. What if I restart a device after receiving a hotpatch update?  A device stays on the hotpatch update KB/OS version even after a restart. It won't receive any new features as part of the regular servicing track until the next quarterly cumulative baseline update. What if I rely on regular restarts to reset and refresh systems, maintain system performance, or reduce support calls? You don't have to give up regular restarts. Hotpatching doesn't eliminate your ability to restart—it gives you flexibility. You can maintain your existing restart cadence and routines while still benefiting from faster compliance. With hotpatching, critical updates are applied promptly, and you can schedule restarts on your terms, without the pressure of immediate patching requirements. Do hotpatch updates apply to common Windows OS binaries loaded in third-party processes or only Microsoft processes? Hotpatch updates aren't limited to Microsoft processes. All Windows OS binaries that are used by third-party processes are also hotpatched. Hotpatch updates are only created for Windows OS binaries. Any process loading Windows OS binaries that have hotpatch updates installed will be patched in memory before the application or operating system uses the binaries. This includes common system dynamic link libraries (DLLs) like ntdll.dll. How can I find out if a hotpatch update was applied to the specific DLL? One of the ways to see the hotpatch modules is in the memory dump. Symbols for hotpatched DLLs depend on the function receiving the update. Some code that is hotpatch-updated could be public (symbols), while other functions could be private (no symbols). Are there kernel-mode hotpatch updates? Yes, there are kernel-mode hotpatch updates. To understand more about hotpatch engineering, visit Hotpatching on Windows. What does a failure to apply hotpatch look like? Hotpatch failures are the same as component-based servicing (CBS) failures that you've seen when installing other KBs (not enough disk space or download errors). In addition, hotpatch update errors are recorded in the event logs. Search the system log for the keyword “hotpatch” to see if your system encountered any errors. Can users switch between hotpatch and standard Windows monthly updates? Yes, users can manually download the standard Windows monthly update from the Microsoft Update Catalog. In this case, the device stops receiving hotpatch updates and receives standard Windows updates until the month after the next baseline month. Since the device is still enrolled in hotpatching, the device will automatically rejoin the hotpatch cadence of updates after the update is released on the baseline month. Testing and error information What does hotpatching look like from a forensic perspective? Hotpatch update events show up in the audit logs. Using Process Explorer, search for “_hotpatch.” The results will show the hotpatch binaries loaded in memory. The hotpatch update KB includes a link to the CSV file listing the update payload. Can I get security alerts through Event Tracing for Windows about hotpatch events? Hotpatch events are captured in the audit log. Search for “hotpatch” to find related errors if any have been captured. Learn more about Event Tracing for Windows (ETW). Do I need to test hotpatch updates if I already test monthly updates? You should test hotpatch updates when released 8 times a year (according to plan) and the monthly standard updates 12 times a year. There are no hotpatch updates for you to test in January, April, July, or October. Get started and browse additional resources To receive the May 2025 hotpatch update, enroll your devices into hotpatching and update them with the April 2025 baseline update.  Visit the most up-to-date version of this information on Windows Autopatch – Frequently asked questions (FAQ). See additional resources to help your organization make the most of hotpatch updates: * Official announcement: Hotpatch for Windows client now available * Technical documentation, including prerequisites, enrollment instructions, and troubleshooting: Hotpatch updates * Windows 11, version 24H2 Enterprise hotpatch calendar: Windows 11 hotpatch calendar * Monthly update contents: Release notes for hotpatch public preview on Windows 11, version 24H2 Enterprise clients * User readiness information to share with people at your organization: Understanding security updates that get installed without a restart * Per-policy level view of the current update statuses: Hotpatch quality update report * Technical demo: The hottest way to update Windows 11 and Windows Server 2025 --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Hotpatch for client: Frequently asked questions: Interested in faster compliance for your devices running Windows 11 Enterprise or Education, version 24H2? The first hotpatch update since this technology became generally available is now here. Simply enroll your eligible devices into… #WindowsITPro

Blogged: Moving one or more Windows 365 Cloud PCs to another location niallbrady.com/2025/05/08/m... #Windows365 #CloudPC #MSIntune @brinkhoffc.bsky.social
@configmgrdogs.bsky.social

