Microsoft is rolling out a quiet but significant policy shift in Windows 11 Enterprise: mandatory Zero Trust DNS enforcement via the Windows DNS client. In this episode, Lucas and Luna break down what the change actually means for IT admins—how it moves DNS validation from optional to enforced, the role of the DNS-over-HTTPS policy, and why this closes a long-standing gap in Microsoft's Zero Trust architecture. They discuss real-world deployment concerns, including compatibility with legacy DNS servers and the impact on existing network monitoring tools. If you're managing Windows 11 Enterprise devices, this is a policy you need to know about before it starts blocking DNS traffic you didn't expect. No fluff, just the technical angle.

#Windows11 #ZeroTrustDNS #MicrosoftEnterprise #DNSoverHTTPS #WindowsSecurity #ITAdmin #EnterpriseIT #NetworkSecurity #Microsoft #WindowsPodcast #FexingoBusiness #BusinessPodcast #ZeroTrust #DNS #GroupPolicy #Windows11Enterprise #TechPodcast #EndpointSecurity

Keep every episode free: buymeacoffee.com/fexingo

Microsoft has been quietly tightening Windows 11 Enterprise security requirements, and the latest mandate is Kernel DMA Protection for all new certified PCs. Lucas and Luna dive into what this means for IT admins: the hardware requirements (Intel VT-d, AMD IOMMU, or Qualcomm's hypervisor), the threat model it addresses (Thunderbolt and USB-C direct memory access attacks), and the gotchas for legacy peripherals. They discuss the phased rollout starting with Windows 11 24H2 and how this fits into Microsoft's broader zero-trust push. A concrete look at a security feature that's easy to miss but hard to disable.

#Windows11 #KernelDMAProtection #EnterpriseSecurity #Microsoft #ITAdmin #Thunderbolt #ZeroTrust #DirectMemoryAccess #IntelVTd #AMDIOMMU #Windows11Enterprise #DeviceSecurity #Fexingo #BusinessPodcast #Technology #PC #EndpointSecurity #HardwareSecurity

Keep every episode free: buymeacoffee.com/fexingo

In Episode 112 of The Windows Podcast with Fexingo, Lucas and Luna dive into Microsoft's quiet tightening of TPM 2.0 requirements for Windows 11 enterprise deployments. Starting with a specific case — a mid-sized manufacturer that discovered its fleet of 2018 Dell OptiPlex systems lacked TPM 2.0 modules — they unpack the hardware reality: roughly 15 percent of enterprise PCs in circulation still don't meet the spec, according to a July 2026 Lansweeper survey. The conversation covers why Microsoft is enforcing this now, how IT admins can audit compliance via PowerShell and Microsoft Intune, and the real-world cost of retrofitting — about $25 per motherboard for a TPM module, or hundreds per machine for new hardware. They also address the security rationale: TPM 2.0 anchors BitLocker, Windows Hello for Business, and Virtualization-Based Security. No clickbait, just the numbers and the practical path forward.

#TPM20 #Windows11 #EnterpriseIT #Microsoft #HardwareMandates #BitLocker #WindowsHelloForBusiness #VirtualizationBasedSecurity #Intune #PowerShell #ITCompliance #Lansweeper #DellOptiPlex #Cybersecurity #Technology #FexingoBusiness #BusinessPodcast #PodcastEpisode

Keep every episode free: buymeacoffee.com/fexingo

Microsoft is adding a new security requirement to Windows 11 Enterprise: Secure DMA (Direct Memory Access) protection must be enabled on all devices with Thunderbolt or USB4 ports. This prevents DMA attacks where a malicious device plugged into a port reads sensitive memory. Lucas explains how the change works, why IT admins need to audit hardware now, and what happens if a device doesn't meet the new baseline. Luna brings a real-world case: the 2019 Thunderclap vulnerability that exposed millions of machines. The hosts break down the phased rollout in Windows 11 24H2 and 25H2, the difference between Kernel DMA Protection and the new Secure DMA policy, and how to check compliance via MSInfo or PowerShell. This episode gives IT pros a concrete checklist for their next hardware refresh cycle.

#Windows11 #SecureDMA #Thunderbolt #USB4 #Microsoft #EnterpriseSecurity #ITAdmin #DMAProtection #KernelDMAProtection #Thunderclap #HardwareSecurity #WindowsSecurity #Technology #FexingoBusiness #BusinessPodcast #WindowsPodcast #EndpointSecurity #ITCompliance

Keep every episode free: buymeacoffee.com/fexingo

In episode 110 of The Windows Podcast, Lucas and Luna explore Microsoft's latest quiet mandate: Windows 11 Enterprise now requires all print drivers to be signed by the Windows Hardware Compatibility Program. They break down the shift from Windows 8's inbox print class driver model, why legacy v3 and v4 drivers are being phased out, and what this means for IT admins managing mixed-vendor printer fleets. Lucas cites a real-world case of a mid-sized company that had to replace 15 year-old label printers because the manufacturer never updated their WHCP signing. Luna questions whether this actually reduces vulnerabilities or just pushes the cost onto IT teams. The episode balances practical deployment advice with critique of Microsoft's tightening grip on peripheral drivers.

