Threat Intelligence & APT BleepingComputer 2 weeks ago

Microsoft enables Windows settings backup by default for orgs

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: INFORMATIONAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Threat Intelligence & APT

Analyst Takeaway

"Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2. The Windows settings backup tool (formerly known as Windows Backup for Organizations) backs up and restores enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged...."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Windows

Microsoft announced that Windows settings backup and restore is now enabled by default on all Microsoft Entra-joined or Microsoft Entra hybrid-joined enterprise systems upgraded to Windows 11 26H2.

The Windows settings backup tool (formerly known as Windows Backup for Organizations) backs up and restores enterprise users' Windows settings after a device is reset, replaced, upgraded, or reimaged.

Microsoft unveiled it two years ago at the Ignite conference in November 2024 as an opt-in feature (disabled by default), and it reached public preview in May 2025 and general availability in August 2025.

As announced in July, Microsoft has enabled the Windows settings backup policy by default for eligible devices after the release of Windows 11, version 26H2 on September 29.

"If user devices ever enter recovery, you don't have to guess whether their Windows settings have a backup. With this feature on by default, users are more likely to have their settings and Microsoft Store app list available to restore after a device reset, replacement, or upgrade," Microsoft said in a Wednesday message center update.

Save your seat

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →