Windows

Microsoft announced Device Association for Windows Autopilot Device Preparation on August 27, 2026. It is one of those features that sounds incremental until you understand what problem it actually solves. The problem it solves Traditional Autopilot ties the provisioning experience to the user signing in. That works well in most scenarios, but it breaks down when you need the device — not the user — to determine which policy and experience gets applied. ...

What it does Extracts BitLocker recovery keys from all locally protected volumes and saves them to a timestamped file at C:\Temp\BitLockerKeys_YYYYMMDD_HHMMSS.txt. Useful for: Auditing BitLocker key availability before a device is reprovisioned Manual verification when keys have not escrowed correctly to Entra ID / Intune Local key recovery in offline or unmanaged environments Requirements Windows 10/11 or Windows Server with BitLocker module available PowerShell run as Administrator BitLocker active on at least one volume Source Script available on GitHub: ...

Stumbled across this while browsing: WOFA — Windows Organized Feed for Admins. It is essentially a clean, machine-readable aggregation of Windows security update data sourced from MSRC and CISA KEV. What it gives you at a glance: CVE count per OS version (Windows 10, 11, Server 2016 through 2025) Actively exploited CVEs flagged separately Latest Patch Tuesday build versions per release CISA KEV (Known Exploited Vulnerabilities) flags per version JSON feed and RSS available for automation As of today (August 2026), it is tracking 11,711 CVEs across 13 OS versions, with 153 actively exploited. Windows Server 2025 has CVE-2026-56155 flagged as a KEV — worth checking if your Server 2025 fleet has the July 2026 update applied. ...

Symptom When attempting to uninstall FortiClient via Add/Remove Programs or an MDM platform, the uninstaller throws an error similar to: “The network resource is unavailable” or “Windows Installer cannot find the original package” This happens because the Windows Installer is looking for the original FortiClient.msi in a path that no longer exists. Option 1 — Force Uninstall via GUID Step 1 — Get the product GUID Open PowerShell as Administrator: ...

1. Overview CVE-2026-26128 is a Kerberos authentication reflection bypass discovered by Synacktiv that completely bypasses the patch introduced for CVE-2025-33073. It allows an attacker to obtain SYSTEM-level access on most Windows builds. CVE CVE-2026-26128 Discovered by Synacktiv Patched March 2026 Patch Tuesday Related CVE-2025-33073, CVE-2025-58726, CVE-2026-24294 Impact Local Privilege Escalation → SYSTEM Affected All Windows versions except Windows 11 24H2 (default config) 2. Background The broader context of this vulnerability sits within a chain of authentication reflection research: ...