All posts by Ed Tittel

Full-time freelance writer, researcher and occasional expert witness, I specialize in Windows operating systems, information security, markup languages, and Web development tools and environments. I blog for numerous Websites, still write (or revise) the occasional book, and write lots of articles, white papers, tech briefs, and so forth.

MVP Status Renewed thru June 2027

I’m pleased and delighted to report that a much-anticipated email from MS popped into my inbox last Friday. Such was the press of work that day (Fridays have been unusually busy all month) that I didn’t even see that missive until after lunch. Long story short: the powers that be informed proclaimed MVP status renewed thru June 2027. Of course, I’m glad to be so honored, and happy to receive another year of benefits.

What MVP Status Renewed thru June 2027 Means

It means this website and my weekday Windows blog posts will continue for at least another year. It also means I’ll keep exploring new Windows OS tools and facilities, Windows apps, and other Windows related stuff so we can all learn — and sometimes laugh — together.

I first started using Windows when I “moved up” from DOS 6.x to Windows 3.1 in 1992. It’s been a wild and interesting ride over the past 34 years since then. I’ve seen a lot of versions come and go. Some of them I’ve loved and others despised. But one thing has persisted throughout that interval: a burning desire to understand how things work, and to fix (or work around) them when they don’t do what they should.

The MVP Story So Far…

I got into a fork of the MVP program in 2018 when I became a “Windows Insider MVP.” That lasted until 2024, when MS folded that fork into the main branch. I’ve been a “Microsoft MVP (Windows)” since 2024, and my status is good through June 20, 2027. As I keep moving forward, I keep learning more about how the program works, what it lets me do, and how I can share such information with my readers as the terms of my NDA agreement allow. That covers a lot of great stuff, and I’m happy to use it to write about what I’m seeing and learning.

Thanks for your support and interest over the years. I provide content for over 80K individuals per year here at EdTittel.com. I reach another half-a-million or so through my articles for the likes of ComputerWorld, Tom’s Hardware, WindowsLatest and others. Just this morning I got a big shout-out from WindowsLatest on a recent and fascinating hobby-horse named Secure Boot.

For the future I plan to keep finding, fixing, and reporting on things that break or don’t work as I think they properly  should, and exploring Windows Insider releases as they emerge. Here in Windows-World, that gives me a nearly infinite fund of topics. Stay tuned! If you’re of a similar bent, you can’t apply to the Microsoft MVP program directly. But if you know an MVP who’s already in the program, you can ask them to nominate you. Check the Microsoft MVP Home page to learn more about the program and all of its accoutrement.

Facebooklinkedin
Facebooklinkedin

Dodging a BIOS Bullet By Design

I’ve been dreading a recent moment for years. Whenever you update the BIOS (UEFI) in a PC or laptop, the maker usually throws dire warnings about maintaining power. The unthinkable happened to me this morning: the lights flickered, then went dark. And, as fate would have it, the Lenovo ThinkStation P3 Ultra Gen3 was in the middle of a firmware update (about 65% complete showing) as that happened. I was poleaxed, fearing a fully bricked PC. It wasn’t. The machine came back up cleanly, and I ended up dodging a BIOS bullet by design. I’ll explain…

Note: the lead-in graphic is a mock-up I put together. I didn’t capture the actual screen on my iPhone as it appeared.

Dodging a BIOS Bullet By Design

I was running a routine BIOS update as part of a routine Windows Update (WU) sequence. The firmware update screen had been up for a couple of minutes, progress bar inching along, and then — boom. A power fluctuation in my home office killed the display and dropped the machine cold. The Lenovo firmware screen itself had been displaying the standard warning in big, friendly (okay, slightly ominous) letters: “Do not power off or unplug the machine during the update.”

The progress bar was sitting at 65% when everything went black. That’s prime corruption territory — far enough in that the old BIOS image has been partially overwritten, but not far enough that the new one is complete and verified. If this had happened on an unprotected consumer board, I’d have been looking at a paperweight. Fortunately, on  a workstation-class PC, this story gets a happier ending.

