Tag: Microsoft Windows

Fake USB devices being inserted into a Windows laptop port
August 14, 2026

Fake USB Devices Are Hijacking Windows: What You Must Know

Post By administrator Microsoft, Windows , , , , , , No Comments

Fake USB devices are now one of the most alarming vectors for gaining SYSTEM-level control over Windows machines — and the worst part is that victims don’t even need to click anything. Security researchers Alejandro Hernando and Borja Martínez publicly demonstrated a class of attacks, dubbed Plug and Pwn, that weaponise Windows’ own Plug and Play (PnP) subsystem to hand attackers the highest privilege tier on any targeted PC. If your organisation allows arbitrary USB hardware to connect to endpoints, this threat is immediate and real.

What Is the Plug and Pwn Attack?

Diagram of fake USB devices exploiting Windows Plug and Play attack chain

The human factor makes this worse than it looks on paper. In a landmark study by researchers at the University of Illinois, the University of Michigan and Google, 297 USB drives were deliberately dropped around a university campus — and users picked up and connected an estimated 45–98% of them. Files were opened on 48% of the drives, and the first one was plugged into a machine within six minutes of being dropped. Applied to Plug and Pwn, that behaviour is all an attacker needs: no phishing email, no credential theft, just a device left in a car park or reception area.

The Plug and Pwn technique exploits a fundamental trust relationship built into Windows Plug and Play: when new hardware is detected, Windows automatically searches for and installs the appropriate driver — often fetching signed vendor software from the internet or from a local driver store. Researchers found that by presenting a carefully crafted fake USB device — one that masquerades as legitimate hardware — they could force Windows to load a malicious driver package and, in doing so, execute code at the SYSTEM level with zero user interaction required.

The attack does not rely on a traditional software vulnerability in the conventional sense. Instead, it abuses a design behaviour: Windows is engineered to be helpful and automatically install drivers, and that helpfulness becomes the exploit. The technique was presented publicly at DEF CON 34, along with proof-of-concept code, meaning the bar for replication by threat actors is now dramatically lower.

How a Malicious USB Attack Reaches SYSTEM Privileges

To understand why this USB privilege escalation is so dangerous, it helps to appreciate the Windows privilege model. Standard users operate at a restricted level. Administrators have elevated rights but are still constrained in many ways. SYSTEM is the highest local privilege tier — it is the account that Windows itself uses internally, and it can bypass most user-mode security controls, read sensitive credential stores, and interact with protected kernel objects.

Here is the step-by-step chain that the Plug and Pwn technique follows:

  1. Physical or emulated connection. An attacker plugs in a crafted USB device — or, in remote scenarios, presents an emulated USB device over an RDP session — to the target machine.

  2. PnP enumeration. Windows detects the device and begins its automatic hardware identification and driver-fetching routine.

  3. Malicious driver injection. The fake device presents a device ID that matches a signed driver package pre-positioned in a reachable driver store or pulled down from the internet.

  4. SYSTEM-level code execution. Because driver installation runs as SYSTEM, any code embedded or triggered in the driver package inherits that same privilege level — giving the attacker a SYSTEM shell on the endpoint.

The attack can succeed even when the user logged in at the time has only standard privileges. That is what makes the Plug and Pwn class of attacks so alarming from a threat-modelling perspective.

Who Is at Risk from This Fake USB Attack?

IT team applying Group Policy controls to block malicious USB attacks on Windows endpoints

Any Windows endpoint that meets the following conditions is potentially vulnerable:

  • USB ports are accessible and not disabled at the hardware or policy level.

  • Automatic driver installation via Windows Update or the local driver store is enabled.

  • The machine is reachable via RDP with external peripheral redirection permitted (for the remote variant).

  • No endpoint detection solution actively monitors or blocks driver-store manipulation.

That description fits a significant proportion of corporate endpoints. The research highlights that Windows 10 and Windows 11 are both affected. Organisations in sectors with high physical-access risk — retail, healthcare, hospitality, co-working spaces, and open-plan offices — face an especially elevated threat level from a malicious USB attack of this type.

It is also worth noting that the RDP variant of Plug and Pwn expands the attack surface well beyond physical presence. An attacker who already has limited RDP access — perhaps through a phishing-obtained credential — could elevate themselves to SYSTEM without ever entering the building.

Plug and Pwn vs. Traditional BadUSB: What’s Different

You may be familiar with older USB-based attack tools such as BadUSB, Rubber Ducky, or OMG Cable, which typically emulate keyboards or network adapters to inject keystrokes or redirect traffic. Plug and Pwn is a distinct and, in some ways, more sophisticated category of USB privilege escalation because it does not depend on injecting keystrokes or tricking a user into running something.

The key difference: traditional BadUSB attacks still rely on the user’s session to execute payloads — they type commands as the logged-in user. Plug and Pwn, by contrast, exploits the SYSTEM-level driver installation process itself, entirely bypassing whatever the user’s permission level happens to be. This makes it effective even against hardened user accounts and even when application whitelisting is in force at the user level.

Immediate Steps IT Teams Should Take

Comparison of USB privilege escalation attacks versus traditional BadUSB methods

The most effective mitigations combine policy controls, endpoint configuration, and physical security. None of these steps requires a Microsoft patch — they are defensive practices that should be in place regardless of this specific research.

1. Restrict USB Device Installation via Group Policy

Windows provides granular Group Policy controls under Computer Configuration > Policies > Administrative Templates > System > Device Installation > Device Installation Restrictions. Enabling “Prevent installation of devices not described by other policy settings” stops Windows from installing any unrecognised hardware automatically. You can then whitelist only approved device classes (e.g. approved keyboards and mice by vendor ID). This is the single most direct mitigation for fake USB devices attacking via PnP.

Microsoft’s own documentation on creating a GPO to disable USB storage devices provides a solid starting point, though for Plug and Pwn you will want to go further and restrict all unrecognised device classes, not just storage.

2. Disable Driver Installation from Windows Update for Endpoint Devices

One of the attack’s delivery mechanisms involves Windows fetching driver packages from Windows Update automatically. In enterprise environments, this behaviour can be suppressed via Group Policy (Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not include drivers with Windows Updates). Driver updates should be vetted and deployed through a managed endpoint solution instead.

3. Control RDP Peripheral Redirection

For the remote variant of the USB privilege escalation, disable Plug and Play device redirection in your Remote Desktop Session Host settings. In Group Policy, navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection and enable “Do not allow supported Plug and Play device redirection”. This closes the remote attack path.

4. Deploy Endpoint Detection and Response (EDR)

A quality EDR solution that monitors driver-store changes, unusual SYSTEM-level process spawns, and new hardware enumeration events will detect anomalous PnP activity even if policy controls are not fully hardened. Alert on any new driver installation from an unmanaged source, especially those that spawn child processes at SYSTEM privilege.

5. Apply Physical Security Controls

For endpoints in high-risk physical environments, consider USB port blockers (physical plugs that prevent insertion), epoxy fills for unused ports, or endpoint management policies that lock machines automatically after short idle periods. Physical access to a USB port is the prerequisite for the direct variant of this attack — removing that access removes the risk at source.

6. Keep Windows Fully Patched

While Plug and Pwn exploits a design behaviour rather than a specific named CVE patched in one update, running a fully updated Windows installation ensures that any related vulnerabilities — such as driver signing enforcement bypasses or PnP subsystem flaws — are closed as quickly as Microsoft addresses them. The BitLocker bypass exploit targeting Windows 11 demonstrated similarly that USB-adjacent attack surfaces can be patched, but only if your systems are up to date.

Why Signed Drivers Don’t Guarantee Safety

A common misconception is that Windows’ requirement for digitally signed drivers provides a safety net. It does raise the bar — but it does not close the Plug and Pwn gap entirely. Legitimate, signed driver packages that exist in the Windows Update catalogue or a corporate driver store can be abused if an attacker can steer Windows into installing them for a fake device. The signature validates the package’s origin and integrity, not its appropriateness for the connected hardware. This is why device installation restriction policies — not just signature enforcement — are the correct control.

The Broader Lesson: Windows Security Starts at the Perimeter

The Plug and Pwn research is a vivid reminder that perimeter-level thinking must extend to the physical layer. Network firewalls, strong passwords, and even BitLocker encryption do not protect against an attacker who can plug a malicious USB attack vector into an unguarded port and have Windows hand over SYSTEM privileges within seconds.

IT and security teams should treat any USB port on a corporate endpoint as a potential attack surface — because that is exactly what it is. Combine that mindset with the Group Policy and RDP controls outlined above, and you close the vast majority of the Plug and Pwn exposure without waiting for a vendor patch.

For organisations looking to maintain a locked-down, fully managed Windows estate, ensuring every machine runs a genuine, properly licensed copy of Windows is also foundational. A correctly licensed and activated Windows installation receives security updates reliably, without gaps or delays. You can explore Windows 11 Pro licences to keep your endpoints current and patch-ready — Windows 11 Pro also includes the most robust Group Policy toolset for implementing the device installation restrictions described above.

Frequently Asked Questions

What exactly are fake USB devices in the context of Plug and Pwn?

Fake USB devices are purpose-built or modified hardware units — or software-emulated virtual devices — that present a false hardware identity to Windows when connected. They mimic the device IDs of legitimate hardware to trigger Windows Plug and Play into installing a driver package chosen by the attacker. Unlike ordinary USB drives, they may carry no visible storage or function; their sole purpose is to manipulate the PnP subsystem.

Do I need to be physically present to carry out a USB privilege escalation attack?

Not necessarily. Researchers demonstrated a remote variant of the attack using USB device redirection over RDP. If an attacker has access to an RDP session — even with limited credentials — they can present a virtual fake USB device through that session and trigger the same SYSTEM-level driver installation chain. Disabling PnP device redirection in RDP settings is therefore a critical remote-attack mitigation.

Does Plug and Pwn affect Windows 11 specifically?

Yes. Both Windows 10 and Windows 11 are affected by the underlying Plug and Play design behaviour that the attack exploits. Windows 11 does introduce stricter hardware requirements and improved security defaults in some areas, but the PnP driver installation process that Plug and Pwn abuses is present and exploitable across both versions without specific hardening in place.

Will disabling USB ports protect against all malicious USB attacks?

Disabling or restricting USB ports removes the physical attack vector for the direct variant of Plug and Pwn, but it must be combined with RDP peripheral redirection controls to close the remote path. Additionally, disabling USB ports via Group Policy (device installation restrictions) is more granular and practical for most organisations than physically disabling ports, since it allows whitelisted devices like keyboards and mice to continue functioning.

Is there a Microsoft patch for this vulnerability?

Plug and Pwn exploits a design behaviour in Windows Plug and Play rather than a single discrete software bug with its own CVE in the traditional sense. Microsoft has acknowledged the research. Rather than waiting for a specific patch, organisations should implement the Group Policy restrictions, RDP controls, and endpoint hardening measures described in this article, which collectively mitigate the attack without depending on a single fix.

How does this relate to other USB-based Windows threats like BadUSB?

BadUSB-style attacks typically emulate keyboards or other human-interface devices to type commands in the context of the logged-in user. Plug and Pwn is distinct because it targets the SYSTEM-level driver installation process, bypassing user-level privilege entirely. The two attack classes can be used independently or in combination, but Plug and Pwn represents a more fundamental escalation path because it does not depend on user interaction or the user’s privilege level.

Legacy software on Windows 11 running vintage Word 1.1a from 1990 natively
August 10, 2026

Legacy Software on Windows 11: How Old Programs Are Running Again

Post By administrator Microsoft, Windows , , , , , No Comments

Legacy software on Windows 11 is having an unexpected renaissance. In 2025, developer John Marshall published a fully working native x64 port of Microsoft Word for Windows 1.1a — a word processor originally released in 1990 — that runs directly on modern Windows 11 machines without an emulator or virtual machine in sight. It’s a remarkable technical feat, and it’s part of a growing movement to preserve and revive vintage software on today’s hardware.

Whether you’re a software historian, a developer curious about the techniques involved, or simply someone who needs to breathe life into an old application your business still depends on, understanding how these compatibility revivals work is increasingly valuable knowledge.