#Windows11 #Microsoft #PrintDrivers #WHCP #WindowsHardwareCompatibilityProgram #EnterpriseIT #PrinterSecurity #PrintNightmare #DriverSigning #ITAdmin #PrintServer #LegacyDrivers #V3Drivers #V4Drivers #PrintClassDriver #EnterpriseWindows #TechPodcast #FexingoBusiness

Keep every episode free: buymeacoffee.com/fexingo

In this episode of The Windows Podcast, Lucas and Luna dive into Microsoft's latest quiet mandate: Windows 11 now requires smart card authentication for all enterprise users. Starting with the updated Windows 11 24H2 release, the default security baseline enforces certificate-based authentication via smart cards or Windows Hello for Business, effectively phasing out password-only logins. Lucas explains the technical shift from a 'password optional' world to a 'password forbidden' one, citing the August 2025 security baseline update that made smart card or FIDO2 tokens mandatory for domain-joined devices. Luna questions the real-world impact on IT admins managing thousands of users, especially those in remote or small-office settings. The hosts discuss the driver behind this: the rise in credential theft attacks, with Microsoft reporting a 120 percent increase in password-based breaches in 2025. They also explore the challenges for enterprises still relying on legacy apps that don't support certificate authentication. The episode closes with a practical tip for IT teams to start testing with a pilot group and the critical need for a break-glass emergency account. A must-listen for any IT pro managing Windows 11 enterprise deployments.

#Windows11 #EnterpriseSecurity #SmartCard #Microsoft #WindowsHello #FIDO2 #CertificateAuthentication #ITAdmin #ZeroTrust #Passwordless #SecurityBaseline #WindowsPodcast #Technology #CyberSecurity #FexingoBusiness #BusinessPodcast #ITSecurity #Authentication

Keep every episode free: buymeacoffee.com/fexingo

Episode 108 of The Windows Podcast with Fexingo. Lucas and Luna drill into Microsoft's quiet mandate for Remote Credential Guard in Windows 11 enterprise deployments, effective with the 2026 feature update. They break down how the feature prevents pass-the-hash attacks by redirecting Kerberos authentication to the remote machine, why it breaks legacy admin workflows, and what IT admins need to do before the deadline. Specific numbers: 80% reduction in lateral movement attacks in early adopter studies. Includes an honest moment about how listener support through buy me a coffee dot com slash fexingo keeps the show ad-free.

#Windows11 #RemoteCredentialGuard #Microsoft #EnterpriseSecurity #CredentialGuard #Kerberos #PassTheHash #LateralMovement #ITAdmin #ZeroTrust #Authentication #WindowsSecurity #Episode108 #TheWindowsPodcast #FexingoBusiness #Technology #BusinessPodcast #Cybersecurity

Keep every episode free: buymeacoffee.com/fexingo

Microsoft is quietly enforcing Always-On VPN for Windows 11 Enterprise devices through a new policy that automatically establishes a VPN connection whenever a device is network-connected. This episode unpacks how the policy works, what it means for IT admins, and why it matters for security. Lucas explains the technical mechanism — triggered via Group Policy or MDM with a new VPN profile flag — and Luna questions the potential impact on remote workers and latency-sensitive applications. We discuss the convergence of Zero Trust and network access control, and why Microsoft is pushing this now in mid-2026. Plus: a brief note on how listener support keeps this show independent. If your organization manages Windows 11 fleets, this policy is already on your radar — or should be.

#Windows11 #AlwaysOnVPN #EnterpriseSecurity #ZeroTrust #GroupPolicy #MDM #Microsoft #VPNPolicy #NetworkAccessControl #ITAdmin #RemoteWork #SecurityCompliance #WindowsEnterprise #Fexingo #BusinessPodcast #Technology #CyberSecurity #DeviceManagement

Keep every episode free: buymeacoffee.com/fexingo

This episode of The Windows Podcast with Fexingo explores Microsoft's quiet mandate that all Windows 11 enterprise devices must support WPA3 for Wi-Fi connections. Lucas and Luna discuss what WPA3 is, why Microsoft is pushing it now in mid-2026, and how it impacts enterprise IT teams still using legacy WPA2 infrastructure. They break down the specific security improvements in WPA3—like Simultaneous Authentication of Equals (SAE) that prevents offline dictionary attacks—and the practical challenges of upgrading access points and supplicants. The conversation also touches on Windows 11's new Wi-Fi settings panel that surfaces WPA3-only networks differently, and the timeline for enforcement in upcoming cumulative updates. If your organization manages Windows laptops or tablets, this episode gives you a roadmap for compliance and a warning about legacy device compatibility.

#Windows11 #WPA3 #EnterpriseWiFi #MicrosoftSecurity #NetworkSecurity #WiFiSecurity #ITManagement #EnterpriseIT #WindowsPodcast #FexingoBusiness #BusinessPodcast #Technology #CyberSecurity #WirelessNetworking #SAE #LegacyInfrastructure #Compliance #ZeroTrust

Keep every episode free: buymeacoffee.com/fexingo

Episode 105 of The Windows Podcast digs into Microsoft's latest quiet mandate: Windows Defender Application Control (WDAC) is now required for all Windows 11 Enterprise devices. Lucas and Luna explain how WDAC differs from AppLocker (covered in Ep 97), why it's more secure, and what IT admins need to know about deployment, auditing, and policy creation. They walk through a real-world example of a financial services firm that rolled out WDAC to 5,000 endpoints, cutting software exploit incidents by 80%. The episode also covers the transition from AppLocker to WDAC, the importance of signed policies, and how to use Microsoft's built-in tools to avoid common pitfalls. A must-listen for enterprise IT pros managing Windows 11 security baselines.

#Windows11 #WDAC #AppControl #EnterpriseSecurity #Microsoft #WindowsDefender #ITAdmin #ZeroTrust #EndpointSecurity #AppLocker #GroupPolicy #Intune #CyberSecurity #Technology #FexingoBusiness #BusinessPodcast #WindowsPodcast #EnterpriseIT

Keep every episode free: buymeacoffee.com/fexingo