M365 Message Center

Geändert

25.08.2025

Services

Windows

Starting in September 2025, the latest Windows quality updates will be available by default during the out-of-box experience (OOBE). With Windows Autopilot and Microsoft Intune, you can manage this capability with a policy setting for eligible Microsoft Entra joined or Microsoft Entra hybrid joined devices running Windows 11, version 22H2 or higher. When will this happen: This experience will be available starting with the September 2025 Windows security update. Note: When Windows quality update support is available in the Windows Autopilot Enrollment Status Page (ESP) at the end of August 2025, you’ll see the new quality update setting enabled by default. How this will affect your organization: This new capability has several key benefits for your organization: the latest quality updates are already applied out of the box, security is enhanced from day 1, and post-deployment update over

Geändert

21.08.2025

Services

Windows

Secure Boot protects Windows systems by validating firmware and boot components using trusted certificates. Microsoft-issued certificates used in Secure Boot are expiring in 2026. In the coming months, Microsoft will be rolling out updated Secure Boot certificates needed to ensure a secure startup environment of Windows. IT-managed environments must take action to ensure their systems remain secure and serviceable. This post outlines what enterprise IT admins need to know and do. When will this happen: Microsoft UEFI CA 2011 and Microsoft KEK CA 2011 expire in June 2026. Microsoft Windows Production PCA 2011 expires in October 2026. Microsoft is rolling out updated certificates now via Windows Update to home users, businesses, and schools with devices that have updates managed by Microsoft. How this will affect your organization: Without updated certificates, Secure Boot-enabled systems

Geändert

20.08.2025

Services

Windows

Prepare for hotpatch in your environment by meeting a key requirement to enable virtualization-based security (VBS) on Windows client. With the hotpatching feature of Windows Autopatch, you can apply security updates to Windows without requiring a restart. VBS protects against kernel-level exploits and other advanced threats to help ensure your endpoints are secure and ready for patching. It’s straightforward to enable VBS, and here we’ll show you how—whether deploying at scale with Microsoft Intune or on a single device using PowerShell or Windows Command Prompt. How this will affect your organization: You’ll need to enable VBS as a requirement for hotpatch, which applies security updates to Windows without requiring a restart. Hotpatch minimizes downtime while improving patch compliance and reducing risk. What you need to do to prepare: You’ll need to ensure VBS is enabled for hotpatch

Geändert

19.08.2025

Services

Windows

Microsoft has identified an issue where some attempts to reset or recover Windows devices might fail. This issue is observed after installing the August 2025 Windows security update on some client versions of Windows. For more information on this issue, see Reset and recovery operations on some Windows versions might fail.A non-security out-of-band (OOB) update was released today, August 19, 2025, to address this issue. This is a cumulative update, so you do not need to apply any previous updates before installing this update, as it supersedes all previous updates for affected versions. If you haven’t installed the August 2025 Windows security update yet, we recommend you apply this OOB update instead. If your device is not affected by this issue, you do not need to install this OOB update.For more information and instructions on how to install this update on your device, consult the bel

Geändert

15.08.2025

Services

Windows

IMPORTANT: This notice is only relevant for environments where:Windows Server Update Services (WSUS) is used to deploy Windows security updates to Windows 11, version 24H2 devices.Scan Cab is used to check for update complianceThe August 2025 Scan Cab was deployed before 9:15 AM PT on August 15, 2025. An updated version of the August 2025 Scan Cab was made available at 9:15 AM PT on August 15, 2025. This Scan Cab includes new metadata corresponding to the republished August 2025 security update for Windows 11, version 24H2 (KB5063878). The new Scan Cab only needs to be re-deployed in the environments where Windows Server Update Services (WSUS) is used for installing updates. The republished update for Windows 11, version 24H2 addresses an issue where the August 2025 Windows security update (KB5063878) failed to install with error code 0x80240069 when installed via WSUS. The issue was not

Geändert

14.08.2025

Services

Windows

On October 14, 2025, Windows 11, version 22H2 (Enterprise, Education, and IoT Enterprise editions) will reach end of servicing. The October 2025 monthly security update will be the last update available for this version. After this date, devices running this version will no longer receive monthly security and preview updates containing protections from the latest security threats.As always, we recommend that you update your devices to the latest version of Windows 11. For detailed information, see the Windows 11, version 22H2 reaching end of updates (Enterprise, Education, IoT Enterprise) lifecycle page. For information about servicing timelines and lifecycle, see Windows 11 release information, Lifecycle FAQ - Windows, and Microsoft Lifecycle Policy search tool.