windows 11 24h2

In depth with Windows 11 Recall—and what Microsoft has (and hasn’t) fixed

AI, copilot+ PC, Features, Tech, Windows 11, windows 11 24h2, windows recall / Paul Patrick / April 22, 2025

Original botched launch still haunts new version of data-scraping AI feature.

Recall is coming back. Credit: Andrew Cunningham

Microsoft is preparing to reintroduce Recall to Windows 11. A feature limited to Copilot+ PCs—a label that just a fraction of a fraction of Windows 11 systems even qualify for—Recall has been controversial in part because it builds an extensive database of text and screenshots that records almost everything you do on your PC.

But the main problem with the initial version of Recall—the one that was delayed at the last minute after a large-scale outcry from security researchers, reporters, and users—was not just that it recorded everything you did on your PC but that it was a rushed, enabled-by-default feature with gaping security holes that made it trivial for anyone with any kind of access to your PC to see your entire Recall database.

It made no efforts to automatically exclude sensitive data like bank information or credit card numbers, offering just a few mechanisms to users to manually exclude specific apps or websites. It had been built quickly, outside of the normal extensive Windows Insider preview and testing process. And all of this was happening at the same time that the company was pledging to prioritize security over all other considerations, following several serious and highly public breaches.

Any coverage of the current version of Recall should mention what has changed since then.

Recall is being rolled out to Microsoft’s Windows Insider Release Preview channel after months of testing in the more experimental and less-stable channels, just like most other Windows features. It’s turned off by default and can be removed from Windows root-and-branch by users and IT administrators who don’t want it there. Microsoft has overhauled the feature’s underlying security architecture, encrypting data at rest so it can’t be accessed by other users on the PC, adding automated filters to screen out sensitive information, and requiring frequent reauthentication with Windows Hello anytime a user accesses their own Recall database.

Testing how Recall works

I installed the Release Preview Windows 11 build with Recall on a Snapdragon X Elite version of the Surface Laptop and a couple of Ryzen AI PCs, which all have NPUs fast enough to support the Copilot+ features.

No Windows PCs without this NPU will offer Recall or any other Copilot+ features—that’s every single PC sold before mid-2024 and the vast majority of PCs since then. Users may come up with ways to run those features on unsupported hardware some other way. But by default, Recall isn’t something most of Windows’ current user base will have to worry about.

Microsoft is taking data protection more seriously this time around. If Windows Hello isn’t enabled or drive encryption isn’t turned on, Recall will refuse to start working until you fix the issues. Credit: Andrew Cunningham

After installing the update, you’ll see a single OOBE-style setup screen describing Recall and offering to turn it on; as promised, it is now off by default until you opt in. And even if you accept Recall on this screen, you have to opt in a second time as part of the Recall setup to actually turn the feature on. We’ll be on high alert for a bait-and-switch when Microsoft is ready to remove Recall’s “preview” label, whenever that happens, but at least for now, opt-in means opt-in.

Enable Recall, and the snapshotting begins. As before, it’s storing two things: actual screenshots of the active area of your screen, minus the taskbar, and a searchable database of text that it scrapes from those screenshots using OCR. Somewhat oddly, there are limits on what Recall will offer to OCR for you; even if you’re using multiple apps onscreen at the same time, only the active, currently-in-focus app seems to have its text scraped and stored.

This is also more or less how Recall handles multi-monitor support; only the active display has screenshots taken, and only the active window on the active display is OCR’d. This does prevent Recall from taking gigabytes and gigabytes of screenshots of static or empty monitors, though it means the app may miss capturing content that updates passively if you don’t interact with those windows periodically.

All of this OCR’d text is fully searchable and can be copied directly from Recall to be pasted somewhere else. Recall will also offer to open whatever app or website is visible in the screenshot, and it gives you the option to delete that specific screenshot and all screenshots from specific apps (handy, if you decide you want to add an entire app to your filtering settings and you want to get rid of all existing snapshots of it).

Here are some basic facts about how Recall works on a PC since there’s a lot of FUD circulating about this, and much of the information on the Internet is about the older, insecure version from last year:

Recall is per-user. Setting up Recall for one user account does not turn on Recall for all users of a PC.
Recall does not require a Microsoft account.
Recall does not require an Internet connection or any cloud-side processing to work.
Recall does require your local disk to be encrypted with Device Encryption/BitLocker.
Recall does require Windows Hello and either a fingerprint reader or face-scanning camera for setup, though once it’s set up, it can be unlocked with a Windows Hello PIN.
Windows Hello authentication happens every time you open the Recall app.
Enabling Recall and changing its settings does not require an administrator account.
Recall can be uninstalled entirely by unchecking it in the legacy Windows Features control panel (you can also search for “turn Windows features on and off”).

If you read our coverage of the initial version, there’s a whole lot about how Recall functions that’s essentially the same as it was before. In Settings, you can see how much storage the feature is using and limit the total amount of storage Recall can use. The amount of time a snapshot can be kept is normally determined by the amount of space available, not by the age of the snapshot, but you can optionally choose a second age-based expiration date for snapshots (options range from 30 to 180 days).

You can see Recall hit the system’s NPU periodically every time it takes a snapshot (this is on an AMD Ryzen AI system, but it should be the same for Qualcomm Snapdragon PCs and Intel Core Ultra/Lunar Lake systems). Browsing your Recall database doesn’t use the NPU. Credit: Andrew Cunningham

It’s also possible to delete the entire database or all recent snapshots (those from the past hour, past day, past week, or past month), toggle the automated filtering of sensitive content, or add specific apps and websites you’d like to have filtered. Recall can temporarily be paused by clicking the system tray icon (which is always visible when you have Recall turned on), and it can be turned off entirely in Settings. Neither of these options will delete existing snapshots; they just stop your PC from creating new ones.

The amount of space Recall needs to do its thing will depend on a bunch of factors, including how actively you use your PC and how many things you filter out. But in my experience, it can easily generate a couple of hundred megabytes per day of images. A Ryzen system with a 1TB SSD allocated 150GB of space to Recall snapshots by default, but even a smaller 25GB Recall database could easily store a few months of data.

Fixes: Improved filtering, encryption at rest

For apps and sites that you know you don’t want to end up in Recall, you can manually add them to the exclusion lists in the Settings app. As a rule, major browsers running in private or incognito modes are also generally not snapshotted.

If you have an app that’s being filtered onscreen for any reason—even if it’s onscreen at the same time as an app that’s not being filtered, Recall won’t take pictures of your desktop at all. I ran an InPrivate Microsoft Edge window next to a regular window, and Microsoft’s solution is just to avoid capturing and storing screenshots entirely rather than filtering or blanking out the filtered app or site in some way.

This is probably the best way to do it! It minimizes the risk of anything being captured accidentally just because it’s running in the background, for example. But it could mean you don’t end up capturing much in Recall at all if you’re frequently mixing filtered and unfiltered apps.

New to this version of Recall is an attempt at automated content filtering to address one of the major concerns about the original iteration of Recall—that it can capture and store sensitive information like credit card numbers and passwords. This filtering is based on the technology Microsoft uses for Microsoft Purview Information Protection, an enterprise feature used to tag sensitive information on business, healthcare, and government systems.

