So far, we have taken a look at Search, Widgets, the Start menu, Snap Layouts and Snap Groups, the Taskbar, quick settings and notifications, Virtual Desktops, power and battery settings, default apps configurations, File Explorer, context menus, Teams integration, the updated Clock app in Windows 11, the Microsoft Store, the Snipping Tool, the Paint app refresh, and the lock screen. Today, we'll be discussing the updated Photos app available in Windows 11.

For the purpose of this hands-on, we'll be taking a look at the generally available Windows 11 build versus a publicly available and up-to-date Windows 10 (version 21H1 build 19043.1288).

As usual, we'll start off with what's available presently in Windows 10. I'll be honest and say right off the bat that the Photos app is not part of my usual workflow. Image editing or even taking photos is not something I do on a daily basis, and the Photos app has been so slow and crash-prone in my previous brief experiences with it that I actually dread scenarios where I'm forced to use it.

When you launch the Photos app, you'll see the Collections page where you'll see some groupings of photos at the top and images in chronological order in the bottom half of the screen. It can appear fairly cluttered but shows a decent amount of information. There are other tabs available too such as Albums, People, Folders, and Video Editor. Folders are essentially pointers to directories in Windows where you store images, while Albums are groupings of similar images based on date or anything else, really. You can add new Folders and Albums fairly easily too. The People tab is where you can utilize Microsoft's AI technology to automatically detect faces in images and group them together, but if you're privacy-conscious, you can simply choose not to enable it. That is the default configuration too. There is also a search bar at the top-center through which you can search for specific images, provided that you use decent keywords.

Before we go to the Video Editor tab, let's first wrap up the images section by talking about the image-editing experience. When you click on any image in the Photos app, it opens up in a dedicated window showing you some basic options such as zoom, delete, crop, rotate, share, and print. There are also a bunch of other options in the three-dotted menu on the far-right corner including a slideshow, file info, resize, set as desktop wallpaper, and more. But if all of this is not enough for you, there is also a dedicated Edit & Create drop-down that gives you some relatively advanced editing options including Edit, Draw, Add 3D effects, Add animated text, Create a video with music, and Edit with Paint 3D.

All of the aforementioned options provide what I would call an adequate set of image-editing capabilities. You'll see all the usual stuff including filters, lighting adjustments, drawing, effects from Microsoft's 3D library, fancy texts, integration with Paint 3D, and video editor. It's not meant for advanced users or professional users but it might scratch the Instagram bug in you if you're into that sort of stuff.

Photos also has a basic video editor built-in. You can either use your existing photos to create a video project or start a new one from scratch. I haven't used it a lot but it is very similar to the image-editing experience because it borrows most of its capabilities including filters, 3D effects, and more. But there are also other video-specific configurations such as title cards, duration for frames, and motion that can zoom or pan into specific portions of the frame. You can also add music to your videos (obviously), change the aspect ratio, and export the video using hardware acceleration. Interestingly though, exports seem to be only available in MP4 format. Overall, the whole experience is not too advanced, and I think it's adequate for some basic use-cases.

Finally, we have a dedicated Settings page, which I think wastes a whole lot of space and requires you to scroll quite a bit to see all the available options. This is a complaint that I have with settings in most native system apps as well the OS settings UI so it's nothing surprising.

It enables you integrate Photos with OneDrive, link duplicates, toggle mouse wheel to zoom, allow automatic generation of albums, indexing, and more. There's a decent amount of stuff to customize here, I just think it wastes a lot of space and it's difficult to find what you're looking for. The least it could do is add a search bar at the top to increase efficiency.

If you're wondering why I spent so much time discussing the Photos app in Windows 10, that's because the Photos app in Windows 11 offers the same functionality and the changes are only cosmetic. A key point of our Closer Look series is to give our readers a view of the new features they'll be getting if they upgrade from Windows 10 to Windows 11 and what they'll be missing out on if they don't. In case of Photos, it turns out that you won't be missing out on anything except some UI changes.

When you launch the Photos app in Windows 11, you may not notice any difference right away. And that is because there have been no major changes made to the landing page, just some minor icon changes. You'll notice that all the icons on the top-right are fresh but offer exactly the same functionalities. The Collection, Albums, People, Folders, and Video Editor tabs are still there. The search bar just has rounded corners.

That said, I did experience some bugs in my experience with the Photos app in Windows 11. The "Recent" and "On this day" album thumbnails won't show the image for me until I hover my cursor over it, and even when I do that, the images keep fading in and out. I though that this was because it has not loaded the images from OneDrive yet, but then I opened the album and all the images are loaded, so it's definitely not related to the availability of images. I haven't changed any settings in Photos on either Windows 10 or Windows 11 and both are integrated with OneDrive so this definitely seems like a bug.

The dedicated basic image-editing experience is where you might start to notice more changes to the UI. All the available options have been moved to the center of the app and there is a new button to add images to your favorites collection too. I think this is a neat change and something that I may find a use-case for if I do get around to using Photos in my daily workflow.

All the icons have been revamped but I have mixed feelings about them personally. I find it hard to figure out what an icons means. If I go from left to right in the image above, the icons are See all favorites, Zoom in, Zoom out, Rotate, Edit image, Draw, Delete, Add to favorites, File information, See more. Differentiating between the Edit image and Draw icons is a bit confusing for me. This also feeds into my thought process that Edit and Draw functionalities should be in a unified UI rather than being split, since they are both a part of the image editing experience overall. The three-dotted menu also offers integration with third-party Microsoft Store apps that you have downloaded on your device such as Picsart. It essentially acts as a launcher for those apps if you're inclined to use them for your image-editing workflow. There is also a dedicated button to view images in fullscreen, which is decent addition.

You'll also notice that references to Paint 3D have been removed, because it is effectively been killed off, as we discussed last week. If you're wondering if other 3D options have been done away with too, that's not the case; they have simply been moved inside the three-dotted menu. It's clear that they are not a top priority for Microsoft right now. The cropping icon is missing too, which I think is a bit odd considering it's a capability that most image-editing tools that I have used offer at your fingertips, but all other settings seem to be intact. There is a new multi-viewing experience that allows you to compare multiple photos in the same UI and while Microsoft made a big deal about it in it's blog post, I think it's a fairly basic feature, because it does nothing on top of that really. The company could have expanded this functionality to include the creation of collages too, but this potential is not utilized.

The Edit and Draw settings have new icons too. Similar to the basic editing UI discussed before, Microsoft seems to have done away with text descriptions for icons completely unless you hover your cursor over them. This might make sense for many, but personally, I have mixed views as it requires me to familiarize myself with all of Microsoft's icons without any immediately visible textual hint. This is problematic not only because there is no standard set of icons used by companies all over the world but also because the Redmond tech giant itself isn't known for UI consistency either. Maybe I'll get used to it with the passage of time, but for now, it's just adding difficulty to an app that I'm not a fan of in the first place. Functionality-wise though, the editing experience is the same.

The video-editing experience is essentially the same as Windows 10 too. You'll get some new icons here and there but the overall functionality set is exactly the same. Exports are still limited to the MP4 file format too. There's not much else to talk about here.

Unfortunately, the Settings UI hasn't received much of an update either. The Add a folder icon is new but the rest is the same. You still have to scroll a lot and there is no search bar. I wouldn't call the addition of a new icon a massive improvement as compared to Windows 10.

Overall, the updated Photos app in Windows 11 still hasn't established a strong use-case for itself, at least in my opinion. It offers the same capabilities as Windows 10 and just furnishes the experience with some redesigned menus and icons. There are some nifty additions in there including the launcher-like integration with third-party photo-editing apps and multi-view UI but I think they could benefit from some maturity, especially the latter, which just feels shoehorned at this point.

The Photos app still isn't as performant as I would like it to be and is occasionally buggy. The new icons will take some time getting used to and so will the redesigned menus. The image-editing tools are still fairly basic and as I discussed in a previous Closer Look, I just think it's strange that the company doesn't provide obfuscation capabilities in any of its image-related apps.

Pro users who complained about lack of advanced video and image-editing functionalities and support for more file types in the Photos app on Windows 10 will have the same complaints with the Windows 11 revamp. Almost all of the modifications are related to cosmetics and the backend functionality remains mostly the same. If you're an active user of Photos on Windows 10, you're not missing out on much in that department by not upgrading to Windows 11.

Closer Look: Photos app in Windows 11

The new Settings app uses a sidebar and breadcrumbs to help users easily navigate between different pages, and it also features new controls for customization, managing network, power usage, disk management, and more.

The settings app has been significantly improved, but several Control Panel features are still missing.

Thankfully, Windows 11 still comes with the Control Panel and File Explorer-based advanced configuration page called "God Mode" that allows you to easily access all advanced tools, features, and tasks.

With God mode, you can access the advanced management features in one location and it's better than the modern settings.

Enable God Mode in Windows 11

To access God Mode in Windows 10, create a special shortcut folder, as highlighted in the steps below:

1. On the desktop, right-click anywhere.
2. Select “New” option and click on "Folder"

   

    

3. Right-click the new folder.
4. Rename the folder to the following command:
   GodMode.{ED7BA470-8E54-465E-825C-99712043E01C}

   

    

5. Press enter.

You can double-click on this folder to open God Mode.

Once done, you will be presented with a page similar to the above screenshot. As you can see, Windows 11's God mode offers a familiar experience and it also restores the classic view of File Explorer.

To improve the experience, you can also use CLSID, a unique identifier to access other settings pages directly from the desktop.

For example, you can create folder with the name "{D20EA4E1-3957-11d2-A40B-0C5020524153}" to open Administrative Tools, such as the defragmentation tool, disk format options, etc.