Why the P3 Ultra Gen3 Didn’t Brick

Here’s where things get interesting — and where Lenovo’s engineering team deserves credit. The P3 Ultra Gen3 didn’t survive by accident. It survived because its design planned for this event. Several overlapping layers of firmware resilience kicked in automatically. Let me break them down in basic terms:

  1. Dual BIOS / Backup BIOS Chip. Lenovo workstations — like many enterprise-class machines — carry a secondary, read-protected BIOS image alongside the primary one. Think of it as a golden master copy that the system keeps locked away. If the primary BIOS region shows corrupted at POST time, the firmware controller automatically detects the bad state and boots from the backup image. No user intervention required. The system just comes back up, potentially with the previous firmware version, but alive and functional.
  2. Flash BIOS Button / Crisis Recovery Mode. Some ThinkStation models — including variants in the P3 line — include a dedicated Flash BIOS Button on the chassis. In a true recovery scenario where even the backup region is compromised, you can create a crisis recovery USB drive and use that button to force-reflash the firmware from scratch, completely bypassing any need for a working BIOS. It’s the ejector seat of firmware recovery.
  3. UEFI Firmware Resilience (NIST SP 800-193 / Platform Firmware Resilience). This is the standards-level framework underpinning everything. NIST SP 800-193 defines a three-pillar architecture for firmware protection: Protect (prevent unauthorized modification), Detect (identify corruption or tampering), and Recover (restore a known-good state automatically). Lenovo has formally committed to this standard across its Think commercial product line, which means the recovery behavior I experienced wasn’t a happy accident — it was a tested, certified design outcome.
  4. Intel BIOS Guard. Underneath all of that sits Intel BIOS Guard, a hardware-enforced mechanism that prevents any unauthorized or incomplete writes to the BIOS flash storage from being committed without cryptographic verification. Even if a flash operation is interrupted mid-write, BIOS Guard’s atomic-write design means that an incomplete image cannot silently corrupt the chip’s protected regions without detection.
“ThinkPads detect corruption of all primary BIOS code regions and recover the corrupted region by booting from the backup region, then restore the primary region with the verified binary in the backup.” — Lenovo BIOS Security Statement LEN-20208228 Feb 28, 2020 (no longer active: former URL https://www.lenovo.com/us/en/pdf/product_security/Lenovo_BIOS_Security_Statement_
20200228.pdf)

 

In short: these systems are built with layered defenses specifically because power failures, bad actors, and Murphy’s Law are all real things that happen to real machines in the real world.

What Does It All Come Down To?

Even with all of these protections in place, I’m not going to tell you to start flashing BIOS updates casually while thunderstorms roll in. Here’s what I’d recommend taking away from this little adventure:

  • Use a UPS. Full stop. An uninterruptible power supply is the single most effective insurance policy for any workstation-class firmware update. Even a modest desktop UPS gives you the runtime buffer to either complete the flash cleanly or gracefully abort. My home office UPS setup failed me here — lesson painfully reinforced.
  • Check your service manual for dual-BIOS and crisis recovery support before you update. Not every machine has these features. Know what your hardware can and cannot do before you find out the hard way. Lenovo’s support site documents this clearly for ThinkStation models.
  • Use Lenovo Vantage or Lenovo System Update rather than manual executables. These tools handle pre-flight checks, staged delivery, and rollback behavior far more gracefully than dropping a raw executable and hoping for the best. They’re there for a reason — use them.
  • Know where your Flash BIOS Button is before you ever need it. Locate it in your chassis documentation now, not while you’re in crisis mode at 11 PM staring at a dark screen.

PRO TIP: Before any major firmware update on a workstation, run Lenovo System Update to confirm you’re pulling the current validated image, verify your UPS is holding charge, and note the current BIOS version in case you need to reference it during a recovery. Two minutes of prep, potentially hours saved.

After a Moment of Blissful Relief, Thank the Engineers

Avoiding unplanned downtime is a major design goal in the ThinkStation P3 Ultra Gen3 ‘s design. Today’s tale of averted woe is as clear a demonstration of that design philosophy as you’re going to get outside a Lenovo engineering lab.

I hit what should have been a fatal event, and the machine shrugged it off through a combination of dual-BIOS architecture, Intel BIOS Guard, and NIST SP 800-193-compliant firmware resilience. That’s not marketing copy. That’s a machine doing things right. If you want to dig into the specifics for your own ThinkStation model — crisis recovery procedures, Flash BIOS Button location, and backup BIOS behavior — head over to Lenovo’s support site and pull up your model’s Hardware Maintenance Manual. It makes for surprisingly reassuring bedtime reading.

Here in Windows-World dodging bullets is something that happens occasionally. Today, I’ll gratefully accept a happy ending to what I thought might involve hours of recovery. Three cheers for the engineers!