Improved data sharing and hotpatch now in Windows Autopatch Improved control and consent over data sharing is a new feature coming to Windows Autopatch in June 2025. Plus, hotpatching—small and immediate security updates that don't interrupt your workflow—is now accessible to everyone using Windows Autopatch. In March, we announced that subscribers to Windows 11 Education and Business Premium SKUs have access to Windows Autopatch and will also enjoy these new features. Let’s dive in and share a little more detail. Improved control and consent over data sharing You've expressed your concerns about privacy and control when it comes to sharing your data. Some people want to share as much information as possible while others prefer to share less. Starting in June 2025, Windows Autopatch will offer improved reporting and troubleshooting capabilities based on your preferences. If there's critical information that the service can't access, Windows Autopatch will alert you to it. There are two levels of control to be aware of: * Reporting and alerting: Most data in Windows Autopatch reporting is managed using diagnostic data settings. If you've disabled diagnostic data, you can still see your devices, but some columns will be empty, and an alert will let you know that Windows Autopatch can't access information for that device. * Improved troubleshooting: The Windows Autopatch client broker improves your ability to troubleshoot issues. For example, the broker can identify if devices may be sourcing updates from an old location, rather than the correct new location. As of June 2025, the Windows Autopatch client broker can be targeted however you want. For example, you can opt in to the Windows Autopatch client broker to help assess why a device may be experiencing update issues. Bottom line: Data settings are no longer set for Windows Autopatch groups by default. Instead, you're fully in control over what data you want to share with Microsoft. Hotpatch updates are available through Windows Autopatch A hotpatch update installs important Windows security updates once a month without needing to restart—securing your devices quickly without interrupting your workflow. Using hotpatch is easy and included if you are already using Windows Autopatch. To enable hotpatching for Windows client devices, you will need: * Devices that have the most recent hotpatch baseline security update installed. (Baseline updates are offered quarterly as part of a normal security update. April was the most recent baseline month, and the next baseline is in July.) * Devices running Windows 11, version 24H2 for x64 (AMD and Intel) CPU. * Virtualization Based Security (VBS) enabled and running. * CHPE disabled for Arm64 devices. (Note: Hotpatching for Arm64 devices is still in public preview.) If your devices meet the prerequisites for hotpatch updates, you can opt devices in (or out) for automated hotpatch update deployment using Windows Autopatch. From the Microsoft Intune admin center, navigate to Devices > Windows updates > Create Windows quality update policy and toggle to Allow. Note: Your devices will still receive regular security updates even if they don't meet the prerequisites for hotpatch updates. Learn more about Windows Autopatch features Explore the concepts and technology in detail and find answers to frequently asked questions about Windows Autopatch and hotpatch: * Visit the Windows Autopatch documentation for more about Windows Autopatch client broker and hotpatch updates for Windows. * Review the directions for activating hotpatch. * Learn more about hotpatch for Windows client. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Improved data sharing and hotpatch now in Windows Autopatch: Improved control and consent over data sharing is a new feature coming to Windows Autopatch in June 2025. Plus, hotpatching—small and immediate security updates that don't interrupt your workflow—is now accessible to… #WindowsITPro

Sympa Says Sympa Says will dive into the real-life stories of professionals from various fields, exploring the paths they've taken to achieve their career goals. Analyze the key decisions, challenges, and opport...

Georgy’s just launched his own YouTube channel, check it out!

youtube.com/@sympasays

“Sympa Says” will help you discover inspiring real-life stories of professionals who have navigated diverse career paths. Subscribe today for regular videos with George!