You can also try these values:

• Network - {F02C1A0D-BE21-4350-88B0-7367FC96EF3C}
• Bluetooth - {28803F59-3A75-4058-995F-4EE5503B023C}
• Mouse properties - {6C8EEC18-8D75-41B2-A177-8831D59D2D50}
• Personalization - {ED834ED6-4B5A-4bfe-8F11-A626DCB6A921}
• Troubleshooting - {C58C4893-3BE0-4B45-ABB5-A63E4B8C8651}

How to unlock Windows 11's God Mode to access advanced settings

Microsoft is testing fix for Windows 11 File Explorer performance issue in Dev channel

Sysinternals offers a wide variety of advanced system utilities that let you perform administrative tasks in Windows or get detailed information about the internal functions and processes of the operating system.

Some of the well-known Sysinternals utilities include:

• Process Explorer - A graphical utility that allows you to see what processes are running on a computer, what DLLs they have loaded, and more.
• Process Monitor - View file system, Registry, process, and thread activity in real time.
• Sysmon - Monitors system activity for various behavior and activity, which is then logged to the Windows Event Log.
• PSExec - Allows you to execute commands on remote systems. 

Sysinternals' utilities can be downloaded as an all-in-one package called Sysinternals Suite, or individually from their website or the https://live.sysinternals.com/ site.

Sysinternals Suite now auto-updated

The Sysinternals utilities are updated often, but none offer a built-in automatic update feature, forcing users to manually download new versions as they are released.

Starting this week, Microsoft now offers the Sysinternals Suite in the Microsoft Store on Windows 10 and Windows 11, allowing the utilities to be automatically updated as new versions are released.

After installing the Sysinternals Suite, users will get access to the following individual utilities.

AccessChk, AccessEnum, ADExplorer, ADInsight, ADRestore, Autologon, Autoruns, BGInfo, CacheSet, ClockRes, Contig, Coreinfo, CPU Stress, DebugView, Desktops, Disk2vhd, DiskExt, DiskMon, DiskView, DU (Disk Usage), EFSDump, FindLinks, Handle, Hex2dec, Junction, ListDLLs, LiveKd, LoadOrder, LogonSessions, MoveFile, NotMyFault, NTFSInfo, PendMoves, PipeList, ProcDump, Process Explorer, Process Monitor, PsExec, PsFile, PsGetSid, PsInfo, PsKill, PsList, PsLoggedOn, PsLogList, PsPasswd, PsPing, PsService, PsShutdown, PsSuspend, RamMap, RDCMan, RegDelNull, Regjump, RU (Registry Usage), SDelete, ShareEnum, ShellRunas, Sigcheck, Streams, Strings, Sync, Sysmon, TCPView, Testlimit, VMMap, VolumeID, WhoIs, WinObj, and ZoomIt.

As new versions of the individual utilities are released, Microsoft will repackage them into the Sysinternals Suite, which will then be updated via the Microsoft Store.

By installing the utilities in this manner, you will no longer have to find newer versions and download them manually.

For those using the Winget, you can now update the Sysinternals Suite through the package manager as well.

Sysinternals apps can now auto-update via the Microsoft Store

AMD's Secure Memory Encryption (SME) feature has been found to be causing issues to certain Linux systems and as such, the feature will be disabled by default from now on. The issue was discovered on October 5 by Linux engineer Paul Menzel.

The SME feature is apparently causing boot failures on certain AMD Raven Ridge systems The issue was detected on a Ryzen 3 2200G system which was paired up with an MSI B350M MORTAR motherboard. In other Ryzen PCs, with SME enabled, black screen problems - something AMD is closely familiar with - have also been reported. Hence, the problem might be present on other Zen-based processor families too.

Selecting the symbol `AMD_MEM_ENCRYPT` – as done in Debian 5.13.9-1~exp1 [1] – also selects `AMD_MEM_ENCRYPT_ACTIVE_BY_DEFAULT`, as it defaults to yes, causing boot failures on AMD Raven systems. [...] It even causes black screens on other systems as reported to the Debian bug tracking system

Do not enable AMD memory encryption in Kconfig by default due to shortcomings of some platforms, leading to boot failures.

For those wondering what SME or Secure Memory Encryption is, the feature allows encryption of system DRAM so as to protect sensitive data inside it from hacking efforts or attacks.

Source: LKML via Freedesktop

AMD SME causing boot failures and black screen issues on Ryzen Linux systems

One major issue affects AMD processors, which may see a performance drop by up to 15% on Microsoft's newest operating system. The situation worsened after the release of the first cumulative update for Windows 11 this Tuesday. A patch is already available for testing but stable version users need to wait a bit longer before it is made available to their machines.

Microsoft confirmed another performance issue on Windows 11 this week. The company released build 22478 to the Developer channel, bringing new fluent emoji to the operating system and a number of fixes.

One fix addresses the performance issue in File Explorer, which occurs when users navigate between folders in File Explorer.

Fixed an issue where the command bar was doing unnecessary calculations when navigating to folders, causing an unexpected decrease in performance. This is also believed to be the root cause of performance issues when using drag to select files, as well as using the arrow keys to navigate in certain folders.

Folder navigation is one of the core activities in File Explorer, considering that users need to navigate to different folders often to access files stored in those folders.

Microsoft did not reveal details on the performance degradation, only that File Explorer's new Command Bar is performing unnecessary calculations. The Command Bar replaced the traditional Ribbon interface of File Explorer in Windows 10.

The new File Explorer has usability issues, e.g. that it has two context menus instead of just one when users right-click. First, the new Microsoft designed one with just a few functions, and then the Windows 10 menu with all functions. The classic File Explorer context menu can be restored, however.

Some of the options change depending on the type of folder or drive that is displayed. A CD or DVD drive may display additional options, e.g. eject, than a regular folder on a hard drive.

Drag & drop operations, and keyboard navigation are always affected by the performance issue.

There is no workaround for the issue currently. Affected users may use a third-party file manager for the time being. Options include recently reviewed apps such as Imperium, Sigma File Manager, or Altap Salamander.

The fix is being tested in the developer build currently. Microsoft has not revealed an ETA for the update, but a likely target is the next cumulative update for Windows 11, which will be released on November 9, 2021.

Closing Words

It is usually a good idea to wait months before upgrading Windows to a new version. The smaller updates for Windows 10 that Microsoft released since 2020 may be an exception, as they happen to introduce less bugs and issues.

Users who upgraded to Windows 11 this month face a number of issues, of which only some are confirmed officially by Microsoft.

Windows 11 File Explorer may slow down PCs

If you have been using a Windows 11 virtual machine in VMware Workstation Pro with TPM enabled, you will be used to having to set and enter a password for each encrypted VM, but with this update you can now remove the encryption and add in the software level TPM flag instead. Fortunately, the flag also works in the free VMware Workstation Player.

The following assumes you have not encrypted the VM further with BitLocker within Windows, if you have you may need to decrypt the drive first before performing the steps below.

If you already added TPM to Windows 10 or 11:

• Ensure you are updated to version 16.2.0 (Pro - Player ~600mb)
• Open Edit virtual machine settings
• In the Hardware tab Remove the TPM
• In the Options tab click on Access Control, then Remove Encryption

This will take some time depending on how large your VM is, when it completes, you can back out of the Virtual Machine settings.

Adding software level TPM to Workstation Pro and Workstation Player

• Ensure you are updated to version 16.2.0 (Pro - Player ~600mb)
• Ensure VMware (manager) is not running
• Go to the directory where the VM is stored (for example D:\VM\Windows 11 Dev)
• Open the file with the .vmx extension with Notepad
• Add the line managedvm.autoAddVTPM = "software"
• Save the file by closing it
• Double click on it to open it in VMware Workstation Pro or Player
• Start your VM

You can confirm that TPM is present by running the command tpm.msc by right clicking on the Start icon and entering it in the Run command.

As you can see above, I am running the latest Windows 11 Dev build 22478 with a compatible TPM present in the free VMware Workstation Player. In addition you will also find that a TPM module is once again present in the virtual machine settings, do not delete it!

Michael Roy, who works on the VMware Fusion and Workstation teams, shared the undocumented feature via Twitter and also noted that people will see a significant performance gain, and best of all, you will be free of having to enter a password each time.

Windows 11 compliant TPM support added to the free version of VMware Workstation 16.2.0

Parallels 17.1 now has Windows 11, virtual TPM 2.0 support

Microsoft has released a new Office Insider Preview Build 14609.20000 for Windows users that registered in the Beta Channel of the Office Insider program. The new build adds improvements to the coauthoring error recovery experience in Word, noteworthy fixes in Word, Excel, Outlook, Project, Office Suite. You can read the full official changelog below to know about what’s been fixed.

Changelog

Word

Improved Coauthoring Error Recovery Experience

We’ve developed an improved recovery experience to quickly restore users back to a connected state after experiencing coauthoring errors.

Notable fix

• We fixed an issue where the app would stop responding when “at mentioning” (@mention) someone in a comment.

Excel

Notable fixes

• We fixed an issue where the word “Column” disappeared from the Cell Format ribbon dropdown menu on mouse over.
• We fixed an issue where localized characters were rendering too small in a worksheet tab (issue only present for users with the Fluent UI Coming Soon toggle enabled).
• We fixed an issue related to a workbook with many custom views with Freeze Panes that was causing Excel to stop responding immediately after launch.
• We fixed an issue where the user was seeing the Music data type button but the artists were not converting.
• We fixed an issue where hitting the hot key “e” for Filter would conflict with Search on the context menu.

Outlook

Notable fixes

• We fixed a sync failure that was occurring when generating a preview.
• We fixed an issue where the app would stop responding when conducting a search.
• We fixed an issue where default sensitivity labels were not getting applied on encrypted emails.
• We fixed an issue where an invite would go out to attendees but would not be saved to the Organizer’s calendar.
• We fixed an issue where an “Encrypt-Only” sensitivity label would not process for all UI languages except EN.
• We fixed an issue that caused the Appointment quick view to be cropped when previewing meeting invitations.