This automated content filtering is hit and miss. Recall wouldn’t take snapshots of a webpage with a visible credit card field, or my online banking site, or an image of my driver’s license, or a recent pay stub, or of the Bitwarden password manager while viewing credentials. But I managed to find edge cases in less than five minutes, and you’ll be able to find them, too; Recall saved snapshots showing a recent check, with the account holder’s name, address, and account and routing numbers visible, and others testing it have still caught it recording credit card information in some cases.

The automated filtering is still a big improvement from before, when it would capture this kind of information indiscriminately. But things will inevitably slip through, and the automated filtering won’t help at all with other kinds of data; Recall will take pictures of email and messaging apps without distinguishing between what’s sensitive (school information for my kid, emails about Microsoft’s own product embargoes) and what isn’t.

Recall can be removed entirely. If you take it out, it’s totally gone—the options to configure it won’t even appear in Settings anymore. Credit: Andrew Cunningham

The upshot is that if you capture months and months and gigabytes and gigabytes of Recall data on your PC, it’s inevitable that it will capture something you probably wouldn’t want to be preserved in an easily searchable database.

One issue is that there’s no easy way to check and confirm what Recall is and isn’t filtering without actually scrolling through the database and checking snapshots manually. The system tray status icon does change to display a small triangle and will show you a “some content is being filtered” status message when something is being filtered, but the system won’t tell you what it is; I have some kind of filtered app or browser tab open somewhere right now, and I have no idea which one it is because Windows won’t tell me. That any attempt at automated filtering is hit-and-miss should be expected, but more transparency would help instill trust and help users fine-tune their filtering settings.

Recall’s files are still clearly visible and trivial to access, but with one improvement: They’re all actually encrypted now. Credit: Andrew Cunningham

Microsoft also seems to have fixed the single largest problem with Recall: previously, all screenshots and the entire text database were stored in plaintext with zero encryption. It was technically, usually encrypted, insofar as the entire SSD in a modern PC is encrypted when you sign into a Microsoft account or enable Bitlocker, but any user with any kind of access to your PC (either physical or remote) could easily grab those files and view them anywhere with no additional authentication necessary.

This is fixed now. Recall’s entire file structure is available for anyone to look at, stored away in the user’s AppData folder in a directory called CoreAIPlatform.00UKP. Other administrators on the same PC can still navigate to these folders from a different user account and move or copy the files. Encryption renders them (hypothetically) unreadable.

Microsoft has gone into some detail about exactly how it’s protecting and storing the encryption keys used to encrypt these files—the company says “all encryption keys [are] protected by a hypervisor or TPM.” Rate-limiting and “anti-hammering” protections are also in place to protect Recall data, though I kind of have to take Microsoft at its word on that one.

That said, I don’t love that it’s still possible to get at those files at all. It leaves open the possibility that someone could theoretically grab a few megabytes’ worth of data. But it’s now much harder to get at that data, and better filtering means what is in there should be slightly less all-encompassing.

Lingering technical issues

As we mentioned already, Microsoft’s automated content filtering is hit-and-miss. Certainly, there’s a lot of stuff that the original version of Recall would capture that the new one won’t, but I didn’t have to work hard to find corner-cases, and you probably won’t, either. Turning Recall on still means assuming risk and being comfortable with the data and authentication protections Microsoft has implemented.

We’d also like there to be a way for apps to tell Recall to exclude them by default, which would be useful for password managers, encrypted messaging apps, and any other software where privacy is meant to be the point. Yes, users can choose to exclude these apps from Recall backups themselves. But as with Recall itself, opting in to having that data collected would be preferable to needing to opt out.

You need a fingerprint reader or face-scanning camera to get Recall set up, but once it is set up, anyone with your PIN and access to your PC can get in and see all your stuff. Credit: Andrew Cunningham

Another issue is that, while Recall does require a fingerprint reader or face-scanning camera when you set it up the very first time, you can unlock it with a Windows Hello PIN after it’s already going.

Microsoft has said that this is meant to be a fallback option in case you need to access your Recall database and there’s some kind of hardware issue with your fingerprint sensor. But in practice, it feels like too easy a workaround for a domestic abuser or someone else with access to your PC and a reason to know your PIN (and note that the PIN also gets them into your PC in the first place, so encryption isn’t really a fix for this). It feels like too broad a solution for a relatively rare problem.

Security researcher Kevin Beaumont, whose testing helped call attention to the problems with the original version of Recall last year, identified this as one of Recall’s biggest outstanding technical problems in a blog post shared with Ars Technica shortly before its publication (as of this writing, it’s available here; he and I also exchanged multiple text over the weekend comparing our findings).

“In my opinion, requiring devices to have enhanced biometrics with Windows Hello but then not requiring said biometrics to actually access Recall snapshots is a big problem,” Beaumont wrote. “It will create a false sense of security in customers and false downstream advertising about the security of Recall.”

Beaumont also noted that, while the encryption on the Recall snapshots and database made it a “much, much better design,” “all hell would break loose” if attackers ever worked out a way to bypass this encryption.

“Microsoft know this and have invested in trying to stop it by encrypting the database files, but given I live in the trenches where ransomware groups are running around with zero days in Windows on an almost monthly basis nowadays, where patches arrive months later… Lord, this could go wrong,” he wrote.

But most of what’s wrong with Recall is harder to fix

Microsoft has actually addressed many of the specific, substantive Recall complaints raised by security researchers and our own reporting. It’s gone through the standard Windows testing process and has been available in public preview in its current form since late November. And yet the knee-jerk reaction to Recall news is still generally to treat it as though it were the same botched, bug-riddled software that nearly shipped last summer.

Some of this is the asymmetrical nature of how news spreads on the Internet—without revealing traffic data, I’ll just say that articles about Recall having problems have been read many, many more times by many more people than pieces about the steps Microsoft has taken to fix Recall. The latter reports simply aren’t being encountered by many of the minds Microsoft needs to change.

But the other problem goes deeper than the technology itself and gets back to something I brought up in my first Recall preview nearly a year ago—regardless of how it is architected and regardless of how many privacy policies and reassurances the company publishes, people simply don’t trust Microsoft enough to be excited about “the feature that records and stores every single thing you do with your PC.”

Recall continues to demand an extraordinary level of trust that Microsoft hasn’t earned. However secure and private it is—and, again, the version people will actually get is much better than the version that caused the original controversy—it just feels creepy to open up the app and see confidential work materials and pictures of your kid. You’re already trusting Microsoft with those things any time you use your PC, but there’s something viscerally unsettling about actually seeing evidence that your computer is tracking you, even if you’re not doing anything you’re worried about hiding, even if you’ve excluded certain apps or sites, and even if you “know” that part of the reason why Recall requires a Copilot+ PC is because it’s processing everything locally rather than on a server somewhere.

This was a problem that Microsoft made exponentially worse by screwing up the Recall rollout so badly in the first place. Recall made the kind of ugly first impression that it’s hard to dig out from under, no matter how thoroughly you fix the underlying problems. It’s Windows Vista. It’s Apple Maps. It’s the Android tablet.

And in doing that kind of damage to Recall (and possibly also to the broader Copilot+ branding project), Microsoft has practically guaranteed that many users will refuse to turn it on or uninstall it entirely, no matter how it actually works or how well the initial problems have been addressed.

