Microsoft Pluton is a security chip designed into the CPU itself, not soldered onto the motherboard like a TPM. In this episode, Lucas and Luna break down how Pluton works in Windows 11 Enterprise: why it stores encryption keys and credentials in a tamper-resistant enclave inside the processor, how it blocks firmware-level attacks that even discrete TPMs can't fully stop, and what this means for IT administrators deploying Surface or AMD Ryzen Pro devices. They walk through a concrete use case — credential theft via a cold boot attack — and explain why Pluton reduces the attack surface. Lucas also shares data from Microsoft's 2025 hardware security report showing that Pluton-equipped systems had 47% fewer successful credential theft incidents in enterprise pilots. Luna pushes back on lock-in concerns: Pluton is Windows-only, and if you ever want to run Linux on a Pluton machine, the chip's key storage can't be accessed. They wrap with a forward-looking question about whether Intel and AMD will make Pluton standard across all enterprise laptop lines by 2028.

#Microsoft #Windows11 #Pluton #TPM #EnterpriseSecurity #HardwareSecurity #AMD #RyzenPro #Surface #CredentialTheft #FirmwareAttack #ColdBootAttack #ZeroTrust #ITAdmin #CPU #Technology #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 123 of The Windows Podcast dives into a security feature Microsoft is quietly requiring for enterprise Windows 11 deployments: Kerberos armoring, also known as Flexible Authentication via Secure Tunneling (FAST). Lucas and Luna break down what Kerberos armoring actually does—protecting authentication traffic against offline brute-force attacks by wrapping it in a secure tunnel—and why it's becoming mandatory in the latest Windows 11 enterprise compliance baselines. They discuss practical deployment gotchas, like ensuring all domain controllers run Windows Server 2012 or later and that time sync is rock-solid. They also touch on what this means for organizations still running legacy DCs or mixed environments. Tune in for a focused, technical look at a policy change that could trip up IT teams that aren't paying attention.

#Windows11 #KerberosArmoring #FAST #EnterpriseSecurity #Microsoft #ActiveDirectory #DomainController #WindowsServer #Authentication #ZeroTrust #ITPro #SecurityBaselines #WindowsPodcast #FexingoBusiness #BusinessPodcast #TechPodcast #EnterpriseIT #CyberSecurity

Keep every episode free: buymeacoffee.com/fexingo

Episode 122 of The Windows Podcast uncovers a little-known but significant change in Windows 11: the quiet mandate for network segmentation in enterprise deployments. Starting with the 24H2 update, Microsoft requires devices to be on a segmented network with firewall rules that isolate critical workloads. Lucas and Luna break down what this means for IT admins, why Microsoft is pushing it, and how it ties to zero-trust architecture. They discuss real-world challenges for organizations with flat networks and offer practical steps for compliance. The episode also touches on the broader trend of Microsoft hardening the Windows stack against lateral movement attacks, a shift that started with credential guard and now extends to the network layer. If you manage Windows devices, this episode is essential listening.

#Windows11 #EnterpriseIT #NetworkSegmentation #ZeroTrust #Microsoft #ITSecurity #LateralMovement #WindowsSecurity #TechPodcast #FexingoBusiness #BusinessPodcast #Cybersecurity #NetworkSecurity #ITAdmin #WindowsDeployment #24H2 #Firewall #NetworkIsolation

Keep every episode free: buymeacoffee.com/fexingo

In this episode of The Windows Podcast, Lucas and Luna dive into Microsoft's quiet mandate for certificate-based authentication in Windows 11 Enterprise. Starting with Windows 11 24H2, the default authentication policy shifts from password-based to certificate-based for domain-joined devices, leveraging the built-in Certificate Autoenrollment feature. The hosts explore how this eliminates password spraying and pass-the-hash attacks, the rollout timeline through Group Policy and Intune, and the hidden infrastructure requirements—including Active Directory Certificate Services and proper PKI hierarchy. They also discuss the impact on IT administrators, user experience, and third-party certificate providers. A practical deep dive into a major security shift that many enterprises are only now discovering.

#Windows11 #EnterpriseSecurity #CertificateBasedAuthentication #Microsoft #PassTheHash #PasswordSpraying #ActiveDirectory #PKI #Intune #GroupPolicy #ZeroTrust #ITAdmin #CyberSecurity #Technology #FexingoBusiness #BusinessPodcast #WindowsPodcast #Authentication

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has quietly made its Local Administrator Password Solution (LAPS) a mandatory configuration for Windows 11 Enterprise devices joined to Azure AD or on-premises Active Directory. In this episode, Lucas and Luna break down what the mandate means for IT administrators: why Microsoft is enforcing randomized, rotated local admin passwords, how LAPS works under the hood, and what happens if your organization hasn't deployed it yet. They walk through the specific Group Policy and Intune settings that trigger compliance enforcement, the February 2026 Windows servicing stack update that enabled the mandate, and the security rationale behind eliminating static local admin passwords. Lucas shares data from Microsoft's 2025 Digital Defense Report showing that lateral movement using compromised local admin credentials was involved in 67 percent of ransomware incidents. Luna asks about legacy systems and offline devices, and Lucas explains the fallback options and exceptions. By the end, you'll understand exactly what your IT team needs to configure before the next compliance scan hits.