New enhancements for Windows App on web A set of new enhancements for Windows App on web, including the Remote App Launcher and new printing capabilities, improve your experience and ease of use. Remote App Launcher Located directly on the toolbar inside the web client itself, you can now use Remote App Launcher to launch additional apps without leaving the web window. With Remote App Launcher, you can discover and launch apps easily, without having to switch back and forth between tabs. Screenshot of the Remote App Launcher dropdown menu from the toolbar in Windows App on web. Improved printing capabilities In addition to the Remote App Launcher, there are improved printing capabilities for Windows App on web. You can now effortlessly print documents directly to your locally attached printers. This enhancement streamlines the printing experience, eliminating the need for additional steps between viewing and printing documents. Access remote sessions natively You can now utilize the Windows App on web to access Windows App and Azure Virtual Desktop remote sessions natively. By simply selecting the "Connect in desktop app" option from the dropdown menu, you can open the desktop version of the Windows App. Print Screenshot of a Cloud PC in Windows App with dropdown-menu options. Connect to Windows App on web or review Windows App documentation to learn more about Windows App across all devices. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

New enhancements for Windows App on web: A set of new enhancements for Windows App on web, including the Remote App Launcher and new printing capabilities, improve your experience and ease of use.


Remote App Launcher




Located directly on the toolbar inside the web client itself,… #WindowsITPro

Windows news you can use: April 2025 It's been another busy month in the Windows ecosystem! Highlights in this month's "Windows news you can use" will help you get up to speed on news you may have missed—including recent announcements about the general availability of AI features for Copilot+ PCs—and new ways to drive productivity and security at your organization. Along with what's available to you now, be sure to check out the Windows 11 Roadmap to help with longer-term planning. Before jumping into the goods for this month, it's worth celebrating that this is the thirteenth issue in our monthly series. Help us plan for the second year of "Windows news you can use." Is there content you'd like to see more or less of? What matters most to you? Let us know in the comment section below! New in Windows update and device management * [HOTPATCH] Help your organization stay secure and productive. Hotpatch for Windows client is now available. Hotpatch provides immediate protection, consistent security, and minimal disruption as updates are installing. Learn how hotpatch works and how to get started using it. And, share this complementary resource with your organization about how hotpatch updates are installed and take effect without restarting Windows devices.  * [WINDOWS AUTOPATCH] Dive into what's new in Windows Autopatch for April. Learn how new features simplify update rollouts, policy configuration, and compliance reporting. Discover advancements in Windows Autopatch reporting that focus on update compliance for every device and Windows Autopatch groups that are more flexible and intelligent. * [WINDOWS AUTOPATCH] Don't miss this overview of new Windows Autopatch capabilities and new naming conventions, including the rename of Windows Update for Business to Windows Update client policies. Windows Autopatch is the smart update solution for organizations and businesses of all sizes, helping to make the update process secure, seamless, and productive. It offers a unified update management experience in Microsoft Intune and expanded features for those with Windows Education and Business Premium licenses.   * [WINDOWS 365] Looking for ways to make more informed decisions about snapshots for restoring Cloud PCs? Learn about point-in-time restore snapshot health indicator—the newest disaster recovery solution for Windows 365 is now generally available. The point-in-time snapshot health indicator is integrated into the Microsoft Intune admin center, where admins can readily see healthy and unhealthy snapshots and then use that information to select the most reliable snapshots for successful recovery operations. * [INTUNE][PREVIEW] Take advantage of "automatic mode" in Microsoft Intune for enhanced configuration and device preparation provisioning specifically for Windows 365 Frontline in shared mode. Automatic mode in Intune helps ensure required apps and scripts are delivered to the shared Cloud PC before users sign in. * [QMR][PREVIEW] Get and test the remediation package "Quick machine recovery update for Windows 11" through the Windows Insider Program, starting with the Beta Channel. Just activate the "test mode" to simulate the quick machine recovery (QMR) experience and get the remediation package installed. To verify successful installation, go to Settings > Windows Update > Update history. Locate the remediation under Quality updates. New in Windows security * [ZERO TRUST DNS][PREVIEW] Test the public preview of Zero Trust DNS (ZTDNS), a new feature now available in Windows 11 Insider builds. ZTDNS is designed to enforce domain-name-based network access controls to enhance security posture. Learn what ZTDNS is, how to use it to mitigate threats, and how to get started with it in your environment. * [SFI] The second Microsoft Secure Future Initiative (SFI) progress report is now available. Catch up on the evolution of the largest cybersecurity engineering project in history. Find a wealth of information including data and security resources to share at your organization, and read the full report.    * [SECURITY][PREVIEW] On Windows Insiders' Beta, Dev, or Canary Channel, experience an improved Windows Security app. If you have PCs that use Pluton TPM chips, find information about them under Device security > Security processor details. New in Copilot+ PCs and AI * [AI] Built-in controls and policies are available to complement new AI features now generally available for Copilot+ PCs. Deep dive into Recall (preview),i Click to Do (preview),ii and improved Windows search.iii Learn more about these AI features, gradually rolling out with the April non-security preview update. * [COPILOT KEY] Learn about new experiences coming to the Copilot key including changes to the Microsoft 365 Copilot app and accessing Microsoft 365 Copilot using the Copilot key on Windows 11 keyboards. We're also bringing back a way to interact with Microsoft 365 Copilot Chat without interrupting your flow of work. * [M365 COPILOT] For the latest features and improvements for Microsoft 365 Copilot, see the release notes. Install the April 2025 non-security update for Windows 11, version 24H2 to get these capabilities: * [RECALL] Use Recall (preview) to quickly find and get back to any app, website, image, or document just by describing its content using the AI capabilities of Copilot+ PCs. * [WINDOWS SEARCH] With improved Windows search, find your documents, photos, and settings across Windows 11 on Copilot+ PCs with semantic indexing models and traditional lexical indexing. * [CLICK TO DO] Take immediate action on text or images on your screen with Click to Do (preview). Open it with Windows key+mouse click, Windows key+Q, or the Snipping Tool menu. * [SETTINGS] You can now manage which apps Windows recommends actions for by going to Settings > Apps > Actions on Copilot+ PCs. If you're a Windows Insider, you can preview what's coming next: * [COPILOT APP][PREVIEW] If you're a Windows Insider on any channel, get the newest changes for your Microsoft Copilot app on Windows via the Microsoft Store. Use the app to find, open, or ask questions about the contents of a file on your device. Share your browser or window with Copilot to get analysis, insights, or answers to your questions with Copilot Vision (available in the United States). Personalize your Copilot key and Windows key+C experience under Settings > Personalization > Text input > Customize Copilot key on keyboard. * [NARRATOR][PREVIEW] If you're a Windows Insider in the Dev Channel or the Beta Channel, experience more accessible images with AI-powered descriptions in Narrator. Simply press Narrator key+Ctrl+D to hear Narrator read out a contextual description of your image, chart, or graph. Further regenerate, like, dislike, or copy the generated description. Available on Snapdragon-powered Copilot+ PCs. * [CLICK TO DO][PREVIEW] If you're in Windows Insiders' Beta or Dev Channel, try new Click to Do actions: "Practice in Reading Coach" and "Read with Immersive Reader." Available today in the Beta Channel on AMD and Intel-powered Copilot+ PCs. Starting with Dev's Build 26200.5518 and Beta's Build 26120.3671, highlight text or image and select Ask Copilot (not yet available in the European Economic Area). Manage how to invoke Click to Do in Settings > Bluetooth & devices > Touch. And, if you're in the Beta Channel, configure the shortcut button from Settings > Bluetooth & devices > Pen & Windows Ink and add it as one of the apps you can launch via the pen menu. * [SEARCH][PREVIEW] If you're on the Windows Insiders' Beta or Dev Channel, search more efficiently. To manage how you search content saved in the cloud from the Windows search bar on your Copilot+ PC, go to Settings > Privacy and Security > Search permissions. If you're in the European Economic Area, you can now find photos saved in the cloud via the Windows search box. Rolling out gradually on Snapdragon-powered Copilot+ PCs. Additionally, starting with Beta's Build 26120.3863 and Dev's Build 26200.5551, search for the right setting using your own words in the Windows search box. New in Windows Server For the latest features and improvements for Windows Server, see the Windows Server 2025 release notes and Windows Server, version 23H2 release notes.   * [PREVIEW] For Windows Server Insiders, Windows Server vNext Preview Build 26392 is now available. It contains a new build of the next Windows Server Long-Term Servicing Channel (LTSC) Preview with both the Desktop Experience and Server Core installation options for Datacenter and Standard editions, Annual Channel for Container Host and Azure Edition (for VM evaluation only). Windows Server Datacenter: Azure Edition Preview Build 26392 is now available to try in Desktop and Core version on the Microsoft Server Operating Systems Preview offer in Azure. * [SERVER SUMMIT] Join us for Windows Server Summit sessions. Improve your skills with deep dives and demos. Learn about connecting Windows Server servers across environments with Microsoft Azure Arc, fine-tuned host networking, easy upgrades with Windows Server 2025, hardening security and building resiliency, and much more. If you didn't attend the virtual sessions live (April 29-30), all sessions were recorded and available on demand—be sure to build your agenda. Have questions? Q&A chat remains open for the week. * [HOTPATCH] Hotpatching for Windows Server 2025 becomes generally available as a subscription service on July 1, 2025. With hotpatching, what was previously a Microsoft Azure-only capability will be available to Windows Server machines outside of Azure through Azure Arc and this hotpatch subscription. Learn more. New in productivity and collaboration [WINDOWS 365] Discover how to Maximize productivity and ROI with Windows 365. Learn about Windows 365 innovations including Windows 365 Frontline shared mode, Windows 365 Disaster Recovery Plus, and Windows 365 migration API, which makes the transition to Windows 365 easier than ever. These innovations and others—now generally available—help boost productivity, improve efficiency and security, and reduce costs. Don't miss the report on Forrester Consulting's study, which projects significant return on investment (ROI) with Windows 365 and Azure Virtual Desktop. [CLOUD PC] Learn about streaming enhancements for Windows 365 and Azure Virtual Desktop for like-local experiences that optimize performance, reduce latency, and improve responsiveness of remote session. Get the April 2025 security update for Windows 11, version 24H2 and version 23H2 to start using the following improvements, which might be rolled out gradually. * [SETTINGS][24H2][23H2] Understand your PC's capabilities at a glance. "Top cards" are an easy way to view key specifications including processor, RAM, storage, and GPU. "Top cards" appear under Settings > System > About. * [TASK MANAGER][24H2] Task Manager will now calculate CPU usage differently for Processes, Performance, and Users pages. It will use standard metrics to display CPU workload consistently across all pages and align with industry standards and third-party tools. To ensure backward compatibility, an optional column named CPU Utility is available (hidden by default) on the Details tab, showing the previous CPU value from the Processes page. Install the April 2025 non-security preview update to get the following Windows 11, version 24H2 and version 23H2 improvements ahead of next month's quality update: * [PHONE LINK][24H2][23H2] Use Phone Link to access cross-device features between your mobile device and PC. For example, you can make phone calls, send SMS messages, or access your photos. * [NARRATOR][24H2][23H2] Use speech recap in Narrator to quickly access spoken content, follow along with live transcription, and copy what Narrator last said—all with simple keyboard shortcuts. * [FILE EXPLORER][24H2][23H2] Increase productivity with pivot-based curated views on File Explorer Home, which support ease of access of Microsoft 365 content on Windows. * [WIDGETS] [24H2][23H2] If you're a web developer, use your existing content to create interactive widgets that can be added to multiple widgets surfaces. Lifecycle milestones Check out our lifecycle documentation for the latest updates on Deprecated features in the Windows client and Features removed or no longer developed starting with Windows Server 2025. * [WSUS] Removal of Windows Server Update Services (WSUS) driver synchronization has been postponed. The service remains deprecated and no longer in active development, but, based on your feedback, Microsoft will continue to support driver update synchronization, and it will not be removed in April 2025. This gives you time to explore new options and plan for change. * [WIN10 EOS][REMINDER] Windows 10 end of support (EOS) is now six months away. Find resources to help you get ready for Windows 10 end of support coming up on October 14, 2025. This resource hub includes important reminders, guides, interactive assessments, and customer testimonials. Choose among several ways to transition to Windows 11, check if current devices are eligible for the upgrade, purchase new PCs as part of your refresh cycle, and learn more about the Extended Security Updates (ESU) program. For extra insights, watch the on-demand Technical Takeoff session to bust myths and misconceptions around Windows 10 EOS. * [WIN10 EOS][IOT] Some Windows 10 IoT Enterprise versions are impacted by Windows 10 end of support (EOS) on October 14, 2025. To learn more about which Windows IoT Enterprise devices will and won't be impacted, see Windows 10 EOS for Windows IoT Enterprise tech community blog. * [WINDOWS APP] Prepare for the Windows App