Windows 11 24H2 is Out Now

[-]

evetsleep@reddit

FYI, at least for us, 24H2 broke FIDO2 security key login to Windows (at the login UI) if there is no line of sight to a domain controller. Not clear why yet, but it triggers if you have a UNC for your `homeDirectory` defined in Active Directory. If you have line-of-sight to a DC login works just fine, but if you try to login, say in airplace mode with the network disconnected, we get a `Credentials could not be verified` error. We've been using FIDO2 security keys to login to laptops for over a year, so we're pretty familiar with it and this instantly broke when we updated some devices which were in insider builds.

Reply

[-]

Successful-You1803@reddit

Same issue here as soon as I inplace upgraded to 24H2 & I have the latest update 26100.2033. During initial login fails but after I manually sign in & reach the desktop, I can press CTRL, ALT Del lock then unlock using my YubiKey. I can also connect to VPN for line of sight to a DC, press CTRL, ALT Del lock then unlock using my YubiKey. The only issue is at the login UI. Driving me insane. Was about to remove my device object in AzureAD & rejoin but I think I'll hold off for the time being.

Reply

[-]

evetsleep@reddit

At least with how the issue manifests for us, after working with backend MSFT support (folks who actually have access to source code) we found a viable (albeit not scalable) work around where we clear out the value in the users `homeDirectory` in Active Directory. After you've done that and it replicates, when you login and then off with that cleared the cached login will properly work with FIDO2 security key logins. You can still map the home directory other ways, just not through AD. It does appear that a fix is coming, but not sure on the timeline.

Reply

[-]

Successful-You1803@reddit

Just a quick follow-up. Restored a UNC path to my home drive (AD acct) & the issue returned. It's been 5 months & Msft have not fixed the issue.

Reply

[-]

evetsleep@reddit

I'm expecting a fix to become available today and it should be pushed out via Windows update in April. It takes a long time for issues like this to be fixed.

Reply

[-]

Successful-You1803@reddit

That's great news! I'll test again after installing April's patch. Thank you.

Reply

[-]

Successful-You1803@reddit

Thank you so much for the recommendation. That absolutely worked! Luckily the home drive setting for my account is no longer valid, we are forced to use OneDrive. Thanks again & will keep an eye out for the fix. Have a great day!

Reply

[-]

chmod771@reddit

Same, this is starting to become a headache 😔

Reply

[-]

evetsleep@reddit

The current workaround is to clear the users home directory value in AD. If you manually map the drive (or use a login script) it'll work just fine. It's not ideal, but hopefully they have a fix soon.

Reply

[-]

digitaldisgust@reddit

This update has my Wi-Fi dropping constantly now. Smh.

Reply

[-]

reZZZ22@reddit

Out of curiosity, when running sfc /scannow on 24H2, are you guys receiving the same message saying corrupt files were found and fixed however, it seems to continue popping up with the same message when I run sfc /scannow

Reply

[-]

jenmsft@reddit

This is fixed in the latest update: https://support.microsoft.com/en-us/topic/october-24-2024-kb5044384-os-build-26100-2161-preview-5a4ac390-7c7b-4f7f-81c2-c2b329ac86ab

Reply

[-]

NoAd5508@reddit

Anyone run into it not allowing Citrix WorkSpace pass-thru authentication?

Reply

[-]

XALHACKER@reddit

Has anyone faced the problem of sudden restart after the new update to Windows 11 24H2?

Reply

[-]

geomedge@reddit

Hate it. Ruined my laptop a year in and my warranty expired as well.

Reply

[-]

Several_Party2075@reddit

I have 3 diffent operating systems i can choose from now since ive update to this piece of crap update? How to fix this?

Reply

[-]

reddit_username2021@reddit

RSAT is gone. Do I need to update WSUS and check Win 11 24H2 tickbox to receive updates for this OS?

Reply

[-]

earl_OO7@reddit

I'm unable to reinstall RSAT after upgrading to 24H2 from 23H2. Registry edit didn't work - Set-ItemProperty -Path "HKLM:\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU" -Name "UseWuServer" -Value 0 Powershell script didn't work - Get-WindowsCapability -Name RSAT\* -Online | Add-WindowsCapability -Online Group Policy didn't work - Local computer->Admin template->System->Specify settings for .... (Enabled but option does not show "download repair content...." Uninstalled 24H2 and not I have RSAT back.

Reply

[-]

Trooper27@reddit

My RSAT tools did not disappear.

Reply

[-]

atw527@reddit

Common for RSAT to disappear on upgrades.

Reply

[-]

jantari@reddit

Not since 2018 when it became an optional feature.

