In this episode of The Windows Podcast with Fexingo, Lucas and Luna explore Microsoft's quiet push to make dedicated-purpose devices a core enterprise strategy. They focus on the new Windows 11 kiosk mode features announced for the 2025 update—specifically, the ability to run a single Microsoft Edge app in full-screen without a taskbar or desktop, enforced through Intune policies. Lucas explains how a midsize healthcare chain used this to deploy 500 check-in kiosks, reducing per-device setup time from 45 minutes to 8 minutes. The hosts discuss the security benefits, the reduction in attack surface, and the surprising cost savings on endpoint management licensing. They also touch on the dark side: worker privacy concerns and the walled-garden experience. If you're an IT admin or enterprise architect evaluating Windows 11 for locked-down devices, this episode gives you concrete numbers and deployment patterns to consider.

#Windows11 #KioskMode #MicrosoftIntune #EnterpriseIT #EndpointManagement #HealthcareIT #Security #Edge #LockedDownDevices #Productivity #ITAdmin #DigitalTransformation #WindowsPodcast #FexingoBusiness #BusinessPodcast #Technology #DeviceManagement #WindowsHello

Keep every episode free: buymeacoffee.com/fexingo

Episode 93 of The Windows Podcast with Fexingo drills into a quiet but sweeping mandate: all Windows 11 Enterprise and Education devices must now have BitLocker full-disk encryption enabled by default. Lucas and Luna unpack the policy shift, which started rolling out in preview builds and became standard with the 2025 feature update. They walk through the technical requirements — TPM 2.0, Secure Boot, recovery key escrow to Entra ID — and what it means for IT admins managing fleets of devices. Specific numbers: Microsoft estimates that less than 40 percent of enterprise PCs in the field are currently encrypted, a figure this policy aims to push toward 100 percent. The conversation covers the user experience change (no more manual BitLocker setup wizard), the recovery key management burden, and the tension between security gain and support desk load. They also touch on how this compares to Apple's FileVault and Linux LUKS defaults. Concrete takeaway: if you manage Windows devices, your next deployment will encrypt every drive out of the box.

#Windows11 #BitLocker #FullDiskEncryption #EnterpriseSecurity #Microsoft #TPM2.0 #SecureBoot #EntraID #RecoveryKey #ITAdmin #DataProtection #EncryptionMandate #WindowsEnterprise #Technology #WindowsPodcast #FexingoBusiness #BusinessPodcast #TechPolicy

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has quietly added a new requirement for enterprise Windows 11 deployments: enforced USB device control via Group Policy. In this episode, Lucas explains the technical details behind the policy, which blocks all USB storage devices by default unless explicitly approved. Luna questions whether this will cause chaos for IT departments and users alike. They walk through the policy path, how exception lists work, and what this means for existing USB-based workflows like key fobs, developer tools, and emergency boot drives. The conversation also touches on the security rationale — 60% of data breaches involve removable media — and the practical pushback from teams that rely on USB drives for daily operations. If you manage enterprise endpoints, this is a policy you'll need to understand before the next Windows 11 feature update hits your fleet.

#Windows11 #USBDeviceControl #EnterpriseIT #GroupPolicy #Microsoft #DataSecurity #RemovableMedia #ITPolicy #TechPodcast #Fexingo #BusinessPodcast #WindowsPodcast #EndpointSecurity #DeviceManagement #USBBlock #CyberSecurity #LucasAndLuna #EnterpriseWindows

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has been steadily tightening Windows 11 security defaults for enterprise PCs. In this episode, Lucas and Luna focus on one specific mandate rolling out this year: Credential Guard. They explain what Credential Guard actually does — isolating Kerberos and NTLM secrets inside a virtualized container so that even if an attacker gains admin rights, they can't dump cached passwords or pass-the-hash. Lucas breaks down the hardware requirements (Virtualization-Based Security, TPM 2.0, UEFI Secure Boot) and the deployment timeline: starting with Windows 11 24H2, new enterprise devices will have Credential Guard enabled by default, and existing devices will get a compliance warning in Intune. Luna asks about compatibility with legacy line-of-business apps and whether this breaks VPNs or credential managers. Lucas outlines Microsoft's configuration service provider approach and the opt-out mechanism via Group Policy. They discuss the real-world impact: a 2025 Verizon DBIR stat showing 80% of data breaches tied to compromised credentials. This is episode 91 of The Windows Podcast with Fexingo.

#Windows11 #CredentialGuard #EnterpriseSecurity #VirtualizationBasedSecurity #Microsoft #EndpointSecurity #IdentityProtection #PassTheHash #Kerberos #NTLM #Intune #GroupPolicy #TPM20 #ZeroTrust #VerizonDBIR #Technology #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has been quietly adding requirements to Windows 11 enterprise editions, and the latest is Local Administrator Password Solution (LAPS). Starting with the 2025 feature update, Windows 11 Pro and Enterprise will require a local admin password management tool—either Microsoft's built-in LAPS or a third-party equivalent—for all domain-joined devices. This episode breaks down what LAPS does, why Microsoft is making it mandatory now, and what IT admins need to know about the transition. Lucas explains the timeline and technical details, while Luna brings real-world examples from organizations that have already adopted LAPS. If you manage Windows devices in any enterprise setting, this is a change you cannot ignore. We also touch on the security implications of shared local admin passwords and how mandatory LAPS fits into Microsoft's broader Zero Trust push.

