Microsoft recently closed a loophole that allowed people to continue to access the free upgrade to Windows 10 (and then Windows 11), from Windows 7 or 8, but it appears there’s been an unwelcome side-effect here. Namely, those who have previously taken the free upgrade offer in years past have reportedly found that their license key is suddenly deactivated. Let’s outline a quick example to make the situation clearer. Say you owned a PC with Windows 7 way back when then took the free upgrade to Windows 10 when it emerged. And down the road, you further upgraded to Windows 11. So, you’ve been happily carrying on with your Windows 11 PC, but last week – since the mentioned loophole was closed – you decided to upgrade your graphics card. After that upgrade, you find that Windows 11 is telling you that your license key isn’t valid – so you have to buy a new one. That’s what has happened to The Verge, some of its readers, and other folks who have been complaining about the situation on Reddit and other online platforms. Okay, so it’s not clear how many Windows 11 and 10 users this is happening to, but it’s certainly occurring in some circumstances. It may arise without a hardware component upgrade, The Verge suggests, and the deactivation of the license could even take place due to a simple BIOS update. Reader Daniel Mittelman tells a story of having his activation blocked after upgrading some hardware in his PC, and he contacted Microsoft customer support about the problem.  Mittelman observes: “They told me because my Windows 10 license had been upgraded from Windows 7, and that they had discontinued support for Windows 7 product keys, that they could not continue my license for Windows 10 Pro after the hardware change. “They also acknowledged that changing the hardware is not a violation of the Windows license so there is no reason my Windows 10 license should be revoked or altered in any way.”  That’s the key point here, of course. While you can’t get an entirely new PC and use a Windows license from your existing computer – it’s tied to one machine – upgrading components should not mess with your license (it’s still the same PC, just with a bit of it swapped out, or maybe several bits). So, this shouldn’t be happening, and as theorized it may be something to do with Microsoft squashing the upgrade path from Windows 7 or 8 to Windows 10/11. That free offer officially expired a year after the launch of Windows 10, but remained an unofficial route until just recently when Microsoft finally did away with it. Microsoft is looking into this issue, you’ll be glad to hear. Principal product manager of Windows at Microsoft, Bill Babonas, told The Verge: “Microsoft is aware of these customers reports and is investigating. Customers who are experiencing technical difficulties should contact customer support.” Want more you can find it on OUR FORUM.

In a move that resembles the famous Trustworthy Computing push of yesteryear, Redmond is responding to a spate of embarrassing hacks with a new ‘Secure Future Initiative’ promising faster cloud patches, better management of identity signing keys, and a commitment to ship software with a higher default security bar. In a note announcing the new SFI approach, Microsoft Security Vice President Charlie Bell said the software giant will revamp the age-old Software Development Lifecycle (SDL) to account for the latest trends in cyberattacks. “The first priority is security by default,” Bell said, echoing the words of Microsoft founder Bill Gates in the seminal 2002 memo that documented the company’s mission to root out security problems that were leading to destructive Windows worm attacks. Today, Microsoft is reeling from a major hack of its flagship M365 cloud platform, a compromise that led to the theft of U.S. government emails and prompted a U.S. senator to accuse Microsoft of “cybersecurity negligence.” The M365 hack, caused by an embarrassing mismanagement of signing keys, is being investigated by the Department of Homeland Security’s Cyber Safety Review Board (CSRB). “We have carefully considered what we see across Microsoft and what we have heard from customers, governments, and partners to identify our greatest opportunities to impact the future of security. We will focus on transforming software development, implementing new identity protections, and driving faster vulnerability response,” Bell said. More specifically, Microsoft plans to move identity signing keys to an integrated, hardened Azure HSM and confidential computing infrastructure where the signing keys are not only encrypted at rest and in transit but also during computational processes as well. “Key rotation will also be automated allowing high-frequency key replacement with no potential for human access, whatsoever,” Bell announced, a clear reference to how a crash dump error was exploited by a Chinese espionage group to steal emails from approximately 25 organizations. Bell, who took control of security at Microsoft in 2021 after a stint running security at AWS, said the company will use AI to help automate threat modeling and adopt memory-safe languages like Rust to build security at the language level and eliminate entire classes of traditional software vulnerabilities. In a nod to the dangers of default cloud deployments that expose data to remote hackers, Bell said the SFI will move to implement Azure tenant baseline controls (99 controls across nine security domains) by default across our internal tenants automatically. “Without full transparency on vulnerabilities, the security community cannot learn collectively—defending at scale requires a growth mindset. Microsoft is committed to transparency and will encourage every major cloud provider to adopt the same approach,” Bell declared. Microsoft has faced intense criticism for its own approach to third-party vulnerability research of its cloud products and continues to struggle with faulty and incomplete patches and a surge in Windows zero-day attacks. The company recently announced plans to expand logging defaults for lower-tier M365 customers and increase the duration of retention for threat-hunting data.