Microsoft security · what's new
Microsoft-Windows-NTLM/Operational and find unsigned clients. Servers start requiring signing by default in May 2027.*.trouter.communications.svc.cloud.microsoft through your firewall for Intune push notifications on Windows.This week was thin, so this roundup covers 29 October to 12 November 2026. The change with the most impact is in the November Windows update: clients now offer NTLM signing by default, and servers will require it from May 2027. Microsoft also set dates for on-premises Exchange protections, and Intune's October service release adds Administrator protection settings and a new firewall endpoint.
Windows security updates released on and after 10 November 2026 address CVE-2026-118737 and are the first phase of NTLM signing hardening. Clients now offer NTLM signing on non-anonymous connections by default, servers still accept signed and unsigned clients, and new audit events flag clients that do not sign. In phase 2, in May 2027, servers begin requiring signing by default and reject clients that do not offer it.
It covers Windows 11 23H2 to 26H2, Windows 10 Enterprise LTSC 2021 and Windows Server 2016 to 2025. With NTLM enhanced auditing, Windows Server 2019 and later logs event 4023 on the server and 4022 on the client. Two registry values under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 control the behaviour: ClientAllowUnsignedNtlm, for temporary compatibility only, and ServerRequireNtlmSign=1 to enforce early once auditing shows you are ready. Kerberos is not affected. KB5135557
Our take: the clients that fail will be the ones nobody patches: scanners, NAS boxes, old appliances and line-of-business apps. Six months sounds like plenty, but not once change freezes are counted. Start collecting 4023 events now and keep the list; in a PCI DSS or NIS2 audit it is good evidence that you know where legacy authentication still runs. It follows on from the NTLMv1 SSO block we covered two weeks ago.
Devices enrolled in hotpatch get standalone security updates that fix Windows PowerShell vulnerabilities involving web requests, PowerShell workflows and the DSC Archive Resource. They are offered after the November hotpatch update is installed and may need a restart: KB5135385 for Windows 11 24H2, 25H2 and 26H2, and KB5135386 for Windows Server 2025. Secure Boot certificate deployment also expands to more eligible devices.
There will be no December 2026 non-security preview update in the second half of the month. Normal servicing resumes in January 2027. For the CVE breakdown, see our Patch Tuesday November 2026 page. Windows message center
Microsoft announced an on-premises security initiative for supported Exchange Server, SharePoint Server and Skype for Business Server. Since September 2026 it has shipped Important as well as Critical security updates outside Patch Tuesday when needed. The rest is planned, not shipped:
Microsoft has not said how long the fixed period is or whether you can opt out. Its advice for servers that stay on-premises: move to supported releases, apply current security updates and turn on the available protections. Microsoft Security blog
Our take: automatic mitigations and patching need change control written for them. Decide now who approves them and how you will record them, before December.
These items come from service release 2610, listed under the week of 26 October. Intune what's new
Endpoint security Account protection policies, and the settings catalog for Windows 11 24H2 and 25H2, now include two Administrator protection settings: the Administrator Approval Mode type and the elevation prompt behaviour.
Our take: Administrator protection belongs in a hardened Intune baseline. Pilot it on IT devices first and test your helpdesk and installer workflows, which tend to assume silent elevation.
The Intune endpoint security template for Defender for Endpoint agent runtime protection settings on Windows is now generally available. It adds a new setting, AI agent runtime inspection.
Microsoft recommends allowing *.trouter.communications.svc.cloud.microsoft for scenarios that rely on push notifications: device actions, Win32 apps, PowerShell scripts and Remediations. Strict egress filtering is where this tends to get missed.
Intune has ended support for Setup Assistant (legacy) authentication in automated device enrollment profiles with user affinity. Existing profiles are moved to Setup Assistant with modern authentication automatically, and enrolled devices are not affected. Intune is also removing the legacy Apple MDM software update workloads, because Apple retired them in OS 27. Use declarative device management update policies instead.
The Certificate Connector for Microsoft Intune now reports health signals in the admin center. They flag a connector that cannot reach the CA, a service account without permission to issue or revoke, and requests rejected for a template mismatch with your PKCS profile. Check it if Wi-Fi or VPN rely on certificates.
Note on last week's item: the STIG audit baseline for commercial tenants requires Intune Advanced Analytics.
Defender for Endpoint discovers supported local AI agents and the MCP servers they are configured to use on onboarded devices. They appear in the AI agent inventory, the exposure map and advanced hunting. It needs Defender Antivirus platform 4.18.26090.9 or later on Windows, or Defender for Endpoint 101.26072.0017 or later on macOS. Discovery in WSL is still in preview, and MCP server discovery needs antivirus in active mode with real-time protection. Microsoft Learn
From Defender for Endpoint on Linux 101.26062.0007, audit mode detects and alerts on malware without quarantining files or ending processes. It was in preview in August. It is useful for testing performance on sensitive workloads before you turn on enforcement. Microsoft Learn
A new CallActivityEvents table in Defender XDR advanced hunting records activity in Teams calls and meetings. Microsoft's entry gives no preview or GA label. Microsoft Learn
Entra ID, Sentinel and Purview had no new entries on their what's-new pages in this window. Want a second pair of eyes? Start with our free assessment or the Microsoft 365 identity check, or see our Entra ID hardening and Microsoft 365 security audit services.
From the 10 November 2026 updates, Windows clients offer NTLM signing by default on non-anonymous connections, and new audit events (4022 and 4023) show which clients do not sign. Servers still accept unsigned clients for now.
Microsoft plans phase 2 for May 2027, when Windows servers begin requiring NTLM signing by default and reject clients that do not offer it. You can enforce early by setting ServerRequireNtlmSign to 1 once auditing shows no unsigned clients.
It is the next version of the service that applies interim mitigations automatically for certain new vulnerabilities. Microsoft plans to introduce it in December 2026 for Exchange Server and Skype for Business Server, on by default, and extend it to SharePoint Server in January 2027.
We review Entra ID, Intune and Defender configurations against a hardened baseline and give you a prioritized fix list, with the evidence your NIS2 or PCI DSS auditor will ask for.
Get in touch →