Project

Notable fix

• We fixed an issue where, when programmatically adding new tasks to a project via CSOM, the tasks might not be inserted at the correct location if the new task’s summary task is collapsed.

Office Suite

Notable fixes

• We fixed an issue affecting the MSI Office 2007 catalyst detection logic, which was causing Visio and Project to be unintentionally removed.
• We fixed an issue where corrupted SVGs in Office documents fail to render, showing a red X, by substituting an uncorrupted bitmap version of the image.
• We fixed an issue where a “wdlor” + GUID query parameter could get added to the end of a link.

To update to the latest Microsoft Office Insider Preview Build, open any Office program and go to File> Account> Update Options> Update Now.

New Windows Office Insider Preview Build(Beta Channel) brings improvements to Word and more

If you were looking for a way to simply restore the Windows 11 taskbar and File Explorer to the same behavior you were used to in Windows 10 and without all the fluff of (paid for) Start menu replacement app, look no further than Explorer Patcher. Simply add a .DLL to C:\Windows and Microsoft will download the rest of the files that will make it possible.

The developer touts this as a project that aims to bring back a productive working environment on Windows 11. Or more to the point, restore what was already not broken in Windows 10.

The functionality of this software includes:

• Taskbar from Windows 10:

  • "always combine" / "combine when full" / "never combine" options for main and secondary taskbars
  • Search button
  • Task View button
  • optional skinned, centered and toggled pop-up menus, or non-skinned (useful for classic theme users)
  • open "Network and Sharing Center" when clicking "Open Network & Internet settings" in the pop-ip menu of the system tray network icon
  • hide Control Center button
  • Show People on the taskbar
  • Show touch keyboard button

• File Explorer

  • disable the Windows 11 command bar
  • disable the Windows 11 context menu
  • disable even the Windows 10 (immersive) context menu (useful for classic theme users)
  • disable modern search bar (reverts to the search bar in early Windows 10 builds or Windows 7/8)
  • disable search bar completely

• Start menu from Windows 11

  • open Start on monitor containing the cursor
  • open Start at logon
  • open Start in "All apps" by default
  • positioning on screen
  • maximum number of frequent apps to show

• Window switcher (Alt-Tab) from Windows 10:

  • choose whether to include desktop in the window list
  • ability to set opacity of the window list
  • set row size, maximum extents etc

• Others

  • Open the time and date flyout when pressing Win+C (instead of Microsoft Teams)
  • Set default shutdown action for Alt+F4 on the desktop
  • Show Command Prompt instead of PowerShell in the Win+X menu

Installation

Grab the latest version of Explorer Patcher in the Releases section, you will find a download for a DLL called dxgi.dll. It has been tested on our latest stable build of Windows 11 (22000.258), but the developers claim that it should work just fine on newer builds too. This is the runtime part of the application. You need to place this DLL in the following location: C:\Windows which also means you will need Administrator rights.

After you have done the above, make sure you have an active Internet connection and restart the Explorer process using Task Manager or by issuing the following command:

taskkill /f /im explorer.exe.

Once File Explorer restarts, some necessary files (symbol files) will be downloaded from Microsoft (around 50MB). This should be relatively quick, depending on your Internet connection speed. When this is done, File Explorer will restart again and will be ready for use.

As you can see with the above images, you can also elect to revert back to the Windows 10-style File Explorer with the ribbon and context menu. It's up to you!

In fact, there is also a lot possible with additional third party add-ons as well, such as a forked version of TaskbarX that will let you place Start in the center of the taskbar. If you prefer that, details on how to get that setup are here. In short, great things are possible if we look around.

As always, this is a third-party app, and you have to be cool with using this Open Source software. You will also need Administrator rights on the PC you are using this on, and some Antivirus software programs may alert that this it is malware. Edge also automatically blocks the download of the .DLL so I needed to opt to "Keep anyway". If you have any doubts or questions, you can contact the developer directly on Github in the discussions section.

Explorer Patcher restores the Windows 11 taskbar to be exactly like Windows 10

What’s new in Windows 11 Build 22000.282:

• We fixed an L3 caching issue that might affect performance in some applications on devices that have AMD Ryzen processors after upgrading to Windows 11 (original release).
• We fixed an issue for a small number of users that prevents the Start menu from working and prevents you from seeing the updated taskbar design after upgrading to Windows 11 (original release).
• We fixed a race condition that occurs during the early part of startup that might cause a stop error.
• We fixed a regression that might cause stop error 0x38 on some machine configurations that use non-ASCII text in the registry.
• We fixed an issue with the interrupt handling of certain processors that might cause devices to stop responding.
• We fixed an issue that causes PowerShell to create an infinite number of child directories. This issue occurs when you use the PowerShell Move-Item command to move a directory to one of its children. As a result, the volume fills up and the system stops responding.
• We fixed an issue that causes the Server Manager application to disappear after you use it to remove Hyper-V features. This issue occurs when you install Server Manager on Windows 11 (original release) clients using Remote Server Administration Tools (RSAT).
• We fixed a threading issue that might cause the Windows Remote Management (WinRM) service to stop working when it is under a high load.
• We fixed an issue that causes the Windows Management Instrumentation (WMI) provider host process to stop working. This occurs because of an unhandled access violation that occurs when using the Desired State Configuration (DSC).
• We fixed an issue that causes a device to stop responding when you forcibly shut down the device while a Group Policy is being updated.
• We fixed an issue that causes file migration between Distributed File System (DFS) paths that are stored on different volumes to fail. This issue occurs when you implement the migration using PowerShell scripts that use the Move-Item command.
• We fixed an issue that prevents you from writing to a WMI repository after a low memory condition occurs.
• We fixed an issue with a hardcoded font in the PowerShell shortcut file that distorts Japanese, Chinese, and Korean language fonts. This update fixed this issue for all newly created users on the machine. Existing users can use the C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk file to open PowerShell to address the issue. Alternatively, existing users can create a shortcut to this file on the desktop and use the shortcut to open PowerShell.
• We fixed an issue with parsing time formats in events when milliseconds are excluded.
• We fixed an issue that incorrectly renders some Enhanced Metafile Format (EMF) files. This issue occurs if you build the EMF files using third-party applications with ExtCreatePen() and ExtCreateFontIndirect().
• We provided administrators the option to reset the zoom to the default for HTML dialogs in Microsoft Edge Internet Explorer mode.
• We fixed an issue with Enterprise Mode Site List redirection from Internet Explorer 11 to Microsoft Edge. In certain circumstances, the redirection opens a site in multiple tabs in Microsoft Edge.
• We fixed an issue that causes Internet Explorer to stop working when you input certain characters in the Input Method Editor (IME).
• We fixed an issue with PropertyGet in JScript9.dll.
• We fixed a memory leak that occurs when you use nested classes within VBScript.
• We fixed an issue that fails to keep the NumLock state after a Fast Startup restart.
• We fixed an issue with moving certain app windows. Moving these app windows might be unusually slow if a File Explorer window is visible on the screen.
• We fixed an issue that intermittently prevents the Mail app from accepting keyboard input in the address and subject boxes.
• We fixed an issue with the UI for renaming files using folder view in File Explorer. The UI fails to properly handle inline composition using the new Japanese IME.
• We fixed an issue in which the use of App-V intermittently causes black screens to appear when signing in on the credentials page.
• We fixed an issue with an internet print server that fails to properly package modified printer properties before sending the package to the client.
• We implemented a Group Policy setting for the following registry value (For more information, see KB5005010):

Registry location: HKLM\Software\Policies\Microsoft\Windows NT\Printers\PointAndPrint

Value name: RestrictDriverInstallationToAdministrators

Value data: 1

• We fixed an issue that might cause Xbox Game Bar recording features to be unavailable.
• We fixed an issue that might cause distortion in the audio captured by voice assistants.
• We fixed an issue that causes a memory leak in lsass.exe when the pTokenPrivileges buffer is not released.
• We fixed an issue that might cause Kerberos.dll to stop working within the Local Security Authority Subsystem Service (LSASS). This occurs when LSASS processes simultaneous Service for User (S4U) user-to-user (U2U) requests for the same client user.
• We fixed an issue with a non-paged pool (NPP) leak from the UxSF pool tag. This leak occurs when lsass.exe stops processing asynchronous Security Support Provider Interface (SSPI) calls.
• We fixed an issue that prevents you from enabling BitLocker on a thinly provisioned virtual machine (VM). The error is “A device attached to the system is not functioning” and the system logs, “STATUS_UNSUCCESSFUL”.
• We improved the performance of MsSense.exe in environments with User Datagram Protocol (UDP) applications that require high amounts of bandwidth.
• We fixed an issue in Windows Defender Exploit Protection that prevents some Microsoft Office applications from working on machines that have certain processors.
• We enabled credentials for Azure Active Directory (Azure AD) Active Directory Federation Services (ADFS) users in Quick Assist.
• We fixed an issue that sometimes prevents Quick Assist users from using full screen view after they start a remote assistance session.
• We fixed an issue in which Set-RDSessionCollectionConfiguration does not set the camerastoredirect:s:value custom property.
• We fixed an IME mode instability in the RemoteApp scenario. You must install this update on the Remote Desktop server and Remote Desktop client.
• We fixed an issue that causes the IME toolbar to appear even when the RemoteApp is closed.
• We fixed a paged pool memory leak of the registry keys for the Virtual Desktop ID that occurs in explorer.exe.
• We made small adjustments to the contrast theme colors, such as making hyperlinks more distinct when you hover over them while you are using the desert theme.
• We fixed an issue that prevents Narrator and other screen readers from announcing when the Start menu is open in certain cases.
• We fixed an issue that occurs if the search index is damaged in certain ways; attempts to search using the taskbar or File Explorer fail.
• We fixed an issue that prevents the search window from appearing on a secondary monitor.
• We fixed an issue that might cause the File Explorer window to lose focus when you map a network drive.
• We fixed an issue that sometimes causes the lock screen to appear black if you set up slideshow.
• We fixed a reliability issue with LogonUI.exe, which affects the rendering of the network status text on the credentials screen.
• We fixed an issue that prevents you from opening multiple instances of an app using Shift and clicking on the app’s icon in the taskbar.
• We updated the visual design and animations of the Chat icon on the taskbar.
• We removed the warning about losing other people’s unsaved work when shutting down or restarting if no other users are signed in.
• We fixed an issue that might occur when you configure the policy, “Delete user profiles older than a specified number of days on system restart”. If a user has been signed in for longer than the time specified in the policy, the device might unexpectedly delete profiles at startup.
• We fixed an issue that fails to establish a connection to the Remote Desktop Protocol (RDP) service or immediately drops an RDP connection under certain circumstances.
• We fixed an issue that might cause input delays for certain Bluetooth mice and keyboards.
• We fixed an issue that prevents the Start menu from opening after a video driver upgrade.
• We improved the precision of the estimates for downtime when the estimates are at least two minutes or more.
• We fixed a Local Security Authority Subsystem Service (LSASS) domain controller memory leak that is reported in Privileged Access Management (PAM) deployments.
• We fixed an issue that occurs when the Lightweight Directory Access Protocol (LDAP) bind cache is full, and the LDAP client library receives a referral.
• We fixed an issue in Adamsync.exe that affects the syncing of large Active Directory subtrees.
• We fixed an issue that causes a deadlock when Offline Files are enabled. As a result, CscEnpDereferenceEntryInternal holds parent and child locks.
• We added the ability to configure period or dot (.) delimited IP We fixed interchangeably with fully qualified host names in the following Group Policy settings:
  • Package Point and Print – Approved Servers
  • Point and Print Restrictions