Facebooklinkedin
Facebooklinkedin

WinGet Shows More Icons

Here’s an interesting and welcome observation. Installing updates this morning, I noticed that 7 of 10 packages showed icons as Winget did its upgrade thing. (And this came from the 2018 vintage ThinkPad X380 Yoga!) Anecdotally, that’s way up from when icons first started showing up Windows Terminal in early March of this year. I’m delighted to see that WinGet shows more icons than ever before. Mostly that happens as more developers start including the necessary image references in their package metadata. In my sample screenshot (5 packages) every one has an associated icon. I’m jazzed!

Why WinGet Shows More Icons Nowadays

Lots of popular apps now include icon Url fields in their metadata (that’s where those images come from: e.g. VLC, Chrome, FireFox, NotePad++, MTPW, etc.). Microsoft has definitely upped its support for icons as well (e.g. Edge, PowerToys, Terminal, VStudio, .NET runtimes, and more). Indeed, there seems to be a growing wave of developer support as more and more packages now sport icons as WinGet interacts with them.

At the same time, says Copilot, “the WinGet backend now caches and serves icons [more] reliably.” These days icons are cached in the content delivery network (CDN), retrieval is faster and better, and broken URLs are getting fixed. The net-net is that more icons are appearing because there are more of them around, and the mechanisms to show them are working better, too.

Here in Windows-World, that counts as progress. Plus, I love the eye-candy that icons provide within the mostly monochrome Windows Terminal environment. How could you not? Good stuff!

If you’ve not yet turned icons on in your Terminal evironment just yet, never fear. I posted about this on April 10 (2026) in an item entitled How to Light Up Winget Icons. Follow its instrux if you’d like to see them for yourself.

Facebooklinkedin
Facebooklinkedin

Understanding Occasional dllhost.exe Crashes

Every now and then, I drop into Reliability Monitor on my primary desktop PC (Flo6). Aka Relimon, this built-in tool provides rough and ready summaries of recent system events. Placement puts emphasis on errors and warnings. In looking over recent stuff, I observed that dllhost.exe has “stopped responding” 4 times in the period from July1 thru 18. I turned to Copilot to aid in understanding such dllhost.exe crashes. Though that frequency may sound ominous or concerning, seems like it’s pretty typical. You can see the latest report for July 1-20 in the lead-in graphic.

Why Bother Understanding Occasional dllhost.exe Crashes?

In examining the critical errors shown in ReliMon’s three-week time window, I saw that dllhost.exe “stopped responding” item on July 1, 8, 17,  and 18. So I shared that info with Copilot and asked “Should I be concerned?” It responded as follows:

Four dllhost.exe crashes over an 18‑day span is well within the “normal Windows background noise” range. It’s not a sign of system instability, corruption, or anything you need to lose sleep over. Let me break down what that frequency actually means in practical terms.

dllhost.exe (COM Surrogate) is invoked constantly—every time Explorer generates thumbnails, previews, metadata, or runs certain shell extensions. On a typical Windows system, dllhost.exe may spin up hundreds of times per day.

So:

  • 4 crashes / 18 days ≈ 1 crash every 4–5 days
  • That’s extremely low for COM Surrogate failures
  • It suggests occasional thumbnail/preview hiccups, not systemic trouble

Driving the Bus Means Wear and Tear

Given that running dllhost.exe during file access can easily cause error events to protect Explorer itself, I’m comforted to know that this occurs by deliberate design. I’ve run into a variety of .com related error events over the years that can be safely ignored (e.g. 1601, 1603, etc.). With information from Copilot in hand, and references to back it up, I’m OK with seeing this in my reliability monitor output.

Here are some useful and interesting supporting materials:

Here in Windows-World, Copilot can be a valuable source of information and insight. But I’ve learned through experience that you must check its sources to separate fact from fiction. If you use it for the same purposes, be sure to check its work (and assertions). In this case, I’m comfortable with the information it’s drawing upon and inclined to trust its veracity. Good stuff!

Facebooklinkedin
Facebooklinkedin

Cloud Rebuild Requires Registry Access

When I read about the incorporation of a Cloud Rebuild feature in Windows 11, Experimental Build 26300.8772 on July 6, I had to have it. First, of course, I had to upgrade a machine to that release. Alas, I hit a few snags on the way (see my July 15 post for deets) but eventually I got there. Then I used the “Create a recovery drive” facility to build a brand-new bootable WinRE for that PC (a honkin’ ThinkStation P3 Ultra Gen 2). But when I booted to that media, WinRE did not appear amidst its menus. The only way to see it is to use Settings > System > Recovery > Restart Now, and then to select that option under the Troubleshoot menu when on-disk WinRE boots instead. Why? Because getting to Cloud Rebuild requires registry access. I’ll explain…

Accessed via on-disk WinRE, there it is!

