Microsoft introduces Windows "Quick Machine Recovery" to prevent another CrowdStrike-like incident

[Alfonso Maruccia]

In context: The CrowdStrike incident impacted millions of Windows PCs worldwide, disrupting numerous industries and leaving a significant dent in Microsoft's business confidence. In response, the company has had to refocus its development efforts, making substantial commitments to reshape the future of the Windows platform.

Microsoft in recent months has committed to significantly enhancing security across the Windows ecosystem. The company is reportedly working to ensure that even a non-bootable OS can be updated and repaired, a promising step forward in its efforts to bolster reliability and protection.

At the recent Ignite 2024 conference, Microsoft unveiled several upcoming changes for Windows users, set to roll out over the next few quarters. Central to these updates is the Secure Future Initiative, which positions security as a "foundational" pillar for every product. Currently, an estimated 34,000 developers are working full time to address these top-priority challenges.

One of the first tangible outcomes of SFI is Quick Machine Recovery (QMR), a feature designed to prevent disasters like the infamous "July incident." Microsoft explained that QMR will empower IT administrators to deploy targeted fixes via Windows Update, even on machines that are unable to boot.

Quick Machine Recovery will operate remotely and is slated to join the Windows Insider Program in early 2025. Meanwhile, Microsoft is urging customers to prepare for the end of Windows 10 support, emphasizing that Windows 11 is "secure by default." The company is advising enterprise organizations to complete their migration to the newer operating system without delay.

Windows 11 is set to receive several new security enhancements in the coming months. Among them is a novel "administrator protection" feature designed to make standard user accounts more practical. This feature will allow users to grant temporary administrator rights through Windows Hello when performing system changes. A temporary, "isolated" admin token will be created for the task and automatically destroyed upon completion, minimizing potential vulnerabilities.

Microsoft is also introducing stronger protections for access credentials, smart app control policies, data security, and OS management tools.

A major shift in the Windows security architecture is on the horizon as well: the company plans to remove security software from the Windows kernel entirely. This move will compel antivirus and security tools to operate in standard user mode, aligning them with other non-privileged programs. The initiative marks a fundamental change to the Windows software ecosystem, with a private preview expected to launch in July 2025.

Permalink to story:

Microsoft introduces Windows "Quick Machine Recovery" to prevent another CrowdStrike-like incident

 

[AnilD]

Removing antivirus from the kernel is bold—if it works, it could finally stop AV software from acting like it's part-time malware.

34,000 developers working on security is like an entire small country's workforce dedicated to stopping us from installing Chrome via Edge.

 

[Gars]

Maybe im blind
but if MS need to take direct control of your system, why is that a news
if you use it - u r
nothing new, just a new way - like the viruses, MS mutated
I dont understand how long it takes for tech savvy ppl to get it

 

[trents]

So, does removing antivirus from the kernel mean the end of Windows Defender such that we will of necessity deploy third party antivirus/antimalware solutions like we did in yesteryear?

 

[brucek]

34,000 developers are assigned fulltime to this feature? I'm going to need to see the task breakdown on that...

And just think, before Microsoft/GitHub CoPilot, they would have needed more like 128,000! (kidding).

 

[maxxcool7421]

As someone in the AV industry this is stupid. If you remove AV from the kernel then the only thing in the kernel will be rootkits and MS products .. and MS av is .. uh .. not great. good luck folks.

 

[Phylop]

Quick Machine Recovery will operate remotely...

What exactly does this mean?

 

[ZedRM]

Quick Machine Recovery? Remotely executed? This is not security, it's another way for Microsoft to control things.

 

[LimyG]

Quick Machine Recovery? Remotely executed? This is not security, it's another way for Microsoft to control things.

Right. They'll likely screw it up though and end up reversing it. Or try to save face by patching whatever new problems they introduce. Then another security nightmare, complete with our favourite blue screens and non functioning Windows.

Win 10 or Win 11. Re: security with MS at the helm there really is no point upgrading from 10 to 11 if the reason is security. MS look rather foolish these days.