Unfortunately, those people probably have it right. I can see no signs that Recall data is as easily accessed or compromised as before or that Microsoft is sending any Recall data from my PC to anywhere else. But today’s Microsoft has earned itself distrust-by-default from many users, thanks not just to the sloppy Recall rollout but also to the endless ads and aggressive cross-promotion of its own products that dominate modern Windows versions. That’s the kind of problem you can’t patch your way out of.

Listing image: Andrew Cunningham

Andrew is a Senior Technology Reporter at Ars Technica, with a focus on consumer tech including computer hardware and in-depth reviews of operating systems like Windows and macOS. Andrew lives in Philadelphia and co-hosts a weekly book podcast called Overdue.

In depth with Windows 11 Recall—and what Microsoft has (and hasn’t) fixed Read More »

New Windows 11 build makes mandatory Microsoft Account sign-in even more mandatory

Tech, Windows 11, windows 11 24h2, windows 11 25h2 / Rejus Almole / March 29, 2025

Microsoft released a new Windows Insider build of Windows 11 to its experimental Dev Channel today, with a fairly extensive batch of new features and tweaks. But the most important one for enthusiasts and PC administrators is buried halfway down the list: This build removes a command prompt script called bypassnro, which up until now has been a relatively easy and reliable way to circumvent the otherwise mandatory Microsoft Account sign-in requirement on new Windows 11 PCs and fresh installs of Windows 11 on existing PCs.

Microsoft’s Windows Insider Program lead Amanda Langowski and Principal Product Manager Brandon LeBlanc were clear that this change is considered a feature and not a bug.

“We’re removing the bypassnro.cmd script from the build to enhance security and user experience of Windows 11,” Langowski and LeBlanc write in the post. “This change ensures that all users exit setup with internet connectivity and a Microsoft Account.”

Of course, the removal of bypassnro makes life harder for people who want to exit Windows setup without Internet connectivity or a Microsoft Account. You might be setting up a computer in a place with no Internet connection, or you might simply prefer a local user account like the ones that all past Windows versions allowed you to use.

There are benefits to a Microsoft Account—easy access to any existing Microsoft 365 or OneDrive subscriptions, automated encryption for your local disk and backup of your drive’s encryption key for recovery purposes, and syncing of certain settings between PCs. But using a local account reduces the number of notifications and other upsells that Windows 11 will bother you with. Whatever your reasoning, you’ll need to find a different workaround for future Windows versions.

New Windows 11 build makes mandatory Microsoft Account sign-in even more mandatory Read More »

Microsoft reiterates “non-negotiable” TPM 2.0 requirement for Windows 11

Tech, Windows 10, Windows 11, windows 11 24h2 / Tim Belzer / December 4, 2024

Windows 11 has other system requirements, though they weren’t the focus of this TPM-centric blog post. Windows 11 systems must have Secure Boot enabled, and they have to use a supported processor—an 8th-gen Intel Core CPU, an AMD Ryzen 2000 CPU, or a Qualcomm Snapdragon 850 CPU or newer. In fact, these CPU requirements exclude a couple of generations’ worth of Intel and AMD chips with built-in TPM 2.0 support.

Windows 11 also has nominal requirements for RAM and processor speed, but any system that meets the CPU or TPM requirements will easily clear those bars. If you have a supported CPU and your PC doesn’t appear to support TPM 2.0, you should be able to enable it in your system’s BIOS, either manually or by installing a BIOS update for your motherboard.

Windows 11 can be installed on unsupported systems, either those with an older TPM 1.2 module or no TPM enabled at all. It’s more annoying to install major updates on those systems, and Microsoft reserves the right to pull updates from those systems at any time, but aside from that, Windows 11 usually runs about as well on these PCs as Windows 10 did.

Microsoft reiterates “non-negotiable” TPM 2.0 requirement for Windows 11 Read More »

Microsoft’s controversial Recall scraper is finally entering public preview

copilot, microsoft, recall, Tech, Windows 11, windows 11 24h2, windows insider program, windows recall / Rejus Almole / November 22, 2024

Users will be asked to reauthenticate with Windows Hello every time they access their Recall database. Credit: Microsoft

Microsoft has now delayed the feature multiple times to address those concerns, and it outlined multiple security-focused additions to Recall in a blog post in September. Among other changes, the feature is now opt-in by default and is protected by additional encryption. Users must also re-authenticate with Windows Hello each time they access the database. Turning on the feature requires Secure Boot, BitLocker disk encryption, and Windows Hello to be enabled. In addition to the manual exclusion lists for sites and apps, the new Recall also attempts to mask sensitive data like passwords and credit card numbers so they aren’t stored in the Recall database.

The new version of Recall can also be completely uninstalled for users who have no interest in it, or by IT administrators who don’t want to risk it exposing sensitive data.

Testers will need to kick the tires on all of these changes to make sure that they meaningfully address all the risks and issues that the original version of Recall had, and this Windows Insider preview is their chance to do it.

“Do security”

Part of the original Recall controversy was that Microsoft wasn’t going to run it through the usual Windows Insider process—it was intended to be launched directly to users of the new Copilot+ PCs via a day-one software update. This in itself was a big red flag; usually, even features as small as spellcheck for the Notepad app go through multiple weeks of Windows Insider testing before Microsoft releases them to the public. This gives the company a chance to fix bugs, collect and address user feedback, and even scrub new features altogether.

Microsoft is supposedly re-orienting itself to put security over all other initiatives and features. CEO Satya Nadella recently urged employees to “do security” when presented with the option to either launch something quickly or launch something securely. In Recall’s case, the company’s rush to embrace generative AI features almost won out over that “do security” mandate. If future AI features go through the typical Windows Insider testing process first, that will be a sign that Microsoft is taking its commitment to security seriously.

Microsoft’s controversial Recall scraper is finally entering public preview Read More »

Microsoft pushes full-screen ads for Copilot+ PCs on Windows 10 users

Tech, Windows 10, Windows 11, windows 11 24h2 / Tim Belzer / November 20, 2024

Windows 10’s free, guaranteed security updates stop in October 2025, less than a year from now. Windows 10 users with supported PCs have been offered the Windows 11 upgrade plenty of times before. But now Microsoft is apparently making a fresh push to get users to upgrade, sending them full-screen reminders recommending they buy new computers.

The reminders, which users have seen within the last few days, all mention the end of Windows 10 support but otherwise seem to differ from computer to computer. My Ars colleague Kyle Orland got one focused on Windows 11’s gaming features, while posters on X (formerly Twitter) got screens that emphasized the ease of migrating from old PCs to new ones and other Windows 11 features. One specifically recommended upgrading to a Copilot+ PC, which supports a handful of extra AI features that other Windows 11 PCs don’t, but other messages didn’t mention Copilot+ specifically.

None of the messages mention upgrading to Windows 11 directly, though Kyle said his PC meets Windows 11’s requirements. These messages may be intended mostly for people using older PCs that can’t officially install the Windows 11 update.

Microsoft pushes full-screen ads for Copilot+ PCs on Windows 10 users Read More »

Notepad.exe, now an actively maintained app, has gotten its inevitable AI update

AI, microsoft, notepad, paint, Prism, Tech, Windows 11, windows 11 24h2, windows insider / Rejus Almole / November 9, 2024

Among the decades-old Windows apps to get renewed attention from Microsoft during the Windows 11 era is Notepad, the basic built-in text editor that was much the same in early 2021 as it had been in the ’90 and 2000s. Since then, it has gotten a raft of updates, including a visual redesign, spellcheck and autocorrect, and window tabs.