Why Running Old Programs on Windows 11 Is So Hard

Diagram showing why old software fails on legacy software Windows 11 systems

Modern Windows 11 is a 64-bit operating system, and that single architectural fact is the root cause of most vintage app compatibility failures. Programs built for Windows 3.x and early Windows 95 were compiled as 16-bit executables — a format that 64-bit Windows simply cannot load natively. Microsoft removed its WOW16 (Windows-on-Windows 16-bit) subsystem when it moved to 64-bit editions, leaving a generation of software stranded.

Beyond the bitness barrier, older applications relied on APIs, system DLLs, and hardware-level tricks that no longer exist in modern Windows. Early word processors and CD-ROM titles frequently called undocumented Windows internals, manipulated memory in ways that would trigger modern security protections, or depended on specific timing characteristics of vintage CPUs. Running them on a contemporary machine is less like opening an old file and more like transplanting an engine from a 1955 car into a 2025 chassis.

  • 16-bit executables cannot load on 64-bit Windows — no native WOW16 layer exists.
  • Removed APIs cause instant crashes when code calls functions that no longer exist.
  • Memory model differences break apps that relied on segmented x86 memory addressing.
  • Driver dependencies for peripherals like old MIDI cards or CD-ROM drives are often absent.
  • Hardcoded timing loops run far too fast on modern processors, causing instability.

How Developers Are Porting Old Software to Run Natively

Developer porting vintage app compatibility code to run on modern Windows 11

The Word 1.1a port by John Marshall — posted to GitHub under the handle JMarshall23 — is an outstanding case study in how vintage app compatibility can be achieved through source-level porting rather than emulation. Marshall had access to the leaked Microsoft source code for Word 1.1a (codenamed Opus) and spent considerable time modernising it so the MSVC compiler could produce a genuine 64-bit binary.

Recompiling for x64 Architecture

The most direct route to native compatibility is recompilation: taking the original source code and rebuilding it as a 64-bit binary. This sounds simple, but decades-old C code is riddled with assumptions — pointer sizes, integer widths, calling conventions — that break the moment a modern compiler targets x64. Marshall’s approach involved fixing thousands of implicit 16-to-32-bit type conversions, replacing obsolete Windows API calls with their modern equivalents, and stubbing out functionality that simply has no modern counterpart.

Shimming and API Wrapping for Vintage App Compatibility

When source code is unavailable — the far more common scenario — developers turn to compatibility shims and API wrappers. A shim intercepts calls from an old application to the Windows API and translates them on the fly, correcting arguments, emulating missing functions, or redirecting to modern equivalents. Microsoft itself ships a compatibility shim database (sysmain.sdb) with Windows that quietly patches hundreds of known applications at load time. Independent developers extend this concept to write custom wrapper DLLs that stand between a vintage executable and the modern OS.

Patching Binaries Directly

For 32-bit applications that almost run on Windows 11 but stumble on one or two compatibility issues, direct binary patching is often faster than recompilation. A developer disassembles the executable, identifies the offending instruction or API call, and replaces it with a working alternative — all without touching source code. This technique is particularly popular in the retro gaming and CD-ROM preservation communities, where 1998-era titles frequently need a patched DirectDraw or CD-check call to run on modern systems.

The Role of Compatibility Mode

For everyday users dealing with old programs on Windows 11, Microsoft’s built-in compatibility mode remains the first port of call. Right-clicking an executable, choosing Properties → Compatibility, and selecting an older Windows version (Windows 7, Windows XP SP3, etc.) tells Windows to lie to the application about its environment — reporting a lower OS version, disabling visual themes, running the process at 640×480, and applying known shims automatically. It won’t save a 16-bit app, but it resolves a surprising number of 32-bit compatibility issues without any developer intervention.

According to Microsoft’s official compatibility guidance, the Program Compatibility Troubleshooter can automatically detect and apply the right settings for many legacy applications — a useful starting point before diving into manual fixes.

Old Software Windows 11 Users Still Depend On

This isn’t purely an academic exercise. Plenty of real-world organisations still run old software on Windows 11 — or are forced to confront the question when they upgrade. Industries from manufacturing to healthcare have bespoke applications written in the mid-1990s that have never been replaced because the cost of doing so outweighs the effort of keeping them alive. A 1998 inventory management system or a proprietary CAD tool from 2001 can represent years of business logic that would cost millions to recreate.

The challenge is that Windows 10 reached end of support on 14 October 2025, pushing millions of business users towards Windows 11 and forcing an immediate reckoning with any run old programs Windows compatibility debt they’d been deferring. Suddenly, the old app that “just worked” on Windows 7 and muddle through on Windows 10 is crashing on the new OS — and there’s no more putting off the fix.

Techniques Used in Real Preservation Projects

Old programs Windows 11 users still rely on shown as vintage software icons

The broader software preservation and retro-computing community has developed a rich toolkit for reviving vintage software on modern platforms. The Word 1.1a project is high-profile, but dozens of quieter efforts are happening on GitHub and specialist forums every month.

Vintage App Compatibility Through Virtual Machines

Running a 16-bit application inside a virtual machine — typically a Windows XP or Windows 98 guest on something like VirtualBox or VMware — sidesteps the 64-bit barrier entirely because the VM presents a 32-bit or 16-bit environment. It’s not native execution, but it is reliable. Many preservation projects use this as the “good enough” baseline before pursuing a full native port.

Wine and ReactOS as Cross-Platform Shim Layers

Wine — originally built to run Windows software on Linux — has become an unlikely hero of legacy software preservation. Its compatibility database covers thousands of Windows titles, and it runs on Windows itself via the Windows Subsystem for Linux (WSL). ReactOS, an open-source Windows clone, provides another environment where old Windows executables can sometimes run better than on modern Windows itself, precisely because it re-implements APIs that Microsoft has since removed.

NTVDM and DOSBox for DOS-Era Code

True DOS applications predate even the 16-bit Windows layer, and 64-bit Windows has no NT Virtual DOS Machine (NTVDM) support. DOSBox and its forks — particularly DOSBox-X, which targets application rather than game compatibility — have become the standard preservation tool for this era of software. For CD-ROM titles from the 1990s, DOSBox-X’s emulation of vintage CD-ROM extensions, Sound Blaster audio, and VESA graphics is remarkably accurate.

What the Word 1.1a Port Means for Legacy Software Preservation

The significance of John Marshall’s Word 1.1a port extends beyond nostalgia. It demonstrates that even without official vendor support, determined developers can rescue genuinely important cultural and historical software artefacts by working directly with the source code. Word for Windows 1.1a was commercially sold from 1990 onwards and shaped how millions of people interacted with computers during one of computing’s most formative decades.

More practically, the project is a proof-of-concept that the techniques for run old programs Windows compatibility — source-level porting, API wrapping, and binary patching — are accessible to skilled individual developers, not just large corporate engineering teams. The full port compiles with MSVC and produces a binary that launches cleanly on a stock Windows 11 installation. No compatibility flags, no administrator hacks, no special drivers: just a 35-year-old word processor running natively in 2025.

For organisations maintaining vintage app compatibility across a fleet of upgraded machines, this kind of community-driven approach points to a viable path forward — and a compelling argument for keeping source code, even for software long since retired from active development.

Getting Your Windows 11 Licence Before You Upgrade

Whether you’re upgrading specifically to explore retro software preservation techniques or simply moving on from Windows 10, having a genuine, properly licensed copy of Windows 11 is the essential first step. A correctly activated installation ensures you have access to all compatibility features — including the Program Compatibility Troubleshooter, Hyper-V for virtual machines, and the Windows Subsystem for Linux — that make running old programs on Windows 11 far more manageable.

At Buy Now Key, you can pick up a Microsoft Windows 11 Pro licence from just €17.90, with instant digital delivery and lifetime activation on your device. If you’re not sure which edition suits you, the Windows 11 Home category covers home users looking for a cost-effective, fully-featured starting point.

Frequently Asked Questions

Can I run 16-bit software on Windows 11?

Not natively. Windows 11 is a 64-bit operating system and has no built-in WOW16 subsystem to load 16-bit executables. Your best options are running the software inside a virtual machine (such as a Windows XP guest on VirtualBox), using DOSBox-X for DOS-era titles, or waiting for a community source port if the original code is available.

Does Windows 11 compatibility mode fix most old programs?

Compatibility mode solves a broad range of issues for 32-bit applications — false OS version detection, theme-related crashes, DPI scaling problems, and some known API differences. It won’t help with 16-bit apps or software that relies on hardware drivers for long-obsolete devices. Run the Program Compatibility Troubleshooter first; if the app still fails, you’ll need a deeper technical approach.

What is a compatibility shim and how does it work?

A compatibility shim is a small piece of code that intercepts API calls from an old application and translates them so modern Windows can process them correctly. Windows ships with a built-in shim database covering hundreds of known applications. Developers can also write custom shims — essentially wrapper DLLs — for applications not already covered by Microsoft’s database.

Is running vintage software on Windows 11 legal?

It depends on the software. Running software you legitimately own for personal use is generally permissible. Porting or distributing source code you do not own may infringe copyright. Community projects like the Word 1.1a port operate in legally complex territory — they typically distribute only source changes (patches), not the original binaries or assets. Always check the licence terms of any software before distributing a modified version.

Will my 32-bit applications still work on Windows 11?

Most 32-bit Windows applications continue to run on Windows 11 via the WOW64 (Windows 32-bit on Windows 64-bit) compatibility layer, which Microsoft has preserved. Issues arise when 32-bit apps rely on 32-bit kernel drivers, 32-bit COM servers, or API sets that Microsoft has since removed. Testing on a clean Windows 11 installation before a fleet-wide upgrade is always recommended.

How do I find out if my legacy software will run on Windows 11?

Start with the Program Compatibility Troubleshooter built into Windows 11 — right-click the executable and select “Troubleshoot compatibility”. For enterprise environments, Microsoft’s App Assure programme offers free compatibility assistance. Community databases like the Wine AppDB and various retro-computing forums often have user reports on specific legacy titles.

Windows 11 RAM specs guide showing official memory requirements for users
August 7, 2026

Windows 11 RAM Specs: What Microsoft’s Changes Mean for You

Post By administrator Microsoft, Windows , , , , , No Comments

Windows 11 RAM specs have just become a hot topic again: Microsoft has quietly removed its long-standing “no worries” 32 GB recommendation from the Windows Learning Center, leaving many users wondering what the real guidance actually is. The short answer is that the official minimum remains 4 GB — but the real-world story is quite a bit more nuanced, and Microsoft’s own behaviour suggests it is rethinking how it communicates memory guidance altogether.

What Microsoft Actually Changed

Microsoft Windows 11 RAM specs documentation change from 32 GB to 4 GB minimum

For some time, Microsoft’s documentation included a tiered RAM recommendation table that effectively told users 32 GB was the “no worries” level for Windows 11 — implying anything below that could involve performance trade-offs. According to a TechPowerUp report, those references have now been quietly deleted, with Microsoft citing significant pushback from gamers and consumers during a period of elevated DRAM prices. The removal is not a bug or an oversight — it is a deliberate editorial decision to stop publishing guidance that was driving unnecessary hardware anxiety.

Crucially, this is not a change to the Windows 11 minimum system requirements. Those remain exactly as they were at launch: 4 GB RAM, a 1 GHz dual-core 64-bit processor, 64 GB of storage, TPM 2.0, and Secure Boot support. What changed is the aspirational tier that existed above the minimum — the one that told enthusiasts how much RAM would make Windows 11 feel truly effortless.

The Official Windows 11 RAM Requirements Right Now

According to Microsoft’s official Windows 11 requirements on Microsoft Learn, the confirmed minimum specification list is:

  • RAM: 4 GB or greater
  • Processor: 1 GHz or faster, 2 or more cores, 64-bit compatible
  • Storage: 64 GB or larger
  • Firmware: UEFI with Secure Boot enabled
  • TPM: Version 2.0
  • Graphics: DirectX 12 compatible, WDDM 2.0 driver
  • Display: HD (720p), 9 inches or larger

Nothing in this list has changed. The 4 GB RAM floor is the same figure Microsoft published when Windows 11 launched in October 2021. If your machine met those specs yesterday, it still meets them today.

Does 4 GB of RAM Actually Cut It for Windows 11?