#Windows11 #Microsoft #LAPS #LocalAdminPassword #CyberSecurity #ZeroTrust #ITAdmin #GroupPolicy #Intune #AzureAD #ActiveDirectory #Ransomware #LateralMovement #EnterpriseSecurity #Compliance #WindowsPodcast #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Episode 119 of The Windows Podcast digs into Microsoft's latest quiet mandate: BitLocker device encryption is now the default for all Windows 11 Enterprise deployments. Lucas and Luna break down what this means for IT admins, how it intersects with previous mandates like TPM 2.0 and Secure Boot, and the real-world tension between security and data recovery. They discuss the cryptographic details—XTS-AES 128-bit by default, the shift from AES-CBC—and unpack the recovery key management challenge that trips up organizations that aren't already using Microsoft Account or Azure AD. If your enterprise is still relying on a GPO that disables BitLocker for performance, this episode is your heads-up.

#Windows11 #BitLocker #DeviceEncryption #EnterpriseSecurity #Microsoft #ITAdmin #TPM2.0 #SecureBoot #DataProtection #XTSAES #WindowsEnterprise #Compliance #Padlock #DataRecovery #AzureAD #TechPolicy #FexingoBusiness #BusinessPodcast

Keep every episode free: buymeacoffee.com/fexingo

Microsoft is quietly tightening the screws on Windows 11 Enterprise deployments. As of the July 2026 security update, all new Windows 11 domain-joined devices must also be registered in Azure Active Directory via Hybrid Join — or they won't receive security patches. Lucas and Luna break down what the mandate actually says, how IT admins can prepare, and why Microsoft is willing to risk breaking existing domain-only environments. They walk through the three scenarios that trigger the requirement, what happens if you don't comply, and one PowerShell workaround that buys you 30 days. For IT admins managing legacy domain controllers or air-gapped networks, this change has serious implications for update compliance and future Microsoft 365 integration.

#Windows11 #EnterpriseIT #AzureAD #HybridJoin #Microsoft365 #SecurityPatches #ITAdmin #DomainJoin #ZeroTrust #UpdateCompliance #PowerShell #GroupPolicy #July2026 #FexingoBusiness #BusinessPodcast #Technology #Microsoft #WindowsEnterprise

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has quietly made Universal Print a mandatory feature for Windows 11 Enterprise deployments as of the 2026 feature update. Lucas and Luna explore what this means for IT admins: the shift from on-prem print servers to cloud-based printing, the cost implications per user, and how it affects legacy printer drivers. They discuss a real-world case of a mid-sized law firm that had to migrate 200 printers and the unexpected savings they saw. The episode also covers the timeline for enforcement and whether small businesses are caught in the crossfire. If you manage Windows devices, this change will touch your print infrastructure sooner than you think.

#WindowsPodcast #Microsoft #UniversalPrint #Windows11 #Enterprise #ITAdmin #CloudPrinting #PrintServers #PrintDrivers #Technology #BusinessPodcast #FexingoBusiness #WindowsUpdate #ZeroTrust #PrintMigration #LawFirm #PrintCosts #DriverlessPrinting

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna explore Microsoft's quiet enforcement of Virtualization-Based Security (VBS) for Windows 11 Enterprise devices. They unpack the technical requirements—like TPM 2.0, Secure Boot, and 8GB of RAM—and the performance trade-offs, including benchmark hits of up to 30 percent on older CPUs. The discussion covers how VBS protects against kernel-level attacks, why it's mandatory for new deployments after recent updates, and what IT admins need to check before upgrading. They also touch on the broader trend of Microsoft tightening enterprise security defaults without fanfare. A practical look at a policy shift that affects millions of corporate PCs.

#Windows11 #EnterpriseSecurity #VirtualizationBasedSecurity #Microsoft #VBS #Windows11Enterprise #ITSecurity #ZeroTrust #KernelProtection #TPM20 #SecureBoot #EnterpriseIT #WindowsUpdate #Technology #FexingoBusiness #BusinessPodcast #CyberSecurity #WindowsPodcast

Keep every episode free: buymeacoffee.com/fexingo

In this episode, Lucas and Luna explore Microsoft's quiet mandate for Windows 11 Enterprise: Credential Guard must be enabled on all new deployments. They break down what Credential Guard actually does under the hood, using Windows Defender Credential Guard's virtualization-based security to isolate domain credentials from the operating system. Lucas cites a recent Microsoft security baseline update from June 2026 that makes this mandatory for Enterprise and Education SKUs, and explains why this matters for IT admins managing hybrid or fully cloud-joined environments. Luna asks about compatibility with legacy line-of-business apps and third-party credential providers, and Lucas walks through known issues with smart cards and single sign-on solutions. They also touch on the performance trade-off, noting that Credential Guard requires Hyper-V and adds about 200 to 300 megabytes of memory overhead per user session. The episode closes with practical advice for IT teams: test credential manager delegation and plan for user training around passwordless workflows. This is episode 115 of The Windows Podcast with Fexingo.

#Windows11 #CredentialGuard #Microsoft #EnterpriseSecurity #VirtualizationBasedSecurity #ZeroTrust #ITAdmin #Passwordless #HybridCloud #WindowsDefender #HyperV #SecurityBaseline #EnterpriseIT #Technology #FexingoBusiness #BusinessPodcast #TheWindowsPodcast #WindowsEnterprise

Keep every episode free: buymeacoffee.com/fexingo