Given Microsoft’s continuing obsession with all things AI, it’s perhaps not surprising that the app’s latest update (currently in preview for Canary and Dev Windows Insiders) is a generative AI feature called Rewrite that promises to adjust the length, tone, and phrasing of highlighted sentences or paragraphs using generative AI. Users will be offered three rewritten options based on what they’ve highlighted, and they can select the one they like best or tell the app to try again.

Rewrite appears to be based on the same technology as the Copilot assistant, since it uses cloud-side processing (rather than your local CPU, GPU, or NPU) and requires Microsoft account sign-in to work. The initial preview is available to users in the US, France, the UK, Canada, Italy, and Germany.

If you don’t care about AI or you don’t sign in with a Microsoft account, note that Microsoft is also promising substantial improvements in launch time with this version of Notepad. “Most users will see app launch times improve by more than 35 percent, with some users seeing improvements of 55 percent or more,” reads the blog post by Microsoft’s Windows apps manager Dave Grochocki.

Notepad.exe, now an actively maintained app, has gotten its inevitable AI update Read More »

Microsoft delays rollout of the Windows 11 Recall feature yet again

microsoft, Tech, Windows 11, windows 11 24h2, windows recall / Mike M. / November 1, 2024

“We are committed to delivering a secure and trusted experience with Recall. To ensure we deliver on these important updates, we’re taking additional time to refine the experience before previewing it with Windows Insiders,” said Microsoft Windows Insider Senior Program Manager Brandon LeBlanc in a statement provided to The Verge.

LeBlanc didn’t offer additional details on the latest Recall delay or make any new announcements about other security precautions Microsoft is taking with the feature. The company’s September blog post detailed how data was being protected using Windows’ Virtualization-Based Security (VBS) features and Windows Hello authentication and reiterated that Recall will be opt-in by default and that it will be fully removable for Windows users who aren’t interested in using it.

When it does start to roll out, Recall will still require a Copilot+ PC, which gets some AI-related features not available to typical Windows 11 PCs. To meet the Copilot+ requirements, PCs must have at least 16GB of RAM and 256GB of storage, plus a neural processing unit (NPU) that can perform at least 40 trillion operations per second (TOPS). Users will also need their PCs to be enrolled in the Windows Insider Program; we have no idea when non-Windows Insider PCs will start getting Recall, though at this point, it seems likely it won’t be until sometime in 2025.

Microsoft delays rollout of the Windows 11 Recall feature yet again Read More »

What I learned from 3 years of running Windows 11 on “unsupported” PCs

Features, microsoft, Tech, Windows, Windows 10, windows 10 22h2, Windows 11, windows 11 23h2, windows 11 24h2 / Tim Belzer / October 26, 2024

where we’re going, we don’t need support

When your old PC goes over the Windows 10 update cliff, can Windows 11 save it?

Credit: Andrew Cunningham

The Windows 10 update cliff is coming in October 2025. We’ve explained why that’s a big deal, and we have a comprehensive guide to updating to Windows 11 (recently updated to account for changes in Windows 11 24H2) so you can keep getting security updates, whether you’re on an officially supported PC or not.

But this is more than just a theoretical exercise; I’ve been using Windows 11 on some kind of “unsupported” system practically since it launched to stay abreast of what the experience is actually like and to keep tabs on whether Microsoft would make good on its threats to pull support from these systems at any time.

Now that we’re three years in, and since I’ve been using Windows 11 24H2 on a 2012-era desktop and laptop as my primary work machines on and off for a few months now, I can paint a pretty complete picture of what Windows 11 is like on these PCs. As the Windows 10 update cliff approaches, it’s worth asking: Is running “unsupported” Windows 11 a good way to keep an older but still functional machine running, especially for non-technical users?

My hardware

I’ve run Windows 11 on a fair amount of old hardware, including PCs as old as a late XP-era Core 2 Duo Dell Inspiron desktop. For the first couple of years, I ran it most commonly on an old Dell XPS 13 9333 with a Core i5-4250U and 8GB of RAM and a Dell Latitude 3379 2-in-1 that just barely falls short of the official requirements (both systems are also pressed into service for ChromeOS Flex testing periodically).

But I’ve been running the 24H2 update as my main work OS on two machines. The first is a Dell Optiplex 3010 desktop with a 3rd-generation Core i5-3xxx CPU, which had been my mother’s main desktop until I upgraded it a year or so ago. The second is a Lenovo ThinkPad X230 with a i5-3320M inside, a little brick of a machine that I picked up for next to nothing on Goodwill’s online auction site.

Both systems, and the desktop in particular, have been upgraded quite a bit; the laptop has 8GB of RAM while the desktop has 16GB, both are running SATA SSDs, and the desktop has a low-profile AMD Radeon Pro WX2100 in it, a cheap way to get support for running multiple 4K monitors. The desktop also has USB Wi-Fi and Bluetooth dongles and an internal expansion card that provides a pair of USB 3.0 Type-A ports and a single USB-C port. Systems of this vintage are pretty easy to refurbish since components are old enough that they’ve gone way down in price but not so old that they’ve become rare collectors’ items. It’s another way to get a usable computer for $100—or for free if you know where to look.

And these systems were meant to be maintained and upgraded. It’s one of the beautiful things about a standardized PC platform, though these days we’ve given a lot of that flexibility up in favor of smaller, thinner devices and larger batteries. It is possible to upgrade and refurbish these 12-year-old computers to the point that they run modern operating systems well because they were designed to leave room for that possibility.

But no matter how much you upgrade any of these PCs or how well you maintain them, they will never meet Windows 11’s official requirements. That’s the problem.

Using it feels pretty normal

Once it’s installed, Windows 11 is mostly Windows 11, whether your PC is officially supported or not. Credit: Andrew Cunningham

Depending on how you do it, it can be a minor pain to get Windows 11 up and running on a computer that doesn’t natively support it. But once the OS is installed, Microsoft’s early warnings about instability and the possible ending of updates have proven to be mostly unfounded.

A Windows 11 PC will still grab all of the same drivers from Windows Update as a Windows 10 PC would, and any post-Vista drivers have at least a chance of working in Windows 11 as long as they’re 64-bit. But Windows 10 was widely supported on hardware going back to the turn of the 2010s. If it shipped with Windows 8 or even Windows 7, your hardware should mostly work, give or take the occasional edge case. I’ve yet to have a catastrophic crash or software failure on any of the systems I’m using, and they’re all from the 2012–2016 era.

Once Windows 11 is installed, routine software updates and app updates from the Microsoft Store are downloaded and installed on my “unsupported” systems the same way they are on my “supported” ones. You don’t have to think about how you’re running an unsupported operating system; Windows remains Windows. That’s the big takeaway here—if you’re happy with the performance of your unsupported PC under Windows 10, nothing about the way Windows 11 runs will give you problems.

…Until you want to install a big update

There’s one exception for the PCs I’ve had running unsupported Windows 11 installs in the long term: They don’t want to automatically download and install the yearly feature updates for Windows. So a 22H2 install will keep downloading and installing updates for as long as they’re offered, but it won’t offer to update itself to versions 23H2 or 24H2.

