Security News Windows 11 New Security Feature Denies Unauthorized Access to System Files

[Parkinsond]

Content source

https://cybersecuritynews.com/windows-11-new-security-feature/

Microsoft has introduced a significant security control in the latest Windows 11 preview update designed to restrict unauthorized interaction with critical system files.

Released as part of the January 2026 non-security preview (KB5074105), this enhancement specifically targets the Storage settings menu, a sensitive area of the operating system that reveals detailed information about drive usage, temporary files, and system-reserved storage.

By implementing a mandatory User Account Control (UAC) prompt, Microsoft aims to prevent unprivileged users and potential threat actors with local access from modifying or analyzing storage configurations without explicit administrative approval.

Windows 11 New Security Feature Denies Unauthorized Access to System Files

Microsoft released a non-security update for Windows 11 24H2 and 25H2 that improves protection against unauthorized access to system files.

cybersecuritynews.com

 

[Sorrento]

Most of the Windows users I know (friends & family) ought not to have access to any settings whatsoever

Fingers that don't understand but like to faff with settings cause more problems than anything, PC's I look after for others & the amount of these is thankfully dwindling as i now act dumb ought to leave things alone so the less that users can change I feel the better

Edit: This includes & especially @Parkinsond (he likes me really)

 

[Parkinsond]

Edit: This includes & especially @Parkinsond

I access settings at least once a month; after each W update, I get sure the OS built number, under "about" tab, has changed, and I clean the remains of udpate files to free disk space under the "storage" tab.

Occasionally, I use installed apps tab to check if there is any unfamiliar app (might be side-installed while installing a known app), which might not be visible in the start menu.

 

[Divergent]

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1082 (System Information Discovery)
The feature mitigates adversaries' ability to enumerate storage configurations and file system details via the GUI.

T1548.002 (Abuse Elevation Control Mechanism
Bypass User Account Control)
While not a bypass, this feature leverages UAC to create a trust boundary around sensitive system information.

Update Telemetry & Artifacts

KB Identifier
KB5074105 (Cumulative Update Preview).

Target Versions
Windows 11 24H2 (Build 26100.7705) and 25H2 (Build 26200.7705).

Trigger Mechanism
Accessing ms-settings:storagesense or navigating to the Storage page now invokes the Consent.exe (UAC) flow.

Operational Context
Previously, any user with an unlocked session could view granular storage details. This update closes that gap, specifically mitigating "shoulder surfing" and unauthorized data manipulation by individuals with physical access.

Remediation - THE ENTERPRISE TRACK (SANS PICERL)

Phase 1: Identification & Containment

Identify
Audit endpoints for Windows 11 version 24H2/25H2. Use WSUS/Intune to identify devices eligible for the January 2026 preview.

Containment
N/A (Feature is defensive). However, ensure Help Desk is aware of the new UAC prompt to prevent false positive tickets regarding "locked settings."

Phase 2: Eradication (Implementation)

Deploy
This is currently an optional update. Enterprise environments should test KB5074105 in a pilot ring before the features are rolled into the mandatory February Patch Tuesday update.

Pre-requisite
Ensure the Servicing Stack Update (SSU) KB5074104 is installed to guarantee reliable installation.

Phase 3: Recovery & Validation

Validation
After reboot, log in as a standard user and attempt to access Settings > System > Storage. Verify that a UAC credential prompt appears.

Rollback
If compatibility issues arise (e.g., with third-party storage management tools), the cumulative update portion can be removed using DISM /Remove-Package, though the SSU cannot be uninstalled.

Phase 4: Lessons Learned

Governance
Update internal documentation to reflect that Storage settings are now a privileged area. Review other sensitive settings pages for similar future hardening.

Remediation - THE HOME USER TRACK

Priority 1: Update Installation
Navigate to Settings > Windows Update and look for the "2026-01 Cumulative Update Preview" (KB5074105). Click Download & Install.

Priority 2: Verification
Once restarted, try to open the Storage settings. If you are using a Standard account (recommended for safety), you should see a prompt asking for an Administrator password.

Priority 3: UAC Configuration
Ensure your User Account Control settings are not set to "Never Notify," as this would bypass the intended security benefit of this feature.

Hardening & References

CIS Benchmark
Ensure User Account Control: Behavior of the elevation prompt for administrators is set to "Prompt for consent on the secure desktop" to maximize the effectiveness of this new control.

Lifecycle Strategy
This update also refreshes local AI models (Copilot+) and fixes explorer.exe crashes, making it a critical stability update beyond just security.

Sources

Cyber Security News

Microsoft Support

 

[Brownie2019]

Microsoft has acknowledged a strange user interface bug affecting specific Windows environments where the password sign-in option appears to vanish from the lock screen.
The issue, which originated with updates released in late 2025, primarily impacts managed IT infrastructures and enterprise devices rather than personal home computers.
The flaw first surfaced after installing the August 2025 non-security preview update, identified as KB5064081 (OS Build 26100.5074).
System administrators and users reported that upon reaching the Windows lock screen, the familiar password icon was missing from the available sign-in options. While this creates immediate confusion for users attempting to authenticate, Microsoft has clarified that the functionality itself remains intact, despite the visual glitch.
According to Microsoft’s technical advisory, the password button is still present but rendered invisible. Users who encounter this “ghost” interface can still access the login field by hovering their cursor over the empty space where the icon typically resides.
Once the hidden placeholder is selected, the standard password text box appears, allowing credentials to be entered and authentication to proceed normally.
The scope of this bug is notably specific. Telemetry data suggests that individuals running Windows Home or Pro editions on unmanaged personal devices are highly unlikely to encounter this anomaly.
The defect is concentrated within enterprise environments, likely triggered by specific Group Policy configurations or mobile device management (MDM) settings common in corporate deployments.
While the visual bug poses no direct security threat, such as an authentication bypass or privilege escalation, it represents a significant usability hurdle that generates support tickets for IT helpdesks.
To resolve the issue permanently, Microsoft has released a fix in the January 29, 2026, preview update, KB5074105 (OS Builds 26200.7705 and 26100.7705). Administrators managing affected fleets are advised to prioritize this update to restore standard visual cues to the login experience.
Organizations that defer the January 2026 update can continue instructing users to use the invisible placeholder workaround, though deploying the patch is recommended to reduce user friction and internal support overhead.

Windows 11 Bug Hides Password Sign-in Option From the Lock Screen

Microsoft has acknowledged a strange user interface bug affecting specific Windows environments where the password sign-in option appears to vanish from the lock screen.

cybersecuritynews.com

 

[Parkinsond]

Windows 11 Bug Hides Password Sign-in Option From the Lock Screen

Microsoft has acknowledged a strange user interface bug affecting specific Windows environments where the password sign-in option appears to vanish from the lock screen.

cybersecuritynews.com

Fortunately, not using any sign-in method for W; if kiddos wanna to use my PC, they are welcome