Why Cloud Rebuild Requires Registry Access

Cloud Rebuild is a new WinRE recovery option that downloads a fresh Windows installation directly from Windows Update and reinstalls it onto the machine. It preserves nothing — no apps, no settings, no user data. Think of it as the “nuclear but automatic” option: positioned for situations where Reset This PC fails or the local recovery image is corrupted beyond use. It does, however, require an active internet connection and relies on Windows Update to supply appropriate NIC drivers. In short, the cloud does the heavy lifting so you don’t have to carry a USB installer everywhere.

So where does the registry come into play? When you create a recovery UFD from a machine running build 26300.8772, Windows faithfully copies the host’s WinRE.wim to the drive — byte for byte. The Cloud Rebuild code is therefore physically present on that UFD. So why doesn’t the tile appear?

When you boot from the UFD, WinRE runs as a fully isolated, self-contained instance. It has no path to the host machine’s registry — that OS partition might not even be mounted. The enablement check silently fails, and the Cloud Rebuild tile simply doesn’t appear. No error, no explanation, no tile. Additionally, Cloud Rebuild is riding a Controlled Feature Rollout in this build, which means not every enrolled Insider machine receives it simultaneously. That adds yet another variable into an already narrow set of conditions.

Here’s the Catch!

The following insight matters, when it comes to planning how to make best and proper use of Cloud Rebuild. Its registry dependency means this feature is available in a narrower slice of real-world failure scenarios than one might hope. Walk through this landscape:

  • Scenario 1 — OS corrupted, disk intact: Native WinRE auto-triggers after two or three consecutive failed boots. The registry is still readable. Cloud Rebuild appears and does its job. This is the sweet spot the feature was designed for.
  • Scenario 2 — Recovery partition (or files) deleted or corrupted: Native WinRE is unavailable, so you reach for the UFD. However, Cloud Rebuild won’t appear on the UFD because the isolated WinRE instance can’t reach the host registry. You’re on your own with whatever tools that generic WinRE environment provides.
  • Scenario 3 — SSD or NVMe failed or dead: Nothing works. Not Cloud Rebuild, not native WinRE, not the UFD for anything disk-related. At that point, the conversation is about replacement hardware, not recovery software.
  • Scenario 4 — BCD or boot files corrupted: Startup Repair may intervene and restore enough of the environment for native WinRE to launch. Cloud Rebuild visibility in that scenario is uncertain and depends on how much of the OS partition structure survived intact.

Microsoft’s own documentation quietly confirms this scope by requiring that the device have “a healthy Windows Recovery Environment” for Cloud Rebuild to function. The architectural intent is clearly to cover soft OS failures — driver corruption, bad cumulative updates, damaged system files — where the underlying disk is intact and the recovery partition is alive. That’s a real and valuable use case. It does not, however, cover every use case.

Cloud Rebuild’s Place in the Recovery Toolkit

For Cloud Rebuild to be a genuine lifeline, your recovery partition must survive whatever broke Windows in the first place. That’s a reasonable bet against driver corruption, a bad update, or OS file damage. But it’s not a bet you should make against disk failure or deliberate partition cleanup.

Additionally, you should test Cloud Rebuild from within a running Windows session before you need it for real. The path is simple: Shift+Restart → Troubleshoot → Recovery and uninstall → Cloud Rebuild. If the tile appears during a deliberate test, you know the feature is enabled on your specific machine. On Insider builds especially, confirm this for yourself. That’s because Controlled Feature Rollout means the tile may simply not be there yet on your hardware, regardless of build number.

If you want to test Cloud Rebuild without committing to a full reinstall, entering WinRE via Shift+Restart lets you verify tile visibility and back out safely. Do this now, on a good day, so you know exactly what you’re working with when a bad day happens.

Closing Thoughts

Cloud Rebuild is not vaporware, and it’s not a gimmick. Within its intended scope — soft OS failure on a machine with a healthy disk and a live recovery partition — it’s a useful automatic recovery mechanism.