This behavior may be targeted specifically at unsupported PCs, or it may just be a byproduct of how Microsoft rolls out these yearly updates (if you have a supported system with a known hardware or driver issue, for example, Microsoft will withhold these updates until the issues are resolved). Either way, it’s an irritating thing to have to deal with every year or every other year—Microsoft supports most of its annual updates for two years after they’re released to the public. So 23H2 and 24H2 are currently supported, while 22H2 and 21H2 (the first release of Windows 11) are at the end of the line.

This essentially means you’ll need to repeat the steps for doing a new unsupported Windows 11 install every time you want to upgrade. As we detail in our guide, that’s relatively simple if your PC has Secure Boot and a TPM but doesn’t have a supported processor. Make a simple registry tweak, download the Installation Assistant or an ISO file to run Setup from, and the Windows 11 installer will let you off with a warning and then proceed normally, leaving your files and apps in place.

Without Secure Boot or a TPM, though, installing these upgrades in place is more difficult. Trying to run an upgrade install from within Windows just means the system will yell at you about the things your PC is missing. Booting from a USB drive that has been doctored to overlook the requirements will help you do a clean install, but it will delete all your existing files and apps.

If you’re running into this problem and still want to try an upgrade install, there’s one more workaround you can try.

Download an ISO for the version of Windows 11 you want to install, and then either make a USB install drive or simply mount the ISO file in Windows by double-clicking it.
Open a Command Prompt window as Administrator and navigate to whatever drive letter the Windows install media is using. Usually that will be D: or E:, depending on what drives you have installed in your system; type the drive letter and colon into the command prompt window and press Enter.
Type setup.exe /product server

You’ll notice that the subsequent setup screens all say they’re “installing Windows Server” rather than the regular version of Windows, but that’s not actually true—the Windows image that comes with these ISO files is still regular old Windows 11, and that’s what the installer is using to upgrade your system. It’s just running a Windows Server-branded version of the installer that apparently isn’t making the same stringent hardware checks that the normal Windows 11 installer is.

This workaround allowed me to do an in-place upgrade of Windows 11 24H2 onto a Windows 10 22H2 PC with no TPM enabled. It should also work for upgrading an older version of Windows 11 to 24H2.

Older PCs are still very useful!

This 2012-era desktop can be outfitted with 16 GB of memory and a GPU that can drive multiple 4K displays, things that wouldn’t have been common when it was manufactured. But no matter how much you upgrade it, Windows 11 will never officially support it. Credit: Andrew Cunningham

Having to go out of your way to keep Windows 11 up to date on an unsupported PC is a fairly major pain. But unless your hardware is exceptionally wretched (I wouldn’t recommend trying to get by with less than 4GB of RAM at an absolute bare minimum, or with a spinning hard drive, or with an aging low-end N-series Pentium or Celeron chip), you’ll find that decade-old laptops and desktops can still hold up pretty well when you’re sticking to light or medium-sized workloads.

I haven’t found this surprising. Major high-end CPU performance improvements have come in fits and starts over the last decade, and today’s (Windows 11-supported) barebones bargain basement Intel N100 PCs perform a lot like decade-old mainstream quad-core desktop processors.

With its RAM and GPU updates, my Optiplex 3010 and its Core i5 worked pretty well with my normal dual-4K desktop monitor setup (it couldn’t drive my Gigabyte M28U at higher than 60 Hz, but that’s a GPU limitation). Yes, I could feel the difference between an aging Core i5-3475S and the Core i7-12700 in my regular Windows desktop, and it didn’t take much at all for CPU usage to spike to 100 percent and stay there, always a sign that your CPU is holding you back. But once apps were loaded, they felt responsive, and I had absolutely no issues writing, recording and editing audio, and working in Affinity Photo on the odd image or two.

I wouldn’t recommend using this system to play games, nor would I recommend overpaying for a brand-new GPU to pair with an older quad-core CPU like this one (I chose the GPU I did specifically for its display outputs, not its gaming prowess). If you wanted to, you could still probably get respectable midrange gaming performance out of a 4th-, 6th-, or 7th-gen Intel Core i5 or i7 or a first-generation AMD Ryzen CPU paired with a GeForce RTX 4060 or 3060, or a Radeon RX 7600. Resist the urge to overspend, consider used cards as a way to keep costs down, and check your power supply before you install anything—the years-old 300 W power supply in a cheap Dell office desktop will need to be replaced before you can use it with any GPU that has an external power connector.

My experience with the old Goodwill-sourced ThinkPad was also mostly pretty good. It had both Secure Boot and a TPM, making installation and upgrades easier. The old fingerprint sensor (a slow and finicky swipe-to-scan sensor) and its 2013-era driver even support Windows Hello. I certainly minded the cramped, low-resolution screen—display quality and screen-to-bezel ratio being the most noticeable changes between a 12-year-old system and a modern one—but it worked reliably with a new battery in it. It even helped me focus a bit at work; a 1366×768 screen just doesn’t invite heavy multitasking.

But the mid-2010s are a dividing line, and new laptops are better than old laptops

That brings me to my biggest word of warning.

If you want to run Windows 11 on an older desktop, one where the computer is just a box that you plug stuff into, the age of the hardware isn’t all that much of a concern. Upgrading components is easier whether you’re talking about a filthy keyboard, a failing monitor, or a stick of RAM. And you don’t need to be concerned as much with power use or battery life.

But for laptops? Let me tell you, there are things about using a laptop from 2012 that you don’t want to remember.

Three important dividing lines: In 2013, Intel’s 4th-generation Haswell processors gave huge battery life boosts to laptops thanks to lower power use when idle and the ability to switch more quickly between active and idle states. In 2015, Dell introduced the first with a slim-bezeled design (though it would be some years before it would fix the bottom-mounted up-your-nose webcam), which is probably the single most influential laptop design change since the MacBook Air. And around the same time (though it’s hard to pinpoint an exact date), more laptops began adopting Microsoft’s Precision Touchpad specification rather than using finicky, inconsistent third-party drivers, making PC laptop touchpads considerably less annoying than they had been up until that point.

And those aren’t the only niceties that have become standard or near-standard on midrange and high-end laptops these days. We also have high-resolution, high-density displays; the adoption of taller screen aspect ratios like 16: 10 and 3:2, giving us more vertical screen space to use; USB-C charging, replacing the need for proprietary power bricks; and backlit keyboards!

The ThinkPad X230 I bought doesn’t have a backlit keyboard, but it does have a bizarre little booklight next to the webcam that shines down onto the keyboard to illuminate it. This is sort of neat if you’re already the kind of person inclined to describe janky old laptops as “neat,” but it’s not as practical.

Even if you set aside degraded, swollen, or otherwise broken batteries and the extra wear and tear that comes with portability, a laptop from the last three or four years will have a ton of useful upgrades and amenities aside from extra speed. That’s not to say that older laptops can’t be useful because they obviously can be. But it’s also a place where an upgrade can make a bigger difference than just getting you Windows 11 support.

Some security concerns

Some old PCs will never meet Windows 11’s more stringent security requirements, and PC makers often stop updating their systems long before Microsoft drops support. Credit: Andrew Cunningham

Windows 11’s system requirements were controversial in part because they were focused mostly on previously obscure security features like TPM 2.0 modules, hypervisor-protected code integrity (HVCI), and mode-based execution control (MBEC). A TPM module makes it possible to seamlessly encrypt your PC’s local storage, among other things, while HVCI helps to isolate data in memory from the rest of the operating system to make it harder for malicious software to steal things (MBEC is just a CPU technology that speeds up HVCI, which can come with a hefty performance penalty on older systems).

