CVE-2026-108142 lets an attacker who is not logged in get past authorization on the CDP Coordinator Service. Version 12 is not affected. Two path-traversal bugs and a Linux agent flaw are fixed too.
Windows 11 26H2 will turn settings backup on by default for businesses
EditorialBy TrustList Editorial
A policy already set either way is still honoured, restore stays off until an admin configures it, and Windows Backup for Organizations gets a new name.
- Redmond, Washington
- Endpoint Management
- Backup
- Backup Software
About Windows 11 26H2 will turn settings backup on by default for businesses
Windows 11 26H2 will turn settings backup on by default for businesses
9 November 2026: Microsoft says Windows settings backup will be enabled by default on eligible devices starting with Windows 11 version 26H2, so an organisation with no policy in place will begin storing users' Windows settings and Microsoft Store app lists without taking any decision. A tenant that wants otherwise has to configure it before those devices arrive.
Not yet independently verified. Microsoft's post does not give a release date for version 26H2, and the definition of an eligible device is on a linked Microsoft Learn page that we have not read. We will update this when it can be confirmed, and remove this note.
Explicit policies win, and only backup changes
The company's wording on control is specific. "Any explicitly configured backup policy, whether enabled or disabled, continues to be honored," the post says, and the default applies to backup only. Restore needs separate configuration by an administrator, so users will not see their settings come back on a new machine until someone turns that on.
The practical effect is a gap for anyone who never touched this setting. Backups can start accumulating with no restore path enabled, and the data sits in the tenant whether or not the organisation ever uses it. A team with data minimisation commitments should choose deliberately and set the policy either way.
A new name and one place for roaming
Windows Backup for Organizations, generally available since August 2025, is now Windows settings backup and restore. Existing configurations carry over, per Microsoft's post.
Enterprise State Roaming has moved under the same management. The settings it covers are unchanged, and Microsoft says that after a transition period that ended in June 2026, the backup and restore policies are the supported way to manage it. Licensing requirements for Enterprise State Roaming still apply, so the merged console does not widen who is entitled to the feature.
PowerShell for profiles that pile up
Because default-on means more profiles to look after, Microsoft points administrators to a WindowsBackupAdmin PowerShell module, published on the PowerShell Gallery and GitHub. It lets a suitably permissioned admin view the attributes of backup profiles linked to a user, export backup information and delete a user's backup data or profiles. It cannot show the settings or app data inside a backup. The scripts wrap Microsoft Graph beta APIs, which is worth knowing before building them into a long-lived process, since beta endpoints can change.
Deletion is the capability a leaver process needs. If an employee departs or exercises an erasure right, a clean-up step that previously had no target now has one once backups run by default.
What users will see after a restore
A restore summary arrives for Windows 11 24H2 and later. During setup or at first sign-in a user picks a backup profile, and the summary shows what was restored from personalisation settings and the Store app list. Help Net Security reports that it opens in a browser about an hour after a successful restore and stays available for seven days after setup.
Our backup software category lists four products.
Sources
- Windows IT Pro Blog, Enhanced resilience with Windows settings backup and restore, 9 November 2026
- Help Net Security, Windows settings backup default, 10 November 2026
Categories & features
- Redmond, Washington
- Endpoint Management
- Backup
- Backup Software
TrustList Weekly
The week in software and IT, in one email
The news that matters to buyers, new rankings and our own research. Every Thursday, free, and easy to leave.
You may be interested in
The service formerly known as SkyKick was cut off for every partner. Phased restoration began on 28 October, and each Microsoft 365 tenant must be re-authorised through a new application.
Attackers are encrypting NAS devices through a flaw Synology fixed in December 2024 and points to advisory SA-24:20, whose worst bug, CVE-2024-10441, allows remote code execution without a login.
Advisory Synology-SA-26:14 now covers Calendar and Mail Station on DSM 6.2 to 7.1. CVE-2026-109618 and CVE-2026-109619 are rated 9.8, and the PHP 7.3 package will stay unpatched.
Version 9.x of the Management Pack for Microsoft System Center will not be patched. Every fix lands only in 13.1, build 13.1.0.334, so customers on the older line have to move up a major version.
DSA-2026-416 now covers unauthenticated root command execution, a hard-coded key and rogue admin creation in DD OS, plus three Management Center flaws that reach other managed systems. Fixes ship in 8.9.0.0 and three LTS lines.
Italy's CSIRT rates the batch critical for systemic impact. The worst lets an unauthenticated client write outside the root of rclone serve webdav; version 1.75.2, out since 9 October, fixes all ten.
Customer records, hashed passwords and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone were taken in a weekend intrusion. UpdraftPlus 1.26.13 and 2.26.13 cut every old UpdraftCentral link.
More on TrustList
Everything here links back to the same verified catalogue. Pick your next stop.
- CompaniesAgencies, consultancies and IT service providers, ranked by verified reviews.
- ProductsSoftware and SaaS with pricing, features, integrations and alternatives.
- AwardsAnnual recognition decided by verified reviews and an independent jury.
- LaunchesNew products and releases, voted up by the community every day.
- AI ModelsBenchmark scores and community ratings for every major model.
- RequestsBuyers describe what they need; vendors respond directly.
- PeopleReviewers, authors and makers with public profiles.
- ComparePut up to four listings side by side before you shortlist.