Reply

[-]

belgarion90@reddit

Really? Happens on every single one of my machines that have it each feature update, which is mostly people who are perfectly fine installing it on their own via PowerShell.

Reply

[-]

jmbpiano@reddit

Strange. The machine I'm running now has, so far, gone through every major feature update from W10 20H2 through W11 23H2 and I can't recall ever having to reinstall RSAT on it.

Reply

[-]

belgarion90@reddit

Well dang. Wonder what I'm doing wrong.

Reply

[-]

MrYiff@reddit (OP)

Since it's a full upgrade you might need to reinstall optional features like RSAT, I seem to remember this has happened a few times now although I thought MS had added support for maintaining them between upgrades.

Reply

[-]

Abecedy@reddit

Several canary machines failed to update from 23H2 to 24H2 after multiple reboots and automatically rolled back to 23H2. They failed with generic error code 0x800736cc. We haven't really dug into it but we are temporarily deferring the upgrade

Reply

[-]

DocSnyd3r@reddit

same here, it also shows a boot menu now where I can choose between win11 and win11 but one options just shuts down, the other boots 23h2.

Reply

[-]

Scolax@reddit

Yep my machine did the update last night and this is the same that happened. Going to retry and if it's still the same the update will have to be pulled.

Reply

[-]

Mr_ToDo@reddit

Hash mismatch? That seems fun.

Reply

[-]

MrYiff@reddit (OP)

Just installing it now on my work PC so I'll see how it goes.

Reply

[-]

TKInstinct@reddit

This might sound weird but I am very hyped about the inclusion of sudo into Windows, it makes me very happy.

Reply

[-]

ButterInMyPants@reddit

Can you elaborate?

Reply

[-]

segagamer@reddit

You know what sudo is? Windows now supports the command.

Reply

[-]

dhelmet78@reddit

Barely. Its essentially the same as right click, run as administrator. It doesn't support anywhere near the same things as Linux. Usage: sudo.exe \[OPTIONS\] \[COMMANDLINE\]... \[COMMAND\] Commands: run Run a command as admin config Get current configuration information of sudo help Print this message or the help of the given subcommand(s) Arguments: \[COMMANDLINE\]... Command-line to run Options: -E, --preserve-env Pass the current environment variables to the command -N, --new-window Use a new window for the command --disable-input Run in the current terminal, with input to the target application disabled --inline Run in the current terminal -D, --chdir <chdir> Change the working directory before running the command -h, --help Print help (see more with '--help') -V, --version Print version

Reply

[-]

Sure_Acadia_8808@reddit

Don't worry, it's enough to make ignorant MCSE's fail to branch out because "Windows is just as good, because it has all the Linux features!" It's just more embrace-extend-extinguish behavior. Just watch, their implementation will cause some kind of mass worm intrusion, mark my words.

Reply

[-]

segagamer@reddit

I don't see what sudo on Windows would do that sudo on Linux wouldn't.

Reply

[-]

Sure_Acadia_8808@reddit

I'm guessing it's just a command that will map to a privilege escalation process behind the scenes, except the one in Windows is probably going to be proven horribly, catastrophically insecure once it's exposed and scriptable. Windows invented "get compromised by being sent (not opening) a goddamned email." Just wait, there's some zero-day someone's been sitting on that's going to pwn everyone's Windows box by sending Outlook something that looks like a jpeg. I'm calling it now.

Reply

[-]

segagamer@reddit

You say everyone, but you need to specifically enable the sudo command.

Reply

[-]

Sure_Acadia_8808@reddit

That's a very naive assumption you're making. I'm guessing you don't have much experience with malware enabling features you disabled and/or doing arbitrary privilege escalation to gain the ability to do so. That's malware 101.

Reply

[-]

segagamer@reddit

It's no more naive than me listening to someone saying *just you wait, something will happen based on this!*. So I'm just not taking your post seriously.

Reply

[-]

Sure_Acadia_8808@reddit

I mean, you also have to ignore all the things that already happened because of similar MS-based incompetencies. And all the security expertise that plops massive already-existing security culture issues directly on this one company's doorstep. The arguments are compelling and professional, but it's become normalized to make things up instead of following the evidence.

Reply

[-]

segagamer@reddit

What's missing that would be useful in a Windows environment?

Reply

[-]

Coffee_Ops@reddit

Most of the Linux sudo options are irrelevant and / or theatre.

Reply

[-]

ButterInMyPants@reddit

So I can type ‚sudo diskmgmt.msc‘ into the terminal and it‘ll start disk management with admin rights?

Reply

[-]

shipsass@reddit

I type diskmgmt.msc and press Ctrl-Shift-Enter

Reply

[-]

jantari@reddit

Well that's the easy part, that's always worked with runas. New with sudo is the choice to run an elevated CLI process within an unelevated terminal session - which was also previously possible, but not with built-in tools.

Reply

[-]

Coffee_Ops@reddit

A security dumpster fire? Luckily it appears that MS has learned from that, because they make it clear what the security options are (interactive vs non-interactive).

Reply

[-]

p90rushb@reddit

segagamer is not in the sudoers file. This incident will be reported.

Reply

[-]

DoctorOctagonapus@reddit

Ever tried running a command that needs admin rights in a non-admin command prompt or Powershell window? It doesn't work. How do you elevate that CMD/PS instance to give it admin rights? Before 24H2 the answer to that question was "Fuck you".

Reply

[-]

Lukage@reddit

I don't disagree, but there are (stupid) answers to that problem. If (-Not (\[Security.Principal.WindowsPrincipal\] \[Security.Principal.WindowsIdentity\]::GetCurrent()).IsInRole(\[Security.Principal.WindowsBuiltInRole\] "Administrator")) { Write-Host "Restarting script as Administrator..." Start-Process powershell -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File \`"$PSCommandPath\`"" -Verb RunAs Exit }

Reply

[-]

AlexisFR@reddit

Yawn, we want to type a command, not make some weird script

Reply

[-]

7ep3s@reddit

does it change to Administrateur when the os language is french?

Reply

[-]

Rare-Page4407@reddit

it has a chance to work for both versions

Reply

[-]

Algent@reddit

You can probably select account using the SID since it never change. Didn't try recently and too lazy to try rn on my french laptop but I'm pretty sure it works.

Reply

[-]

7ep3s@reddit

thats how i usually do things, learned it the hard way \^\^

Reply

[-]

BlackV@reddit

what do yo mean `RunAs` (as the verb or the tool) worked fine

Reply

[-]

eliodib@reddit

yeah i think what they meant is elevating mid powershell session. so you can just elevate an exisiting shell with sudo, something you cant do with run as.

Reply

[-]

HostileHarmony@reddit

There is also [gsudo](https://github.com/gerardog/gsudo)!

Reply

[-]

Slurp6773@reddit

CMD: Use runas or psexec. PS: start-process powershell –verb runAs

Reply

[-]

MairusuPawa@reddit

https://marc.info/?l=openbsd-tech&m=170742832804260

Reply

[-]

jenmsft@reddit

I'm glad you like it 😊

Reply

[-]

orev@reddit

Does this version of sudo let you elevate by typing your own password, or does it still require the password of another user with admin rights? If it;s the latter, then this tool should not be called sudo.

Reply

[-]

dhelmet78@reddit

As far as I can tell, it does not support running as another user at all.

Reply

[-]

SevaraB@reddit

Good, because that would be su, not sudo- and Windows already has runas (would be interesting to alias su to runas in Powershell).

Reply

[-]

dhelmet78@reddit

sudo -u [user] [command]

Reply

[-]

mr_datawolf@reddit

sudo -i

Reply

[-]

TKInstinct@reddit

I'd seen some demonstrations online that suggested you could run as another user. Maybe I'm wrong though.

Reply

[-]

HusselnBussel@reddit

Did anyone's pin break after this update? I had two users already (including me) with login issues shortly after the update. I was unable to signin using my pin. I had to login as the local admin (using LAPS of course) and then switch user to get my account working again. Anyone else experience that issue?

Reply

[-]

formal-shorts@reddit

As in Windows Hello for Business PIN?

Reply

[-]

HusselnBussel@reddit

Yup. That one. It didn’t break completely. Once I logged as admin and switched user it worked. But I had to put a pause on all the update rings so it didn’t go around breaking everyone’s pin.

Reply

[-]

chmod771@reddit

Same, something broke with authentication.

Reply

[-]

ThirstyOne@reddit

Woot! They released Win11 Ent LTSC 24H2 as well, and not just the iOT version.

Reply

[-]

Trooper27@reddit

Where is this available? Do not see it in VLSC?

Reply

[-]

ThirstyOne@reddit

I downloaded the eval from the public link.

Reply

[-]

Trooper27@reddit

Got you. I will do the same for now since I do not see it available in VLSC.

Reply

[-]

Weird_Lawfulness_298@reddit

iOT version makes TPM optional.

Reply

[-]

dhelmet78@reddit

I thought they were making LTSC, not just iOT, tpm optional, but I tried it today and I got the tpm error.

Reply

[-]

ThirstyOne@reddit

IOT requires specific licensing though.

Reply

[-]

Trooper27@reddit

Where can you get the ISO from though?