RAM for Windows 11 performance tiers from 4 GB to 32 GB explained

Technically, yes. Practically, it depends on what you do. Windows 11 at idle on a clean install typically consumes between 2.5 GB and 3.5 GB of RAM, which leaves precious little headroom on a 4 GB system once a browser tab or two is open. Windows 11 RAM requirements set the floor for compatibility — not for a comfortable daily-use experience.

Here is a sensible breakdown of what different amounts of RAM actually deliver in 2026:

  • 4 GB: Meets the official minimum but feels sluggish with multitasking. Suitable only for very light single-task use.
  • 8 GB: The practical sweet spot for most home and office users. Comfortable for web browsing, Office apps, and light media use. Microsoft itself has recently stated that 8 GB should be enough for anyone running Windows 11.
  • 16 GB: Recommended for developers, creatives, and users who regularly run several heavy applications at once.
  • 32 GB+: Useful for video editing, large virtual machines, 3D rendering, and AI workloads — but no longer formally recommended by Microsoft as a general-use target.

Why Did Microsoft Remove the 32 GB RAM for Windows 11 Guidance?

The timing is telling. Global DRAM prices surged significantly in 2024 and into 2025, pushing the cost of a 32 GB upgrade well beyond what many mainstream users were willing or able to spend. When Microsoft lists 32 GB as the premium tier in an official recommendation table, it creates an implicit pressure — users feel their system is underspecced, even if it runs perfectly well for their actual workload.

Removing that tier does two things. First, it reduces the perception gap between what users have and what Microsoft says they should have. Second, it broadens the addressable upgrade market: a user sitting on 8 GB who felt their machine was already “behind” the recommended tier may now feel confident enough to upgrade to Windows 11 rather than dismissing it as not worth the effort on their current hardware.

There is also the question of Copilot and AI features. Microsoft has been careful not to attach heavy RAM requirements to its AI-powered features — doing so would immediately exclude a large chunk of the Windows install base. Removing a high-tier recommendation keeps the messaging inclusive.

Windows 11 Memory: Is Your Current PC Still Supported?

If you are running a modern machine — say, an 8th-generation Intel Core processor or newer, or a 2nd-generation AMD Ryzen or newer — and you have at least 4 GB of RAM with TPM 2.0 enabled, your PC is still fully supported. The removal of the 32 GB recommendation does not affect eligibility or support status in any way.

The real concern for many users is not RAM but the CPU compatibility wall. Windows 11 enforces strict processor requirements, locking out a large number of otherwise capable machines. If you are unsure whether your system qualifies, our detailed guide Do You Meet Windows 11 System Requirements? Check Before You Upgrade walks through every hardware check step by step.

How Much RAM Should You Actually Target in 2026?

Windows 11 licence upgrade options showing RAM requirements for a compatible PC

Independent testing and community consensus consistently point to 16 GB as the sensible practical target for a Windows 11 machine used for anything beyond light tasks. Here is why:

  • Modern browsers are memory-hungry: Chrome or Edge with 10–15 tabs can comfortably consume 3–5 GB on their own.
  • Windows 11’s memory compression and SuperFetch work best when there is enough headroom to cache data intelligently.
  • AI features in Copilot and other tools benefit from available RAM, even if they don’t formally require it.
  • 16 GB provides a buffer against background processes, security software, and system updates that temporarily spike memory use.

For anyone who does creative work, game, or run developer tooling, 32 GB remains a worthwhile investment — Microsoft removing the recommendation does not mean 32 GB is no longer useful, only that it was never a universal requirement.

What This Means If You Are Buying or Upgrading Windows 11

The practical upshot of Microsoft’s documentation change is freeing: if you have been delaying a Windows 11 upgrade because you felt your 8 GB or 16 GB machine was underspecced, you have no reason to wait any longer on memory grounds alone. The operating system will run, and run well, on hardware with RAM for Windows 11 well below the old 32 GB aspirational figure.

If you are ready to upgrade, Buy Now Key offers Windows 11 licences starting from just €9.65 for Windows 11 Home OEM and from €12.90 for Windows 11 Pro OEM — both delivering genuine, lifetime-activated licences at a fraction of retail cost. You can check the full range of editions and bundles in our Windows 11 Pro category.

Already have a compatible machine and want to understand more about what Windows 11 actually uses during daily operation? Our in-depth look at Windows 11 RAM requirements: Is 8 GB really enough in 2026? covers real-world usage figures in detail.

Windows 11 RAM Specs: The Bottom Line

Microsoft removing its 32 GB guidance is a pragmatic move, not a technical one. The Windows 11 RAM specs that matter for compatibility — the 4 GB minimum — have not changed one bit. What has changed is that Microsoft is no longer setting an aspirational bar so high that ordinary users feel their machines are inadequate. For most people, 8 GB gets you through the door comfortably; 16 GB keeps you comfortable for years. And if you need 32 GB for your workload, nothing in this change stops you from installing it — it just means Microsoft will no longer make you feel obligated to.

Frequently Asked Questions

Has Microsoft changed the minimum RAM for Windows 11?

No. The official minimum Windows 11 RAM requirements remain at 4 GB, exactly as they were at launch in October 2021. What Microsoft removed was its separate, non-mandatory tiered recommendation table that suggested 32 GB as the “no worries” level. Your minimum compatibility threshold is unchanged.

Is 8 GB of RAM enough for Windows 11 in 2026?

Yes, for the majority of everyday tasks. Windows 11 runs on 4 GB and works comfortably on 8 GB for typical home and office workloads including web browsing, Microsoft 365, video calls, and media playback. Microsoft has explicitly stated that 8 GB should be sufficient for most Windows 11 users. For heavy multitasking or creative work, 16 GB is a better long-term investment.

Why did Microsoft remove the 32 GB RAM recommendation?

Microsoft removed the tiered 32 GB recommendation largely in response to user pushback during a period of elevated DRAM prices, when asking consumers to target 32 GB felt unreasonable. The move also aligns with Microsoft’s messaging around AI and Copilot features, which the company has been careful not to tie to demanding hardware specifications so as not to exclude its broad user base.

Does less RAM mean my PC will lose Windows 11 support?

Not at all. Support eligibility is determined by the minimum system requirements — 4 GB RAM, a compatible CPU, TPM 2.0, and Secure Boot. The removed 32 GB recommendation was never part of the support criteria. If your PC passed the Windows 11 upgrade check before this documentation change, it still passes today.

What is the best amount of RAM for Windows 11 right now?

For light use, 8 GB is the practical minimum most users should aim for. For general everyday computing, 16 GB delivers noticeable headroom and future-proofs your system against increasingly memory-hungry applications and browser updates. Power users, gamers, and creative professionals who work with large files or run virtual machines will still benefit from 32 GB or more — the recommendation may be gone, but the performance advantage is real.

Hotel WiFi Windows security warning alert on laptop screen
August 5, 2026

Hotel WiFi Windows Security: How to Stay Safe from Hackers

Post By administrator Microsoft, Windows , , , , , , No Comments

Hotel WiFi Windows security has never mattered more: Microsoft has officially linked a global wave of attacks — codenamed CaptiveCrunch — to Midnight Blizzard, a Russian state-sponsored threat group, that is hijacking hotel networks to steal Microsoft 365 logins and deploy custom malware on Windows PCs. If you travel with a laptop, this is a threat you need to understand today.

What Is the CaptiveCrunch Attack and Who Is Behind It?

Diagram showing hotel WiFi hackers hijacking Windows credentials via fake portal

CaptiveCrunch is a credential-theft and malware-delivery campaign attributed by Microsoft to Midnight Blizzard (also tracked as APT29 or Cozy Bear). Microsoft’s own security blog confirmed the campaign in July 2026, warning that attackers have compromised hotel WiFi infrastructure worldwide — targeting business travellers, government officials, and corporate guests staying in hospitality venues across multiple countries.

The group is not opportunistic. Midnight Blizzard is a sophisticated, state-backed unit with a long history of high-profile intrusions, and CaptiveCrunch represents one of its most operationally complex consumer-facing campaigns to date.

How Hotel WiFi Hackers Hijack Your Connection

The attack exploits the one moment every hotel guest accepts without thinking: the captive portal login page you see when you first connect to hotel WiFi. Here is the step-by-step flow attackers use:

  • DNS hijacking at the router level: Attackers compromise the hotel’s network equipment and redirect DNS queries, so that when your Windows PC requests any website, the router can intercept and reroute the traffic.
  • Fake Microsoft 365 sign-in page: The captive portal is replaced — or supplemented — with a convincing phishing page that mimics a legitimate Microsoft login screen. Credentials you type go straight to the attacker.
  • Fake Windows or browser update prompts: A second attack path presents a fraudulent software update notification. Accepting the update installs a custom malware payload directly onto your Windows machine.
  • Session-token theft to bypass MFA: Critically, the campaign is engineered to defeat standard multi-factor authentication. Rather than stealing passwords alone, the malware captures live authentication session tokens — meaning even an MFA-protected account can be taken over without the attacker ever knowing your password.

Once the malware lands on your device, its capabilities are alarming: keylogging, screenshot capture, microphone and webcam access, browser credential harvesting, and a remote shell that gives attackers ongoing access to your machine long after you check out of the hotel.

Warning Signs Your Windows PC May Be Compromised on Hotel WiFi

Windows travel security settings open on laptop in hotel room

Spotting WiFi credential theft in progress is difficult — that is by design. But there are red flags to watch for as soon as you connect to any hotel network:

  • A Microsoft 365 or Outlook login page appearing inside the hotel captive portal itself (legitimate portals ask for a room number or voucher code, not a Microsoft password).
  • A Windows Update or browser update prompt appearing immediately after connecting — updates should never initiate from a captive portal environment.
  • SSL certificate warnings or browser security alerts on pages you trust.
  • Unusually slow DNS resolution or pages loading from unexpected IP addresses (visible in your browser’s developer tools).
  • Your Microsoft 365 account showing sign-in activity from an unrecognised location shortly after your stay.

If any of these occur, disconnect immediately, change your Microsoft account password from a trusted network, and revoke all active sessions from the Microsoft account security dashboard.

Windows Travel Security: Immediate Steps Before You Connect

The most effective defence against hotel WiFi hackers is a layered approach — applied before you ever open your laptop in a hotel room. Here is what to do:

1. Use a Trusted VPN — Always

A reputable VPN encrypts your traffic before it leaves your device, making DNS hijacking and man-in-the-middle interception significantly harder. Enable your VPN before the captive portal login if your provider supports it, or connect the moment the portal grants access. Corporate VPNs provided by employers are preferred; if you travel privately, choose a provider with a verified no-logs policy and strong encryption standards.

2. Switch to FIDO2 / Passkey Authentication

Because CaptiveCrunch is specifically engineered to steal session tokens and bypass traditional MFA, the most resilient defence is moving away from password-plus-code authentication entirely. FIDO2 hardware security keys (such as a YubiKey) and Windows Hello passkeys bind authentication to your physical device, making stolen tokens useless to an attacker operating remotely. Microsoft supports passkeys natively across Microsoft 365 — enable them in your account security settings before your next trip.

3. Treat Every Hotel Network as Hostile

Windows 11 Pro includes a built-in network profile setting: when you join a new network, set it to Public, not Private. This disables network discovery and file sharing automatically. Additionally, ensure Windows Defender Firewall is active and your Windows Defender antivirus definitions are fully up to date before departure — not via a hotel network prompt.

4. Patch Windows Before You Travel, Not After

Run Windows Update at home on a trusted connection before every trip. Attackers leverage unpatched vulnerabilities; a fully updated Windows 11 system closes many of the lateral-movement vectors that CaptiveCrunch-style malware exploits once it lands on a device.

5. Enable BitLocker Drive Encryption

If your device is physically stolen during a trip — or seized at a border — BitLocker encryption ensures that your stored credentials, files, and cached Microsoft 365 tokens are unreadable without your recovery key. BitLocker is available on Windows 11 Pro. Our in-depth guide to the BitLocker bypass exploit and how to protect your Windows 11 device explains exactly which settings to harden.