replacement of Remote Desktop app for Windows. As of May 27, 2025, Remote Desktop app for Windows from the Microsoft Store will no longer be supported or available for download. Windows App will ensure continued access to Windows 365, Azure Virtual Desktop, and Microsoft Dev Box. [Note: this does not apply to the Remote Desktop client standalone installer (MSI).] Windows Insider Preview news Here's a summary of this month's new experiences available to Windows Insiders. Remember that gradual rollout reaches some devices earlier than others. Note: The Dev Channel now releases 26200 series builds, meaning that you can no longer switch from the Dev Channel to the Beta Channel. All Insider Channels  * [SNIPPING TOOL] Extract text with Snipping Tool, whatever channel you're in. Use the new "Text Extractor" button in the toolbar and select the region you'd like to scan for text. * [SETTINGS] On Beta's Build 26120.3671, Dev's Build 26200.5518, or Canary's Build 27842, configure your mouse settings directly under Settings > Accessibility > Mouse or Mouse pointer and touch. No need to go into Control Panel. Likewise, check out new Settings configurations under Bluetooth & Devices > Pen and Windows Ink and Touch pages. Dev and Beta Channels * [VOICE] On Beta's Build 26120.3872 or Dev's Build 26200.5562, try out improvements for voice access. Add custom words to the dictionary using "Add to Vocabulary" command or through the settings menu. Discover new voice access updates and features through the new in-product experience. Turn On the toggle for voice access from the Accessibility flyout via quick settings in the system tray of the taskbar. Additionally, adjust your profanity filter setting for voice typing from the voice typing launcher (Windows key+H) on the more recent Beta and Dev Channel builds. * [NARRATOR] On Beta's Build 22635.5160 or Dev's Build 26200.5516, keep track of what Narrator has spoken with speech recap. Access spoken content, follow along with live transcription, and copy what Narrator last said. Open the speech recap with Narrator key+Alt+X. Copy the last spoken phrase to your clipboard with Narrator key+Ctrl+X. * [FILE EXPLORER] On Beta's Build 26120.3872 or Dev's Build 26200.5562, if you launch File Explorer folders from outside of File Explorer, manage whether they open in a new tab or in a new window. Open File Explorer's Options > General > Browse Folders. * [TASKBAR] On Beta's Build 26120.3671 or Dev's Build 26200.5518, customize your taskbar icon scaling settings. Right-click an empty region of your taskbar and select "Taskbar settings." Expand "Taskbar behaviors" section and make your selection for the setting "Show smaller taskbar buttons." Additionally, find your assistive technologies grouped by vision, hearing, motor, and mobility in the Accessibility flyout in quick settings on the more recent Beta and Dev Channel builds. * [WINDOWS SHARE] On Beta's Build 26120.3671 or Dev's Build 26200.5518, share files more easily with our new drag tray feature. Start dragging a local file from File Explorer or your desktop and drop it on a tray that appears at the top of your screen. The tray contains common apps that you can use to share the file. Beta Channel   Going forward, updates released to the Beta Channel will be based on Windows 11, version 24H2, which is currently available as an optional upgrade for Windows Insiders in the Beta Channel. * Starting with Build 26120.3653, preview web content of shared links and quickly edit and enhance images while sharing. * On Build 22635.5160, find answers to common questions about your PC and Windows 11 direction from Settings > System > About. Note: Many new features are rolled out gradually and belong to different build versions. If you want to be the first to get features, you can turn On the toggle to get the latest updates as they are available via Settings > Windows Update. Please visit the Windows Insider Blog for complete details. May will be a big month for events including Build and the Microsoft 365 Community Conference. Join us in person at both events or take the opportunity to attend Build sessions virtually! Come back next month for updates on these events, the Windows Server Summit, and much more Windows news you can use. --- i Recall (preview) requires Windows Hello Enhanced Sign-in Security. Available in the European Economic Area later this year. Optimized for select languages [English, Chinese (Simplified), French, German, Japanese, and Spanish]. Content-based and storage limitations apply. Enterprise license required for some policy-enabled management controls. See aka.ms/copilotpluspcs. ii Click to Do (preview) is coming to the European Economic Area later in 2025. Functionality varies by market and will roll out across devices over time; text actions are available across markets in select character sets. See aka.ms/copilotpluspcs. iii Improved Windows search works with specific text, image, and document formats only; optimized for select languages [English, Chinese (Simplified), French, German, Japanese, and Spanish]. See aka.ms/copilotpluspcs. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