Source: Microsoft

Microsoft releases Windows 11 Build 22000.282 to Beta and Release Preview Channel Insiders

On Tuesday, Microsoft released Windows updates to fix bugs and security vulnerabilities as part of the October 2021 Patch Tuesday.

These updates include KB5006674 for Windows 11, KB5006670 for Windows 10 2004, 20H1, and 21H1, KB5006667 for Windows 10 1909, and KB5006714 for Windows 8.

Since installing the KB5006670 update, users are reporting that they cannot print to network print servers, with some users receiving 0x00000709 or 'Element not found' errors when attempting to print.

In an eight-page forum topic at BleepingComputer, Windows administrators recounted their frustration with the printing bugs and came to the same conclusion — uninstalling this week's updates resolves the problem.

Since July, Microsoft has been releasing a constant stream of security updates to fix the PrintNightmare vulnerabilities in the Windows Print Spooler.

As threat actors, including ransomware gangs, actively exploit these vulnerabilities, Microsoft has changed its Point and Print printing feature drastically. Unfortunately, while these changes fix the vulnerabilities, they also lead to problems printing to network print servers.

This week, Microsoft released further security updates for Windows printing vulnerabilities tracked as CVE-2021-41332 and CVE-2021-36970, likely causing the new network printing issues.

While most of the reported problems are related to Windows 10's KB5006670 update, this is likely because it is the most widely used version of Windows at this time.

The same security fixes were also released for Windows 10 1909 and Windows 11 and will likely cause similar issues on those Windows versions.

How to fix KB5006670 network printing issues

When the September cumulative updates caused printing issues, it was possible to fix them by allowing non-Admins to install printer drivers or disabling the 'RpcAuthnLevelPrivacyEnabled' Registry value.

However, this Registry key is no longer working for the problems caused by the October updates, and users are required to fix it using other methods.

The BleepingComputer forum topic includes numerous suggestions from Windows admins on how to resolve the networking printing issues caused by the Windows 10 KB5006670 update. Unfortunately, as these suggestions either remove security updates or don't always work, they are not ideal for resolving the issues.

What makes these printing issues so frustrating is Microsoft's lack of clear guidance and the numerous changes that happen each month to the Windows printing feature.

As these changes all resolve different vulnerable aspects of the Windows Print Spooler, they create a mess of individual fixes that Windows admins need to figure out whether they will fix their printing problems.

BleepingComputer has reached out to Microsoft for official guidance on resolving all of these issues but has not heard back at this time.

Method 1: Uninstall the KB5006670 update

The most common suggestion is to simply uninstall the KB5006670 update, which can be done using the following command in an elevated command prompt:

wusa /uninstall /kb:5006670

However, uninstalling the update will remove the security fixes for 74 vulnerabilities, including one actively exploited, making this a dangerous method.

Method 2: Replace C:\Windows\System32\Win32spl.dll

Others have found that replacing the Win32spl.dll DLL file with the version from the September 2021 updates will fix the network printing problem.

"KB5006670 replaces C:\Windows\System32\Win32spl.dll with version 10.0.19041.1288 which halts printing

We replace this dll with version 10.0.19041.1237 that was installed September's Cumulative update

The attached batch script will copy your "good" dll file to each computer this runs on from a server location and rename the "bad" dll. I run it as a startup script for ease"

As this DLL was likely changed as part of a security update, this too will cause your computer to become less protected from possible future vulnerability exploits.

Method 3: Recreating printer queues on print servers

Some users have also reported that removing and reinstalling their printers on the print server resolved their problem.

When you remove the printer and install it again as an admin, the queues will be rebuilt, potentially allowing printing to work again.

However, workstations may need to be reconfigured to use the new printer queue, which may be a very time-consuming task for some organizations.

Method 4: Enable CopyFiles feature again

Finally, some HP printer drivers require the CopyFiles feature, which Microsoft disabled in September by default.

For users who still need this feature, Microsoft introduced a hidden Group Policy that allows you to enable it again.

To enable the CopyFiles feature, create a Windows Registry value under the HKLM\Software\Policies\Microsoft\Windows NT\Printers key named CopyFilesPolicy. When set to '1', CopyFiles will be enabled again.

New Windows 10 KB5006670 update breaks network printing

Update is reportedly being prepared for public release early next week.

Fixes for AMD Ryzen performance, other Windows 11 issues rolling out to testers now

Last month, the Windows Subsystem for Android (WSA) popped up on the Microsoft Store (image above) indicating that development work for bringing Android Apps to Windows 11 is going on even though the feature is yet to debut officially. Not just that, as earlier today, screenshots too of purported Android apps running on Windows 11 have also leaked allegedly via a Bilibili user named Makazeu, who seems to be a code porter for Microsoft itself.

There are a couple of images of the said leak, the first one shows WeChat while the second image appears to be that of Bilibili app for Android.

The earlier Microsoft store leak revealed some of the system requirements that WSA will have. A user will need the Windows 11 build 22000 or newer (it is actually written as Windows 10, but we believe this is an error), 64-bit x86 or ARM CPU, and 8GB memory. It will also be available on the newer Xbox consoles too. This means the release version (build 22000.194) of Windows 11 is supported.

For bringing the Android apps, Microsoft has collaborated with Amazon and the apps will be delivered via the Amazon Appstore making use of Intel's Bridge technology. According to Intel, this technology is a "runtime post-compiler that enables applications to run natively on x86-based devices" including on Windows. Microsoft officials have only stated that it is coming "soon", however we can deduce that it is very likely we won't see it until the release of Windows 11 22H2, which could put it at around October 2022 for the general public.

via Windows Latest

Screenshots of Android apps running on Windows 11 have leaked

Ubuntu Unity 21.10 is here today as part of the upcoming Ubuntu 21.10 “Impish Indri” release, but Ubuntu Unity still doesn’t have the “official flavor” status. However, that shouldn’t stop you from using this great distribution on your personal computer if you still want to use the Unity desktop environment in 2021.

This release still uses the old Unity7 interface rather than the upcoming UnityX 10 desktop that the Ubuntu Unity team is developing for some time now as the successor of Unity7, which received new and updated indicators, and saw the migration of the glib-2.0 schemas to gsettings-ubuntu-schemas.
Following on the footsteps of Ubuntu Impish Indri, the new Ubuntu Unity release ships with the Mozilla Firefox web browser as a Snap package by default. This change promises to offer users better security due to the sandboxing format of the Snap packages, and guaranteed access to the latest releases as soon as they’re available upstream.

Other noteworthy changes include a new Plymouth boot splash screen, a new simplified logo, and several new wallpapers. This release uses the beautiful Yaru Unity Dark theme by default with the Yaru Unity icons.

Ubuntu Unity 21.10

In other news, the Ubuntu Unity devs are are still working hard on an open-source alternative to the Snap Store called LOL, which is not installed in this release. They also recently published the ISO builder used to build Ubuntu Unity for anyone who wants to build a new Ubuntu Remix distro.

“It’s really simple to build with and we built an Ubuntu remix with it live on UbuCon Asia within 15 minutes. You shouldn’t face any issues with the GPG key files for a PPA unlike lb when building your own flavor of Ubuntu,” reads the release announcement.

If you still love the Unity7 desktop and want to use it on your personal computer, you can download Ubuntu Unity 21.10 right now from the official website or by clicking the direct download link below. Those using Ubuntu Unity 21.04 will have to perform a fresh install if they want to upgrade their installations.

Source

Windows 11’s ‘Fluent Design’ look is a big departure from Windows 10, and emojis were expected to be redesigned to fit in with the new look. As MSPoweruser reports, Microsoft’s Windows social media profiles were teasing the new look emojis, and so a fairly sizable portion of the Windows 11 userbase was looking forward to getting them.

However, it seems like the emoji hype has backfired, as Microsoft has included the redesigned emojis in a new Insider build of Windows 11. These are early versions of the operating system sent out to people who have signed up to help test upcoming new features. 

The problem is, the new emojis do not look as good as the ones teased by Microsoft, and some people aren’t happy.

Spot the difference

As you can see from the Windows UK tweet above, the emojis that were hinted at are lively and engaging, with a hint of 3D design.

However, the new emojis that are coming to Windows 11 are pretty different, with a less interesting flat 2D design.

(Image credit: Microsoft)

The differences between what was hinted at and what was delivered wasn’t missed by many people, who have been complaining to Microsoft about it, with some even accusing Microsoft of scamming them.

That’s a bit over the top – these are just emoji’s overall – and it led to Microsoft Program manager Brandon LeBlanc apologizing, suggesting that the wrong graphics had been used.

LeBlanc also hinted to another annoyed user that those 3D emojis may come at a later date.

Analysis: Communication matters

While this controversy around what emojis look like in Windows 11 may seem like a load of sound and fury, signifying nothing, it does highlight how important communication is for companies who are drumming up hype for their products.

If you’re hinting at a new design or feature, no matter how minor, you’re going to want to deliver on those promises, or someone somewhere will likely be disappointed. The reaction to ‘emojigate’ may have taken Microsoft by surprise, but for many people around the world, emojis are a key part of how they communicate with friends and loved ones, so how they look can mean a lot to them.

Hopefully, Microsoft delivers on its promise of emojis for those who are disappointed, while taking an important lesson from this: no matter how small a feature may be, never over-promise and underdeliver.

Source

Many businesses today, including browsers, are built on the data-collection model, and it’s hard to imagine that companies can survive without selling personal data to advertisers and publishers.

Yet, at Vivaldi, we don’t track or profile you. Nor do we collect usage data. In fact, we believe that the unnecessary collection of data is dangerous and has no place in your browser. We only try to have a general overview of how many users we have, what OS they run and where in the world they are, taken as a whole.

We make the browser but how you use it and who you are – your interests, income, personality – is none of our business. Really, it’s our job and responsibility to protect your data.

We build Vivaldi with passion and pride – for you. And while we are not in this to “make money”, like all businesses we need to make a living and pay the bills to keep doing what we do – in an ethical way.

So let’s find out where our revenue comes from.

Partner deals with search engines

Vivaldi generates revenue from partner deals with search engines. 

Every time you search using one of the pre-installed search engines, you’re helping us grow, one search at a time. Currently, we work with DuckDuckGo, Ecosia, Startpage, Yahoo!, Bing, and Yandex. 

The only exception is Google – we don’t make money when you search with Google. However, we know that some of you use this search engine daily, so we include it in Vivaldi. 

If you need reasons to switch to a new search engine, take a look at why your choice of a search engine matters.

Partner deals with bookmark partners

Vivaldi also generates revenue from partner deals with bookmark partners. 

When you first install Vivaldi, you get several carefully chosen Speed Dial bookmarks on your Start Page, such as Booking.com and eBay. Others can be Kayak, Start.me, Amazon, AliExpress, Tripadvisor, Airbnb. 

We receive shared revenue from these bookmark partners. Every time you use one of them, we get a small amount that helps us build an even stronger Vivaldi. 

That said, you are free to replace any of these preinstalled bookmarks with your own. Or you could keep both, as long as what we offer is useful to you. 

Note that we may add bookmarks even if we don’t receive revenue – if we think they’d be valuable to you, we’ll include them anyway. 

If after reading this, you have a sudden desire to re-install the bookmarks you deleted, feel free to use the links above to add them back to your Speed Dial. 

Vivaldi’s Webmail and other services 

The foundation of Vivaldi is all about giving back to our community of users. 

The partner search and bookmark deals not only make it possible for us to build and provide the Vivaldi browser for free, they also let us support more services free of charge – currently, the ad-free Webmail and blogs. 

With Vivaldi Webmail you get your own @vivaldi.net email account hosted in Iceland. Our ad-free blogging platform is a great tool to publish and share your ideas. 

We don’t have a business model attached to the Webmail and blogs and this will remain the same in the future. These services are made possible by the partnerships, affiliations, and revenue we make from the browser. 

* * *

Want to helps us grow Vivaldi? It’s simple. Browse with Vivaldi and support our partners. And tell your friends! The more people that use the browser, the better. 

Thanks for using Vivaldi! 

Source

The bugs fixed in this release are:

• Minor graphic anomalies seen in Cyberpunk 2077* (DX12), Hitman 2* (DX12), Wolfenstein: Youngblood* (Vulkan).
• Minor graphic anomalies seen in Monster Jam Steel Titans 2*, Ark Survival Evolved* (when Intel Sharpening Filter is enabled) on 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics.
• Black screen seen in Rage 2* (Vulkan) (after ALT + TAB) on 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics.
• Intermittent crash or hang seen in Ark: Survival Evolved* (during launch), Star Wars: Squadrons* (during launch), Warframe* (DX12) on Intel® Iris® Xe Discrete graphics.
• Minor graphic anomalies seen in Euro Truck Simulator 2*, Marvel’s Avengers* (DX12), Metro Exodus* (DX12) on Intel® Iris® Xe Discrete graphics.

The unresolved issues that remain are:

• Intermittent crash or hang may be seen in Call of Duty: Black Ops Cold War* (DX12), Forza Horizon 4* (DX12) (after launch), The Sims 4* (hot plug or unplug of external display).
• Minor graphic anomalies may be observed in Dead by Daylight*, Death Stranding* (DX12), Forza Horizon 4*(DX12). Microsoft Flight Simulator* (during installation), Red Dead Redemption 2* (DX12), Red Dead Redemption*(Vulkan) (while pressing ESC), Resident Evil Village* (DX12) (while pressing ESC), Shadow of the Tomb Raider*
  (DX12), The Surge 2* (Vulkan), Tom Clancy’s Ghost Recon Breakpoint*.
• 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics: Crash or hang may be seen in
  Breathedge*, Deathloop* (DX12), Detroit: Become Human* (Vulkan), FIFA 21*, Moonlight Blade* (DX12), NBA 2K21* (DX12) (when switching resolution from 1920 x 1080 to 1600 x 900 and 1280 x 720), Necromunda:Hired gun* (DX12) (Shadow option other than low), Red Dead Redemption* (Vulkan), The Dark Pictures: Man of Medan* (online mode), Vendetta Online* (Vulkan).
• 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics: Black screen may be seen in Arma 3* (when changing display mode to windowed or full screen).
• 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics: Minor graphic anomalies may be seen in Adobe Premiere Pro 2020 during video playback, Call of the Sea*, Crysis Remastered*, Dark Souls 3*, Elex*, Gears of War Ultimate Edition* (DX12), Gears 5* (DX12), Just Cause 4 *, Mount & Blade II: Bannerlord*.
• Intel® Iris® Xe Discrete graphics: Intermittent crash or hang may be seen in Conan Exiles* (Low End Laptop Mode” in game settings), Doom Eternal* (Vulkan), Forza Motorsport 6* (DX12), Spyro: Reignited Trilogy*.
• Intel® Iris® Xe Discrete graphics: Crash or hang may be seen when launching Batman: Arkham City*, Outriders* (DX12).
• Intel® Iris® Xe Discrete graphics: Minor graphic anomalies may be observed in Assassin’s Creed Valhalla* (DX12), Code Vein*, GRID 2019* (DX12), Rocket League* (when CMAA Enabled).
• 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics: Display is getting blanked out with 4K@60hz resolution connected via dock.
• 11th Generation Intel® Core™ Processors with Intel® Iris® Xe graphics: Thunderbolt display may not turn on after HDR is enabled for built-in display.

The new 30.0.100.9955 driver is compatible with all Intel graphics products starting from the 6th gen processors (Skylake) and newer, as well as Xe-based products. To download it, head over to Intel's official site where you can find the relevant links.

There is a separate driver for Kaby Lake G though as it is built with Radeon Vega M inside. You can find details about that driver here.

https://www.neowin.net/news/intels-latest-3001009955-driver-brings-additional-video-encode-support-on-windows-11/

The 2D emoji present in Windows 11 Dev channel build 22478

Microsoft rolled out a new Windows 11 build in the Dev channel yesterday. Build 22478 contains a bunch of new features and improvements. It also brought Microsoft's Fluent emoji that the company has been heavily advertising for the past few months since Windows 11 was revealed to the public. However, to the dismay of many who utilize emoji in their daily workflows, the new emoji are 2D, not 3D like the company has been promoting so far. The flat emoji present in the latest Dev channel build can be seen above while the ones that were previously advertised can be seen below, the difference is quite stark:

It appears that the 3D emoji shown above are not coming to the Windows 11 emoji panel at all, as revealed by Brandon LeBlanc, Senior Program Manager of the Windows Insider Program:

When grilled about Windows 11 marketing being a scam considering that the Windows and Windows UK Twitter accounts have also been promoting the 3D emoji as native to the OS, LeBlanc downplayed the issue, saying that:

It remains to be seen if some other software such as Teams, Yammer, or Outlook will be getting the 3D emoji instead. The Microsoft Design team tapped the aforementioned software and Windows when talking about the release of 3D emoji back in July. LeBlanc has declined to share more details on the matter.

Whether it was false advertising or not, we will leave it up to our readers to decide. But this is not the first in Microsoft's ongoing series of miscommunication and under-delivering. The company had to modify its system requirements documentation for Windows 11 a couple of times before finally getting them right after the OS' reveal. Similarly, Android app support did not materialize in Windows 11's launch version either, even though the feature was heavily advertised.

That said, it's a bit baffling that the Windows Insider management team did not restrict Microsoft social media accounts from using "wrong graphics" that were not coming to Windows 11 until called out about the fact.

Windows 11 is not getting 3D emoji, previous promise was a marketing blunder

So far, we have taken a look at Search, Widgets, the Start menu, Snap Layouts and Snap Groups, the Taskbar, quick settings and notifications, Virtual Desktops, power and battery settings, default apps configurations, File Explorer, context menus, Teams integration, the updated Clock app in Windows 11, the Microsoft Store, the Snipping Tool, and the Paint app refresh. Today, we'll be discussing the updated lock screen experience.

For the purpose of this hands-on, we'll be taking a look at the generally available Windows 11 build versus a publicly available and up-to-date Windows 10 (version 21H1 build 19043.1288).

Starting with Windows 10, you get to view the lock screen after you boot up your PC. The UI is fairly simple, you get a wallpaper with some search icons and a camera icon next to them, allowing you to explore more about what's being shown in the photo. Clicking on any of these icons opens the result of the relevant Bing query on Microsoft Edge.

You also get the time and date shown on the bottom left of your screen in a pretty big font. Clicking on the Wi-Fi and battery icons on the bottom-right of the screen take you to the next screen so you can't really interact with them. They are only there to show you the status of your machine at a very high-level. So, if you wanted to view the actual battery percentage directly on this screen, you're out of luck.

Once you press enter or swipe on the lock screen, you get the sign-in screen where you unlock your PC through your preferred authentication method; I use a PIN. The UI is quite straightforward here too. The wallpaper is blurred in the background, you have your display picture, name, and text box to enter a PIN in the foreground. Interestingly, the icons on the bottom-right corner of the screen work here. You can click on the Wi-Fi icon to switch your internet connection, toggle accessibility settings from the Ease of Access icon (shown in the screenshot), and utilize the Power icon to put your PC to sleep, shut down it down, and so on.

I wouldn't call the UI consistent because the Wi-Fi and Power configuration UI shown to me have a dark background even though my PC is currently on a light theme, whereas the Ease of Access settings are shown on a light theme. But again, inconsistency just seems to be a trademark for Microsoft when it comes to UI design.

Finally, we have the lock screen settings. Here, you can configure whether you want the background to be refreshed via Windows spotlight, a slideshow, or a static image, choose apps to show detailed and quick statuses on the lock screen and toggle the behavior of the image on the sign-in screen. Nothing too complex.

For better or worse, Microsoft hasn't completely flipped the script when it comes to Windows 11. You'll immediately notice that the time and date has been moved to the center of the lock screen, which aligns with Windows 11's center-focused design theme. The font size and type is also different and personally find it more aesthetic.

Instead of the round icons for search and camera on the wallpaper that we have in Windows 10, we now get square boxes with rounded corners. They are also more pronounced, which means that it's easier to spot them on the background. I find this to be a very good change, as I use this feature occasionally.

The sign-in screen is quite similar so I'll only focus on the changes. The text box to enter your PIN has rounded corners, in line with Windows 11's design. The icons have been refreshed and I'm happy to see the updated icon for Ease of Access as the previous one was not intuitive at all.

Unfortunately, the behavior of the icons remains the same. The Wi-Fi and Power UI shown to me still don't respect my theme settings and sport a dark theme. The worst offender is the Ease of Access configuration UI (screenshot above), which seems to have been lifted as-is from Windows 10, there are no rounded corners or updated toggles.

The lock screen settings are basically the same as Windows 10. That said, you do get some UI changes that are more consistent with the design language of Windows 11. I think they look nice overall.

Overall, while I like most of the changes made to the lock screen experience in Windows 11, the lack of attention towards others infuriates me a bit. It's not like it bothers my workflow, but it just emphasizes the company's commitment to shipping Windows 11 by October 5 without really focusing on the details.

It's as if the engineers over at Microsoft had this idea to revamp the sign-in experience, started work on it, updated the main screen by October 5, and then decided "Nah man, let's leave the Ease of Access settings as-is and let's not update the configuration UI to match the system theme either, nobody will notice".

Microsoft's lax attitude towards some Windows 11 design components just paints a troubling picture where engineers rushed to meet the October 5 deadline to ship Windows 11 for some unknown reason. While things like these won't impact your workflow, they'll definitely bother you when you start to notice the inconsistencies in design in a lot of places.

Closer Look: Lock screen in Windows 11

As with previous editions of StartX products, Start11 allows users to restore the Start menu to appear as it does in previous versions of Windows, as well as customize and enhance its functionality. Release Candidate 2 has also added an option to change individual tile colors for the Windows 10 menu style and enables wider tile groups too.

Start11 is designed for Windows 11 and Windows 10 and comes loaded with features intended to make Windows more productive and personal. Start11 supports moving the Start button to the middle or to the left, adjusting the taskbar size, re-ordering quick access shortcut lists, options for adjusting grid spacing, enhanced classic and modern search experiences and much more.

As a reminder of what you get with Start11, here are a few of its highlights:

• Returning the Start menu to the appearance of previous versions of Windows
• Enhancing Windows 10 and Windows 11 menus with new functionality
• Repositioning the taskbar to the top of the desktop for Windows 11
• Windows 10 style taskbar context menu for Windows 11
• Improving the classic and modern search experiences

With Release Candidate 2, the full-screen menu feature makes it easier to use Windows 10 or 11 on a tablet. When paired with the new option to adjust icon sizes for Windows 10 and 11 style menus, Start11 significantly improves the tablet experience.

For users who want to personalize their Start menu, Start11 offers robust customization options ranging from aesthetic to functional. Start11 supports a host of new Start menu ideas such as the concept of pages, minimalism, and features for enterprise customers.

New Features in Release Candidate 2

• Option to hide "recently installed" applications list for Windows 10/11 menu style
• Full-screen menu option for Windows 10/11 menu styles - great for tablets!
• Hide "recent document list" in Windows 11 menu style
• Enhanced support for wider tile groups in Windows 10 style menu
• Enabled ability to change the background color of individual Windows 10 menu items
• Options to adjust icon sizing for Windows 10/11 style menus
• Animations now support 240hz

Here is the full changelog:

• Tweaked quick access link popup menus to resolve an issue where they may not close on loss of focus correctly
• Tweaked quick access link popup menus to not cause a menu close when closing one and opening another via clicking directly
• Fixed paint issue on Win11 menu quick access links area when switching between monitors
• Fixed appearance typo in config
• Fixed crash introduced by some RC1 work with quick access link menus
• Added support for quick access menus in Win10/11 style. They do not auto-expand on mouseover but require a click to open
• Holding down shift when clicking on a quick access link that's a menu will open it as a window where possible
• Added missing W filter option in all apps for Win10/11 style
• Fixed issue with quick access menus not always closing on loss of focus
• Fixed issue with Win10/11 apps list loading up icon for application exe vs shortcuts
• Fixed issue with Win10/11 apps list not loading up multiple shortcuts to apps in some circumstances
• Fixed issue with Win10/11 pinned items lists loading up app exe icon vs shortcut exe
• Fixed issue with Win10/11 pinned apps not launching correct shortcut but exe instead
• Added option to hide recent documents on Win11 menu
• Added option to change icon size on Win10 and Win11 menus
• Added option to change tile color on Win10 style menu
• Pressing escape when in all programs list in Win11 style menu simply goes back to the previous page now rather than closing
• Fixed drag & drop offset issue in Win7/Modern menu styles
• Limited Win10/11 menu size based on current screen resolution
• Fullscreen mode for Win10/11 menus
• Fixed Win11 menu rearranging issue where items would sometimes rearrange inconsistently especially after a lot of rearranging
• Dragging on the Win11 menu no longer highlights the page title area
• Fixed Win7/Modern Quick access links showing as menus will now open correctly when clicked
• Prevented Win7/Modern quick access link menus popping up under the menu
• Win7/Modern quick access link menus now dark mode aware
• Fixed universal apps quick access menu potential crash issue
• Win7/Modern quick access menus now have rounded corners when rounded menu mode is enabled
• Fixed pinning from Pin to Start11 from explorer menus pinning items to first index in list for Win11 style menu
• Fixed pinning issue for Win10 menu replacing last entry in pinned list when pinned from explorer windows or search page
• Added missing run as admin option on store apps which support it on Windows 10/11 menu (Terminal etc)
• Internal frame rate for animations moved to 240hz
• Fixed issue with mouse getting attached to the top of the menu when opening the menu with Start11 search disabled
• Fixed issue with clock and tray area missing when using custom start button on Windows 11 Dev channel builds
• Fixed issue with custom start button left visible after disabling custom start button or making button centered on Windows 11 (believed to be Dev channel only again)
• Fixed issue on Win11 menu where creating a new page when on a lower page number caused the page to be inserted as a group on the next page instead
• Fixed issue on Win11 menu where deleting pages could cause a blank page to appear
• Tweaks to button handling on Win11 when not using custom start button
• Config UI now responds to touch input
• Rearranging quick access shortcuts list in Win10/11 styles now saves the changes correctly
• Fixed scrolling on menus using MS precision touchpad
• Now able to scroll menus using touch and drag items - to drag an item either drag sideways initially or hold down until you get the right-click indicator box and then drag the item if the list has a scrollbar, otherwise drag as usual.
• Fixed possible crash issue when moving things on the Win10/11 grids
• Adds support for wider groups in Win10 style
• Fixed Win11 style to show user name as friendly name vs account name
• Fixed issue with Win11 style losing shutdown button if you set Win7/Modern style to have a very high number of icons on display or lots of grid columns
• Fixed quick access shortcuts showing display as menu sometimes incorrectly for Win10/11 style
• Stopped jumplists showing for MS store and settings as blank
• Fixed issue with being able to get multiple menu options on config appear in mouseover state
• Added option to hide recently installed applications section in Win10/11 all apps list
• Fixed changing icon size on Win7/modern menu requires two opens of the menu to see the change fully
• Fixed desktop search carried out last so didn't always appear in results as quickly as wanted
• Fixed search getting stuck in some searches
• Fixed issue with taskbar at the top of the screen losing the mouse over thumbnails on one monitor if multiple monitors on Windows 11
• Fixed clicking very left of the leftmost start button can open Win11 menu on Windows 11
• Fixed explorer hang issue if replacing start button on computer with multiple monitors (3 ideally)
• Fixed start menu open offset issue on multiple monitor setups with centered start button
• Fixed Cortana search mode causing Start menu to close when renaming a group/anything else
• All apps list for Win10/11 modes now also includes url files and help documents etc
• Removed surplus MS edge link in all apps
• Double-clicking on the style image opens the settings drop down in the config now

Start11 is currently available for $4.99. There is an upgrade option for users of Start8 and Start10. For more information, visit www.stardock.com.