Why Windows 11 Pro Is the Right OS for Travellers Concerned About Hotel WiFi Security

Windows 11 Pro security features protecting hotel WiFi Windows security

Not all Windows editions are equal when it comes to Windows travel security. Windows 11 Pro includes several enterprise-grade protections that Home edition lacks:

  • BitLocker full-disk encryption — critical if a device is lost or stolen.
  • Windows Defender Credential Guard — isolates authentication secrets in a virtualisation-based security container, limiting what malware can harvest from memory.
  • Remote Device Management (MDM/Intune) — allows IT teams to remotely wipe or lock a compromised device.
  • Advanced Audit Policies — detailed sign-in and access logs that help security teams detect compromise quickly.

If you are still running Windows 11 Home on a work machine used for travel, upgrading to Microsoft Windows 11 Pro gives you access to every one of these protections. At BuyNowKey, a genuine retail licence starts from just €17.90 — a small price against the cost of a credential breach.

Protecting Your Microsoft 365 Account on Hotel Networks

Your Microsoft 365 account is the primary target of hotel WiFi hackers. Beyond passkeys, take these account-level steps:

  • Review sign-in activity regularly: Visit account.microsoft.com/security and check recent sign-ins. Unrecognised locations or devices should trigger an immediate password reset.
  • Revoke all active sessions: After any trip where you connected to an untrusted network, sign out of all devices from the Microsoft account portal.
  • Enable login notifications: Microsoft can alert you by email or the Authenticator app whenever a new device signs into your account.
  • Use a dedicated travel account: Where possible, log into a limited Microsoft account with no admin privileges or sensitive SharePoint/OneDrive access when using hotel WiFi.

It is also worth auditing which apps have delegated access to your Microsoft 365 data — attackers who gain a valid session token can grant themselves persistent OAuth application access that survives a password reset.

What to Do If You Think You Were Already Targeted

If you connected to hotel WiFi recently and now suspect you may have been exposed to hotel WiFi hackers, act fast. The window between initial compromise and data exfiltration is often short.

  1. Disconnect from all networks immediately.
  2. Change your Microsoft 365 password from a trusted device on a trusted network.
  3. Revoke all active sessions and OAuth app permissions from the Microsoft account security portal.
  4. Run a full Windows Defender scan — or a second-opinion scan with Microsoft Safety Scanner.
  5. Notify your IT or security team if you are using a corporate device, as lateral movement to company infrastructure is a documented risk in CaptiveCrunch-style campaigns.
  6. Check your PC for unfamiliar scheduled tasks, startup entries, or newly installed software — signs of a persistent malware foothold. Our article on how to spot fake Windows apps and malware download sites covers key indicators to look for.

Frequently Asked Questions

Can hotel WiFi hackers steal my credentials even if I use MFA?

Yes. The CaptiveCrunch campaign specifically targets session tokens — the authentication cookies your browser stores after a successful sign-in — rather than just passwords. This allows attackers to bypass standard multi-factor authentication entirely. The best defence is switching to FIDO2 passkeys or hardware security keys, which bind the authentication proof to your physical device and cannot be replicated remotely.

Is a VPN enough to stay safe on hotel WiFi?

A VPN significantly raises the bar — it encrypts your traffic and defeats most DNS hijacking attacks. However, it is not a silver bullet. If you accept a fake update prompt from within the captive portal before your VPN connects, malware can still be installed. Layer a VPN with up-to-date Windows Defender, passkey authentication, and network awareness for the strongest protection.

Which Windows version offers the best protection for travellers?

Windows 11 Pro is the recommended choice for travellers who need strong Windows travel security. It includes BitLocker disk encryption, Credential Guard, and full MDM support — features absent from Windows 11 Home. Credential Guard in particular prevents malware from extracting cached authentication tokens from system memory, directly countering the CaptiveCrunch technique.

How do I know if my Microsoft 365 account was compromised via hotel WiFi?

Check your recent sign-in history at account.microsoft.com/security. Look for sign-ins from unfamiliar countries, IP addresses, or devices. Also review the list of apps with delegated access to your account — a compromised session can be used to grant a malicious third-party app persistent access that survives a password change. If anything looks suspicious, revoke all sessions and change your password immediately.

Do these hotel WiFi attacks only affect Windows PCs?

The CaptiveCrunch campaign as documented by Microsoft is primarily focused on Windows credential theft, using Windows-specific malware payloads. However, the phishing pages targeting Microsoft 365 logins are browser-based and will work regardless of operating system. Mac and mobile users should also avoid entering Microsoft credentials on hotel captive portals and should use a VPN on all devices.

Windows 11 desktop showing unexpected OneDrive Photos auto-install notification
August 2, 2026

OneDrive Photos Auto-Install on Windows 11: What to Do

Post By administrator Microsoft, Windows , , , , , , No Comments

OneDrive Photos auto-install on Windows 11 caught millions of users off guard in late July 2026 — the app simply appeared without any prompt, consent screen, or opt-in. If you have noticed a new image viewer in your Start menu or taskbar that you never downloaded, you are not alone, and you are not imagining things. This guide explains what OneDrive Photos actually is, why Microsoft is shipping it this way, and exactly what you can do about it.

What Is OneDrive Photos?

OneDrive Photos app gallery interface showing face grouping on Windows 11

OneDrive Photos is a standalone image-viewing and organisation app that Microsoft has bundled into the OneDrive sync client. It presents your cloud-stored images in a gallery layout and offers face-grouping powered by facial recognition — meaning it can scan your uploaded photos, detect faces, and cluster pictures of the same person together.

According to Microsoft’s own OneDrive support documentation, the People grouping feature is optional and can be turned off at any time through the app’s Privacy and Permissions settings, at which point all stored facial-grouping data is deleted. However, the app itself arrives without that conversation ever taking place — the installation is silent.

How the OneDrive Photos Silent App Install Happens

The silent app install happens because OneDrive Photos is not an independent application distributed through the Microsoft Store. It is a component bundled directly inside the OneDrive sync client, which Windows 11 ships with by default. When the OneDrive client updates — which it does automatically in the background — it can silently deploy OneDrive Photos as part of that update payload.

This means the app can appear on virtually any Windows 11 PC that has OneDrive installed, including systems running Windows Server 2025. Users who had never opened OneDrive or actively chosen to use it found the icon appearing on their desktop or pinned to the taskbar with no warning.

  • Trigger: An automatic background update to the OneDrive sync client
  • Scope: Any Windows 11 device with OneDrive installed — home, Pro, and enterprise
  • Consent: None requested before installation
  • Microsoft Store: Not distributed there; cannot be removed via the Store

Why Is Microsoft Doing This?

Windows 11 Settings installed apps screen for removing OneDrive Photos auto-install

Microsoft’s strategy here is consistent with a broader pattern: tightening the link between Windows 11 and its cloud services ecosystem. OneDrive already backs up Desktop, Documents, and Pictures folders for many users; OneDrive Photos extends that relationship by adding a dedicated viewing surface for that content.

From a business perspective, increased engagement with OneDrive Photos means more users encounter prompts to upgrade from the 5 GB free tier to a Microsoft 365 subscription. The facial-recognition feature in particular offers genuine utility — organising thousands of holiday snaps by person is useful — but that utility does not justify installing software that processes biometric data without first asking permission.

The timing also fits a competitive pattern: Google Photos has long dominated the cloud photo-management space, and Apple iCloud Photos is deeply embedded in the Apple ecosystem. Microsoft is attempting to close that gap on Windows 11, the operating system it controls entirely.

How to Detect OneDrive Photos on Your System

Checking whether OneDrive Photos has already landed on your PC takes less than a minute. Follow these steps:

  1. Press Windows + I to open Settings.
  2. Go to Apps → Installed apps.
  3. Search for OneDrive in the search bar.
  4. If you see a separate OneDrive Photos entry — or if the main OneDrive entry has expanded — the app is present.
  5. Alternatively, open File Explorer and look for a Photos section in the left navigation pane linked to OneDrive.

You can also check Settings → Personalisation → Taskbar to see whether an OneDrive Photos icon has been pinned without your knowledge.

Remove OneDrive Photos: Your Options

Privacy shield blocking silent OneDrive Photos facial recognition on Windows 11

Because OneDrive Photos is bundled inside the OneDrive client rather than shipped as a standalone package, your removal options are limited but workable.

Option 1 — Uninstall OneDrive Entirely

The most complete fix is to remove the whole OneDrive sync client. Go to Settings → Apps → Installed apps, find Microsoft OneDrive, click the three-dot menu, and select Uninstall. Confirm the prompt and restart. This removes the sync client, the Photos component, and any auto-update mechanism that could reinstall them. Be aware that your OneDrive cloud files remain safe — uninstalling the client does not delete anything from the cloud.

Option 2 — Keep OneDrive, Disable the Photos Component

If you rely on OneDrive for file sync but do not want the Photos app front-end, open OneDrive Photos, navigate to Settings → Privacy and Permissions, and toggle off the People grouping feature. This disables facial recognition and deletes any stored grouping data. You can also change your default image viewer back to the Microsoft Photos app (or any other viewer) via Settings → Apps → Default apps.

Option 3 — Block Auto-Install via Group Policy (IT Admins)

On Windows 11 Pro, Enterprise, or Education, IT administrators can use Group Policy to prevent the OneDrive client from installing additional components. The relevant policy is found under Computer Configuration → Administrative Templates → Windows Components → OneDrive. Preventing OneDrive from running as part of Windows setup also blocks future silent deployments of bundled apps.

The Facial Recognition Privacy Question

The detail that has generated the most concern around this OneDrive Photos silent app install is the biometric angle. Facial recognition data is classified as sensitive biometric information under the UK GDPR and the EU AI Act. Installing an app that offers face-scanning — even as an opt-in — without disclosing that installation to the user raises questions about informed consent.

Microsoft’s position is that the face-grouping feature is strictly opt-in within the app, and that all processing is tied to the user’s Microsoft account data rather than stored locally in a way accessible to third parties. That may be technically accurate, but the fact that the app arrives uninvited means users who are unaware of its presence may inadvertently grant camera or photo permissions while troubleshooting something else entirely.

The safest approach: if you did not ask for OneDrive Photos, do not give it any permissions until you have decided whether you actually want it. Treat it like any other unfamiliar app that appeared on your device.

What This Means for Your Windows 11 Licence

None of this affects your Windows 11 activation or licence validity. If you purchased Windows 11 Home or Windows 11 Pro — whether retail or OEM — your licence remains fully valid regardless of how many optional Microsoft apps are bundled alongside it. The OneDrive Photos situation is a software policy decision, not a licensing issue.

That said, if silent installs like this make you reconsider your Windows setup or prompt you to do a clean reinstall, you can find genuine Windows 11 Pro licences at Buy Now Key from €17.90 — giving you a clean, verified activation without paying the full retail price.

If you are on Windows 11 Home and the expanded app ecosystem is becoming frustrating, it may be worth considering an upgrade path. Our Windows 11 KB5089549 update coverage also explains other recent changes Microsoft has pushed in the background, so you can stay informed about what your OS is actually doing.

Frequently Asked Questions

Is OneDrive Photos the same as the Microsoft Photos app?

No. Microsoft Photos (also called the Photos app) has been the default image viewer in Windows 10 and 11 for years. OneDrive Photos is a separate, newer component bundled inside the OneDrive sync client. Both can coexist on the same PC, and Windows 11 may now have three image-viewing options installed: Photos, OneDrive Photos, and any third-party viewer you added yourself.

Does OneDrive Photos automatically scan my face without permission?

No — facial recognition requires an explicit opt-in inside the app’s Privacy and Permissions settings. However, the app is installed without consent, so you may not realise it is present until it requests access to something. The safest step is to deny all permissions until you have reviewed the settings and decided whether you want the feature.

Will uninstalling OneDrive delete my cloud files?

No. Removing the OneDrive sync client from your PC does not delete anything stored in your Microsoft cloud account. Your files, photos, and shared documents remain in OneDrive and can be accessed via a web browser at onedrive.live.com. Uninstalling only removes the local sync agent and bundled apps like OneDrive Photos.

Can this happen on Windows 10 as well?

Yes. Reports confirm that OneDrive Photos has also appeared on machines running Windows 10 and even Windows Server 2025 that have the OneDrive sync client installed. The deployment is tied to the OneDrive client update mechanism, not to the Windows version itself.

How do I stop Microsoft from silently installing apps in future?

