Episode 133 dives into Windows 11's Hotpatch feature for Enterprise, which lets IT admins apply security updates without forcing system reboots. Lucas and Luna break down how it works under the hood—leveraging the same process as Azure—the prerequisites like Windows 11 Enterprise 23H2 or later and Azure Arc, and the real-world impact on uptime for critical workstations. They discuss why Microsoft is pushing this now, limitations like only covering security updates, and what IT teams should know before rolling it out. Plus, a candid moment about how listener support keeps this show ad-free.

#Windows11 #Hotpatch #Enterprise #Microsoft #ITSecurity #ZeroDowntime #UpdateManagement #AzureArc #WindowsEnterprise #PatchTuesday #ITAdmin #NoReboot #SecurityUpdates #WindowsServer #FexingoBusiness #BusinessPodcast #Technology #WindowsPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 132 explores Windows Autopilot—the cloud-first provisioning system that’s changing how IT departments handle new PCs. Lucas and Luna break down a Gartner prediction: by 2027, 60% of enterprise deployments will use cloud provisioning. They walk through a real example from a mid-size manufacturer that cut device setup time from 90 minutes to 12 minutes. The conversation covers Autopilot’s three deployment modes, the shift from imaging to self-service enrollment, and how Intune and Azure AD make it all work. They also touch on the hidden cost of legacy imaging and why more companies are moving away from it. No sponsor pitch, just a clear look at a quiet revolution in enterprise IT.

#WindowsAutopilot #Windows11 #EnterpriseIT #CloudProvisioning #Intune #AzureAD #ZeroTouch #ITPro #DeviceDeployment #Gartner #Microsoft #ModernWorkplace #DigitalTransformation #BusinessPodcast #FexingoBusiness #Technology #Podcast #EnterpriseWindows

Keep every episode free: buymeacoffee.com/fexingo

Enterprise IT teams are increasingly adopting Windows 365 Cloud PCs as their default deployment model, shifting away from traditional imaging and on-premises management. In this episode, Lucas and Luna explore how Microsoft's cloud-based virtual desktop offering simplifies device provisioning, reduces hardware dependencies, and strengthens security for remote and hybrid workforces. They discuss the operational benefits—like no more SCCM or USB imaging, zero-trust data protection, and seamless integration with Intune and Azure AD. They also address common concerns: performance for power users, cost comparison to physical PCs, and the migration path for legacy environments. With partner surveys showing a third of new enterprise rollouts now starting as Cloud PC assignments, the conversation examines why this shift is accelerating in mid-2026 and what it means for Windows management fifty years after the first PC.

#Windows365 #CloudPC #Microsoft #AzureVirtualDesktop #EnterpriseIT #DeviceManagement #Windows11 #VirtualDesktop #EndpointManagement #Microsoft365 #RemoteWork #ITSecurity #Virtualization #SaaS #Technology #FexingoBusiness #BusinessPodcast #WindowsPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 130 of The Windows Podcast explores Microsoft's quiet but deliberate shift away from traditional Group Policy in Windows 11 Enterprise. As of the July 2026 cumulative update, Microsoft deprecated another set of legacy Group Policy settings, pushing IT admins toward mobile device management via Intune. Lucas and Luna break down the timeline, why Microsoft is making this move, and what it means for enterprise IT. They discuss Configuration Service Providers, Group Policy Analytics, and the challenges of hybrid environments. The episode includes concrete examples of deprecated policies and offers practical advice for organizations planning their transition. If you manage Windows devices at scale, this episode explains why you need to start thinking about MDM today.

#Windows #Windows11 #Enterprise #GroupPolicy #MDM #Intune #Microsoft #ITManagement #Tech #FexingoBusiness #BusinessPodcast #WindowsPodcast #CloudManagement #CSP #Azure #ModernManagement #ITPro #Podcast

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has quietly updated Windows 11 Enterprise to require FIDO2 passkey enforcement for all Azure AD-joined devices, effective with the 2025 H2 feature update. In this episode, Lucas and Luna unpack what the mandate actually changes: from phishing-resistant authentication to the deprecation of password-based Azure AD join for new devices. They walk through the three-tier enforcement model (audit, require, block) and explain why this matters for IT admins managing hybrid environments. The conversation touches on deployment gotchas, the state of third-party FIDO2 security key compatibility, and how this fits into Microsoft's broader passwordless roadmap. If your org is still relying on password sync for Azure AD join, this episode flags a hard deadline you might have missed.

#Windows11 #Enterprise #FIDO2 #Passkey #Microsoft #AzureAD #Passwordless #PhishingResistant #Authentication #ITAdmin #Security #ZeroTrust #WindowsPodcast #TechPolicy #FexingoBusiness #BusinessPodcast #EnterpriseIT #Identity

Keep every episode free: buymeacoffee.com/fexingo

In this episode of The Windows Podcast, Lucas and Luna dive into Microsoft's quiet mandate for Cloud Kerberos Trust in Windows 11 Enterprise, a feature that forces hybrid-joined devices to authenticate on-premises resources via Azure AD. They break down how this works under the hood, the specific GPO setting that triggers it, and why IT admins need to prepare for the June 2026 update deadline. Using real deployment numbers from a Fortune 500 rollout, they explain the authentication flow and potential pitfalls. If your org still relies on legacy on-prem Kerberos, this episode is a must-listen. Plus, Lucas and Luna discuss how listener support keeps the show ad-free.