Reply

[-]

ThirstyOne@reddit

Volume licensing portal I guess?

Reply

[-]

Trooper27@reddit

Did not see it earlier today. Maybe that has changed.

Reply

[-]

ThirstyOne@reddit

I just downloaded the eval version to play with. I think you can feed it the gvlk if you’ve got a KMS server.

Reply

[-]

Trooper27@reddit

Gotcha. I know they changed everything up from the old vlsc portal. Thanks!

Reply

[-]

SpongederpSquarefap@reddit

Is this a legit LTSC and not a bullshit one like the last one was? LTSC 1809 is good until 2029 - they released one after that was LTSC but it was only good until 2026 Please tell me this is good until 2034

Reply

[-]

KarmicCorduroy@reddit

LTSC Enterprise is 2029. LTSC IoT Enterprise is 2034. https://en.wikipedia.org/wiki/Windows_11_version_history

Reply

[-]

mcj@reddit

[Only until 2029](https://learn.microsoft.com/en-us/windows/whats-new/ltsc/whats-new-windows-11-2024#lifecycle), Microsoft seem to be doing 5-year lifecycle now for LTSC. IoT LTSC is 10 years.

Reply

[-]

ThirstyOne@reddit

It is, as far as I can tell.

Reply

[-]

SpongederpSquarefap@reddit

Sweet

Reply

[-]

MrYiff@reddit (OP)

Yes! This could be a big deal for us too as we have loads of industrial pcs with varying LTSC/IoT versions so it would be great to standardise at some point if only for my sanity!

Reply

[-]

thewheelsonthebuzz@reddit

I’m more surprised people are using WSUS ;)

Reply

[-]

Lukage@reddit

And what would you use in an airgapped environment? What free update management product would you replace it with?

Reply

[-]

thewheelsonthebuzz@reddit

I must’ve missed that the system was air gapped. I was simply making a joke. I am almost certain Microsoft is retiring wsus. But I could be wrong.

Reply

[-]

Historical_Second521@reddit

I dont have it yet

Reply

[-]

Classic_Adagio_2949@reddit

Anyone else had internet issues after installing it cause reverted the update back to the previous update and now everything is working fine again

Reply

[-]

BrechtMo@reddit

No Enablement Package update sadly **Is there an enablement package for this release?** No. Windows 11, version 24H2 requires a full OS swap so it cannot be deployed using servicing technology. In addition, devices must be running Windows 11, version 23H2 or 22H2 with the May 2024 non-security preview update installed in order to update to version 24H2.

Reply

[-]

MrYiff@reddit (OP)

Yeah, this is a bit of a bummer, got the update queued in wsus now so il test the upgrade timing tomorrow and see how bad it is so we can start deciding how we handle upgrades.

Reply

[-]

IndyPilot80@reddit

Am I missing something? My Win 11 23H2 systems are showing 24H2 and "Not Applicable" in WSUS.

Reply

[-]

Eklundarn@reddit

We're running 23H2 but WSUS have been saying "Not applicable" for this update for over 24h now. Feels like I'm missing something.

Reply

[-]

Mission-Accountant44@reddit

We've noticed this, it's been a thing in our test groups for months and it looks like M$ didn't fix it.

Reply

[-]

way__north@reddit

I'm using Config Manager; Downloaded the 5043080 "Windows 11, 24H2 x64 2024-09B" package and deployed to 2 test pc's running 23H2. These are showing as "not applicable", and when I check the deployment, the 2 pcs both shows as "already compliant" 2 other systems running 23H2 shows as applicable, along with some machines running Win10 22H2

Reply

[-]

HoJohnJo@reddit

I've been watching it slowly add all the available Win 11 machines. It may be some vetting process.

Reply

[-]

IndyPilot80@reddit

Ours as been stuck at only 12% "applicable" for several hours now. Just weird that these are all the same model system, same specs, and even the same Win 11 23H2 deployment image.

Reply

[-]

Lukage@reddit

Microsoft: "Working as intended. Why are you using WSUS? That's dead. Go pay us for autopatch."

Reply

[-]

eider96@reddit

Observing similar behavior, though my sample size might be too small as they are all "Not Applicable". Possibly botched release or there's some sort of staged rollout in first hours.

Reply

[-]

alethewizard@reddit

Hello. Same issue with WSUS.

Reply

[-]

Furki1907@reddit

>In addition, devices must be running Windows 11, version 23H2 or 22H2 with the May 2024 non-security preview update installed in order to update to version 24H2. Im confused. Why is there a pre requirement of a Patch Level (in this case May 2024), if you are forced to make a Full Upgrade with the full .iso anyway? Am i now not able to upgrade clients with a lower patch level than May directly to 24H2?