There is no single toggle that blocks all Microsoft-bundled app deployments, but several steps help: disable automatic OneDrive updates via Group Policy (Pro/Enterprise), periodically audit your installed apps list, and use a local account rather than a Microsoft account, which reduces the number of cloud-tied services that activate automatically. Regularly reviewing Settings → Apps → Installed apps is the quickest manual check.

Windows 11 memory usage RAM meter showing high consumption before fix
August 1, 2026

Windows 11 Memory Usage: Which Apps Hog RAM and What’s Being Fixed

Post By administrator Microsoft, Windows , , , , , , No Comments

Windows 11 memory usage is a bigger problem than most users realise — and now Microsoft has said so publicly. The company has acknowledged that its own built-in applications consume far more RAM than they should, directly hurting system responsiveness even on machines with 16 GB of memory or more. A fix centred on the WinUI 3 framework is in progress, but the details matter. Here is a clear breakdown of what is happening, which apps are the worst offenders, and what the incoming patch can realistically be expected to deliver.

Why Microsoft’s Admission on Windows 11 RAM Usage Is a Big Deal

WinUI 3 framework causing high Windows 11 app RAM overhead illustration

It is rare for Microsoft to publicly concede that a core aspect of its operating system is poorly optimised. Yet that is precisely what happened in mid-2026, when the company confirmed it has been working on changes to WinUI — the UI framework that powers most modern built-in Windows 11 applications — specifically to reduce its memory footprint. According to Windows Latest’s reporting, Microsoft stressed that the memory improvements must land before it proceeds with a broader UI rewrite — including a planned Start Menu overhaul. In other words, the RAM problem is now a blocking issue for future Windows 11 development, not a side project.

That context elevates this beyond a routine performance complaint. When Microsoft puts memory optimisation on the critical path for its flagship OS roadmap, it signals that the situation is serious enough to delay other work. For everyday users experiencing sluggishness on otherwise capable hardware, that validation is long overdue.

Which Built-In Apps Drive the Worst Windows 11 RAM Consumption

The culprits are the modern, WinUI-based inbox applications that ship with every copy of Windows 11. These apps were rebuilt using Microsoft’s newer UI toolkit, which — while visually polished — carries a heavyweight rendering engine that loads significant resources even when an app is merely sitting in the background.

  • Microsoft Teams (personal/chat widget): The integrated Teams experience that auto-starts with Windows 11 has been one of the most consistently cited memory offenders, routinely consuming several hundred megabytes at idle.

  • Widgets panel: The Widgets service runs persistent background processes that fetch news, weather, and finance data continuously, adding to overall Windows 11 RAM usage even when the panel is closed.

  • Microsoft Photos: Rebuilt on WinUI 3, Photos loads a heavier runtime than its Windows 10 predecessor despite offering a largely similar feature set to most users.

  • Settings app: The relaunched Settings application — a WinUI shell — keeps portions of itself resident in memory after you close it, a behaviour tied directly to the framework’s initialisation overhead.

  • Cortana / Search indexer: Although Cortana’s profile has shrunk, background search indexing and the Search highlights feature maintain a persistent RAM presence that can spike under load.

  • Xbox app and Game Bar: Game-related services auto-launch on non-gaming machines and contribute to idle memory pressure, particularly on systems with 8 GB of RAM.

The common thread across all these apps is WinUI 3 itself. The framework initialises a rendering stack — DirectComposition, XAML islands, and associated services — regardless of how lightweight the app’s actual workload is. That overhead is the root problem Microsoft has now committed to addressing.

What the WinUI 3 Performance Fix Actually Promises

Four steps to reduce Windows 11 RAM usage and improve system performance

Microsoft’s stated approach is to reduce the per-process memory cost of the WinUI 3 runtime. The key changes being worked on include deferred initialisation (loading rendering components only when an app is actually brought into view rather than at process start), better resource sharing between WinUI processes, and tighter controls over background service lifetimes for inbox apps.

According to PCWorld’s coverage of the story, Microsoft plans a WinUI 3 overhaul specifically before it begins rebuilding major UI surfaces such as the Start Menu. That sequencing is deliberate: a Start Menu written in the current WinUI 3 framework would be catastrophically expensive in RAM terms, so the framework must be leaner first.

What this means practically for users:

  • Idle RAM consumption from built-in apps should fall noticeably once the updated WinUI runtime rolls out through Windows Update.

  • App launch times may improve because less of the rendering stack will be pre-loaded at startup.

  • Systems with 8 GB of RAM — the official minimum for Windows 11 — should see the biggest gains, since they are most constrained by the current overhead.

  • The fix is framework-level, meaning it will benefit all WinUI apps simultaneously rather than requiring individual updates to each application.

However, it is worth tempering expectations. A framework-level memory improvement rarely produces overnight miracles. The optimisations will roll out incrementally, and some apps may require their own updates to take full advantage of the leaner runtime.

How to Reduce Windows 11 RAM Usage Right Now

You do not have to wait for Microsoft’s patch to reclaim memory. Several practical steps can meaningfully reduce Windows 11 memory usage today.

Disable Auto-Starting Apps

Open Task Manager (Ctrl + Shift + Esc), navigate to the Startup apps tab, and disable anything you do not need at boot. Teams personal, Xbox app, and the Widgets service are safe to disable for most users and deliver immediate relief.

Turn Off the Widgets Panel

Right-click the taskbar, select Taskbar settings, and toggle Widgets off. This kills the background data-fetching service and typically frees 150–300 MB of RAM, depending on your system.

Adjust Virtual Memory Settings

If you are on 8 GB of RAM, ensure Windows 11 is managing your page file automatically. Go to System > Advanced system settings > Performance > Advanced > Virtual memory and select “Automatically manage paging file size for all drives.” This gives the OS more headroom when physical RAM is tight.

Uninstall Unused Inbox Apps

Windows 11 allows you to uninstall most built-in apps via Settings > Apps. Removing applications you genuinely never use — such as the Maps app, Solitaire Collection, or the Xbox app on non-gaming machines — eliminates their background processes entirely, which is more effective than simply closing them.

Keep Windows 11 Fully Updated

Microsoft is already shipping incremental memory improvements ahead of the full WinUI overhaul. Staying current via Windows Update ensures you receive these as they land. The May 2026 cumulative update (KB5089549) included memory management refinements as part of its broader patch package — staying up to date is the easiest optimisation of all.

Does Windows 11 Memory Usage Affect Whether You Should Upgrade?

Windows 11 memory fix comparison showing RAM usage before and after patch

If you are still on Windows 10 and weighing an upgrade, this issue deserves honest consideration. Windows 11 does carry a meaningfully higher idle RAM baseline than Windows 10, largely because of the WinUI-based app ecosystem. On machines with 16 GB or more, the difference is rarely felt in practice. On 8 GB systems, particularly those used for productivity tasks that also have a browser open, the overhead can translate into real sluggishness.

That said, Windows 10 reaches end of life in October 2025, meaning it will no longer receive security patches — a far more significant risk than slightly elevated RAM usage. The correct response is not to avoid Windows 11 but to ensure your hardware is genuinely ready for it, and to apply the practical optimisations above while Microsoft’s framework fix matures.

If you need a clean, fully activated copy of Windows 11 at a fair price, Buy Now Key offers Microsoft Windows 11 Pro – Retail with lifetime activation from €17.90, or the more affordable Microsoft Windows 11 Home – OEM from €9.65 — both delivering instant digital delivery and full activation support.

What to Watch For in Upcoming Windows 11 Memory Fix Updates

Microsoft has not published a single release date for the WinUI 3 memory improvements — the changes are being rolled out progressively through Windows Update and preview builds in the Windows Insider Programme. Users who want to track progress should watch for Insider builds that mention “WinUI performance,” “memory management,” or “reduced app resource usage” in their changelogs. The full Start Menu rebuild — which follows the memory work — will itself serve as a signal that the framework optimisation phase is substantially complete.

In the meantime, the Windows 11 KB5089549 update breakdown on this blog covers what Microsoft has already shipped in recent cumulative updates, giving you a clear picture of how performance work is progressing right now.

Frequently Asked Questions

Why does Windows 11 use so much RAM compared to Windows 10?

Windows 11 rebuilt many of its core inbox applications using the WinUI 3 framework, which carries a heavier rendering stack than the older Win32 apps it replaced. This framework loads DirectComposition and XAML services even for relatively lightweight applications, driving up baseline Windows 11 RAM usage. Microsoft has acknowledged this overhead and is actively working to reduce the WinUI 3 per-process memory cost.

Which Windows 11 apps use the most memory?

The biggest consumers of Windows 11 RAM at idle are typically Teams (personal integration), the Widgets panel, Microsoft Photos, and the Settings application — all of which are built on WinUI 3. Background services tied to the Xbox app and Cortana also contribute. Disabling auto-start for these apps is the fastest way to cut idle RAM consumption.

Will Microsoft’s WinUI 3 fix automatically apply to my PC?

Yes. Because the fix targets the WinUI 3 runtime itself rather than individual applications, it will be delivered as part of cumulative Windows Updates. You do not need to reinstall Windows or sideload anything — keeping Windows Update enabled is sufficient. Some benefits may also arrive through Microsoft Store updates to individual inbox apps.

Is 8 GB of RAM still enough for Windows 11?

8 GB meets the official Windows 11 system requirements and works adequately for light use. However, with current WinUI overhead, multitasking on an 8 GB system — especially alongside a browser with multiple tabs open — can feel constrained. Microsoft’s memory fix should meaningfully improve the experience, but 16 GB remains the practical sweet spot for comfortable day-to-day use in 2026.

Can I disable built-in Windows 11 apps to save RAM?

Yes, most inbox apps that you do not use can be uninstalled via Settings > Apps, or disabled from auto-starting via Task Manager’s Startup apps tab. Removing unused WinUI apps eliminates their background processes entirely, which is more effective than simply closing them. Apps like Maps, Solitaire, and the Xbox app are safe to remove on non-gaming machines.

Illustration of a Windows 11 2026 clean installation showing Microsoft Store app privacy data retained after formatting, with secure local storage, Microsoft cloud synchronization, and account data persistence represented by security, cloud, and storage icons.
July 31, 2026

Microsoft Store App Privacy: Why History Survives a Clean Install

Post By administrator Microsoft, Windows , , , , , , No Comments

Microsoft Store app privacy is more complicated than most users realise. Do a full clean install of Windows 10 — boot from USB, format the entire drive — sign back into your Microsoft account, and open the Store. Years of app installations are already listed, waiting for you (or anyone else using that machine). No local data survived the wipe, yet the history is all there. This article explains exactly why it happens, what data Microsoft stores in the cloud, and the concrete steps you can take to prevent it.

Why Your Store App History Survives a Full Format

Cloud storage keeping Microsoft Store app history separate from local device data

Your Microsoft Store app history is not stored on your local drive — it is stored against your Microsoft account in the cloud. When you sign in with a Microsoft account, the Store automatically pulls your full acquisition history from Microsoft’s servers, regardless of what happened to the device underneath it. The operating system version, whether you formatted once or five times, or whether you switched to a brand-new machine entirely — none of that matters. The history lives in your account, not on your SSD.

This is by design. Microsoft treats app purchases and free acquisitions like a library: once an app is tied to your account, you can re-download it on any compatible device at any time. A handy feature for software continuity — a significant privacy concern when you want a genuinely clean start.

What Exactly Is Recorded Under Your Account

The data that persists includes every app you have ever installed or purchased from the Microsoft Store, going back to whenever you first created your account. According to Microsoft’s own support documentation on order history, all purchases and free acquisitions are logged against your account billing record. This covers:

  • Free apps you downloaded (games, utilities, productivity tools)
  • Paid apps and any in-app purchases
  • Apps installed on previous devices you no longer own
  • Apps from accounts tied to old email addresses you’ve since linked
  • Apps installed by other users who signed in on the same machine

Because the Microsoft Store has been integrated into Windows since Windows 8 (launched in 2012), some accounts carry over a decade of installation history — easily hundreds of entries.

