As announced in January 2026, the unattend.xml file used in hands‑free deployment poses a vulnerability when transmitted over an unauthenticated RPC channel. Beginning with the April 2026 security update, the second phase of hardening for CVE-2026-0386 is now in effect. These changes make hands‑free deployment disabled by default to enforce secure behavior. After this update, hands‑free deployment no longer works unless explicitly overridden with registry settings. When will this happen:Starting with the April 2026 security update, Windows Deployment Services (WDS) enforces secure‑by‑default behavior by automatically disabling hands‑free deployment. How this will affect your organization:After installing the April 2026 security update, hands‑free deployment is blocked to prevent unauthenticated access to unattend.xml, enforcing the hardening requirements for CVE-2026-0386. Any workflows
Administrative actions are undergoing hardening changes that might require operational change to support your organization’s security posture. With the August 2025 Windows non-security update, devices were hardened against unauthorized attempts to bypass loopback detection. However, if you’ve cloned machines without Sysprep, you might see Kerberos and NTLM authentication failures. This is by design. The recommended solution is to rebuild affected devices using supported imaging methods. A temporary workaround is also available. When will this happen:September 2025 and later: Windows security updates include hardening changes that strengthen the trust boundary between identity, authentication, and User Account Control (UAC). April 2026 and later: Windows security updates include a temporary workaround for machines cloned without Sysprep. This registry-based compatibility option isn’t reco
If you are an IT admin with questions about managing and updating Windows, we want to help. Every third Thursday of the month, we host a live chat-based event on the Tech Community called Windows Office Hours. Members of the Windows, Microsoft Intune, Windows Autopilot, Windows Autopatch, and Windows 365 engineering teams will be standing by to answer your questions. Want to attend the April 16 session of Office Hours? Add it to your calendar and select Attend on the event page to let us know you’re coming. There is no video or live meeting component. Simply visit the event page, log in to the Tech Community, and leave your questions in the Comments section. You can also bookmark https://aka.ms/Windows/OfficeHours for upcoming dates (and the ability to add this event to your calendar). We look forward to helping you.
If your organization relies on Windows 10 Enterprise LTSB 2016, you know it’s nearing end of support on October 13, 2026. While the long-term solution is upgrading to a newer LTSC release, another temporary solution is available as of April 1, 2026. Extended Security Updates (ESU) are now available for purchase through Volume Licensing or a Microsoft Cloud Solution Provider (CSP). When will this happen:October 13, 2026: Devices on Windows 10 Enterprise LTSB 2016 will receive a final monthly security update. This date marks end of support (EOS) for this product. April 1, 2026: Extended Security Updates (ESU) are available as a temporary bridge to your next step. How this will affect your organization:After October 13, 2026, these devices will no longer receive Windows security updates, non-security updates, bug fixes, technical support, or online technical content updates. If your organiz
Starting May 2026, Enterprise State Roaming (ESR) management will transition to Windows Backup for Organizations. Windows Backup for Organizations is the enterprise‑grade solution for backing up and restoring Windows user settings and Microsoft Store app list. It’s designed to support device refresh, replacement, and upgrade scenarios (for example, moving to the latest version of Windows 11). ESR settings remain the same in scope. The only change is in how you manage these settings. This change aligns ESR‑managed settings with Windows Backup for Organizations policies. You can now manage and synchronize user settings with a policy‑based experience through Microsoft Intune or other mobile device management (MDM) providers. When will this happen:This change begins May 2026. You can manage ESR settings through both the Microsoft Entra portal and Windows Backup for Organizations policies for
Migrate away from the Microsoft Support and Recovery Assistant utility (SaRA). This command-line utility is deprecated to help secure and harden your environment. The Get Help command-line tool has similar capabilities and is recommended as a replacement for the SaRA utility. You’ll need to download it and use GetHelpCmd.exe to run your scenarios. When will this happen: March 10, 2026: Microsoft has officially removed the SaRA utility from all in-support versions of Windows. The Get Help command-line tool has been available for some time now. How this will affect your organization: The infrastructure powering GetHelpCmdLine includes improved security. The core functionality of GetHelpCmdLine and SaraCmdLine remains the same. All the scenarios supported in SaRACmdLine tool are supported as-is in GetHelpCmdLine. All SaRA scripts are migrated to GetHelpCmdLine. These scripts no longer work