Windows news you can use: April 2025: It's been another busy month in the Windows ecosystem! Highlights in this month's "Windows news you can use" will help you get up to speed on news you may have missed—including recent announcements about the general availability of AI features for… #WindowsITPro

AI innovations grounded in transparency and control Looking to pioneer innovation with greater transparency and control? With the general availability of several new AI features first introduced at Microsoft Ignite 2024,i Copilot+ PCs help address your organization's productivity pain points and transform end user experiences. Recall (preview),ii Click to Do (preview),iii improved Windows search,iv and use the neural processing unit (NPU) on the Copilot+ PC to run models locally, keeping your data not only local but also secure. Let's see how to take advantage of new AI improvements in your organization while supporting your compliance requirements and change management control needs. Deploy AI features safely with control and compliance Grounded in responsible AI (RAI) principles, there are built-in and IT-driven policy controls available for managed devices. This applies to you if you: * Manage Windows updates on devices via Windows Update with Windows Autopatch or via Windows Server Update Services. * Manage devices with an Enterprise (ENT) or Education (EDU) SKU or any premium SKU. Additionally, these devices must have a volume license key or be joined to a domain. Consider the following change management controls to test, evaluate, and approve new pivotal functionality before rolling it out to your users. Start with built-in controls Recall (preview), Click to Do (preview), and improved Windows search all include built-in controls. Recall (preview) is off and removed from the device by default. So, take your time to conduct compliance checks ahead of enabling this feature in your organization. Click to Do (preview) and improved Windows search are behind temporary commercial control if you manage updates with Windows Autopatch or Windows Server Update Services. These AI features are available in the April optional non-security update and will be enabled by default in the next annual feature update. Learn about additional built-in RAI controls, safeguards, and filters to protect privacy and manage risks. Get features early with policies Not interested in waiting? Take advantage of the productivity gains provided by these features early! Just configure and control access to these features for Copilot+ PCs in your organization via policy. * Enable Click to Do (preview) and improved Windows search: Enable AllowTemporaryEnterpriseFeatureControl via Group Policy or via your mobile device management (MDM) solution. * Install Recall (preview): Enable AllowRecallEnablement. This will install Recall (preview) on the device and allow the user to enable it. How to manage the new AI features Recall (preview) Remember having seen specific content on your Copilot+ PC? Recall (preview) is an AI-powered Windows feature that allows you to search across time using your language to find and reengage with content. For example, with Recall (preview) on Copilot+ PCs, it can take up to 70% less time to find and reengage with your Microsoft PowerPoint presentation. Just use your own words, no digging required. v    Screenshot of the Recall (preview) timeline showing work on a Microsoft Excel document as a result of the search for related keywords. This is now generally availableii on Copilot+ PCs powered by AMD, Intel, and Qualcomm NPUs. When enabled, and a user has opted in, Recall (preview) takes frequent snapshots of your active screen. These snapshots are locally stored and encrypted, so that you have an explorable timeline of your past on your PC. Recall (preview) snapshots are available only after you authenticate using Windows Hello credentials. Recall (preview) is off by default for organizations, so that you can adopt Recall (preview) at your own pace. To start using it today: * Enable AllowRecallEnablement via Group Policy or CSP policy, such as in Settings Catalog in Microsoft Intune. * Customize Recall (preview) for your users using policies to manage snapshots. Note: Sensitive content filtering is on by default and helps reduce passwords, national ID numbers, and credit card numbers among other sensitive information from being stored in Recall (preview). Screenshot of the Recall (preview) policy settings in the Microsoft Intune admin center. To learn more about Recall (preview) IT controls, including granular controls