The trouble is, “within scope” is doing a lot of work in that sentence. Knowing where that scope ends is the difference between a recovery plan and a recovery hope. The best time to discover that Cloud Rebuild registry access doesn’t extend to your UFD is during a Friday afternoon test with a cup of coffee in hand — not at 2 a.m. during an real recovery. Test deliberately, kit accordingly, and you’ll be fine.

Here in Windows-World, it not only pays to be prepared. It’s also essential to know what you’re doing, and to understand what the tools in your kit can (and can’t) do. ‘Nuff said.

Facebooklinkedin
Facebooklinkedin

Remote Connection Name Cache Cleanup

Take a look at the lead-in graphic. It shows the start menu entries that appear when I enter “rem” to fire off the Remote Desktop Connection app (mstsc.exe). Most of the items that appear therein are current and correct, but some are not (two of the machine names, and all of the IP-based connections). That led me to ask Copilot to lead me though remote connection cache name cleanup. I basically wiped the cache and wound up with this:

Why Do a Remote Connection Name Cache Cleanup?

Short answer: because it points only at useful entries. Longer answer: because I got tired of looking at names for PCs I’d returned to their makers in late 2025 and early 2026. So I decided to ask Copilot to tell me how to clear the stale entries. Boy, howdy,  did THAT turn out to be an adventure. Why? Because there are many different things to clean, and many ways to clean them. Here’s a quick recitation of the various steps I took along my path.

Step 1 — Polite Approach: Delete Single Entries

Before you reach for a registry editor or fire up PowerShell, give the built-in method a shot. Open Remote Desktop Connection (mstsc.exe), click the drop-down arrow next to the Computer field, hover over the offending entry, and press the Delete key. Windows will ask you to confirm, you click Yes, and that hostname is gone. Clean, simple, no collateral damage.

Under the hood, all this does is remove a single string value — MRU0, MRU1, or whichever slot held that entry — from HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default. It doesn’t touch your saved credentials, your default connection settings, or anything else. Surgical, even.

Here’s the problem: this works beautifully when you have two or three stale entries. If you’re staring at a list of twenty-plus hostnames and you need to kill most of them, the one-at-a-time approach will age you visibly. There’s no “select all and delete,” no batch operation — just you, your Delete key, and an ever-dwindling reservoir of patience. Time to escalate.

Step 2 — Targeting MRU Registry Keys Directly

Open Registry Editor (regedit.exe, run as your normal user — no elevation needed for HKCU), and navigate to:

HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default

In the right-hand pane you’ll see the MRU entries spelled out plainly: MRU0, MRU1, MRU2, and so on, each containing a hostname or IP string. You can click any entry and hit Delete, or — and here’s where it gets slightly more satisfying — hold Ctrl and click multiple entries to select a batch, then delete the whole lot in one go.

While you’re in the neighborhood, don’t overlook the Servers subkey:

HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers

Each child key here is named after a machine you’ve connected to, and it stores credential hints — typically the username Windows offered when you last connected. Deleting a machine’s subkey here removes that saved username data, which matters if you’re handing the machine to someone else or just want a clean security posture.

⚠ Caution: Regedit is unforgiving. There is no Undo. Work carefully, and if you’re nervous, export the Terminal Server Client key first (File > Export) so you have a fallback. It takes ten seconds and has saved many an afternoon.

Registry surgery is great for targeted removal — ripping out specific machines while leaving others intact. But it’s still a manual process, and if your list is long, you’ll find yourself in exactly the same situation as Step 1, just with a slightly scarier interface.

Step 3 — Scripted PowerShell Cleanup

This is where most IT pros should start. Two lines of PowerShell. No GUI fumbling, no click-by-click tedium, and — crucially — repeatable. Drop it in a script, assign it to a shortcut, paste it into a runbook. It doesn’t care how many MRU entries you’ve accumulated.

Open PowerShell (no elevation required — we’re working in HKCU) and run the following:

Remove-ItemProperty -Path “HKCU:\Software\Microsoft\Terminal Server Client\Default” -Name * -ErrorAction SilentlyContinue
Get-ChildItem “HKCU:\Software\Microsoft\Terminal Server Client\Servers” | Remove-Item -Recurse -ErrorAction SilentlyContinue

Here’s what each line actually does:

  • Line 1 uses Remove-ItemProperty with the wildcard -Name * to delete every value (every MRU entry) inside the Default key in one shot. The -ErrorAction SilentlyContinue keeps things tidy if the key happens to be empty or the path doesn’t exist yet — no red error text, no drama.
  • Line 2 pipes all child keys under Servers through Remove-Item -Recurse, which deletes each per-machine subkey and its contents. Again, SilentlyContinue means it won’t throw a tantrum if the Servers key is already empty.
💡 Pro Tip: Note that neither line deletes the Default or Servers keys themselves — it only removes their contents. That means mstsc.exe finds the parent keys intact and doesn’t need to re-create them, which keeps things clean on the filesystem side.