Reply

[-]

KaitRaven@reddit

They do state elsewhere on the page that Windows 10 to 11 24H2 is supported

Reply

[-]

w3ll_w3ll_w3ll@reddit

You don't need to install from ISO. The update will simply take more time than using an enablement package.

Reply

[-]

woodburyman@reddit

FI usually run into more problems with full upgrades though. Various drivers sometimes do not reinstall correctly in the in place upgrade. I had one issue too with a Windows 10 upgrade, anyone with a particular USB dongle for a wireless mouse we had DOZENS of would fail the upgrade unless that USB dongle was removed in the upgrade. Logitech one too. Roughly 5% of my upgrades don't go through the first try or without some manual intervention vs easy sailing with enablement, same as CU more or less. However on the same page, given they are ENTIRELY new Windows folder and full system replacement, it sometimes fixes odd and random issues with system as well.

Reply

[-]

Furki1907@reddit

Then which Patchfile is it? From my knowledge, its either an Enablement package or a full upgrade.

Reply

[-]

TrueStoriesIpromise@reddit

It's a full upgrade but there's something in the May 2024 update that is required for the upgrade to work.

Reply

[-]

Furki1907@reddit

I guess i will just test it with an Windows 10 Image and Windows 11 pre May doing it the .iso way. I will update.

Reply

[-]

Furki1907@reddit

Windows 11 Test: Initial Patch Level: 22H2, 22621.1702 After .iso Upgrade 24H2: 24H2, 26100.1742 In other words, you dont need to have May Patch to use the .iso Full Upgrade. Windows 10 Update Info coming in a bit.

Reply

[-]

xCharg@reddit

I may be reading it wrong but no one said anywhere that updating using .iso requires anything? Requirement is for updating via windows updates.

Reply

[-]

Furki1907@reddit

Maybe, but since they said there is no enablement package, i was thinking a full upgrada (aka .iso) is needed. How else do you wanna update? Will it be like a classic patch file around \~1GB? How does this update procedure go if you want it to do manually?

Reply

[-]

TakenToTheRiver@reddit

WTF

Reply

[-]

simask234@reddit

In 24H2 they apparently did stuff with the kernel, SSE4.2 is required now (not that CPUs without it were ever officially supported by Win11 anyway), so that might be part of the reason why.

Reply

[-]

jamesaepp@reddit

> No. Windows 11, version 24H2 requires a full OS swap so it cannot be deployed using servicing technology Sorry, I'm really confused here. What on earth do they mean by "requires a full OS swap"? The use of the word "swap" makes me think they don't mean "reinstallation from install media". What is the practical result of their description?

Reply

[-]

andrewpiroli@reddit

It's an in-place OS upgrade delivered via Windows Update. Like going from 10->11, but from one version of 11 to another. If you downloaded a 24H2 iso and run `setup.exe /auto upgrade` you would get the same result.

Reply

[-]

ByTheBeardOfZues@reddit

Since towards the end of Win 10, major versions of Windows share a common 'core OS' where new features are included but disabled/dormant until ready for release. The enablement packages enable these features making feature updates much faster. I'm assuming by that description, the 'core OS' is changed so a good old fashioned feature pack installation is required.

Reply

[-]

intangir@reddit

Oops File : Printing Key : Software\Policies\Microsoft\Windows NT\Printers\WPP Name : ConfigureWindowsProtectedPrint Value : {ConfigureWindowsProtectedPrint} Class : Machine DisplayName : Configure Windows protected print ExplainText : Determines whether Windows protected print is enabled on this computer. By default, Windows protected print is not enabled and there are not any restrictions on the print drivers that can be installed or print functionality. If you enable this setting, the computer will operate in Windows protected print mode which only allows printing to printers that support a subset of inbox Windows print drivers. If you disable this setting or do not configure it, there are not any restrictions on the print drivers that can be installed or print functionality. For more information, please see [insert link to web page with WPP info]

Reply

[-]

420GB@reddit

I hear Microsoft LAPS support is removed... *sigh*

Reply

[-]

No_Whereas_8803@reddit

It still works. I put it 24H2 on my test box last night. Came in this morning and had to look up the LAPS password in Intune to continue testing.

Reply

[-]

420GB@reddit

Thanks, good to know!

Reply

[-]

MrYiff@reddit (OP)

There are improvements to laps listed as headline features in the link I shared so not sure where you heard that from. You can see removed features here https://learn.microsoft.com/en-gb/windows/whats-new/whats-new-windows-11-version-24h2#features-removed-in-windows-11-version-24h2

Reply

[-]

420GB@reddit

That's *Windows* LAPS. I'm concerned about the previous version, *Microsoft* LAPS which they have fast-tracked into legacy status after releasing the new replacement that isn't a replacement.