for organizations with a Windows Enterprise license, please visit Manage Recall (preview) for Windows clients. Click to Do (preview) Click to Do (preview) saves you time by recognizing any text or image on your screen and suggesting relevant actions that integrate seamlessly into your workflows. For an image, Click to Do (preview) might suggest actions like Bing Visual Search, erasing objects, or removing the background. With Click to Do (preview) actions on a Copilot+ PC, it can take up to 55% less time to remove an object from an image you see in a PDF file. It's as easy as Win+Click.v Screenshot of Click to Do (preview) highlighting search items on the projected screen in a Microsoft Teams meeting. Click to Do (preview) is now generally availableiv and off by default for commercial devices. It will be enabled by default in the next annual feature update. To start using it today: * Enable AllowTemporaryEnterpriseFeatureControl via Group Policy or via your MDM solution. * Use a new policy to manage Click to Do (preview) in your environment for Copilot+ PC users. Learn more about the DisableClickToDo policy. Improved Windows search Experience improved Windows search in File Explorer, Settings, and Windows search on your taskbar, powered by AI models. Find the document and image files on your Copilot+ PC device using associated words and phrases. You no longer need to remember the exact file names, keywords, or content. On Copilot+ PCs, it can take up to 70% less time to find an image and copy it to a new folder using improved Windows search.v And, thanks to the power of the 40+ TOPS NPU onboard Copilot+ PCs, it works even if you're not connected to the internet. Screenshot of improved Windows search showing a document thumbnail that has a matching image to the keyword in the Windows search bar. To start using it today: * Enable AllowTemporaryEnterpriseFeatureControl via Group Policy or via your MDM solution. * Review your existing search policies that manage which folders and file extensions are searchable or indexable. Improved Windows search will continue to respect these policies. Start managing your AI journey If you're looking to adopt Copilot+ PC innovations for your organization at your own pace, try these IT controls. They are designed for you to tailor the Copilot+ PC experience and manage change to better meet the needs and requirements of your organization. For more information on all the new features available, read more on our Windows Experience Blog. Dive deeper into Responsible AI principles and multimodal functionality of Phi Silica. To learn about new AI feature availability to your organization, visit: * Windows Roadmap * The commercial grid  --- i Review the Microsoft Ignite 2024 announcement of New AI experiences transform productivity on Windows 11 Copilot+ PCs. ii Recall (preview) requires Windows Hello Enhanced Sign-in Security. Available in the European Economic Area later this year. Optimized for select languages [English, Chinese (Simplified), French, German, Japanese, and Spanish]. Content-based and storage limitations apply. Enterprise license required for some policy-enabled management controls. See aka.ms/copilotpluspcs. iii Click to Do (preview) is coming to the European Economic Area later in 2025. Functionality varies by market and will roll out across devices over time; text actions are available across markets in select character sets. See aka.ms/copilotpluspcs. iv Improved Windows search works with specific text, image, and document formats only; optimized for select languages [English, Chinese (Simplified), French, German, Japanese, and Spanish]. See aka.ms/copilotpluspcs. v Based on Microsoft-commissioned testing conducted by Principled Technologies, March 2025. Testing compared traditional manual workflows on Windows 10 PC to workflows using prerelease versions of Recall (preview), Click to Do (preview), and improved Windows search on Copilot+ PCs. Actual performance may vary depending on device specifications, configuration, usage, and other factors. Additional details here. --- Continue the conversation. Find best practices. Bookmark the Windows Tech Community, then follow us @MSWindowsITPro on X and on LinkedIn. Looking for support? Visit Windows on Microsoft Q&A.

AI innovations grounded in transparency and control: Looking to pioneer innovation with greater transparency and control?


With the general availability of several new AI features first introduced at Microsoft Ignite 2024,i Copilot+ PCs help address your organization's productivity… #WindowsITPro