Mark your calendars for February 5, 2026. Windows engineering teams will be hosting a second Ask Microsoft Anything (AMA) on the Microsoft Tech Community to help you get the information you need about updating Secure Boot certificates on your Windows devices before they start expiring in June 2026. Experts will be on camera and in the chat to help you with update scenarios, inventorying your estate, formulating the right deployment plan for your organization, and more. When will this happen:This one-hour AMA event will start at 8:00 AM PST (3:00 PM UTC) on February 5, 2026. What you need to do to prepare:Visit the event page, then select Add to Calendar. Want an event reminder? Log in to the Tech Community and select Attend. Can’t attend at that time? Scroll to the bottom of the event page, then post your questions early where it says “Comment.” The event will be recorded so you can catc
Microsoft has identified issues upon installing the January 2026 Windows security update. To address these issues, an out-of-band (OOB) update was released today, January 17, 2026. Connection and authentication failures in remote connection applications: This issue affects multiple platforms including Windows 11, version 25H2; Windows 10, version 22H2 ESU; and Windows Server 2025. See the bottom of this message for the complete list of affected products. Devices with Secure Launch might fail to shut down or hibernate: This issue only affects Windows 11, version 23H2. The out-of-band (OOB) update was released today, January 17, 2026, in the Microsoft Update Catalog. If you have not yet deployed the January 2026 Windows security update and your IT environment includes the affected applications and features, we recommend applying this OOB update instead. For more information and installatio
Windows updates released on and after January 13, 2026, introduce the first phase of protections addressing a Kerberos information disclosure vulnerability (CVE‑2026‑20833). These updates introduce new auditing and optional registry controls that devices can use to begin reducing reliance on RC4 encryption. They also help prepare domain controllers for a future shift to AES‑SHA1 as the default Kerberos encryption method for accounts without explicit encryption settings. The initial deployment phase focuses on identifying misconfigurations or dependencies before the second deployment phase begins in April 2026. When this will happen:The initial deployment phase starts January 13, 2026, and introduces new Kerberos audit events that help identify any remaining RC4 dependencies across your environment. This phase also adds the temporary RC4DefaultDisablementPhase registry value, which organi
Introduction We are announcing the retirement of Q&A, Power BI’s legacy natural language tool. Starting December 2026, Q&A experiences will be retired. Moving forward, users can leverage Power BI Copilot, which offers a more advanced and integrated solution for querying data using generative AI. This change reduces feature overlap, accelerates innovation, and provides a consistent experience across Power BI. When this will happen: Q&A experiences and Q&A Setup will be fully retired by the end of December 2026. How this affects your organization: Who is affected: All organizations using Q&A experiences in Power BI reports, dashboards, mobile, or embedded analytics. What will happen: Creation of new Q&A visuals or experiences will no longer be permitted after December 2026. Existing Q&A visuals in reports, dashboards, mobile, and embedded scenarios will stop working and will be removed. Q&
Preview the expanded Windows Backup for Organizations experience! In early 2026, if users miss the restore option during the out-of-box experience (OOBE) by accident or due to a technical issue, they can still restore at first sign-in. Windows Backup for Organizations helps preserve Windows settings, the list of installed Microsoft Store apps, and the Start menu pins. And now, even more devices can take advantage of this capability, including Microsoft Entra hybrid joined, multi-user setups, and Windows 365 Cloud PCs. When will this happen: The opportunity to sign up for private preview is open now and until February 13, 2026. First sign-in restore will become generally available in early 2026. How this will affect your organization: Windows Backup for Organizations helps your organization upgrade, migrate, or refresh Windows devices. First sign-in restore experience expands its benefits
Prepare for a two-phase hardening change related to CVE-2026-0386. The Unattend.xml file that underlies the hands-free deployment feature of Windows Deployment Services (WDS) poses a vulnerability when it’s transmitted over an unauthenticated RPC channel. Starting with the January 2026 security update, you can explicitly disable it with the help of new Event Log alerts and registry key options. In April 2026, hands-free deployment will be disabled by default. After that date, it will no longer work unless explicitly overridden with registry settings. When will this happen:January 2026 security update: Phase 1 of hardening begins. Hands-free deployment continues to be supported and can be explicitly disabled to enhance security. Use the new Event Log alerts and registry key options. April 2026 security update: Phase 2 of hardening follows. Hands-free deployment will be disabled by default