Reply

[-]

MrYiff@reddit (OP)

It's not listed as a removed feature so I'm assuming it will still work if it does on 23H2.

Reply

[-]

the_gum@reddit

It does not. Installation fails.

Reply

[-]

MrYiff@reddit (OP)

Ah, it may be necessary to start the process of using the new LAPS, iirc they can be run side by side so you can use legacy laps for older OS's and the new LAPS on newer OS's.

Reply

[-]

jantari@reddit

That's *Windows* LAPS. I'm concerned about the previous version, *Microsoft* LAPS which they have fast-tracked into legacy status after releasing the new replacement that isn't a replacement.

Reply

[-]

Weird_Definition_785@reddit

??? If this is true what system replaced it?

Reply

[-]

secpfgjv40@reddit

"Legacy' LAPS as we know it has been removed. "Windows LAPS" is the replacement which needs to be migrated to. It also supports Azure device password rotation. https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-deployment-migration

Reply

[-]

Weird_Definition_785@reddit

good whoever hasn't done that needs to get with the times

Reply

[-]

chum-guzzling-shark@reddit

i havent done it because microsoft laps works just fine, does not have any security or feature issues, and i got 200 other things to do.

Reply

[-]

Coffee_Ops@reddit

Microsoft LAPS is not encrypted. There's also very little burden to switching to Windows LAPS.

Reply

[-]

jantari@reddit

The burden is that Windows LAPS literally doesn't function on Server 2016, a widespread and still very much supported OS that is still getting security updates for more than 2 years at this point. So there's a BIG burden to switching - actually it's impossible, unless you've already completely moved off of Server 2016 far, far ahead of time.

Reply

[-]

Coffee_Ops@reddit

It's neither impossible, nor hard. Windows LAPS can run in [legacy compatibility mode](https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-scenarios-legacy), so you can simply not install Microsoft LAPS on newer OSes. Or, if you want, you can use WMI filtering to isolate Microsoft LAPS settings to server 2016 and earlier while allowing 2019+ to use Windows LAPS and take advantage of the better tooling + encryption. And for the record-- 2016 did end mainstream support 2 years ago. That's not the same as EOL but if you're not actively migrating off now you're shooting yourself in the foot.

Reply

[-]

Lukage@reddit

Our organization just implemented the old one 2 years ago....

Reply

[-]

confushedtechie@reddit

Microsoft LAPS and Windows LAPS are not the same thing

Reply

[-]

chum-guzzling-shark@reddit

I hope this isnt true. I heard Microsoft LAPS was removed in 23H2 but it continued to work.

Reply

[-]

BlackV@reddit

new laps is compatible with old laps

Reply

[-]

jantari@reddit

No. Windows LAPS doesn't support Server 2016: https://learn.microsoft.com/en-us/windows-server/identity/laps/laps-overview#windows-laps-supported-platforms This means any organization that hasn't completely upgraded away from Server 2016 already - way ahead of schedule, as it's not EoL for another 2+ years - cannot deploy Windows LAPS to manage all their local administrator credentials. Microsoft LAPS supports Server 2016 perfectly fine, and it also used to support everything up to and including the latest versions of Windows 10 and 11. Now Microsoft are changing that abruptly. This means there is no uniform management of local credentials anymore. You *have* to run both Microsoft LAPS and Windows LAPS side-by-side and carefully target which goes where which is ridiculous. They could have just kept supporting Microsoft LAPS for another 2 years and 3 months until Server 2016 is EoL, *THEN* force everyone to adopt Windows LAPS when it's possible to fully do so.

Reply

[-]

BlackV@reddit

"accidentally" in place upgrade, do it :)

Reply

[-]

Jaereth@reddit

What's scary about copilot that would make you want to disable it?

Reply

[-]

chasenmcleod@reddit

I can see why some people would be hesitant, however, it's been nice in our company so far. We have users using it for SharePoint help, troubleshooting help, and just general windows questions. We have adjusted a few things with Graph but don't see the need to fully disable. Granted, we aren't the biggest environment either. 1,500 or so people. But I bet only 10-15% of intermediate to power users are actually using it.

Reply

[-]

BrechtMo@reddit

Recall

Reply

[-]

ZAFJB@reddit

Recall is off and opt-in by default.

