Loading story…
Microsoft expanded the Windows Backup for Organizations “first sign-in restore” experience in Windows 11, allowing more enterprise users to restore prior device settings and their Microsoft Store app list when signing into a new or reimaged device with a Microsoft Entra ID account. The capability, previously limited to Entra-joined devices, now also supports hybrid-managed environments, multi-user device setups, and Windows 365 Cloud PCs, and can be managed via existing policies using Microsoft Intune or Group Policy.
Microsoft also clarified that Windows 11 is not ending support for legacy V3 and V4 printer drivers, after an inaccurate Windows Roadmap entry suggested those drivers would no longer be supported. The company stated that existing printers and already-installed drivers will continue to work, and existing Windows Update-hosted drivers remain available; the actual change is that new V3/V4 driver submissions to Windows Update are blocked by default and now require case-by-case approval for Windows 11 and Windows Server 2025 and later, while vendors can still distribute drivers through their own installers.
See real exploitation activity before you spend the cycle.
8 events from the most recent confirmed update back to the earliest known activity.
From July 1, 2027, Microsoft will restrict third-party printer driver updates delivered through Windows Update to security fixes only, further reducing reliance on legacy print drivers.
Starting July 1, Windows will prioritize Microsoft's built-in IPP class driver when both it and a third-party legacy printer driver are available, as part of the company's print-stack modernization effort.
Microsoft confirmed that Windows 11 is not ending support for legacy V3 and V4 printer drivers and said an earlier Windows Roadmap entry suggesting otherwise was incorrect. The company also reiterated that existing Windows Update-hosted drivers remain available and already-installed printers will continue to work.
Microsoft began general availability of the expanded first sign-in restore experience for devices installing Windows updates released on or after February 24, 2026, extending support to hybrid-managed devices, multi-user setups, and Windows 365 Cloud PCs.
Microsoft changed Windows Update policy to block new legacy V3 and V4 printer driver submissions by default for Windows 11 and Windows Server 2025 and later, with exceptions handled case by case.
Microsoft made Windows Backup for Organizations generally available for enterprise use after its preview period.
Microsoft moved Windows Backup for Organizations into public preview, allowing organizations to begin testing the enterprise backup and restore feature.
Microsoft announced Windows Backup for Organizations at Microsoft Ignite, introducing enterprise backup and restore capabilities for Windows devices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft has ended default support for **legacy V3 and V4 printer drivers** in Windows 11 and newer Windows Server releases, following a deprecation notice issued in September 2023 and a two-year transition window. Starting with optional Windows 11 updates released in mid-January 2026, Microsoft began blocking new legacy print-driver submissions to Windows Update by default and routing exceptions through a manual review process; the change is expected to roll into broader servicing via February 2026 cumulative updates and affect Windows 11 **24H2/25H2** as deployment expands. Microsoft’s published policy states that for Windows 11+ and **Windows Server 2025+**, no new printer drivers will be published to Windows Update, while existing drivers may still receive updates only on a case-by-case basis. The practical impact is concentrated on organizations and users with **older printer hardware** that depends on V3/V4 drivers: devices may fail to install via Windows Update or stop functioning if a compatible modern driver path is unavailable. Microsoft frames the move as a **security and reliability** hardening step, citing the historical risk profile of print drivers within Windows, and recommends remediation through printer-vendor support (e.g., updated supported drivers/firmware) or migration to modern printing approaches such as **IPP (Internet Printing Protocol)** and newer driver architectures.
Jun 29, 2026
Microsoft is warning organizations that **Windows Server 2016**, **Windows 10 Enterprise LTSB 2016**, and **Windows 10 IoT Enterprise 2016 LTSB** are approaching end of support, after which they will no longer receive security patches, bug fixes, or technical support. Reported lifecycle dates include **October 13, 2026** for the Windows 10 2016 LTSB variants and **January 12, 2027** for Windows Server 2016; Microsoft’s guidance is to prioritize upgrades (e.g., to **Windows Server 2025** and Windows 10/11 LTSC options where hardware permits) and, if migration timelines slip, to use the **Extended Security Updates (ESU)** program as a short-term bridge for up to three years with only “critical” and “important” security updates. Separately, Microsoft released the **Windows 11 KB5077241** optional (non-security) preview cumulative update with 29 quality changes, including **BitLocker reliability** improvements (addressing freezes after entering a recovery key) and new built-in capabilities such as a taskbar **network speed test** and **native Sysmon functionality** (disabled by default). The update also enables **Quick Machine Recovery (QMR)** by default on certain unmanaged Windows Pro devices and is positioned for admin testing ahead of the next Patch Tuesday release, but it does **not** include security fixes.
Jun 29, 2026
Microsoft attributed **Windows 11 no-boot failures** seen after installing the January 2026 cumulative update `KB5074109` (Windows 11 **24H2/25H2**) to devices that had previously **failed to install the December 2025 security update** and were left in an “**improper state**” after rollback. Affected systems can crash on startup with a BSOD `UNMOUNTABLE_BOOT_VOLUME`; Microsoft said the issue appears limited to **physical devices** (no confirmed VM impact) and is working on a **partial mitigation** to prevent additional systems from entering a no-boot scenario, while continuing to investigate why some devices fail updates or end up unstable after rollback. Separately, Microsoft’s recent Windows 11 servicing and security work included **deliberately disabling legacy dial-up modem drivers** (e.g., `AGRSM64.SYS`/`AGRSM.SYS`, `SMSERL64.SYS`/`SMSERIAL.SYS`) due to reported vulnerabilities including **CVE-2023-31096** (EoP) and **CVE-2025-24052** (stack-based buffer overflow), which can present risk even if the modem hardware is unused—at the cost of breaking connectivity for niche systems relying on those drivers. Microsoft also patched **nine bypasses** reported by Google Project Zero that could undermine the new **Windows Administrator Protection** feature by enabling silent admin privilege gains via legacy Windows/UAC behaviors (including a token/Logon Sessions-related technique involving `NtQueryInformationToken` and DOS device object directory creation), ahead of broader availability beyond Insider builds.
Jun 29, 2026