Windows 11

Locking the taskbar position and size

by

This week is all about the taskbar in Windows. That taskbar on itself is not something new, but it does get a pretty nice update with Windows 11 version 26H2. The user can now position the taskbar at the bottom, top, left, or right side of the screen, and there is also an option for a smaller taskbar that reduces the size of the icons and the height of the taskbar. Especially that first option has been on the wish list of many users for a very long time. Those new options fit perfectly in the storyline of making the Windows experience more personal, and in the storyline of managing the taskbar, as discussed in this post and in this post of a while ago. From an organizational perspective, …

Read more

Configuring Windows Ready Print driver ranking

by

This week is all about Windows Ready Print driver ranking. Driver ranking on itself is not something new, but it is getting more attention with Windows 11 version 26H2. Especially because the configuration of driver ranking is now also part of the latest security baseline for Windows. The Windows Ready Print driver ranking fits perfectly in the storyline of the end of servicing of third-party printer drivers. That storyline goes from no longer publishing new printer drivers to Windows Update, which started in January 2026, to always preferring the Microsoft IPP Class Driver in the driver ranking order, which started in July 2026, to only allowing security-related fixes for third-party printer drivers, which will start in July 2027. The Microsoft IPP Class Driver supports printers …

Read more

Getting started with AI agent runtime protection

by

This week is all about AI agent runtime protection in Defender for Endpoint. As more AI agents become available on Windows devices, they are also becoming more capable of interacting with local resources, such as files, applications, and system commands. While those capabilities can provide powerful productivity benefits, they also introduce new security considerations. One of those considerations is prompt injection, where hidden or malicious instructions within content can influence the behavior of an AI agent. To help organizations protect against those threats, Microsoft recently introduced AI agent runtime protection in Defender for Endpoint. This capability provides organizations with the ability to detect potential prompt injection attempts on managed devices and to either audit or block suspicious actions before they can be performed. This post …

Read more

Disabling the Get Started app

by

This week is all about the Get Started app in Windows. That app on itself is not something new, but does get a pretty substantial update with Windows 11 version 26H2. It will get some additional pages related to adding popular apps to the device, pin sites to the taskbar, and change the look of the device. All focused on getting the user started on their new device. From an organizational perspective, however, there is just not that much added value in the Get Started app. Especially because the ability to make it organization specific is no longer available since Organizational Messages moved to the Microsoft 365 admin center. So, what often happens is that IT administrators are looking into removing that app, as it …

Read more

Easily enabling Sysmon in Windows 11

by

This week is all about Sysmon and about enabling Sysmon on the latest version of Windows 11. Sysmon itself is not new, but the direct integration within Windows 11 is. Starting in February 2026, Sysmon is available as a built-in optional Windows feature in supported versions of Windows 11. When the feature is enabled and Sysmon is installed, Sysmon remains active after system restarts and continuously monitors system activity, logging detailed events to the event log. Those events include information about process creation, network connections, and changes to file timestamps. That provides an additional layer of visibility into what is happening on Windows devices and supports detecting malicious or unusual behaviour. Sysmon generates the events, but it does notanalysee them. It simply adds deep insights …

Read more

Easily managing Windows App on Windows devices

by

This week is all about easily managing the Windows App on Windows devices. In the early days, the Windows App was pretty straightforward. There were some configuration settings available within the Windows App, and the user could configure those settings. Nowadays, more and more configuration settings have become available, and some now also become available for the IT administrators for central management. That enables IT administrators to manage the update behavior, the first run experience, the log off behavior, and the ability to create shortcuts. Especially, managing the update behavior can provide the IT administrators with a little bit more control over the updates for the Windows App, as it enables the them to configure an admin release ring and to turn off automatic updates. …

Read more

Making sure the multi-app kiosk configuration is applied after the installation of the applications

by

This week is all about making sure that the multi-app kiosk configuration is actually applied after the required applications are installed. The ordering is important because the multi-app kiosk configuration will not be correctly configured when the required applications where not installed when the configuration was applied. That was also an important subject during the session on the Workplace Ninja Summit about Mastering shared Windows devices in your environment. The basics around creating the multi-app kiosk configuration, using assigned access, has been described on this blog. Often, however, it refers to using a custom device configuration file. And, even though it technically works, it does not provide full control over the end-result. Given the fact that this was also subject of many questions during the …

Read more

Configuring Point-in-time restore in Windows

by

This week is a follow-up on this post of earlier this year about getting started with point-in-time restore in Windows. At that moment, the early release of Point-in-time-restore became available and showed the concept in the Windows. Now that functionality is further developed in to a general available feature that also includes management capabilities via Microsoft Intune. Point-in-time-restore fits perfectly in the storyline of the many new (and still coming) features related to the backup, restore, and recovery of Windows. That storyline goes from Quick Machine Recovery, which is focused on recovering Windows devices when encountering critical errors that prevent the device from booting, to Windows settings backup and restore (previously known as Windows Backup for Organizations), which is focused on making it easier to switch …

Read more

Collecting Windows registry data

by

This week is all about the recently introduced capability to collect Windows registry data (or in other words, the ability to perform registry inventory). A lot has been written about that capability, but it is such an important enhancement that it deserves a place on this blog as well. Until this moment, IT administrators often used scripting solutions to collect specific Windows registry data. With the introduction of the collection of Windows registry data, the need for such solutions should decline. There will, however, always be scenarios in which it is better to still hold on to those scripting solutions. The capability to collect Windows registry data is part of the earlier introduced device inventory, using the Properties Catalog. That means that the collected information …

Read more

Customizing the pinned folders in Start layout

by

This week is all about customizing the pinned folders in the Start layout, and is a follow-up on this post about customizing the power options in Start layout. Again, it is important to start with that the fact that something is technically possible, does not mean that it should actually be done. In most cases, it should be up to the user to configure in the Start layout whatever they need to be productive. There are, however, cases in which an IT administrator might need to take a bit more control. That can be useful on shared devices, such as kiosk devices and Shared PCs. This post will be another part in the series to go through the different sections of the Start layout, this …

Read more