Reply

[-]

TheRani_Ushas@reddit

Be sure to check-out the known problems with 24H2 https://admin.microsoft.com/Adminportal/Home?#/windowsreleasehealth/knownissues Safe Exam Browser application might fail to open Some devices using Easy Anti-Cheat stop responding and receive a blue screen Fingerprint sensors might experience problems after a device is locked Wallpaper customization applications might not work as expected Compatibility issues with Intel Smart Sound Technology drivers Asphalt 8 might periodically stop responding

Reply

[-]

Proper-Obligation-97@reddit

Thanks, the GPO setting for Copilot are in. https://preview.redd.it/vmkvuy7yjbsd1.png?width=466&format=png&auto=webp&s=70889152166076d556ad6e0ba88e3b7a4c912f86

Reply

[-]

the_gum@reddit

> Watch out, copilot has returned, I've not checked yet but hopefully there are GPOs to disable it. Looks like there is in windowscopilot.admx **Turn off Saving Snapshots for Windows** This policy setting allows you to control whether Windows saves snapshots of the screen and analyzes the user's activity on their device. If you enable this policy setting, Windows will not be able to save snapshots and users won't be able to search for or browse through their historical device activity using Recall. If you disable or do not configure this policy setting, Windows will save snapshots of the screen and users will be able to search for or browse through a timeline of their past activities using Recall.

Reply

[-]

MrYiff@reddit (OP)

Yep, just updated our ADMX files and there is now a Windows AI folder under User settings with the policy you mentioned in it and a seperate Copilot one for controlling other Copilot apps.

Reply

[-]

the_gum@reddit

> Cumulative updates that serve as a checkpoint will be released periodically. Using a checkpoint rather than RTM means the subsequent update packages are smaller, which makes downloads and installations faster. Using a checkpoint also means that in order for a device to install the latest cumulative update, the installation of a prerequisite cumulative update might be required. Why still call it cumulative, if it requires another update?

Reply

[-]

bunkerdude103@reddit

Our root CA trust gets pushed out via intune and all machines on 24h2 are missing that root CA in their trusted store. Importing manually does fix, I have a ticket open with MS about why the certs aren't being pushed

Reply

[-]

kamrash_hlural@reddit

Look there is rust in the kernel they better put some paint on it to keep it from spreading /jk

Reply

[-]

mikeybrah90@reddit

why cant I see the win11 24h2 update when I search for it in windows update?

Reply

[-]

MrYiff@reddit (OP)

Windows Update for unmanaged devices normally has a delay in updates to slowly roll them out over time. If you don't have something like WSUS or WufB configured to force the upgrade then you might need to manually download it and run the installer.

Reply

[-]

jenmsft@reddit

It hasn't been rolled out to everyone yet, appreciate your patience. There's a blog post here about it: [https://blogs.windows.com/windowsexperience/2024/10/01/how-to-get-new-experiences-for-windows-11/](https://blogs.windows.com/windowsexperience/2024/10/01/how-to-get-new-experiences-for-windows-11/)

Reply

[-]

mikeybrah90@reddit

Ah ok - what’s the theory with not rolling it out to everyone?

Reply

[-]

rxbeegee@reddit

A phased rollout allows for only some of the devices to be affected in the event the update is a catastrophic failure

Reply

[-]

mikeybrah90@reddit

Makes sense - Cheers

Reply

[-]

andyr354@reddit

I just tried the iso download and 23h2 was still selected. Will try again after lunch.

Reply

[-]

The_Berry@reddit

yeah.. wtf i upgraded to this, too, and it bricked search and I'm still on 23h2...

Reply

[-]

graywolfman@reddit

> [1] Downloads in the Microsoft 365 admin center and similar channels may be delayed.

Reply

[-]

graywolfman@reddit

> [1] Downloads in the Microsoft 365 admin center and similar channels may be delayed.

Reply

[-]

disclosure5@reddit

> Local Security Authority (LSA) protection to help protect against the theft of secrets and credentials used for logon I like how this is "new in this update" and we've had this in our standard build since early Windows 10 and it may be even older. That said, this feature is extremly meaningful, please turn it on, it has an immediate security benefit: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-ntlm-blocking?tabs=group-policy

Reply

[-]

thortgot@reddit

My understanding is that it's a default on state (overriding existing).

Reply

[-]

disclosure5@reddit

Depending what you mean by "on".. The default state is "enabled", which is the say NTLM is allowed in the same way your average pentester has exploited for a decade. You need to set this yourself. Also it's not yet available in InTune, so you need a Powershell script.

Reply

[-]

thortgot@reddit

LSA protection is being defaulted to on in 24h2. That's why it's in the patch notes.

