The Windows Podcast with Fexingo: Microsoft, PC, and Enterprise Windows Conversations

In this episode, Lucas and Luna dive into Microsoft's latest Windows 11 update that quietly tightens printer driver requirements for enterprise devices. Starting with the July 2026 cumulative update, Windows 11 will block unsigned printer drivers by default, a move that could break legacy printers in corporate environments. Lucas explains the technical underpinnings—driver signing, Windows Hardwar...

Episode 103 of The Windows Podcast with Fexingo digs into a little-known Windows 11 Enterprise requirement: secure time synchronization using Network Time Protocol with Kerberos authentication. Lucas and Luna explain why accurate, tamper-proof system time is critical for everything from Kerberos tickets to certificate validation to audit logs. They walk through how Microsoft is quietly mandating N...

Microsoft is quietly rolling out a new Secure Boot baseline requirement for Windows 11 Enterprise devices, mandating a specific set of Secure Boot policies that restrict which bootloaders and kernel drivers can run. This episode breaks down what the new baseline includes, why it targets legacy bootloaders and unsigned kernel modules, and how IT admins can audit compliance. We also explore the tens...

Episode 101 of The Windows Podcast with Fexingo digs into a quiet but significant change in Windows 11: enterprise devices now require Secure DNS (DoH/DoT) by default under certain Group Policy configurations. Lucas and Luna break down how this affects network admins, why Microsoft is pushing encrypted DNS at the enterprise level, and what happens when legacy DNS infrastructure gets in the way. Th...

In episode 100, Lucas and Luna dive into Microsoft's quiet push to make cloud backup a mandatory enterprise feature in Windows 11, starting with the 2026 H2 update. They explore the technical underpinnings—how Windows Backup integrates with OneDrive for Business and Azure Backup—and what this means for IT admins who have relied on third-party tools for years. The hosts discuss the real cost implic...

Episode 99 of The Windows Podcast with Fexingo dives into Microsoft's latest quiet mandate: enterprise network segmentation enforced via Group Policy and Windows Defender Firewall. Lucas and Luna unpack how Windows 11 now requires administrators to define separate network profiles for corporate, guest, and IoT traffic—or risk non-compliance alerts. They examine the technical underpinnings, includi...

Episode 98 of The Windows Podcast digs into a surprisingly consequential Windows 11 security change that most IT admins haven't noticed yet: mandatory print server isolation. Lucas and Luna explain what Microsoft is actually doing under the hood — separating the print spooler service from the rest of the operating system using a new kernel-level container — and why this quietly breaks decades-old...

Microsoft has enabled Virtualization-Based Security by default on every Windows 11 24H2 Enterprise device, with no opt-out for new builds. Lucas and Luna break down what VBS does under the hood, how it impacts CPU performance by 5–15 percent, and why IT admins need to test legacy drivers before the next feature update rolls out. They also discuss the trade-off between security isolation and everyd...

In this episode of The Windows Podcast, Lucas and Luna explore Windows 11's quiet mandate for enterprise application control using AppLocker. Starting July 2026, new enterprise devices must enable AppLocker to whitelist approved software, blocking unauthorized executables, scripts, and installers. Lucas breaks down the policy's impact on IT admins, including the shift from traditional antivirus to...

In episode 95 of The Windows Podcast, Lucas and Luna explore a quiet but consequential addition to Windows 11: new Group Policy settings that let IT admins control File Explorer's interface, context menus, and default views across thousands of machines. Lucas explains how Microsoft's latest enterprise build, version 24H2, introduces over a dozen policies under 'Windows Components > File Explorer'...

In this episode of The Windows Podcast with Fexingo, Lucas and Luna explore Microsoft's quiet push to make dedicated-purpose devices a core enterprise strategy. They focus on the new Windows 11 kiosk mode features announced for the 2025 update—specifically, the ability to run a single Microsoft Edge app in full-screen without a taskbar or desktop, enforced through Intune policies. Lucas explains h...

Episode 93 of The Windows Podcast with Fexingo drills into a quiet but sweeping mandate: all Windows 11 Enterprise and Education devices must now have BitLocker full-disk encryption enabled by default. Lucas and Luna unpack the policy shift, which started rolling out in preview builds and became standard with the 2025 feature update. They walk through the technical requirements — TPM 2.0, Secure B...

Microsoft has quietly added a new requirement for enterprise Windows 11 deployments: enforced USB device control via Group Policy. In this episode, Lucas explains the technical details behind the policy, which blocks all USB storage devices by default unless explicitly approved. Luna questions whether this will cause chaos for IT departments and users alike. They walk through the policy path, how...

