Microsoft explains why Windows 11 25H2 got twice as heavy due to a key security update

Parkinsond

Level 62
Thread author
Verified
Well-known
Dec 6, 2023
5,051
14,223
6,069
With the November 2025 patch, Microsoft imposed a new security mitigation for the Common Log File System (CLFS) driver in updates to Windows 11 25H2 and Server 2025.
This is a crucial update as it adds a hash-based message authentication code (HMAC) to CLFS logfiles in order to strengthen protection against tampering.

If you are wondering, a Hash-based Message Authentication Code (HMAC) is a cryptographic mechanism used to verify message integrity and authenticity by combining a secret key with a hash function.
The sender computes a hash value over the data and transmits both the data and the HMAC.
The receiver then, using the same secret key, recomputes the hash and checks for a match.
This match is basically what ensures there is no tamper detection.