The Real-World Privacy Risk of Persistent Store App History

Microsoft Store app privacy dashboard showing stored app history and clear option

Windows app privacy matters most in scenarios people don’t always anticipate. Selling or donating a laptop is an obvious one: even after a clean reinstall, the next user can simply sign in to see what apps were associated with the machine’s previous owner if credentials are ever shared or guessed. More subtly, anyone who shares a Microsoft account — family members, a small business where staff use the same sign-in — can see a full log of what everyone has downloaded.

There is also the profiling angle. Your app installation history forms part of the behavioural data Microsoft holds on your account. The Microsoft Privacy Statement confirms that personal data associated with your account includes device and usage data as well as activity-related information — data that can inform advertising targeting and product recommendations across Microsoft’s ecosystem.

How to Check What Microsoft Store History Is Stored

Before clearing anything, it is worth seeing the full picture. Here is how to review your Microsoft Store history right now:

  1. Open the Microsoft Store and click your profile icon in the top-right corner.
  2. Select Library — this shows all apps ever associated with your account, not just the ones currently installed.
  3. For a broader view, visit account.microsoft.com/billing and navigate to Order history. This lists every Store transaction, including free acquisitions.
  4. For the full data picture, go to account.microsoft.com/privacy (Microsoft’s Privacy Dashboard) and review your app and service activity data.

Most users are surprised by the volume. Hundreds of app entries accumulated over years are common for anyone who has used Windows 10 or Windows 11 since launch.

Step-by-Step: How to Reduce Your Windows App Privacy Footprint

Windows app privacy settings screen disabling activity history sync in Windows 11

A clean install alone will not solve a Microsoft Store history problem. These are the steps that actually work.

1. Clear Data via the Microsoft Privacy Dashboard

Head to account.microsoft.com/privacy and sign in. Microsoft’s Privacy Dashboard lets you view and delete various categories of stored activity data. Look for app and service activity, and use the clear function to remove entries. Note that purchase records for paid apps cannot be deleted (they are required for licence verification), but activity data for free acquisitions can be reduced.

2. Sign in with a Local Account Instead of a Microsoft Account

This is the single most effective change you can make for Windows app privacy. When you use a local account, the Microsoft Store cannot link your app activity to a persistent cloud profile. To switch:

  • Go to Settings → Accounts → Your info and select Sign in with a local account instead.
  • Complete the wizard and restart.
  • You can still use the Store by signing in just for that session, without permanently tying history to a cloud account.

The trade-off is losing features like cross-device sync and OneDrive integration, so consider whether those are features you use.

3. Create a Fresh Microsoft Account for Clean Installs

If you want cloud features but not decades of history, creating a new Microsoft account on a new device or after a reinstall gives you a genuinely clean slate in the Store. Free — just a new email address. Useful when selling or donating a machine.

4. Disable Activity History in Windows Settings

In Windows 10 and Windows 11, navigate to Settings → Privacy → Activity history and toggle off Store my activity history on this device and Send my activity history to Microsoft. This does not delete past history but stops new activity from being recorded going forward.

5. Review App Permissions Before and After a Reinstall

Each time you do a fresh install, visit Settings → Privacy and audit which apps have access to your location, microphone, camera, and contacts. A reinstall resets some permission states, but linked cloud data means the apps themselves still know your history once you sign in.

Does This Affect Windows 11 as Well?

Yes — and arguably more so. Windows 11 pushes users more aggressively towards Microsoft accounts during setup, making it harder to opt for a local account during the out-of-box experience. The Microsoft Store is also more deeply integrated into Windows 11, meaning Microsoft Store history is more likely to be pulled automatically at sign-in. The same privacy steps above apply, but local account setup on Windows 11 requires an extra step: on the network screen during install, press Shift + F10 to open a command prompt and type OOBE\BYPASSNRO to enable the “I don’t have internet” option, which allows local account creation.

If you are considering upgrading or doing a fresh install of Windows 11, Buy Now Key stocks genuine Windows 11 Pro Retail licences — a clean, properly activated copy is the right foundation for managing your privacy settings from the start.

Should Microsoft Change How Store App History Works?

The Reddit thread that brought this issue to wider attention in 2025 sparked a clear consensus: users expect a full drive format to mean a fresh start. The fact that cloud-synced Store app history contradicts that expectation is a transparency problem, not just a technical quirk. Many commenters noted they had no idea the history was being stored at all, let alone that it would reappear automatically after a reinstall.

Microsoft does provide tools to manage this data — the Privacy Dashboard exists precisely for this purpose — but they are not surfaced during setup or during the clean-install process. A prompt at first sign-in saying “Your previous app history is available — would you like to restore it or start fresh?” would be a straightforward improvement. Until that happens, users have to take matters into their own hands using the steps above.

Windows 10 Users: Your Licence and Your Privacy

If you are running Windows 10 and have been putting off getting a legitimate licence before the end-of-support deadline, now is a sensible time to sort both your activation and your privacy settings. Buy Now Key offers Windows 10 Pro OEM licences from €8.90 — a straightforward way to get a properly activated system on which you can immediately apply the privacy controls described in this guide.

Frequently Asked Questions

Does formatting my hard drive delete my Microsoft Store app history?

No. Formatting your drive and reinstalling Windows removes all local data, but your Microsoft Store app history is stored against your Microsoft account in the cloud. The moment you sign back in with that account, the history reappears automatically. To remove it, you need to use Microsoft’s Privacy Dashboard at account.microsoft.com/privacy.

Can I use the Microsoft Store without a Microsoft account?

You can browse the Store without an account, but downloading most apps requires signing in. Using a local Windows account and signing into the Store only when needed — rather than keeping a permanent sign-in — is the best middle ground for reducing persistent history tracking.

How do I delete my Microsoft Store purchase history?

Free app acquisitions and activity data can be cleared via the Microsoft Privacy Dashboard (account.microsoft.com/privacy). Paid purchase records cannot be deleted, as Microsoft retains them for licence and billing purposes. You can review what is stored under the “App and service activity” section of the dashboard.

Does Windows 11 have the same Microsoft Store history problem?

Yes. Windows 11 is even more tightly integrated with Microsoft accounts than Windows 10, meaning Store app history syncs automatically at sign-in. The same steps apply: use a local account where possible, or regularly clear activity data via the Privacy Dashboard. Windows 11 also makes local account setup harder during installation, requiring an extra workaround during the out-of-box experience.

Will switching to a local account delete my existing Microsoft Store history?

No — switching to a local account on your device does not delete data already stored in the cloud against your Microsoft account. It simply prevents new activity from being automatically linked and displayed going forward. To delete the stored history itself, you need to log into account.microsoft.com/privacy and clear it there.

Fake Windows 11 apps download site displaying malware warning signs on laptop
July 30, 2026

Fake Windows 11 Apps: How to Spot Malware Download Sites

Post By administrator Microsoft, Windows , , , , , No Comments

Fake Windows 11 apps are one of the fastest-growing threats on the internet right now — and if you’ve ever Googled a utility like PowerToys or CrystalDiskMark, you may have already landed on one. Security researchers have identified more than 70 lookalike websites actively impersonating legitimate Windows app distributors, serving up trojanised installers packed with password-stealing malware, remote-access trojans, and spyware. This guide walks you through every red flag you need to recognise, and exactly what to do when something doesn’t look right.

Why Fake App Sites Are Booming in 2026

Comparison of legitimate versus fake Windows app download websites side by side

Cybercriminals have always followed traffic, and right now, Windows utility apps attract enormous search volumes. Tools such as PowerToys, Wintoys, WinUtil, and CrystalDiskMark are searched millions of times a month by users wanting to customise or maintain their PCs. Attackers clone the real sites pixel-for-pixel — same logos, same screenshots, same changelogs — then buy search ads or exploit SEO loopholes to push their clones above the genuine results. One click on the wrong “Download” button is all it takes.

According to a July 2026 investigation by Windows Latest, over 70 confirmed malware download sites were live and ranking in Google at the time of publication. The payload varied site to site: some dropped remote-access trojans (RATs) that hand full control of your machine to an attacker; others installed info-stealers that silently harvest saved passwords, credit-card numbers, and browser cookies within minutes of execution.

Red Flags That Identify Fake Windows Apps and Download Sites

Spotting malware download sites before you click is a learnable skill. The following warning signs appear on the vast majority of fraudulent pages — train yourself to check them every time you download software.

1. The Domain Name Is Slightly Off

Legitimate developers own one canonical domain. Fake app sites register look-alikes: an extra hyphen (power-toys-official.com), a swapped letter (crysta1diskmark.net), an unusual country-code TLD (powertoys.top), or an extra word like -download or -free appended to a real brand name. Always compare the URL character by character against the developer’s official page before you download anything.

2. The Download Button Doesn’t Match the Real File Size

Real installers for Windows utilities are usually between 5 MB and 200 MB depending on the application. If the file that starts downloading is only a few hundred kilobytes, it is almost certainly a dropper — a tiny loader whose sole job is to fetch and run the actual malware payload after it lands on your machine. Always cross-reference expected file sizes on the real developer’s GitHub or official page.

3. No HTTPS or an Untrusted Certificate

Every reputable software distributor uses HTTPS with a valid, trusted SSL certificate. Click the padlock icon in your browser’s address bar and inspect who issued the certificate. Fake app sites often use free, auto-issued certificates (perfectly valid technically, but trivially easy for anyone to obtain) under a domain name that does not match the software brand. A mismatch between the certificate’s registered domain and the brand name you’re expecting is a hard stop — leave the page immediately.

4. Aggressive Pop-Ups and Fake “Your PC Is at Risk” Alerts

Malware download sites frequently inject JavaScript pop-ups that mimic Windows Security notifications, claiming your PC is already infected and urging you to download a fix. Windows never displays security alerts inside a web browser. If a website pops up a dialogue that looks like a system notification, close the browser tab — do not interact with the dialogue, download anything, or call any phone number displayed.

5. Multiple Competing Download Buttons

A classic dark pattern on fake app sites is placing several large, bright “Download Now” buttons on a single page — only one of which (if any) leads to the real file. The others trigger malware downloads, adware installers, or redirects to phishing pages. Legitimate developer pages usually have one clear, unambiguous download link.

6. Missing or Unverifiable Publisher Information

Genuine Windows installers are code-signed. When you run a downloaded .exe or .msi file, Windows displays a User Account Control (UAC) prompt showing the publisher’s name. If the publisher is listed as “Unknown” or shows a name that doesn’t match the software brand, cancel the installation and delete the file immediately. Verified publishers appear in blue on the UAC prompt; unverified publishers appear with a yellow warning shield.

7. Poor Grammar, Mismatched Logos, or Copied Content

Site cloners work fast and often miss small details: broken image links, slightly faded logos, timestamps that haven’t updated since 2024, or boilerplate legal text copy-pasted from an unrelated product. Read the page critically. If the “About” section describes a completely different app, or if there are obvious grammar errors in what is supposed to be an English-language site operated by a well-funded developer team, treat that as a strong signal the page is fraudulent.

How Fake App Sites Game Google Search Results

Fake Windows apps flagged by Windows UAC unknown publisher warning prompt

Understanding why these pages appear at the top of search results helps you develop better habits. Attackers use three primary techniques:

  • Paid search ads: They buy Google Ads keywords on the exact brand names of popular utilities. These ads often appear above the organic results, and the display URL can be made to look legitimate while the destination is a clone site.
  • SEO poisoning: Fake sites build artificial backlink networks to rank organically for high-volume queries like “download PowerToys Windows 11” or “CrystalDiskMark free download”.
  • Typosquatting: They register dozens of slight misspellings of popular app names and let organic traffic trickle in from users who mistype the URL directly in the address bar.

The practical takeaway: do not trust search-result position alone. The first result — even a sponsored one — can be a malware download site. Always navigate to the developer’s official domain directly, or bookmark it after your first verified visit.

How to Verify a Windows App Download Is Genuine

Before running any downloaded installer, run through this quick verification checklist:

  1. Check the official source. GitHub repositories (look for the verified tick next to the developer’s organisation name), Microsoft’s own app pages, or the Microsoft Store are the safest places to download Windows utilities.
  2. Scan the file on VirusTotal. Go to virustotal.com and upload the installer before running it. VirusTotal scans the file against 70+ antivirus engines simultaneously and returns a verdict in seconds. Any detection should be treated as a serious warning.
  3. Check the SHA-256 hash. Many developers publish the cryptographic hash of their official installer on their download page or GitHub release. Download a tool like CertUtil (built into Windows) to compute the hash of your downloaded file and compare it character by character. A mismatch means the file has been altered.
  4. Review the UAC prompt. Before clicking “Yes” on the installation prompt, read the publisher name carefully. A verified publisher displayed in blue is a strong positive signal.
  5. Use Windows Defender or Microsoft Security Intelligence. Keep Windows Security updated and run a quick scan immediately after installing any new software.