#Windows11 #LAPS #EnterpriseIT #Microsoft #ZeroTrust #LocalAdminPassword #Security #ITManagement #WindowsSecurity #DomainJoined #ActiveDirectory #PasswordManagement #TechPodcast #FexingoBusiness #BusinessPodcast #WindowsPodcastWithFexingo #EnterpriseWindows #ITAdmin

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna dive into how Windows 11 is quietly mandating enterprise certificate auto-enrollment for all domain-joined devices. They break down what this means for IT admins: no more manual certificate requests, but also tighter control over device identity. The discussion covers the shift from user-based to machine-based certificates, the role of Active Directory Certificate Services, and why Microsoft is pushing this now. A concrete look at how this affects enterprise security posture and the admin workload. Plus, a brief mention of how listener support keeps the podcast ad-free.

#Windows11 #Enterprise #CertificateAutoEnrollment #ADCS #DeviceIdentity #MachineCertificate #ITAdmin #Security #Microsoft #WindowsPodcast #FexingoBusiness #BusinessPodcast #LucasAndLuna #PodcastEpisode #TechPolicy #DomainJoined #PKI #NoMoreManualCerts

Keep every episode free: buymeacoffee.com/fexingo

Episode 88 of The Windows Podcast dives into a little-known Windows 11 security mandate that's quietly rolling out for enterprise PCs: Kernel DMA Protection. Lucas explains how this blocks direct memory access attacks by peripheral devices like Thunderbolt docks and PCIe cards, why it's now enforced for new hardware certification, and what IT admins need to check before their next hardware refresh. Luna brings up a real-world case of a finance firm hit by a DMA-based breach in 2024. They also discuss the subtle difference between 'kernel DMA protection' and 'DMA remapping,' and why this matters for any organization using Thunderbolt 4 or USB4 docks. The episode wraps with a reflection on how Microsoft is hardening the Windows kernel piece by piece, and a listener-support pitch for buy me a coffee dot com slash fexingo.

#Windows11 #KernelDMaProtection #EnterpriseSecurity #DirectMemoryAccess #Thunderbolt #PCIe #Microsoft #ITAdmin #HardwareCertification #DMA #HVSecurity #DeviceSecurity #ZeroDay #BusinessTechnology #TechPodcast #FexingoBusiness #BusinessPodcast #WindowsPodcast

Keep every episode free: buymeacoffee.com/fexingo

Microsoft is quietly pushing enterprise Windows 11 devices to use DNS over HTTPS by default, starting with the 2025 feature update. Lucas and Luna break down what this means for IT admins: the shift from network-level DNS filtering to encrypted DoH, the impact on security monitoring tools that rely on plaintext DNS, and how Microsoft is enforcing this via Group Policy and MDM settings. They also discuss why this matters for enterprises using internal DNS resolution and the potential conflicts with existing endpoint detection systems. A focused look at a silent change that could break your network monitoring.

#Windows11 #DNSOverHTTPS #DoH #EnterpriseIT #Microsoft #NetworkSecurity #GroupPolicy #MDM #ITAdmin #Encryption #CyberSecurity #WindowsUpdate #TechPodcast #FexingoBusiness #BusinessPodcast #EnterpriseWindows #NetworkMonitoring #DNS

Keep every episode free: buymeacoffee.com/fexingo

Episode 86 of The Windows Podcast digs into Microsoft's quiet new requirement: every Windows 11 Enterprise device must have a hardware security module (HSM) or a TPM-backed virtual HSM for key storage by the end of 2026. Lucas explains what an HSM is — a tamper-resistant chip that stores encryption keys separately from the CPU — and why Microsoft is now mandating it after years of optional support. He walks through the three key scenarios affected: BitLocker key protection, Windows Hello biometric data, and Azure AD certificate-based authentication. Luna challenges whether this is just another compliance checkbox or actually addresses real attack vectors like the 2024 Golden Key malware that stole private keys from TPM firmware. They discuss the cost: dedicated HSMs from Thales or Utimaco can cost $5,000 per device, though Microsoft's software-based virtual HSM option is included in Windows 11 Enterprise. The episode closes on a practical question: should IT departments start budgeting now or wait for the deadline?

#Windows11 #HardwareSecurityModule #HSM #TPM #BitLocker #WindowsHello #AzureAD #CertificateAuthentication #EnterpriseIT #Cybersecurity #GoldenKeyMalware #Thales #Utimaco #Microsoft #EnterpriseSecurity #Compliance #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 85 of The Windows Podcast with Fexingo. Lucas and Luna unpack Microsoft's quiet requirement that enterprise printers using port 9100—the decades-old raw TCP/IP standard—must now use encryption. They trace the change from a July 2025 Windows 11 24H2 preview build to the current July 2026 mandatory security baseline. Lucas explains why this breaks thousands of pre-2020 office printers and how IT admins can prepare, with specific steps for HP and Brother fleet environments. The hosts also discuss the broader pattern: Microsoft is systematically forcing encryption on every legacy enterprise protocol, from SMB to RDP to now raw printing. A focused, actionable episode for anyone managing Windows enterprise printing.

#Windows11 #WindowsPodcastWithFexingo #EnterprisePrinting #Port9100 #PrintingEncryption #MicrosoftSecurity #ITAdmin #HPPrinters #BrotherPrinters #NetworkPrinting #SecurePrinting #TechPodcast #EnterpriseIT #WindowsSecurity #PrintProtocol #FexingoBusiness #BusinessPodcast #Technology

Keep every episode free: buymeacoffee.com/fexingo