Object Desktop includes programs such as Fences, Start10, Groupy, SoundPackager, DeskScapes, and Multiplicity.

Disclaimer: Neowin's relationship to Stardock

Start11 Release Candidate 2 out with more fixes and a full screen Start menu option

Added features and bug fixes: 

• Added Share support to Windows 7.
• Enabled Picture in Picture support on Windows.
• Finished rolling out the ability to search the web for an image in the sidebar from the context menu.
• Management policies (note that updates to documentation or administrative templates may not have occurred yet):
  • Added a policy to control if the Typosquatting Checker is Enabled, which is a feature that warns if the website being navigated to isn’t the one that was intended because the address was mistyped.
  • Added a policy to control if Renderer App Container support is Enabled, which controls if tab processes are created with extra security.
  • Added a policy to control if Application Guard Upload Blocking in Enabled, which controls if files are allowed to be uploaded from Application Guard window.
  • Added a policy to control when Efficiency Mode is active.
  • Added a policy to control if the New SmartScreen Library is Enabled, which will be deprecated and removed along with the legacy SmartScreen library.
  • Added a policy to control if Shared Links are Enabled, which controls access to the list in History of links shared by or to the user from other Microsoft 365 apps.
  • Added a policy to configure Force Sync Types, which determines which types of data are required to be synced.

Edge Dev Improved Reliability:

• Fixed an issue where using a to draw on a touchscreen sometimes causes a Blue Screen of Death.
• Fixed a crash when autofilling payment card info.
• Fixed an issue where new tabs sometimes immediately crash as soon as they’re opened.
• Fixed an issue where certain shopping websites crash or are blank.
• Fixed a crash when closing the last window in a profile.
• Fixed a crash on launch if a Guest window was the last window closed during the previous session.
• Fixed a crash on startup after taking a major update.
• Fixed a crash on launch on mobile.
• Fixed a crash on Android 12.

Changed Behavior:

• Fixed an issue where certain benchmarks were running slower than expected.
• Fixed an issue where tabs sometimes aren’t restored from a previous browsing.
• Fixed an issue where the Web Capture entry sometimes isn’t available in the context menu.
• Fixed an issue on HoloLens where microphone input doesn’t work.
• Fixed an issue on Mac where shortcuts to PWAs or websites installed as apps are not removed when the PWA or app is uninstalled.
• Fixed an issue where moving tabs to another profile sometimes doesn’t work.
• Fixed an issue when sending a tab to another device where the list of devices to send to sometimes doesn’t list all the available devices properly if multiple channels are installed on a single device.
• Fixed an issue where navigations never finish in Application Guard windows.
• Fixed an issue where Application Guard windows sometimes use the wrong proxy setting.
• Fixed an issue where manually importing data from another browser sometimes fails to import some data.
• Fixed an issue where the Pinning Wizard doesn’t work.
• Fixed an issue where the Web Widget sometimes doesn’t open.
• Fixed an issue where certain panes like the Assistance pane can’t be unpinned once they’re pinned.
• Fixed an issue where some popups can’t be closed by clicking outside of them.
• Fixed an issue where Guided Switch customizations like opening a link in a specific profile fail.
• Fixed an issue where Guided Switch sometimes doesn’t correctly handle links that redirect.
• Fixed an issue where tab group indicators sometimes aren’t placed correctly in the UI.
• Mobile:
  • Fixed an issue where users can sometimes get stuck in a sign-in loop.
  • Fixed an issue where websites can’t be accessed when Conditional Access policies are on.
  • Fixed an issue where certain Top Site tiles can’t be removed.
  • Fixed an issue where the new tab page is blank.
  • Fixed an issue where Top Sites tiles sometimes don’t navigate properly.
• Developer:
  • Fixed an issue where web notifications sometimes can’t be closed programmatically.
  • Fixed an issue in WebView2 apps where the web contents are sometimes blank (Issue 730).
  • Fixed an issue in WebView2 apps where the Name property of objects sometimes doesn’t return the correct value (Issue 641).

Known issues:

• Users of certain ad blocking extensions may experience playback errors on YouTube.  As a workaround, temporarily disabling the extension should allow playback to proceed.  See this help article for more details.
• Some users are still running into an issue where all tabs and extensions immediately crash with a STATUS_INVALID_IMAGE_HASH error.  The most common cause of this error is outdated security or antivirus software from vendors like Symantec, and in those cases, updating that software will fix it.
• Users of the Kaspersky Internet Suite who have the associated extension installed may sometimes see webpages like Gmail fail to load.  This failure is due to the main Kaspersky software being out of date, and is thus fixed by making sure the latest version is installed.
• Some users are seeing “wobbling” behavior when scrolling using trackpad gestures or touchscreens, where scrolling in one dimension also causes the page to subtly scroll back and forth in the other.  Note that this only affects certain websites and seems to be worse on certain devices.  This is most likely related to our ongoing work to bring scrolling back to parity with Edge Legacy’s behavior, so if this behavior is undesirable, you can temporarily turn it off by disabling the edge://flags/#edge-experimental-scrolling flag.

This Edge Dev channel update should download and install directly but in case it doesn’t then you can head to the Edge settings and manually update the browser.

Microsoft releases Edge Dev channel build 96.0.1043.1 with Picture in Picture support on Windows

Interestingly, users running the public release version of the OS will not have to wait until next year to enjoy the new emojis as the firm promises to bring these to the release version bia a future servicing update. The feature joins the likes of more bug fixes that are being made in the Dev channel builds that are being promised for the public version of the OS.

In addition to the new emojis, there are also a few other improvements, including optimizations to the indexer platform that will result in reducing disk space usage on the system. The firm is also adding the ability to change system volume from the volume icon using the mouse wheel by scrolling on the icon - something that is a nifty and welcome addition. Though the feature has been present in Windows 10, it has been oddly omitted in Windows 11.

In addition to these, here are all the improvements made with today's build:

• The updated version of the Korean IME, which began rolling out with Build 22454, is now available to everyone in the Dev Channel.
• When your laptop is closed, it’s now possible to login to your PC using Facial Recognition (Windows Hello) on a connected external monitor if it has a camera attached that supports it.
• We’ve made a change to the underlying indexer platform to help improve overall reliability and database size, which should help reduce disk space usage on the system – particularly in cases where users had very large Outlook mailboxes.
• Scrolling your mouse wheel on the volume icon in the Taskbar will now change the current volume level.
• Made some small adjustments to the dialog when adding a new language in Settings to make it look a little more modern, including rounding the corners.

As usual, there are a bunch of bug fixes that are always welcome. As mentioned earlier, some of these will be brought to Windows 11 version 21H2 via a servicing update in the future. Here is the complete list of fixes:

[Start]

• Keyboard focus will no longer get lost if you press ESC after opening the user profile flyout in Start.
• Updated the prompt text when pinning something from a UWP app to Start, so it now says simply “Do you want to pin this to Start?”.

[Taskbar]

• Addressed an issue that was causing Notification Center to get stuck in a state in recent builds where it would stop launching.
• The plus icon for adding a new Desktop will now display properly when hovering over the Task View icon in the Taskbar when using Arabic and Hebrew languages.
• After bringing up an app’s jump list from the Taskbar, right clicking on the app name should now show the correct icon for Pin to Start (a pin icon).
• Left and right clicking Taskbar at the same time should no longer crash explorer.exe.

[File Explorer]

• Fixed an issue where the command bar was doing unnecessary calculations when navigating to folders, causing an unexpected increase in performance. This is also believed to be the root cause of performance issues when using drag to select files, as well as using the arrow keys to navigate in certain folders.
• The “Show hidden items” option should no longer get out of sync when multiple File Explorer windows are open.

[Widgets]

The following two issues have been addressed with Microsoft Edge version 95, currently live for Microsoft Edge Insiders, and as such we’re removing them from the known issues list:

• The widgets board may appear empty.
• Widgets may be displayed in the wrong size on external monitors.

[Search]

• The recent searches flyout when hovering over the search icon in the Taskbar should no longer immediately dismiss on invocation if an admin window is in focus.

[Input]

• Setting focus to the search box in File Explorer shouldn’t make the touch keyboard invoke and immediately dismiss now when using a tablet with the Taskbar set to auto-hide.
• Fixed an issue causing the handwriting panel to not insert text when using it to write Chinese.
• Mitigated a memory leak that could occur in ctfmon, causing unexpected resource usage over time.
• Addressed an issue for a small number of users that was causing TextInputHost.exe crashes when setting focus on any text field.