Reply

[-]

Safe_Excitement3653@reddit

Anyone having trouble doing a clean install using the ISO made available today? It simply won't connect using IPv4

Reply

[-]

BloodFeastMan@reddit

Can't say I'm thrilled about Rust

Reply

[-]

the91fwy@reddit

This is irrelevant to you and I. The Windows kernel is closed development Microsoft will *always* have Rust developers to maintain whatever is written in Rust there. This is not like the Linux kernel where the lead maintainer of Rust for Linux has retired and they're left a bit scrambling. Rust has been used amply in Firefox and is even making it's way to Chromium. It's the only language where you can get both speed and safety and that matters with large projects like operating systems and browsers written in unsafe languages and CVE's turn into a bag of M&M's.

Reply

[-]

BloodFeastMan@reddit

There's a long learning curve, I just wonder what the quality of the maintainers will be ten years from now. And yeah, that Rust / Linux kernel thing came out of left field .. That wasn't my concern as much as the fact that Rust is not the preferred language of literally everyone I know, anecdotal of course,

Reply

[-]

jantari@reddit

Rusts learning curve is long, but still shorter than the absolutely brain-busting bonkers complexity of C++ which is Microsoft's current / past weapon of choice.

Reply

[-]

autogyrophilia@reddit

The problem with rust is more that people treat it as a silver bullet and it really is not a perfect solution. First, you can do a lot of stupid things inside unsafe blocks. Second, and this is the important part, it does nothing against logic errors. Most of the time, the security stuff we patch is related to the low level where Rust helps. But there are plenty of logic problems. Like the recent terrapin one.

Reply

[-]

Weird_Definition_785@reddit

You can do a lot of stupid things without rust too. What's your point? If you can get rid of some issues by using another language why not?

Reply

[-]

autogyrophilia@reddit

The thesis is written at the top of the comment. That's my point.

Reply

[-]

patmorgan235@reddit

Yeah, rust will not solve all security bugs. But something on the order of 70% of vulnerabilities are due to memory corruption bugs. https://msrc.microsoft.com/blog/2019/07/a-proactive-approach-to-more-secure-code/ If switching to rust gets rid of just half of those (and there's not an increase in logic bugs) it's worth it.

Reply

[-]

Arudinne@reddit

Any particular reason?

Reply

[-]

BloodFeastMan@reddit

Rust seems to be falling out of favor faster than it fell in.

Reply

[-]

autogyrophilia@reddit

You mean it is encountering the friction expected of a mature product and not vaporware?

Reply

[-]

lazerwarrior@reddit

Context? Rust programming language is being used in Windows kernel? > Rust in the Windows kernel

Reply

[-]

BloodFeastMan@reddit

The context is in OP's link

Reply

[-]

Coffee_Ops@reddit

>Rust in the Windows kernel Looking forward to the next presentation on Windows 24H2 getting derailed by kernel devs arguing about minutae.

Reply

[-]

Trooper27@reddit

Wanted the ISO, but saw this on the link posted above. "Downloads in the Microsoft 365 admin center and similar channels may be delayed."

Reply

[-]

Slasher1738@reddit

Wake me when Server 25 gets released

Reply

[-]

chum-guzzling-shark@reddit

When I built out my application control policies, I used applocker because WDAC had enterprise licensing requirements. It looks like those were lifted a few years ago. Is it worth switching to App Control for Business?

Reply

[-]

i-opener@reddit

Color me skeptical but I'll just wait another month (or so).

Reply

[-]

jmbpiano@reddit

> This scoped release also features enhancements designed to improve your overall experience with Windows 11, such as: > [...] >Support for creating 7-zip and TAR archives Uh... what? That's already present in 23H2 and has been there for a while.

Reply

[-]

mcj@reddit

Anyone seeing the ISOs in their Admin console yet? Nothing over here yet...

Reply

[-]

meatwad75892@reddit

Same here. Packages hit WSUS though.

Reply

[-]

kheldorn@reddit

Nothing here yet either.

Reply

[-]

Arudinne@reddit

Not seeing it in ours.

Reply

[-]

Sovey_@reddit

Farewell WordPad... You were useful in the times when I was too cheap to buy Office and too lazy to pirate it.

Reply

[-]

CP_Money@reddit

I've been waiting for this to see if the IAKERB and Local KDC additions let things that need Kerberos work instead of NTLM. Anyone else tried anything in regard to this yet?

Reply

[-]

bbqwatermelon@reddit

Sweet, just in time for moving to the n-1 23H2 out fleet before EOL on the 8th

Reply

[-]

Arudinne@reddit

I've been running it for a bit as my work laptop is enrolled in the Windows Insider Program - Release Preview. No issues.

Reply

Reply to Post

196 Comments