Apps Most Commonly Impersonated by Malware Sites

The July 2026 campaign targeted a specific cluster of popular Windows utilities. If you have recently downloaded any of the following from a non-official source, run a full scan immediately:

  • Microsoft PowerToys
  • Wintoys
  • CrystalDiskMark
  • WinUtil (Chris Titus Tech’s Windows utility)
  • Rufus
  • Ventoy
  • CPU-Z and GPU-Z
  • HWiNFO
  • NirSoft utilities

These are all legitimate, well-respected tools — the risk comes entirely from downloading them through unofficial lookalike pages rather than from the developers themselves.

What to Do If You’ve Already Downloaded from a Fake App Site

Security checklist to protect against malware download sites on Windows 11

If you suspect you’ve already run a trojanised installer, act fast. Malware of this kind can exfiltrate saved credentials within minutes of execution.

  1. Disconnect from the internet immediately to cut off any active data-exfiltration or remote-access channel.
  2. Run a full offline scan using Windows Defender Offline (accessible through Windows Security → Virus & threat protection → Scan options).
  3. Change passwords for all important accounts from a different, clean device — email, banking, Microsoft account, social media — before reconnecting the infected machine.
  4. Enable multi-factor authentication (MFA) on every account that supports it, so stolen passwords alone cannot grant access.
  5. Consider a clean Windows reinstall. For sophisticated RATs and rootkits, a full OS reinstall from verified media is the only way to guarantee the machine is clean.

Why Your Windows License Source Matters Just as Much

The same vigilance that applies to third-party app downloads also applies to where you buy your Windows 11 licence. Fake app sites and rogue key sellers operate from the same playbook: clone a legitimate-looking storefront, take your money (and your payment details), and deliver either nothing at all or a blacklisted key that stops working within weeks.

Buying from a genuine Windows 11 Pro licence source that offers transparent activation guarantees and verifiable customer support removes that risk entirely. At Buy Now Key, every key is sourced from authorised distributors, backed by a money-back guarantee if activation fails, and delivered instantly to your inbox — no shady download portals required. You can also explore the full range of Windows 11 Pro editions to find the right licence for your setup.

According to the Windows Latest investigation into fake Windows app sites, popular utilities including PowerToys and CrystalDiskMark had more than 70 active clone sites as of late July 2026 — a number that is almost certainly growing. The campaigns are well-resourced and difficult for Google to purge in real time, which means user vigilance remains the most reliable defence.

Building Long-Term Habits Against Malware Download Sites

Individual awareness is the most durable protection against fake app sites. Search engines and browser vendors are continuously improving their detection, but attackers adapt faster than the filters. The habits below cost nothing and take seconds to build into your routine:

  • Bookmark verified sources the first time you visit a developer’s real page — never rely on search results again for that app.
  • Use the Microsoft Store where possible. It isn’t perfect, but apps distributed through it go through a vetting process that direct-download sites bypass entirely.
  • Keep Windows Update current. Many RAT payloads exploit known OS vulnerabilities that patches have already fixed. A fully updated Windows 11 machine is significantly harder to compromise.
  • Install a browser extension like uBlock Origin to block malicious ad networks — the same networks that serve search ads for fake app sites.
  • Treat urgency as a red flag. Any page that says you must download something “right now” to fix a critical problem is almost certainly lying. Legitimate software updates do not work this way.

FAQ

How can I tell if a Windows app download site is fake?

Check the domain name carefully for extra hyphens, swapped letters, or unusual TLDs. Verify the SSL certificate matches the brand, look for a single clear download button rather than multiple competing ones, and check that the downloaded file’s size matches what the official developer publishes. When in doubt, scan the file on VirusTotal before running it.

Which Windows apps are most commonly cloned by malware sites?

The July 2026 campaign targeted over 70 utilities, with PowerToys, Wintoys, CrystalDiskMark, WinUtil, Rufus, and CPU-Z among the most heavily impersonated. These are all legitimate, widely used tools — the risk is entirely in downloading them from unofficial sources rather than from the developers’ own pages or GitHub repositories.

What should I do if I accidentally ran a fake app installer?

Disconnect from the internet immediately to interrupt any active data exfiltration. Run a Windows Defender Offline scan, then change all important passwords from a separate clean device before reconnecting. Enable multi-factor authentication on every account that supports it. If you suspect a rootkit or RAT, a clean Windows reinstall from verified media is the safest resolution.

Does Windows Defender protect against fake app malware?

Windows Defender (Windows Security) catches a significant proportion of known malware, but attackers frequently repackage payloads to evade signature-based detection for a window of several days after deployment. Combining Defender with a pre-execution VirusTotal scan and verifying file hashes against the developer’s published values gives much stronger protection than any single tool alone.

Is it safer to buy Windows 11 from a key reseller than to download a cracked version?

Absolutely. Cracked Windows images are one of the oldest and most effective malware distribution vectors — the malicious code is embedded in the image itself, so no amount of post-install scanning will fully remove it. Purchasing a genuine licence from a reputable reseller gives you a clean, Microsoft-activated installation with none of that risk. Look for resellers that offer a money-back activation guarantee and have verifiable customer support.

TPM 2.0 chip powering Windows activation enforcement on a secure server
July 29, 2026

TPM Activation Enforcement in 2026: What Really Changes for Windows Users

Post By administrator Microsoft, Windows , , , , , No Comments

TPM activation enforcement is the buzzword dominating tech headlines in mid-2026 — and understandably so. Microsoft announced it will require TPM 2.0-backed hardware attestation for Key Management Service (KMS) hosts starting in August 2026. But here is the critical detail most coverage glosses over: this change targets enterprise KMS servers, not individual home users running a retail or OEM Windows licence. If you bought a genuine Windows key, your day-to-day experience changes very little. Read on for the full picture.

What Is TPM Activation Enforcement, Exactly?

Detailed diagram of a TPM 2.0 chip on a modern motherboard with labels showing hardware attestation flow to a KMS server, clean tech-infographic style, no dates visible

TPM activation enforcement refers to Microsoft’s new rule requiring that servers responsible for activating Windows across large networks — called KMS (Key Management Service) hosts — must possess a verified, uncompromised Trusted Platform Module 2.0 chip before they can issue activation tokens. According to Microsoft’s own Windows IT Pro Blog post on strengthening KMS with hardware-based trust, TPM attestation will become mandatory for KMS Hardware-Secured activation with the next Windows Server LTSC release, with readiness messages appearing from August 2026.

In plain terms: the KMS server must prove to Microsoft’s cloud infrastructure that its hardware hasn’t been tampered with. A fake or software-emulated TPM will no longer pass the check. This is a server-side enforcement mechanism, not a new gate installed on your personal PC.

How KMS Activation Works — and Where Piracy Entered the Picture

KMS activation is the method large organisations use to activate hundreds or thousands of Windows installations without entering individual product keys on every machine. An IT department sets up a KMS host server; client PCs on the network contact that server every 180 days to renew their activation status.

The piracy angle emerged because bad actors set up rogue KMS servers — software tools that mimic legitimate KMS hosts — allowing unregistered Windows copies to “phone home” to a fake server rather than Microsoft’s own infrastructure. These tools have circulated for years, and some estimates from security researchers put the number of enterprise environments unknowingly running pirated volume licences in the hundreds of thousands globally.

  • Legitimate KMS host: a Windows Server 2025 machine with a valid Volume Licence Agreement and a genuine TPM 2.0 chip, registered with Microsoft.

  • Rogue KMS emulator: software running on any machine, spoofing the KMS protocol to hand out fake activation tokens.

  • New enforcement: from August 2026, the KMS host must pass a TPM attestation check; a software emulator cannot provide a real TPM signature, so it fails.

The result is that KMS-based piracy in enterprise environments becomes significantly harder to sustain. Whether it eliminates the problem entirely remains to be seen — determined attackers often find workarounds — but the barrier to entry rises considerably.

Does TPM Activation Enforcement Affect Home Users?

Side-by-side comparison graphic showing enterprise KMS server environment versus a home user desktop setup, highlighting which is affected by TPM activation enforcement in 2026, flat vector illustration style

No — and this is where conflicting reports have created unnecessary panic. Windows activation for home users relies on a completely different path called online activation or phone activation, tied to a retail or OEM product key. Your PC contacts Microsoft’s activation servers directly over the internet; no KMS host is involved at any point. The August 2026 KMS TPM requirement simply does not touch this flow.

As TechSpot’s coverage of Microsoft’s TPM crackdown on Windows piracy makes clear, the enforcement specifically targets KMS hosts used in volume-licence environments. Home users, small business owners buying retail keys, and OEM device owners are unaffected.

What does apply to every consumer PC running Windows 11 is the pre-existing TPM 2.0 requirement introduced at launch in 2021. Windows 11 has always required a TPM 2.0 chip to install and activate — that’s not new, and it hasn’t changed. If your machine already runs Windows 11, it already has a functioning TPM 2.0.

Windows Activation Methods: Which One Do You Use?

Understanding your own Windows activation method removes any lingering uncertainty. There are three main types:

  1. Retail / Digital Licence: You purchased a product key directly, or Windows was pre-activated on a new device and tied to your Microsoft account. Activation is handled peer-to-peer with Microsoft’s servers. Unaffected by KMS enforcement.

  2. OEM: A key embedded in your PC’s firmware by the manufacturer at the factory. Permanent, device-locked, and completely independent of KMS infrastructure. Unaffected.

  3. Volume / KMS: Used by businesses and educational institutions with Microsoft Volume Licensing agreements. This is the method under scrutiny. From August 2026, the KMS host server must pass TPM 2.0 attestation.

If you’re a home user or a small business owner who purchased individual Windows keys, you fall into category one or two. The new KMS TPM 2.0 requirement is irrelevant to your setup. To double-check your current activation status on any Windows 11 machine, go to Settings → System → Activation. A status of “Windows is activated with a digital licence” or “Windows is activated” confirms you’re on a retail or OEM path.

What Changes for IT Admins and Enterprise Teams

Screenshot-style illustration of a Windows 11 Pro genuine activation confirmation screen on a modern laptop, showing a valid licence status indicator, no calendar dates visible

For IT professionals managing Windows environments at scale, the August 2026 timeline demands attention. Windows Server 2025 KMS hosts will begin displaying TPM readiness messages from that date, and when the next Windows Server LTSC release ships, TPM attestation transitions from optional to mandatory.

Practical steps for enterprise teams include:

  • Audit all KMS hosts for TPM 2.0 presence and firmware TPM health — use the tpm.msc console or PowerShell’s Get-Tpm command.

  • Ensure KMS hosts are running Windows Server 2025 with the latest cumulative updates applied.

  • Verify that Volume Licensing agreements are current and that KMS host keys are properly registered with Microsoft.

  • Replace or upgrade any server hardware that lacks a hardware-rooted TPM 2.0 chip.

  • Test KMS attestation readiness in a staging environment before the mandatory deadline.

Organisations that have inadvertently inherited rogue KMS infrastructure — sometimes brought in by a previous IT contractor — should treat this as an urgent remediation task. Failing the attestation check means client machines in the network will lose their KMS-granted activation on next renewal, which occurs every 180 days.

How to Get a Genuine Windows Licence the Right Way

Whether you’re a home user who wants peace of mind or a small business looking to bring devices into compliance, sourcing a legitimate Windows licence is the cleanest long-term solution. Genuine retail keys activate directly with Microsoft, are unaffected by any KMS enforcement changes, and remain valid for the lifetime of the device.

At Buy Now Key, you’ll find competitive pricing on genuine retail and OEM Windows licences. For example, a Microsoft Windows 11 Pro – Retail licence is available for just €17.90 — a fraction of the full Microsoft Store price — and activates directly with Microsoft’s servers in minutes. If you’re running Windows 10 and not yet ready to upgrade, a Microsoft Windows 10 Pro OEM key (€8.90) keeps you fully activated and secure until the October 2025 end-of-support date.