Aside from those specific security features, there are other concerns when using old PCs, some of the same ones we’ve discussed in macOS as Apple has wound down support for Intel Macs. Microsoft’s patches can protect against software security vulnerabilities in Windows, and they can provide some partial mitigations for firmware-based vulnerabilities since even fully patched and fully supported systems won’t always have all the latest BIOS fixes installed.

But software can’t patch everything, and even the best-supported laptops with 5th- or 6th-generation Core CPUs in them will be a year or two past the days when they could expect new BIOS updates or driver fixes.

The PC companies and motherboard makers make some of these determinations; cheap consumer laptops tend to get less firmware and software support regardless of whether Intel or AMD are fixing problems on their ends. But Intel (for example) stops supporting its CPUs altogether after seven or eight years (support ended for 7th-generation CPUs in March). For any vulnerabilities discovered after that, you’re on your own, or you have to trust in software-based mitigations.

I don’t want to overplay the severity or the riskiness of these kinds of security vulnerabilities. Lots of firmware-level security bugs are the kinds of things that are exploited by sophisticated hackers targeting corporate or government systems—not necessarily everyday people who are just using an old laptop to check their email or do their banking. If you’re using good everyday security hygiene otherwise—using strong passwords or passkeys, two-factor authentication, and disk encryption (all things you should already be doing in Windows 10)—an old PC will still be reasonably safe and secure.

A viable, if imperfect, option for keeping an old PC alive

If you have a Windows 10 PC that is still working well or that you can easily upgrade to give it a new lease on life, and you don’t want to pay whatever Microsoft is planning to charge for continued Windows 10 update support, installing Windows 11 may be the path of least resistance for you despite the installation and update hurdles.

Especially for PCs that only miss the Windows 11 support cutoff by a year or two, you’ll get an operating system that still runs reasonably well on your PC, should still support all of your hardware, and will continue to run the software you’re comfortable with. Yes, the installation process for Windows’ annual feature updates is more annoying than it should be. But if you’re just trying to squeeze a handful of years out of an older PC, it might not be an issue you have to deal with very often. And though Windows 11 is different from Windows 10, it doesn’t come with the same learning curve that switching to an alternate operating system like ChromeOS Flex or Linux would.

Eventually, these PCs will age out of circulation, and the point will be moot. But even three years into Windows 11’s life cycle, I can’t help but feel that the system requirements could stand to be relaxed a bit. That ship sailed a long time ago, but given how many PCs are still running Windows 10 less than a year from the end of guaranteed security updates, expanding compatibility is a move Microsoft could consider to close the adoption gap and bring more PCs along.

Even if that doesn’t happen, try running Windows 11 on an older but still functional PC sometime. Once you clean it up a bit to rein in some of modern Microsoft’s worst design impulses, I think you’ll be pleasantly surprised.

What I learned from 3 years of running Windows 11 on “unsupported” PCs Read More »

Qualcomm cancels Windows dev kit PC for “comprehensively” failing to meet standards

copilot, copilot+ PC, microsoft, snapdragon x, snapdragon x elite, Tech, Windows 11, windows 11 24h2, windows on arm / Tim Belzer / October 17, 2024

It’s been a big year for Windows running on Arm chips, something that Microsoft and Arm chipmakers have been trying to get off the ground for well over a decade. Qualcomm’s Snapdragon X Elite and X Plus are at the heart of dozens of Copilot+ Windows PCs, which promise unique AI features and good battery life without as many of the app and hardware compatibility problems that have plagued Windows-on-Arm in the past.

Part of the initial wave of Copilot+ PCs was a single desktop, an $899 developer kit from Qualcomm itself that would give developers and testers a slightly cheaper way to buy into the Copilot+ ecosystem. Microsoft put out a similar Arm-powered dev kit two years ago.

But Qualcomm has unceremoniously canceled the dev kit and is sending out refunds to those who ordered them. That’s according to a note received by developer and YouTuber Jeff Geerling, who had already received the Snapdragon Dev Kit and given it a middling review a couple of weeks ago.

“The launch of 30+ Snapdragon X-series powered PCs is a testament to our ability to deliver leading technology and the PC industry’s desire to move to our next-generation technology,” reads Qualcomm’s statement. “However, the Developer Kit product comprehensively has not met our usual standards of excellence and so we are reaching out to let you know that unfortunately we have made the decision to pause this product and the support of it, indefinitely.”

Qualcomm’s statement also says that “any material, if received” will not have to be returned—those lucky enough to have gotten one of the Dev Kits up until now may be able to keep it and get their money back, though the PC is no longer officially being supported by Qualcomm.

Qualcomm cancels Windows dev kit PC for “comprehensively” failing to meet standards Read More »

Eleven things to know about in the Windows 11 2024 Update

Features, microsoft, Tech, Windows, Windows 11, windows 11 24h2 / Kris Guyer / October 12, 2024

A look at some of the changes and odds and ends in this year’s Windows release.

The Windows 11 2024 Update, also known as Windows 11 24H2, started rolling out last week. Your PC may have even installed it already!

The continuous feature development of Windows 11 (and Microsoft’s phased update rollouts) can make it a bit hard to track exactly what features you can expect to be available on any given Windows PC, even if it seems like it’s fully up to date.

This isn’t a comprehensive record of all the changes in the 2024 Update, and it doesn’t reiterate some basic but important things like Wi-Fi 7 or 80Gbps USB4 support. But we’ve put together a small list of new and interesting changes that you’re guaranteed to see when your version number rolls over from 22H2 or 23H2 to 24H2. And while Microsoft’s announcement post spent most of its time on Copilot and features unique to Copilot+ PCs, here, we’ll only cover things that will be available on any PC you install Windows 11 on (whether it’s officially supported or not).

Quick Settings improvements

The Quick Settings panel sees a few nice quality-of-life improvements. The biggest is a little next/previous page toggle that makes all of the Quick Settings buttons accessible without needing to edit the menu to add them. Instead of clicking a button and entering an edit menu to add and remove items from the menu, you click and drag items between pages. The downside is that you can’t see all of the buttons at once across three rows as you could before, but it’s definitely more handy if there are some items you want to access sometimes but don’t want to see all the time.

A couple of individual Quick Settings items see small improvements: a refresh button in the lower-right corner of the Wi-Fi settings will rescan for new Wi-Fi networks instead of making you exit and reopen the Wi-Fi settings entirely. Padding in the Accessibility menu has also been tweaked so that all items can be clearly seen and toggled without scrolling. If you use one or more VPNs that are managed by Windows’ settings, it will be easier to toggle individual VPN connections on and off, too. And a Live Captions accessibility button to generate automatic captions for audio and video is also present in Quick Settings starting in 24H2.

More Start menu “suggestions” (aka ads)

Amid apps I’ve recently installed and files I’ve recently opened, the “recommended” area of the Start menu will periodically recommend apps to install. These change every time I open the Start menu and don’t seem to have anything to do with my actual PC usage. Credit: Andrew Cunningham

One of the first things a fresh Windows install does when it connects to the Internet is dump a small collection of icons into your Start menu, things grabbed from the Microsoft Store that you didn’t ask for and may not want. The exact apps change from time to time, but these auto-installs have been happening since the Windows 10 days.