Microsoft has been steadily tightening Windows 11 security defaults for enterprise PCs. In this episode, Lucas and Luna focus on one specific mandate rolling out this year: Credential Guard. They explain what Credential Guard actually does — isolating Kerberos and NTLM secrets inside a virtualized container so that even if an attacker gains admin rights, they can't dump cached passwords or pass-th...

Microsoft has been quietly adding requirements to Windows 11 enterprise editions, and the latest is Local Administrator Password Solution (LAPS). Starting with the 2025 feature update, Windows 11 Pro and Enterprise will require a local admin password management tool—either Microsoft's built-in LAPS or a third-party equivalent—for all domain-joined devices. This episode breaks down what LAPS does,...

In this episode, Lucas and Luna dive into how Windows 11 is quietly mandating enterprise certificate auto-enrollment for all domain-joined devices. They break down what this means for IT admins: no more manual certificate requests, but also tighter control over device identity. The discussion covers the shift from user-based to machine-based certificates, the role of Active Directory Certificate S...

Episode 88 of The Windows Podcast dives into a little-known Windows 11 security mandate that's quietly rolling out for enterprise PCs: Kernel DMA Protection. Lucas explains how this blocks direct memory access attacks by peripheral devices like Thunderbolt docks and PCIe cards, why it's now enforced for new hardware certification, and what IT admins need to check before their next hardware refresh...

Microsoft is quietly pushing enterprise Windows 11 devices to use DNS over HTTPS by default, starting with the 2025 feature update. Lucas and Luna break down what this means for IT admins: the shift from network-level DNS filtering to encrypted DoH, the impact on security monitoring tools that rely on plaintext DNS, and how Microsoft is enforcing this via Group Policy and MDM settings. They also d...

Episode 86 of The Windows Podcast digs into Microsoft's quiet new requirement: every Windows 11 Enterprise device must have a hardware security module (HSM) or a TPM-backed virtual HSM for key storage by the end of 2026. Lucas explains what an HSM is — a tamper-resistant chip that stores encryption keys separately from the CPU — and why Microsoft is now mandating it after years of optional support...

Episode 85 of The Windows Podcast with Fexingo. Lucas and Luna unpack Microsoft's quiet requirement that enterprise printers using port 9100—the decades-old raw TCP/IP standard—must now use encryption. They trace the change from a July 2025 Windows 11 24H2 preview build to the current July 2026 mandatory security baseline. Lucas explains why this breaks thousands of pre-2020 office printers and ho...

Microsoft is quietly turning a recommendation into a requirement: by the end of 2026, Windows 11 Enterprise devices must escrow BitLocker recovery keys to Entra ID or face compliance failures. Lucas and Luna break down the technical details, the timeline, and what IT admins need to do before the deadline hits. They discuss the difference between device encryption and full BitLocker, why passive re...

Episode 83 of The Windows Podcast with Fexingo dives into Microsoft's quiet but sweeping mandate: TPM 2.0 is now required for all Windows 11 Enterprise devices, not just new PCs. Lucas and Luna unpack what this means for IT teams managing fleets of older hardware — from the 2016-era Lenovo ThinkPad T460s that lacks a TPM 2.0 module to the compliance deadlines hitting in Q4 2026. They explore the s...

In this episode of The Windows Podcast, Lucas and Luna uncover how Windows 11 is quietly mandating enterprise printer driver isolation—a security feature that runs printer drivers in isolated processes to prevent crashes and exploits. They discuss the three isolation modes: none, isolated, and full, and explain why Microsoft is pushing full isolation by default through Group Policy and MDM setting...

Episode 81 of The Windows Podcast examines a little-known security policy in Windows 11 that forces enterprise Wi-Fi password rotation every 30 days. Lucas and Luna break down how Microsoft is leveraging the Wi-Fi Protected Access 3 (WPA3) standard and the 802.1X authentication framework to automatically rotate pre-shared keys in managed environments. They discuss the impact on IT departments mana...

In this episode of The Windows Podcast with Fexingo, Lucas and Luna explore Microsoft's quiet move to require Wi-Fi 7 support in Windows 11 enterprise devices starting in late 2026. They break down what Wi-Fi 7 brings — theoretical speeds up to 46 Gbps, multi-link operation combining 2.4, 5, and 6 GHz bands, and 4096-QAM modulation — and why Microsoft is making it a hardware certification requirem...