[Settings]

• Fixed an issue that was causing Settings to crash when radio buttons were updated, for example if you connected an additional audio endpoint while the Sound page in Settings was open.
• Improved performance of loading the themes displayed in Personalization Settings.
• If a non-admin user changes their display language in Language Settings, we’ll no longer show the clickable sign-out button there as it was popping a UAC dialog and causing confusion.
• The Windows Update entry at the top of the System page in Settings should no longer be misaligned with the other options (when shown) in languages like German.
• The Braille options in Settings for Narrator users should now be in sync with the actual state of the Braille input/output mode.
• Made a change to help address an issue where “Media streaming options” in the Network and Sharing Center would unexpectedly revert to default settings after an upgrade.
• Improved Quick Settings launch reliability. This change should also help address the issue causing the window to not fully render (just a thin rectangle).
• Addressed an issue where if you clicked on the media controls area in Quick Settings, it wasn’t bringing the app displayed to the foreground in certain cases.
• Fixed an issue where the colors for items in Quick Settings could get stuck and not reflect the proper color for that state, particularly when using a contrast theme.
• Updated the Quick Settings page for managing audio endpoints from “Volume” to “Sound output”.
• Opening the page for managing audio endpoints in Quick Settings should no longer cause a brief cut in audio playback when multiple devices are listed.

[Windowing]

• Mitigated an issue related to using ALT + Tab very quickly that could make explorer.exe crash.
• Holding down ALT and pressing F4 after pressing ALT + Tab will no longer crash explorer.exe.
• When using the Arabic or Hebrew display languages, dragging an app window to a different Desktop should show the thumbnail moving in the correct direction now.

[Other]

• Fixed a casing issue that was causing LP.cab files to be unexpectedly removed in certain cases, which could lead you your display language changing until you added the desired display language back in Settings.
• Addressed an issue that was causing some users to see a bugcheck with error “KERNEL_SECURITY_CHECK_ERROR”.
• Mitigated an issue that was causing the SysMain service to use an unexpected amount of power in recent builds.
• If the display order is missing in BCD settings that should no longer cause an upgrade failure.
• Fixed an issue that was causing captions to draw at the wrong offset in certain apps.
• Mitigated an issue that was causing crashes related to audiosrv.dll.
• If going through OOBE with an Arabic or Hebrew display language, the volume and accessibility buttons should display on the correct side of the screen now.

Along with the fixes come a bunch of known issues that users must be aware of. Here is the complete list:

[General]

• Users updating from Builds 22000.xxx, or earlier, to newer Dev Channel builds using the latest Dev Channel ISO, may receive the following warning message: The build you are trying to install is Flight Signed. To continue installing, enable flight signing. If you receive this message, press the Enable button, reboot the PC, and retry the update.
• Some users may experience their screen and sleep timeouts being reduced. We’re investigating the potential impact that shorter screen and sleep timeouts could have on energy consumption.

[Start]

• In some cases, you might be unable to enter text when using Search from Start or the Taskbar. If you experience the issue, press WIN + R on the keyboard to launch the Run dialog box, then close it.

[Taskbar]

• The Taskbar will sometimes flicker when switching input methods.
• We’re working on the fix for an issue causing tooltips to appear in an unexpected location after hovering over the Taskbar corner.

[Search]

• After clicking the Search icon on the Taskbar, the Search panel may not open. If this occurs, restart the “Windows Explorer” process, and open the search panel again.
• Search panel might appear as black and not display any content below the search box.

[Quick Settings]

• We’re investigating reports from Insiders that the volume and brightness sliders aren’t displaying properly in Quick Settings.

This is one of the first Dev channel builds to pack a few new features. However, some of these improvements will eventually make it to the currently available version of Windows 11 for all users. Major new features are yet to begin showing up for the OS - those that will be aimed for release next year or in a future release, ones that aren't tied to the current version.

In addition to the features, the firm also announced that it is testing a new "process for delivering new update improvements" in the way of Update Stack Packages. These packages, the firm adds, allow for them to "deliver improvements to the update experience prior to the PC taking a monthly or Feature Update". The verbiage suggests that these are akin to the Experience Packs, delivering features and/or optimization that are developed independently of the OS, making the overall update experience more reliable. These packs are delivered via Windows Update.

Lastly, the firm is celebrating the seventh anniversary of the Windows Insider Program. To commemorate the milestone, the company is giving away two new wallpapers. You can find the wallpapers here.

Update: Added a mention about the Update Stack Packages.

Windows 11 build 22478 for the Dev channel brings Fluent emojis and other improvements

The recent discovery of major vulnerabilities in the printer stack of Windows and its subsequent remediation appears to have caused major compatibility issues with Windows 11, with Microsoft confirming 3 new printer-related issues for their newly released operating system. Notable the issue also affects Windows 10, and the issue appears to be confined to enterprise printing, which uses more complex protocols.

The issues are:

Installation of printers might fail when attempted over some network connections

Devices that attempt to connect to a network printer for the first time might fail to download and install the necessary printer drivers.

This issue has been observed in devices that access printers via a print server, using HTTP connections. When a client connects to the server to install the printer, a directory mismatch occurs, which causes the installer files to generate incorrectly. As a result, the drivers may not download.

Workaround: IT administrators with admin privileges can still install printer drivers on the client through other means, such as copying packaged drivers from a known good package location. Only the automatic download and installation processes are impacted by this issue.

Custom printing properties might not be correctly provided to print server clients

Printing properties defined on that server might not be correctly provided to clients. Note this issue is specific to print servers and does not impact standard network printing. This issue will not cause printing operations to fail, however, custom settings defined on the server – for example, duplex print settings – will not be applied automatically, and clients will print with default settings only.

This issue results from an improper building of the data file which contains the printer properties. Clients which receive this data file will not be able to use the file content and will instead proceed with default printing settings. Servers which use default print settings and have no custom settings to provide to clients are unaffected.

Workaround: IT administrators with admin privileges can still install printer drivers on the client through other means, such as copying packaged drivers from a known good package location. Additionally, clients can still be modified manually to adopt desired printer settings.

Installation of printers via Internet Printing Protocol (IPP) might not succeed

Installation of printers using Internet Printing Protocol (IPP) might not complete successfully.

Microsoft is working on a resolution for all the issues and targeting its release in a future update.

Microsoft confirms 3 new Windows 10 and Windows 11 Printer issues

For those not familiar with Sysmon (aka System Monitor), it is a Sysinternals tool that monitors a system for malicious activity and then logs any detected behavior into system log files.

Sysmon's versatility comes from the ability to create custom configuration files that administrators can use to monitor for specific system events that may indicate malicious activity is occurring on the system.

Sysmon ported to Linux

Today, Microsoft's Mark Russinovich and a cofounder of the Sysinternals utility suite, announced that Microsoft had released Sysmon for Linux as an open-source project on GitHub.

Unlike Sysmon for Windows, Linux users will be required to compile the program themselves and ensure that they have all the required dependencies, with instructions provided on the project's GitHub page.

It is important to note that to compile Sysmon, you must first also install the SysinternalsEBPF project.

Once Sysmon is compiled, you can see a help file by typing sudo ./sysmon -h, as shown in the screenshot below.

To use the program, you first need to accept the end-user license agreement with the following command:

sudo ./sysmon -accepteula

Then you can launch Sysmon with or without a configuration file using one of the following commands:

Without configuration file:

sudo ./sysmon -i

With configuration file:

sudo ./sysmon -i CONFIG_FILE

To create your own Sysmon configuration file, you would need to use ./sysmon -s command to view the current version's configuration schema and see what directives are available.

To learn more about creating a Sysmon configuration file, you can consult the official documentation or use SwiftOnSecurity's template as an example.

Once started, Sysmon will begin logging events to the /var/log/syslog file. If you did not specify a configuration file to restrict what is logged, you will find that your syslog file quickly grows as new processes are launched and terminated.

For example, in the screenshot below, you can see an event showing the 'adduser' command terminating after I used it to create a new user.

To make it easier to filter the logs for specific events, you can use the sysmonLogView utility to show the events you are looking for.

The current events IDs that Sysmon for Linux is capable of logging are listed below:

• 1: SYSMONEVENT_CREATE_PROCESS
• 2: SYSMONEVENT_FILE_TIME
• 3: SYSMONEVENT_NETWORK_CONNECT
• 4: SYSMONEVENT_SERVICE_STATE_CHANGE
• 5: SYSMONEVENT_PROCESS_TERMINATE
• 6: SYSMONEVENT_DRIVER_LOAD
• 7: SYSMONEVENT_IMAGE_LOAD
• 8: SYSMONEVENT_CREATE_REMOTE_THREAD
• 9: SYSMONEVENT_RAWACCESS_READ
• 10: SYSMONEVENT_ACCESS_PROCESS
• 11: SYSMONEVENT_FILE_CREATE
• 12: SYSMONEVENT_REG_KEY
• 13: SYSMONEVENT_REG_SETVALUE
• 14: SYSMONEVENT_REG_NAME
• 15: SYSMONEVENT_FILE_CREATE_STREAM_HASH
• 16: SYSMONEVENT_SERVICE_CONFIGURATION_CHANGE
• 17: SYSMONEVENT_CREATE_NAMEDPIPE
• 18: SYSMONEVENT_CONNECT_NAMEDPIPE 
• 19: SYSMONEVENT_WMI_FILTER
• 20: SYSMONEVENT_WMI_CONSUMER
• 21: SYSMONEVENT_WMI_BINDING
• 22: SYSMONEVENT_DNS_QUERY
• 23: SYSMONEVENT_FILE_DELETE
• 24: SYSMONEVENT_CLIPBOARD
• 25: SYSMONEVENT_PROCESS_IMAGE_TAMPERING
• 26: SYSMONEVENT_FILE_DELETE_DETECTED
• 255: SYSMONEVENT_ERROR

As you can see, many of these events do not apply to Linux, such as the Registry or WMI events, so you will need to adjust your configuration accordingly.

Sysmon is a powerful tool widely used in Windows environments as part of an organization's security toolbox.

With its addition to Linux, a whole new segment of system administrators can utilize it to provide free system monitoring for malicious activity.

Microsoft releases Linux version of the Windows Sysmon tool