The 24H2 update makes this problem subtly worse by adding more “recommendations” to the lower part of the Start menu below your pinned apps. This lower part of the Start menu is usually used for recent files or newly (intentionally) installed apps, but with recommendations enabled, it can also pull recommended apps from the Microsoft Store, giving Microsoft’s app store yet another place to push apps on you.

These recommendations change every time you open the Start menu—sometimes you’ll see no recommended apps at all, and sometimes you’ll see one of a few different app recommendations. The only thing that distinguishes these items from the apps and files you have actually interacted with is that there’s no timestamp or “recently added” tag attached to the recommendations; otherwise, you’d think you had downloaded and installed them already.

These recommendations can be turned off in the Start menu section of the Personalization tab in Settings.

Context menu labels

Text labels added to the main actions in the right-click/context menu. Credit: Andrew Cunningham

When Windows 11 redesigned the right-click/context menu to help clean up years of clutter, it changed basic commands like copy and paste from text labels to small text-free glyphs. The 2024 Update doesn’t walk this back, but it does add text labels back to the glyphs, just in case the icons by themselves didn’t accurately communicate what each button was used for.

Windows 11’s user interface is full of little things like this—stuff that was changed from Windows 10, only to be changed back in subsequent updates, either because people complained or because the old way was actually better (few text-free glyphs are truly as unambiguously, universally understood as a text label can be, even for basic commands like cut, copy, and paste).

Smaller, faster updates

The 24H2 update introduces something that Microsoft calls “checkpoint cumulative updates.”

To recap, each annual Windows update also has a new major build number; for 24H2, that build number is 26100. In 22H2 and 23H2, it was 22621 and 22631. There’s also a minor build number, which is how you track which of Windows’ various monthly feature and security updates you’ve installed. This number starts at zero for each new annual update and slowly increases over time. The PC I’m typing this on is running Windows 11 build 26100.1882; the first version released to the Release Preview Windows Insider channel in June was 26100.712.

In previous versions of Windows, any monthly cumulative update that your PC downloads and installs can update any build of Windows 11 22H2/23H2 to the newest build. That’s true whether you’re updating a fresh install that’s missing months’ worth of updates or an actively used PC that’s only a month or two out of date. As more and more updates are released, these cumulative updates get larger and take longer to install.

Starting in Windows 11 24H2, Microsoft will be able to designate specific monthly updates as “checkpoint” updates, which then become a new update baseline. The next few months’ worth of updates you download to that PC will contain only the files that have been changed since the last checkpoint release instead of every single file that has been changed since the original release of 24H2.

If you’re already letting Windows do its update thing automatically in the background, you probably won’t notice a huge difference. But Microsoft says these checkpoint cumulative updates will “save time, bandwidth, and hard drive space” compared to the current way of doing things, something that may be more noticeable for IT admins with dozens or hundreds of systems to keep updated.

Sudo for Windows

A Windows version of the venerable Linux sudo command—short for “superuser do” or “substitute user do” and generally used to grant administrator-level access to whatever command you’re trying to run—first showed up in experimental Windows builds early this year. The feature has formally been added in the 24H2 update, though it’s off by default, and you’ll need to head to the System settings and then the “For developers” section to turn it on.

When enabled, Sudo for Windows (as Microsoft formally calls it) allows users to run software as administrator without doing the dance of launching a separate console window as an administrator.

By default, using Sudo for Windows will still open a separate console window with administrator privileges, similar to the existing runas command. But it can also be configured to run inline, similar to how it works from a Linux or macOS Terminal window, so you could run a mix of elevated and unelevated software from within the same window. A third option, “with input disabled,” will run your software with administrator privileges but won’t allow additional input, which Microsoft says reduces the risk of malicious software gaining administrator privileges via the sudo command.

One thing the runas command supports that Sudo for Windows doesn’t is the ability to run software as any local user—you can run software as the currently-logged-in user or as administrator, but not as another user on the machine, or using an account you’ve set up to run some specific service. Microsoft says that “this functionality is on the roadmap for the sudo command but does not yet exist.”

Protected print mode

Microsoft is gradually phasing out third-party print drivers in Windows in favor of more widely compatible universal drivers. Printer manufacturers will still be able to add things on top of those drivers with their own apps, but the drivers themselves will rely on standards like the Internet Printing Protocol (IPP), defined by the Mopria Alliance.

Windows 11 24H2 doesn’t end support for third-party print drivers yet; Microsoft’s plan for switching over will take years. But 24H2 does give users and IT administrators the ability to flip the switch early. In the Settings app, navigate to “Bluetooth & devices” and then to “Printers & scanners” and enable Windows protected print mode to default to the universal drivers and disable compatibility. You may need to reconnect to any printer you had previously set up on your system—at least, that was how it worked with a network-connected Brother HL-L2340D I use.

This isn’t a one-way street, at least not yet. If you discover your printer won’t work in protected print mode, you can switch the setting off as easily as you turned it on.

New setup interface for clean installs

When you create a bootable USB drive to install a fresh copy of Windows—because you’ve built a new PC, installed a new disk in an existing PC, or just want to blow away all the existing partitions on a disk when you do your new install—the interface has stayed essentially the same since Windows Vista launched back in 2006. Color schemes and some specific dialog options have been tweaked, but the interface itself has not.

For the 2024 Update, Microsoft has spruced up the installer you see when booting from an external device. It accomplishes the same basic tasks as before, giving you a user interface for entering your product key/Windows edition and partitioning disks. The disk-partitioning interface has gotten the biggest facelift, though one of the changes is potentially a bit confusing—the volumes on the USB drive you’re booted from also show up alongside any internal drives installed in your system. For most PCs with just a single internal disk, disk 0 should be the one you’re installing to.

Wi-Fi drivers during setup

Microsoft’s obnoxious no-exceptions Microsoft account requirement for all new PCs (and new Windows installs) is at its most obnoxious when you’re installing on a system without a functioning network adapter. This scenario has come up most frequently for me when clean-installing Windows on a brand-new PC with a brand-new, as-yet-unknown Wi-Fi adapter that Windows 11 doesn’t have built-in drivers for. Windows Update is usually good for this kind of thing, but you can’t use an Internet connection to fix not having an Internet connection.

Microsoft has added a fallback option to the first-time setup process for Windows 11 that allows users to install drivers from a USB drive if the Windows installer doesn’t already include what you need. As a failover, would we prefer to see an easy-to-use option that didn’t require Microsoft account sign-in? Sure. But this is better than it was before.

To bypass this entirely, there are still local account workarounds available for experts. Pressing Shift + F10, typing OOBEBYPASSNRO in the Command Prompt window that opens, and hitting Enter is still there for you in these situations.

Boosted security for file sharing

The 24H2 update has boosted the default security for SMB file-sharing connections, though, as Microsoft Principal Program Manager Ned Pyle notes, it may result in some broken things. In this case, that’s generally a good thing, as they’re only breaking because they were less secure than they ought to be. Still, it may be dismaying if something suddenly stops functioning when it was working before.