Starting April 2026, the Windows Security app can show users the status of their Secure Boot certificate updates. This experience is disabled by default on enterprise-managed Windows 10 and Windows 11 client devices and Windows Server. If you want to enable this experience for devices in your organization, see the complete guidance at IT admin guide: Secure Boot certificate update status in the Windows Security app. When will this happen: In April 2026, this enhancement brings green, yellow, and red-color badges to Device security > Secure Boot. In May 2026, notifications will appear outside the app (such as system alerts). In late June 2026, the 2011 Secure Boot certificates begin expiring. Devices need updated 2023 certificates by this date to remain protected and productive. How this will affect your organization: This feature is available in Windows 11, Windows 10, Windows Server 202
The Manage option in the Updates card and the label for release wave in the Updates card will be removed on February 3, 2026. How does this affect me? The Environments page in the Power Platform admin center will be updated, removing the Manage option and the label for release wave in the Updates card. When this change takes effect, a new link in the Updates card titled, "Release Wave opt-in has moved!" will be added. Your environment behavior is now dependent on the Release Channel settings. What action do I need to take? To Opt in to early access updates, use the monthly release channel, as explained in Use a release channel. Learn more:For more information about Release channels, please see the Release channel overview learn article. For more information about how to determine dates and build numbers for April and October waves, please see the General availability deployment learn art
Microsoft has identified an issue affecting installation of the March 2026 Windows non-security preview update on some devices running Windows 11, versions 25H2 and 24H2. While installing the update, the following error might occur: “Some update files are missing or have problems. We’ll try to download the update again later. Error code: (0x80073712)” An out-of-band (OOB) update was released today, March 31, 2026, to address this installation issue. This cumulative OOB update for Windows 11, versions 25H2 and 24H2 (KB5086672) supersedes all previous updates and includes all protections and improvements from the March 2026 Windows security and non-security preview updates, as well as this installation fix. Devices running Windows 11, versions 25H2 and 24H2 with Get the latest updates as soon as they’re available turned on may see this update offered automatically through Windows Update wh
(Updated 3-31-2026: The March 2026 Windows non-security preview update has been replaced with out-of-band update KB5086672 for Windows 11, versions 25H2 and 24H2. The Windows 11 links in this message have been updated to reflect this change.) The March 2026 non-security preview update is now available for Windows 11, versions 26H1, 25H2, and 24H2. Information about the contents of this update is available from the release notes, which are accessible from the Windows 11 update history page. To learn more about the different types of monthly quality updates, see Windows monthly updates explained. Looking to explore upcoming features and improvements in Windows 11? Check out the Windows roadmap. It includes what’s coming to the Windows Insider Program, what’s gradually rolling out, and what’s generally available. Highlights for the Windows 11, version 25H2 update: Narrator now provides rich
Updated March 27, 2026: We have updated the timeline. Thank you for your patience. [Introduction] We are updating the entry points for Copilot in Word to provide a clearer, more consistent, and more intuitive experience. These changes unify how users access Copilot and introduce Word Agent in the chat pane as the primary Copilot interface. This update improves discoverability, simplifies the user workflow, and creates consistency with other Microsoft 365 apps. [When this will happen] General Availability (Worldwide): We will begin rolling out in early April 2026 (previously late March) and expect to complete by June 2026 (previously late April). General Availability (GCC, GCCH and DoD): We will begin rolling out in October 2026 (previously late March) and expect to complete by late October 2026 (previously late April). [How this affects your organization] Who is affected All users of Mic
Secure Boot certificates begin expiring in June 2026, and IT admins should take action now to help ensure devices remain secure. Timely deployment of updated certificates is essential to preserving device startup integrity and avoiding servicing (i.e., updates) disruptions. New guidance has recently been published to support a range of deployment scenarios. Whether your organization manages certificates through Microsoft Intune, Group Policy, or manual processes, the resources below provide detailed steps, recommended practices, and troubleshooting guidance to help you plan your updates:Updates and announcements – This page consolidates ongoing updates, milestones, and rollout status changes for the deployment of new Secure Boot certificates across Windows devices. Use it to stay current on important servicing communications as the deployment progresses. Sample Secure Boot E2E Automatio