The January 2026 security update is now available for all supported versions of Windows. We recommend that you install these updates promptly. For more information about the contents of this update, see the release notes, which are easily accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Highlights for the Windows 11, version 25H2 update: This security update includes improvements that were a part of update KB5072033 (released December 9, 2025). This update makes quality improvements to the servicing stack, which is the component that installs Windows updates. This update addresses an issue where you might experience RemoteApp connection failures in Azure Virtual Desktop environments. This might occur after installing KB5070311. This update addresses an issue where devices
A new hardening authentication mitigation has been introduced for the Common Log File System (CLFS) driver. Windows updates that include this new version of CLFS will initiate a 90 day "learning mode" period during which authentication codes will be added to log files automatically. Device behavior will change after this period. For more information, see Common Log File System (CLFS) Authentication Mitigation. When will this happen:Windows 11, version 25H2 and Windows Server 2025 updates released on or after October 28, 2025 include this change. A mitigation adoption period, referred to as "learning mode" will be in place for 90 days following installation of updates. During this time, authentication codes are automatically added to existing logfiles when they are opened. After this period ends, the CLFS driver will enter enforcement mode, requiring all logfiles to contain valid authenti
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. We also have experts from FastTrack, the Customer Acceleration Team, and Microsoft public sector teams. Want to attend the January 15 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar
If you have already set up multi-factor authentication, thank you. No further action is needed at this time. If you have not, please read on. As part of our ongoing commitment to advancing cybersecurity across our company and products, last year, starting February 2025, Microsoft began requiring all users to use multi-factor authentication (MFA) when signing into the Microsoft 365 admin center. Starting February 9th 2026, Microsoft will continue to ramp up enforcement, and users will be unable to sign in to the Microsoft 365 admin center without successfully completing MFA. Implementing MFA in the Microsoft 365 admin center significantly reduces the risk of account compromise, prevents unauthorized access, and safeguards sensitive data. By adding an extra layer of protection beyond standard username and password authentication, MFA makes it harder for attackers to steal data and prevents
Start using the newest Windows 11 capabilities with helpful tips and actionable steps summarized in one place. Discover resources to prepare for Secure Boot certificate update, track and remediate CVEs in Windows Autopatch, opt in to native NVMe support in Windows Server 2025, and much more to help keep your organization protected and productive. When will this happen: Improvements summarized in this monthly recap are already available. Note that some of them are rolling out gradually. How this will affect your organization: You can start seeing improvements across various workflows in your organization with: Common Vulnerabilities and Exposures (CVEs) report in Windows Autopatch Microsoft Intune Suite capabilities included in Microsoft 365 plans Hardware-accelerated BitLocker Secure Boot certificate update resources Optimized multimedia call redirection on Azure Virtual Desktop and Wind
Microsoft has identified an issue affecting Message Queuing (MSMQ) functionality in some enterprise environments after installing the December 2025 Windows security update (released December 9, 2025). Individuals using Windows Home or Pro editions on personal devices are very unlikely to experience this issue, as it primarily affects enterprise or managed IT environments. To address this issue, an out-of-band (OOB) update has been released, today, December 18, 2025, on the Microsoft Update Catalog. For more information and installation instructions, refer to the appropriate KB article for each affected version of Windows listed below. For additional guidance, see How to download updates from the Microsoft Update Catalog. Windows 10, version 22H2 ESU and Windows 10 Enterprise LTSC 2021 (KB5074976) Windows Server 2019 and Enterprise LTSC 2019 (KB5074975) Windows Server 2016 and Windows 10