The two big changes are that all SMB connections need to be signed by default to prevent relay attacks and that Guest access for SMB shares is disabled in the Pro edition of Windows 11 (it had already been disabled in Enterprise, Education, and Pro for Workstation editions of Windows in the Windows 10 days). Guest fallback access is still available by default in Windows 11 Home, though the SMB signing requirement does apply to all Windows editions.

Microsoft notes that this will mainly cause problems for home NAS products or when you use your router’s USB port to set up network-attached storage—situations where security tends to be disabled by default or for ease of use.

If you run into network-attached storage that won’t work because of the security changes to 24H2, Microsoft’s default recommendation is to make the network-attached storage more secure. That usually involves configuring a username and password for access, enabling signing if it exists, and installing firmware updates that might enable login credentials and SMB signing on devices that don’t already support it. Microsoft also recommends replacing older or insecure devices that don’t meet these requirements.

That said, advanced users can turn off both the SMB signing requirements and guest fallback protection by using the Local Group Policy Editor. Those steps are outlined here. That post also outlines the process for disabling the SMB signing requirement for Windows 11 Home, where the Local Group Policy Editor doesn’t exist.

Windows Mixed Reality is dead and gone

Several technology hype cycles ago, before the Metaverse and when most “AI” stuff was still called “machine learning,” Microsoft launched a new software and hardware initiative called Windows Mixed Reality. Built on top of work it had done on its HoloLens headset in 2015, Windows Mixed Reality was meant to bring in app developers and the PC makers and allowed them to build interoperable hardware and software for both virtual reality headsets that covered your eyes entirely and augmented reality headsets that superimpose objects over the real world.

But like some other mid-2010s VR-related initiatives, both HoloLens and Windows Mixed Reality kind of fizzled and flailed, and both are on their way out. Microsoft officially announced the end of HoloLens at the beginning of the month, and Windows 11 24H2 utterly removes everything Mixed Reality from Windows.

Microsoft announced this in December of 2023 (in a message that proclaims “we remain committed to HoloLens”), though this is a shorter off-ramp than some deprecated features (like the Android Subsystem for Windows) have gotten. Users who want to keep using Windows Mixed Reality can continue to use Windows 23H2, though support will end for good in November 2026 when support for the 23H2 update expires.

WordPad is also dead

WordPad running in Windows 11 22H2. It will continue to be available in 22H2/23H2, but it’s been removed from the 2024 update. Credit: Andrew Cunningham

We’ve written plenty about this already, but the 24H2 update is the one that pulls the plug on WordPad, the rich text editor that has always existed a notch above Notepad and many, many notches below Word in the hierarchy of Microsoft-developed Windows word processors.

WordPad’s last update of any real substance came in 2009, when it was given the then-new “ribbon” user interface from the then-recent Office 2007 update. It’s one of the few in-box Windows apps not to see some kind of renaissance in the Windows 11 era; Notepad, by contrast, has gotten more new features in the last two years than it had in the preceding two decades. And now it has been totally removed, gone the way of Internet Explorer and Encarta.

Eleven things to know about in the Windows 11 2024 Update Read More »

Uninstalled Copilot? Microsoft will let you reprogram your keyboard’s Copilot key

copilot, copilot+ PC, microsoft, Tech, Windows 11, windows 11 24h2, windows copilot / Rejus Almole / October 4, 2024

Whether you care about Microsoft’s Copilot AI assistant or not, many new PCs introduced this year have included a dedicated Copilot key on the keyboard; this is true whether the PC meets the requirements for Microsoft’s Copilot+ PC program or not. Microsoft’s commitment to putting AI features in all its products runs so deep that the company changed the Windows keyboard for the first time in three decades.

But what happens if you don’t use Copilot regularly, or you’ve disabled or uninstalled it entirely, or if you simply don’t need to have it available at the press of a button? Microsoft is making allowances for you in a new Windows Insider Preview build in the Dev channel, which will allow the Copilot key to be reprogrammed so that it can launch more than just Copilot.

The area in Settings where you can reprogram the Copilot key in the latest Windows Insider Preview build in the Dev channel. Credit: Microsoft

There are restrictions. To appear in the menu of options in the Settings app, Microsoft says an app must be “MSIX packaged and signed, thus indicating the app meets security and privacy requirements to keep customers safe.” Generally an app installed via the Microsoft Store or apps built into Windows will meet those requirements, though apps installed from other sources may not. But you can’t make the Copilot key launch any old executable or batch file, and you can’t customize it to do anything other than launch apps (at least, not without using third-party tools for reconfiguring your keyboard).

Uninstalled Copilot? Microsoft will let you reprogram your keyboard’s Copilot key Read More »

Microsoft details security/privacy overhaul for Windows Recall ahead of relaunch

Biz & IT, microsoft, Tech, Windows 11, windows 11 24h2, windows recall / Paul Patrick / September 28, 2024

Microsoft is having another whack at its controversial Recall feature for Copilot+ Windows PCs, after the original version crashed and burned amid scrutiny from security researchers and testers over the summer. The former version of Recall recorded screenshots and OCR text of all user activity, and stored it unencrypted on disk where it could easily be accessed by another user on the PC or an attacker with remote access.

The feature was announced in late May, without having gone through any of the public Windows Insider testing that most new Windows features get, and was scheduled to ship on new PCs by June 18; by June 13, the company had delayed it indefinitely to rearchitect it and said that it would be tested through the normal channels before it was rolled out to the public.

Today, Microsoft shared more extensive details on exactly how the security of Recall has been re-architected in a post by Microsoft VP of Enterprise and OS Security David Weston.

More secure, also optional

An abstraction of Recall's new security architecture, which replaces the old, largely nonexistent security architecture. — Enlarge / An abstraction of Recall’s new security architecture, which replaces the old, largely nonexistent security architecture.

Microsoft

The broad strokes of today’s announcement are similar to the changes Microsoft originally announced for Recall over the summer: that the feature would be opt-in and off-by-default instead of opt-out, that users would need to re-authenticate with Windows Hello before accessing any Recall data, and that locally stored Recall data will be protected with additional encryption.

However, some details show how Microsoft is attempting to placate skeptical users. For instance, Recall can now be removed entirely from a system using the “optional features” settings in Windows (when a similar removal mechanism showed up in a Windows preview earlier this month, Microsoft claimed it was a “bug,” but apparently not).

The company is also sharing more about how Windows will protect data locally. All Recall data stored locally, including “snapshots and any associated information in the vector database,” will be encrypted at rest with keys stored in your system’s TPM; according to the blog post, Recall will only function when BitLocker or Device Encryption is fully enabled. Recall will also require Virtualization-Based Security (VBS) and Hypervisor-Protected Code Integrity (HVCI) enabled; these are features that people sometimes turn off to improve game performance, but Recall will reportedly refuse to work unless they’re turned on.

This is because the new Recall operates inside of a VBS enclave, which helps to isolate and secure data in memory from the rest of the system.

“This area acts like a locked box that can only be accessed after permission is granted by the user through Windows Hello,” writes Weston. “VBS enclaves offer an isolation boundary from both kernel and administrative users.”

Windows doesn’t allow any code to run within these enclaves that hasn’t been signed by Microsoft, which should lower the risk of exposing Recall data to malware or other rogue applications. Other malware protections new to this version of Recall include “rate-limiting and anti-hammering measures.”

Microsoft details security/privacy overhaul for Windows Recall ahead of relaunch Read More »