Choosing a legitimate licence means your activation is always tied to Microsoft’s own infrastructure — no KMS host, no attestation gamble, no surprise deactivation when enforcement tightens.

Will Microsoft Ever Extend TPM Enforcement to Consumer Activation?

It’s a fair question, and the honest answer is: not announced, but not impossible. The KMS TPM attestation rollout gives Microsoft a proven technical framework for hardware-rooted verification. Whether that framework eventually extends to retail activation channels is speculative at this stage. Microsoft has made no such announcement for consumer products.

What we do know is that TPM 2.0 is already required on every Windows 11 device, so the hardware foundation is in place across the modern PC ecosystem. If Microsoft ever chose to layer additional attestation onto the consumer activation flow, most Windows 11 machines would already comply. For Windows 10 users still on older hardware without TPM 2.0, that theoretical future scenario would be an additional incentive to upgrade.

For now, the practical implication is simple: own a genuine licence, keep your Windows updated, and you have nothing to worry about regardless of how Microsoft’s activation architecture evolves.

FAQ

Will TPM activation enforcement deactivate my current Windows installation?

Only if your Windows was activated through a rogue or unauthorised KMS server in an enterprise environment. If you’re a home user with a retail or OEM licence activated directly with Microsoft, nothing changes. Your activation is independent of the KMS infrastructure being targeted by the new TPM rules.

What is the difference between KMS activation and retail activation?

KMS activation is a volume-licencing method used by businesses and institutions. Client machines contact an internal KMS host server every 180 days to maintain activation. Retail and OEM activation ties a product key directly to your device and your Microsoft account via Microsoft’s global servers. The TPM 2.0 requirement applies only to KMS hosts — not to retail or OEM keys.

How do I check whether I have a genuine Windows licence right now?

Open Settings → System → Activation. If it reads “Windows is activated with a digital licence” or “Windows is activated” without a KMS-related note, you’re using a standard retail or OEM licence. You can also run slmgr /xpr in Command Prompt: a permanent-licence message confirms you’re not on a time-limited KMS renewal cycle.

Does TPM 2.0 requirement apply to Windows 10?

Windows 10 does not require TPM 2.0 to install or activate — that requirement was introduced with Windows 11 in October 2021. However, the new KMS TPM attestation rules apply to KMS hosts running Windows Server 2025, regardless of which Windows client version those hosts are activating. Windows 10 clients in a KMS environment are indirectly affected if their host server fails attestation.

When exactly does the mandatory KMS TPM enforcement begin?

Windows Server 2025 KMS hosts will start showing TPM readiness warning messages from August 2026. Full mandatory enforcement arrives with the next Windows Server LTSC release. Microsoft has signalled organisations should treat the August 2026 readiness phase as preparation time before enforcement becomes absolute.

Laptop keyboard with Copilot key disable toggle in Windows 11 Settings
July 28, 2026

How to Disable the Copilot Key on Windows 11

Post By administrator Microsoft, Windows , , , , , No Comments

You can now officially disable the Copilot key on Windows 11 — no third-party hacks required. After months of user backlash, Microsoft has acknowledged the frustration and introduced a firmware-level toggle that lets you remap or completely silence the dedicated AI key that ships on most new Windows PCs. This guide explains exactly what changed, which devices support the new option, and every method available to reclaim that key right now.

Why Microsoft Finally Acted on the Copilot Key Backlash

Illustration comparing Copilot key interrupting workflow versus key disabled in Windows 11

When Microsoft introduced the Copilot key in early 2024, it became one of the most controversial hardware decisions the company had made in years. The key — positioned where many users expected a right Ctrl key — launched Copilot regardless of what you were doing, interrupting games, creative apps, terminal sessions, and anything else that relied on the bottom-right corner of the keyboard. Forum threads, Reddit posts, and developer communities filled up with complaints almost immediately.

For over a year, Microsoft’s official guidance amounted to: use PowerToys to remap it. That workaround worked inconsistently — PowerToys’ Keyboard Manager failed to intercept the Copilot key in certain full-screen apps and games — leaving a significant chunk of users effectively stuck with a key they never wanted. By mid-2026, the backlash had become impossible to ignore, and Microsoft quietly pushed a settings update that adds a native “do nothing” option for the Copilot key on supported hardware. It’s a modest concession, but it’s a real one.

What the New Firmware Toggle Actually Does

The new option appears inside Windows Settings and lets you assign the Copilot key to one of several actions — including doing absolutely nothing. Unlike the PowerToys workaround, which operates at the software layer and can be bypassed by certain applications, the new toggle communicates with the keyboard firmware directly on supported devices. That means the key is intercepted before it ever reaches Windows, making it far more reliable across all apps and games.

Microsoft’s updated documentation on the Windows Copilot client management page now covers configuration options for both consumer and commercial environments, including policy-level controls that IT administrators can push across a fleet of managed devices. For home users, the path is simpler: a toggle in Settings does the job.

Which PCs Support the Native Copilot Key Disable

Windows 11 Settings showing Copilot key disable dropdown option in Typing menu

The firmware-level toggle is available on PCs that shipped with a dedicated Copilot key and have received the relevant firmware and driver updates from their manufacturer. In practice, that covers most laptops and desktops released from early 2024 onwards by major OEMs including Lenovo, Dell, HP, ASUS, Samsung, and Surface devices. If your PC shipped before the Copilot key era (before 2024), this toggle is irrelevant — your keyboard simply doesn’t have the key.

Key compatibility notes to keep in mind:

  • New Copilot+ PCs (2024 onwards) — fully supported with the firmware toggle.
  • Pre-2024 laptops with a repurposed key — some manufacturers used an existing key to trigger Copilot via firmware; those may also support the toggle after an OEM update.
  • Desktop PCs with third-party keyboards — the toggle won’t appear if the keyboard doesn’t identify a Copilot key to Windows. Use PowerToys or SharpKeys instead.
  • Windows 11 version requirement — you’ll need a reasonably current build. The May 2026 KB5089549 update and later releases include the necessary hooks.

How to Disable the Copilot Key via Windows Settings

On supported hardware, disabling or remapping the Copilot key takes under a minute. Here’s exactly how:

  1. Open Settings (Win + I).
  2. Go to Bluetooth & devices, then select Typing — or simply search for AI in the Settings search bar.
  3. Look for the Copilot key section.
  4. Click the dropdown and choose Do nothing to fully disable it, or select any other action you prefer (Search, Custom shortcut, etc.).
  5. The change takes effect immediately — no restart needed.

If you don’t see the Copilot key section, your PC either lacks a dedicated Copilot key or the firmware update from your OEM hasn’t arrived yet. Check your manufacturer’s support page for the latest driver and firmware packages.

How to Remap the Copilot Key with PowerToys (Still Useful)

PowerToys Keyboard Manager showing how to remap the Copilot key on Windows 11

Microsoft PowerToys remains one of the most flexible ways to remap the Copilot key, particularly on desktops with third-party keyboards or on laptops whose OEM hasn’t issued a firmware update yet. The Keyboard Manager module inside PowerToys lets you point the Copilot key to virtually any other key or shortcut.

Steps to remap the Copilot key in PowerToys:

  1. Download and install Microsoft PowerToys from the Microsoft Store or GitHub.
  2. Open PowerToys and navigate to Keyboard Manager.
  3. Click Remap a key.
  4. Press the Copilot key in the “From” column, then assign your preferred key or action in the “To” column.
  5. Click OK to save.

Bear in mind that PowerToys operates at the application layer, so the remap may not apply in a handful of full-screen games or apps that capture raw input. For those edge cases, the native firmware toggle described above is the better solution.

Registry and Group Policy: Copilot Key Disable for Advanced Users

If you want to go deeper — or you’re managing a small fleet of machines — Windows 11 also exposes Copilot controls through Group Policy and the Registry Editor.

Via Group Policy (Windows 11 Pro and above):

  1. Open gpedit.msc.
  2. Navigate to User Configuration > Administrative Templates > Windows Components > Windows Copilot.
  3. Double-click Turn off Windows Copilot and set it to Enabled.
  4. Apply and close. The Copilot key and taskbar icon will both be suppressed.

Note that this disables Copilot as a feature entirely, not just the key. If you only want to silence the key while keeping Copilot accessible from the taskbar, stick to the Settings toggle or PowerToys.

For more keyboard productivity tips, the Windows 11 keyboard shortcuts guide on Buy Now Key covers dozens of lesser-known combinations worth learning.

Remap the Copilot Key to Something Actually Useful

If you don’t want to simply disable the Copilot key, remapping it to a function you use every day is a smart alternative. Popular remaps include:

  • Right Ctrl — restores the layout many touch typists expect.
  • Mute / Volume — handy for media-heavy setups.
  • Calculator — a classic productivity shortcut that Windows still supports natively.
  • Custom shortcut — launch a specific app, folder, or macro via the Settings custom action option.
  • Search — replaces Copilot with Windows Search, which many users find more immediately useful.

The Windows 11 Settings method now supports custom shortcuts directly, so you can bind the key to a Win+letter combination without touching any third-party tools. That’s a significant usability improvement over the original Copilot-or-nothing design.

Does Disabling the Copilot Key Affect Copilot on the Taskbar?

No — disabling or remapping the Copilot key has no effect on the Copilot icon in the taskbar or on Copilot’s availability through other entry points like the Start menu or Windows Search. You can disable the key and still use Copilot whenever you choose to open it manually. Conversely, if you want to remove Copilot entirely from the interface, you’ll need to go through Group Policy, the Registry, or the Taskbar settings under Settings > Personalisation > Taskbar.

For a deeper look at everything Microsoft has been adjusting in the Copilot key saga, the dedicated post on Windows 11 Copilot key remapping covers the full history of workarounds and what the official fix changes.

Still Running an Older Windows Version? Time to Consider Upgrading

If you’re on Windows 10 or an earlier build of Windows 11, you won’t have access to the latest Copilot key controls — and you’ll miss out on a growing list of security patches and features. Windows 10 support ends in October 2025, meaning unpatched systems will stop receiving security updates. Moving to a fully licensed Windows 11 Pro is the cleanest solution, and Windows 11 Pro retail keys are available from Buy Now Key from just €17.90, with lifetime activation and instant digital delivery.

Frequently Asked Questions

Can I disable the Copilot key without installing any extra software?

Yes, on supported hardware. If your PC shipped with a dedicated Copilot key and has the latest firmware updates installed, you can disable it directly in Windows Settings under Bluetooth & devices > Typing. No third-party software is required. Older hardware or keyboards without official firmware support will still need PowerToys or a registry edit.

Will disabling the Copilot key remove Copilot from Windows 11?

No. Disabling or remapping the Copilot key only changes what happens when you press that physical key. Copilot remains fully accessible from the taskbar icon, Windows Search, and the Start menu. To remove Copilot from the UI entirely, you need to use Group Policy or the Registry Editor — or toggle the Copilot icon off in Taskbar settings.

Does the firmware toggle work in games and full-screen applications?

Yes — that’s the main advantage over the PowerToys workaround. Because the firmware toggle intercepts the Copilot key before it reaches the OS, it works consistently across games, full-screen video players, and applications that capture raw keyboard input. The PowerToys method, by contrast, can fail in those scenarios.

My PC doesn’t show the Copilot key option in Settings. What should I do?

First, check whether your laptop or keyboard actually has a physical Copilot key — it’s a dedicated key introduced on most new Windows PCs from 2024 onwards. If it does, visit your OEM’s support site (e.g. Lenovo Vantage, Dell SupportAssist, HP Support) and install the latest BIOS and keyboard firmware updates. The Settings toggle should appear after the firmware is updated and Windows is restarted.

Is the Copilot key disable option available on Windows 11 Home?

The Settings-based toggle is available on both Windows 11 Home and Windows 11 Pro. The Group Policy method (gpedit.msc) is only available on Pro, Enterprise, and Education editions. If you’re on Windows 11 Home and want Group Policy-style control, a registry edit achieves the same result, or you can upgrade to Windows 11 Pro for the full management toolkit.