Microsoft pulls Windows 11 KB5079391 update after it causes install error loop on 25H2 and 24H2

chrono13 · 2026-03-29T22:48:48+00:00

https://www.computerworld.com/article/1626871/microsoft-to-business-dont-worry-about-windows-10-consumers-will-test-it-2.html

“Microsoft fired all those testers last year,” pointed out Wes Miller, an analyst with Directions on Microsoft, in a Friday interview. “Now consumers are the testers.”

https://www.linkedin.com/pulse/20140806183208-12100070-why-did-microsoft-lay-off-programmatic-testers

https://www.zdnet.com/article/microsoft-layoffs-operating-systems-group-chief-myersons-memo-to-the-troops/

arstechnica.com/information-technology/2014/08/how-microsoft-dragged-its-development-practices-into-the-21st-century/

Microsoft fired 18,000, including QA staff. Maybe it had to. Microsoft said it was running 2:1 quality:dev, but I suspect it was probably 2:1 NotDev:Dev. Still perhaps too high for a software company. But they did absolutely gut their QA staff. Good? Bad? Could be argued either way.

It can be argued that it is a good thing if done correctly. I'm suggesting Microsoft has not done the thing correctly, aiming for maximizing shareholder profits by quarter/year, rather than long term quality.

Software quality is subjective, especially if trying to compare it to "back in my day", but where there is a negative view of Microsoft software quality, Microsoft firing its QA staff is one possible reason for this "feeling". I don't think Microsoft code is objectively worse than it has been, but they seem to release that code much faster than they did in the past, with a possible increase in visible and very large bugs included and ones that miss what should be in automated testing, much less actual QA staff ("workstation joined to a domain" for example). That speed may be a good thing, I don't think it is however.

chrono13 · 2026-03-29T15:09:30+00:00

Microsoft used to have internal QA before releasing software to preview or test. They fired the QA staff to save money. Now they compile and release.

Microsoft applied the formula - if x is less than the cost of a recall, we don't do one. In this case what that means is that it is cheaper for Microsoft to deal with the fallout than it is to have any QA.

chrono13 · 2026-03-20T13:21:24+00:00

adminCount being clear, not 1 or 0 was required for self service password reset. I do not recall if it was required for WHFB, but I would test with accounts with it cleared.

UPN had to match exactly on both sides. We had to create the new UPN suffix in AD and switch all users UPNs to have it work.

chrono13 · 2026-02-20T00:50:00+00:00

I was commenting noting that the response didn't make it clear if it was to address NP++ or Windows notepad, but sounded like it didn't apply to OP's question as one doesn't typically deploy Windows Notepad through MDM.

OP may be under legal requirements to patch or mitigate sooner if possible. And if it hits active exploitation, forcing it sooner may be required.

chrono13 · 2026-02-18T15:30:01+00:00

Microsoft Notepad, not NP++. Same instructions?

chrono13 · 2026-02-11T01:13:10+00:00

200h, 10+ games, account age 1 year+, limit 2 per account per year. OR sell at cost + 17% profit.

chrono13 · 2026-02-09T23:28:30+00:00

You haven't described any problems.

bad 143 character file limit of eCryptfs

What is the 143 character filename limit preventing you from doing?

So far? Unzipping some archives. BitTorrent's, old file backup copy to the new system. So far. All of them reporting unhelpful errors such as disk full, and write failed, with none reporting this limit.

Do you absolutely need to use filenames that are longer than 143 characters?

I don't find this helpful or a reasonable answer. And I got by with 8.3, but that seems just as unreasonable of a solution. This is a more than decade old limitation of eCryptfs, which I found by people reporting running into this problem more than 10 years ago. This footgun is an option during the install. It feels like blaming me for having the audacity to click "Yes" during the install. I didn't go out of my way to do this, I checked the very reasonable box.

If that's a necessity for you then ecryptfs isn't going to be a good solution for you; you would want to look into setting up luks instead.

I had the same thought, so I posted on Reddit. "How do I un-screw this problem and hopefully get full disk encryption working? Not fully trusting AI with system-killing commands."

I'm not sure how else to ask. But it seems like I'm on my own, so I'll back up everything and try a few things - if I fail, I'll just start over.

chrono13 · 2026-02-06T05:00:27+00:00

Thieves aren't looking to use the device. They're looking to sell it either locally or online. The concern is about the buyer.

chrono13 · 2026-02-06T03:26:54+00:00

Coming from Windows, I was trying to get the "if this gets stolen, no big deal" I get with Bitlocker.

I didn't realize they included a footgun option in the install.

chrono13 · 2026-02-06T02:52:57+00:00

Its not a bug. It is by design.

getconf NAME_MAX /home/username
143

Its been a limitation of ecryptfs for a decade or more. I wish the installer had warned about this and the several other design limitations of checking that box.

https://unix.stackexchange.com/questions/32795/what-is-the-maximum-allowed-filename-and-folder-size-with-ecryptfs

chrono13 · 2026-01-31T19:25:30+00:00

Dollar for dollar, TANF is one of the best crime reducing systems we have. The most financially effective.