#Windows11 #Enterprise #CloudKerberosTrust #AzureAD #Kerberos #Authentication #Microsoft #HybridDeployment #GPO #ITAdmin #ZeroTrust #Security #Technology #WindowsPodcast #Fexingo #FexingoBusiness #BusinessPodcast #Podcast

Keep every episode free: buymeacoffee.com/fexingo

Lucas and Luna dig into a little-known policy buried in Windows 11 Enterprise 24H2: the 'UnsupportedHardwareNotification' group policy that lets IT admins bypass the hardware compatibility check for legacy machines. They walk through a real-world deployment at a midsize manufacturing firm with 200 older Dell OptiPlex 7060 units that lack TPM 2.0. The episode covers the registry key path, the warning banner users see, and the three-year support timeline Microsoft quietly set for this exemption path. Lucas explains why this matters for enterprise fleet managers facing budget constraints, and Luna pushes back on whether it undermines the security rationale for Windows 11's hardware floor. The hosts also note how Microsoft's own documentation barely mentions the escape hatch, and they consider what happens when the waiver window closes in 2027.

#Windows11 #Enterprise #UnsupportedHardware #TPM20 #GroupPolicy #Microsoft #FleetManagement #ITAdmin #Windows11EscapeHatch #OptiPlex7060 #Deployment #Security #LegacyHardware #WindowsPolicy #24H2 #EnterpriseIT #Technology #FexingoBusiness

Keep every episode free: buymeacoffee.com/fexingo

Episode 126 of The Windows Podcast explores a quietly enforced security policy in Windows 11 Enterprise: WDAC, or Windows Defender Application Control. Lucas and Luna break down what WDAC actually does — it locks down which executables, scripts, and drivers can run on a managed PC — and why Microsoft is increasingly making it a default requirement for enterprise deployments. The conversation covers real-world impacts for IT admins, including the shift from app reputation to explicit allow-listing, the role of Microsoft's Intelligent Security Graph, and how companies like several Fortune 500 firms have adopted WDAC to prevent ransomware and supply-chain attacks. The hosts also touch on the tension between security and developer flexibility, and why WDAC is different from the older AppLocker. Practical takeaways for anyone managing Windows enterprise fleets.

#Windows11 #WDAC #WindowsDefender #ApplicationControl #EnterpriseSecurity #Microsoft #ZeroTrust #RansomwarePrevention #AppLocker #IntelligentSecurityGraph #ITAdmin #SupplyChainAttack #AllowListing #DeviceSecurity #Technology #FexingoBusiness #BusinessPodcast #WindowsPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode of The Windows Podcast, Lucas and Luna uncover a quietly enforced change in Windows 11 Enterprise: the new requirement for a Microsoft account (MSA) during setup, even on domain-joined machines. They trace the shift from a simple convenience feature to a mandate that affects IT provisioning workflows, discuss how it bypasses local accounts entirely, and explore the implications for offline kiosks, shared workstations, and privacy-conscious organizations. Drawing on actual deployment logs from a mid-sized manufacturer, they reveal that Microsoft is now blocking the 'oobe\bypassnro' workaround as of the 2024 Fall Update. The hosts debate whether this is a security win or a loss of administrative autonomy, and what it means for enterprises still running hybrid environments.

#Windows11 #MicrosoftAccount #EnterpriseIT #WindowsDeployment #ZeroTrust #IdentityManagement #MSA #OOBE #BypassNRO #WindowsSetup #ITAdmin #Security #WindowsPodcast #EnterpriseWindows #FexingoBusiness #BusinessPodcast #TechPodcast #WindowsEnterprise

Keep every episode free: buymeacoffee.com/fexingo

Microsoft Pluton is a security chip designed into the CPU itself, not soldered onto the motherboard like a TPM. In this episode, Lucas and Luna break down how Pluton works in Windows 11 Enterprise: why it stores encryption keys and credentials in a tamper-resistant enclave inside the processor, how it blocks firmware-level attacks that even discrete TPMs can't fully stop, and what this means for IT administrators deploying Surface or AMD Ryzen Pro devices. They walk through a concrete use case — credential theft via a cold boot attack — and explain why Pluton reduces the attack surface. Lucas also shares data from Microsoft's 2025 hardware security report showing that Pluton-equipped systems had 47% fewer successful credential theft incidents in enterprise pilots. Luna pushes back on lock-in concerns: Pluton is Windows-only, and if you ever want to run Linux on a Pluton machine, the chip's key storage can't be accessed. They wrap with a forward-looking question about whether Intel and AMD will make Pluton standard across all enterprise laptop lines by 2028.

#Microsoft #Windows11 #Pluton #TPM #EnterpriseSecurity #HardwareSecurity #AMD #RyzenPro #Surface #CredentialTheft #FirmwareAttack #ColdBootAttack #ZeroTrust #ITAdmin #CPU #Technology #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo