LIVE · cybersecurity feed
microsoft

Microsoft to enable Windows settings backup by default for orgs

zeroday.news·1d ago
ShareXLinkedInWhatsAppFacebook

Microsoft will enable its Windows settings backup and restore tool by default for enterprise systems that are joined to Microsoft Entra or are Microsoft Entra hybrid-joined, beginning with the Windows 11 26H2 update. This change will apply to eligible devices where administrators have not explicitly configured the backup and restore policy.

The tool, previously known as Windows Backup for Organizations, is designed to facilitate the backup and restoration of enterprise users' Windows settings following events such as device resets, replacements, upgrades, or reimaging. It was initially introduced as an opt-in feature at the Microsoft Ignite conference in November 2024, entered public preview in May 2025, and achieved general availability in August 2025. Its functionality became accessible after installing the September 2025 Windows Monthly Cumulative Update on Entra-joined devices, though IT administrators were required to manually enable it through policy configurations.

According to a recent update to Microsoft's message center, the default behavior for the Windows settings backup policy will transition from disabled to enabled with Windows 11 version 26H2. This default-on setting is specifically for eligible devices and will only take effect if administrators have not previously set a specific policy. Any explicit configurations for enabling or disabling the backup and restore settings will continue to be honored.

The default-on behavior for Windows backup will be limited to devices running Windows 11 26H2 that are located in countries or regions not subject to the EU Digital Markets Act (DMA). It will also exclude devices operating within sovereign or restricted cloud environments, and those for which the backup policy has not been configured.

Even on systems where the tool is enabled by default, IT administrators will maintain complete control through mobile device management (MDM) solutions. Administrators who wish to disable the backup policy can do so using Microsoft Intune or Group Policy, as these explicit settings will override the default behavior. It is important to note that the restore functionality itself will not be enabled by default; users will still require explicit administrative configuration to restore Windows devices.

Microsoft product manager Miranda Leschke indicated that organizations can test this updated experience early. The default-on behavior is currently available for Windows 11 version 26H2 within the Windows Insider Program's Experimental channel, starting in July 2026. The broader rollout for eligible devices is expected to coincide with the general availability of Windows 11 version 26H2 later this year. Devices that were initially running Windows 11 version 26H1 will receive the same default-on treatment with their subsequent feature update.

microsoftwindowsbackupenterprisesecurity
ShareXLinkedInWhatsAppFacebook
← Back to latest

More News

view all →
zeroday.news · 4h ago·high

China-Linked APT Expands Arsenal With New ‘Leash’ Backdoors

A China-linked advanced persistent threat (APT) group, identified as LapDogs, has reportedly enhanced its malicious toolkit. Security researchers have observed the deployment of three new backdoors: LongLeash, DogLeash, and JarLeash, which are designed to compromise small office/home office (SOHO) routers.

zeroday.news · 4h ago·high

RedWing Android Spyware Sold as a Service on Telegram

A new Android spyware called RedWing is being offered as a service on Telegram, allowing less sophisticated attackers to compromise phones and steal banking information. Researchers have identified it as a polished malware-as-a-service operation with extensive documentation and a subscription model, potentially linked to Russian threat actors. RedWing employs fake login overlays, SMS interception, call forwarding, and even screen control to harvest credentials and conduct further malicious activities.

zeroday.news · 4h ago·high

Operationalizing Day Minus Seven: The Cloud-Native ROC

The article introduces the concept of a Risk Operations Center (ROC) as a necessary evolution for cybersecurity teams facing AI-driven threats. It argues that traditional risk management models are insufficient due to the speed at which AI can discover and exploit vulnerabilities, especially in cloud environments. A ROC, powered by platforms like Qualys Enterprise TruRisk Management (ETM), aims to unify disparate security findings, hyper-prioritize risks based on exploitability and business impact, and enable autonomous remediation to keep pace with attackers.

zeroday.news · 5h ago·critical

Ubiquiti Patches Critical UniFi Flaws Across Connect, Talk, Access, Protect, and OS

Ubiquiti has released security updates to address several critical vulnerabilities affecting its UniFi product line, including UniFi Connect, Talk, Access, Protect, and OS. These flaws could allow attackers to escalate privileges or execute arbitrary commands on affected devices. While no active exploitation has been reported for these specific vulnerabilities, the company has previously seen its UniFi OS and Edge OS products targeted by threat actors.

zeroday.news · 5h ago·high

Armored Likho Hits Government, Energy Sectors With BusySnake Stealer

Cybersecurity researchers have identified a new threat actor, dubbed Armored Likho, targeting government and energy sectors in Russia, Kazakhstan, and Brazil with a sophisticated phishing campaign. The operation utilizes a custom-built Python infostealer named BusySnake, designed to steal credentials, sensitive documents, and other high-value data. The attackers employ AI-generated payloads to obscure their activities and maintain persistence through various methods, including reverse SSH tunneling.

zeroday.news · 5h ago·critical

Attackers using Langflow flaw for credential harvesting (CVE-2026-55255)

CISA has issued a warning regarding a critical vulnerability (CVE-2026-55255) in the Langflow AI framework, which is being actively exploited by attackers. The flaw allows authenticated users to execute arbitrary flows belonging to other users, potentially leading to the theft of sensitive credentials and data exposure, especially in multi-tenant environments. US federal agencies have been mandated to patch this vulnerability by July 10th.