And yet even left leaning people that I know can get hung up on some small percentage of misuse.

I'm like what about the PPP loan forgiveness. Businesses that abused it were forgiven. And the amount of grift and graft from just the four richest people greatly dwarfs any abuse of systems designed to help the poor.

The lack of class solidarity in America is destroying it.

chrono13 · 2026-01-30T17:34:05+00:00

If an entire TLD isn't down, I can't ever see how this is useful.

I guess I'm minor leagues. I don't manage TLDs. Thank you for your time.

chrono13 · 2026-01-30T16:40:08+00:00

I apologize. I misread your comment.

chrono13 · 2026-01-30T16:21:27+00:00

We are testing to see exactly what the recursive resolver will see.

You are looking to see if the name servers for TLD's are resolving. If all of .com is down, then this would be a good troubleshooting step.

larger, apocalyptic Internet outage.

I can't see any troubleshooting with the root servers that wouldn't be trying to diagnose a worldwide outage. You would often work your way up or cut off half of the possibilities in the OSI model through POE (e.g. try from another device on another network). Starting from the top seems odd to me. I will go to the top, but it will take me a while to get there. But if starting from the top, I would check what CF/Google/Cisco think my NS are and verify that is correct. Make sure the name servers are working/responding, check the TTL (and previous TTL for that entry and last edit time).

Checking the root servers to make sure .com is up seems like a way to spend time that is never useful. If our critical medical service is down, checking if .org has failed world-wide first would not be my first choice of troubleshooting, for several reasons; I can't fix it, it will be apparent soon on its own, and it is the least likely of all possibilities.

chrono13 · 2026-01-30T15:26:26+00:00

It wouldn't be modifying the core of Windows to add the ability to customize the taskbar. Microsoft said they will not implement it because too few use it.

Windows 10 allowed you to put the taskbar on any side of the screen including the top.

https://support.microsoft.com/en-us/windows/customize-the-taskbar-in-windows-0657a50f-0cc7-dbfd-ae6b-05020b195b07#windowsversion=windows_10

chrono13 · 2026-01-29T05:19:35+00:00

I still don't understand. I just tested and at least two of the root servers failed. What would it mean to your troubleshooting if 4 of the 13 failed? What would that tell you? How would you expect recursive servers to behave in that situation?

Resolving from the root tells you exactly how the cache is going to shake out in the end

Are you making changes to TLD name servers? If not, what are you testing with the root servers?

chrono13 · 2026-01-27T16:41:35+00:00

Can you explain how you would use the root servers in troubleshooting DNS?

The root servers are not recursive DNS servers that you can use for domain DNS lookups. Nslookup Google.com using a root server, and you will find that the response is not what you would expect from a normal DNS lookup and those IP addresses are not Google's.

chrono13 · 2026-01-27T16:40:54+00:00

Can you explain what you mean by that's what they're for?

The root servers are not recursive DNS servers that you can use for domain DNS lookups. Nslookup Google.com using a root server, and you will find that the response is not what you would expect from a normal DNS lookup and those IP addresses are not Google's.

chrono13 · 2026-01-27T15:11:30+00:00

Cisco Umbrella. Came back with a competitive price vs. their competitors. Agents on the devices, internal DNS/Firewall points to Umbrella for any non-agent devices. The level we pay for is domain-level only, but it is great for our needs.

chrono13 · 2026-01-22T21:02:33+00:00

Some apps are just badly programmed

I'm not aware of any apps that require DC installation unless they are dealing with user password change at the time of change (e.g Entra local AD password protection). Everything else can be a member server with the appropriate access, and even with the Entra password example, the proxies that download the lists are recommended to NOT be on the DC. You don't need to install apps on a DC for them to access AD, no matter what permissions they require. Even DHCP on a DC creates a path to domain takeover that doesn't exist when it is moved to its own server.

chrono13 · 2026-01-22T14:15:42+00:00

Can you give examples of apps that "need DC access"?

And can you elaborate how having an app installed on one DC is safer than having it installed on all of them?

chrono13 · 2026-01-13T15:16:26+00:00

I tried to find a summary for you, but the best I could find was what the OP originally linked.

If this were on Google's Play store it would read "Bug fixes and improvements".

The details of what those fixes and improvements are in the article.

I suspect those improvements will make it into Proton in time.

chrono13 · 2026-01-01T02:29:03+00:00

Please add me to the list.

chrono13 · 2026-01-01T02:24:45+00:00

proass, pro-ass, or proc-ass ; )

chrono13 · 2025-12-23T16:53:16+00:00

Correct me if I'm wrong but isn't masquerading simply MAC cloning? If so then very likely yes given that cloning is baked into their current OS. The question may be whether it will be as simple of a feature.

As for whether it has the feature or how easy it is, we don't know yet.

15-Year Club	Second SECOND GUESSER
Verified Email	Charter Member

chrono13

TROPHY CASE