The PowerShell approach is the sweet spot for most users and administrators: fast, repeatable, easy to verify, and infinitely less error-prone than clicking around regedit under time pressure. Run it once and you’re done. Or add it to an off-boarding script and never think about it again.

 

Step 4 — Wipe the Terminal Server Client Hive

Sometimes the PowerShell approach still leaves you with artifacts — corrupted entries, unexpected subkeys, or settings that mstsc.exe seems to be reading from somewhere you can’t quite pin down. For those moments, there’s one final escalation: delete the entire Terminal Server Client key wholesale.

In regedit, navigate up one level to HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client, right-click the key, and choose Delete. Or from PowerShell:

Remove-Item -Path “HKCU:\Software\Microsoft\Terminal Server Client” -Recurse -ErrorAction SilentlyContinue

Windows will re-create the entire key structure fresh the next time you launch mstsc.exe. This gives you a genuinely clean slate. Because it got rid of entries whose source I couldn’t identify (but were still producing entries in the Start menu “Recent” list), this is what I decided to do.

⚠ Important Warning: This wipes everything — not just the MRU name cache, but also any default settings you’ve configured in the RDP client (default screen resolution, audio settings, drive redirection preferences, and so on). It’s the right call when decommissioning a workstation, preparing a machine for a new user, or resolving a genuinely corrupted configuration. For routine cache cleanup on your own machine, the PowerShell two-liner in Step 3 is the better choice.

Keeping A Tidy Registry

So there you have it — a clean escalation ladder for taming the RDP name cache, matched to whatever level of mess you’re facing. One or two stale entries? Hit Delete in the client and move on with your life. A sprawling graveyard of defunct hostnames? The PowerShell two-liner clears it in seconds. Truly cursed configuration? Nuke the whole hive and let mstsc.exe start fresh.

Each approach is appropriate to its context, and none of them require third-party tools, elevated privileges, or any particularly heroic effort. The registry isn’t as scary as it looks — as long as you back it up before you go excavating and resist the urge to poke at things you don’t recognize. Keep your tools sharp, your connections list short, and your registry cleaner than you found it. Future-you will be grateful.

What I Did Next, and Where It Took Me

After nuking my name cache completely (option 4) I then remoted into each of the PCs currently on hand here at Chez Tittel. That updated the recents list so it shows ONLY those PCs I might actually remote into. IMO that means “Case closed.” I’m glad it’s over!

Here in Windows-World, the desire to clean up can be overtopped by the difficulties involved. This time, I powered through and got things where I wanted them. I plan to enjoy that while it lasts…

 

Facebooklinkedin
Facebooklinkedin

P3 Ultra Insider Enrollment Falters

Having returned a couple of loaner units to Lenovo, I recently decided to enroll the  Lenovo ThinkStation P3 Ultra — a beast of a workstation — in the Windows Insider Program to start testing preview builds. The machine was running Windows 11 Pro, TPM 2.0 was enabled, Secure Boot was on, and I had a personal Microsoft account linked. By every measure, this machine should have sailed right through that process. But alas, P3 Ultra Insider enrollment falters, and thereby hangs this tale.

Why P3 Ultra Insider Enrollment Falters

Enrollment hung. Indeed, I hit a brick wall: an eligibility error that blocked enrollment dead in its tracks. I got no clear explanation, no obvious next steps. Just a vague message and a dead end. If you’re in the same boat, you’re not alone, and there’s an easy fix. Here’s exactly what I did to get it working.

What This Error REALLY Means

The error Windows surfaces during Insider enrollment is frustratingly generic. Depending on your exact configuration, you might see language about the device not being “eligible,” a “policy restriction” preventing enrollment, or a note about account requirements — sometimes all three in the same dialog. There’s rarely a useful error code attached.

What makes this especially maddening on a machine like the P3 Ultra is that the hardware is fully compliant. TPM 2.0? Check. Secure Boot? Check. Windows 11 Pro? Absolutely check. The error fires anyway, leaving you staring at a dialog that tells you almost nothing useful about where the actual blocker is hiding.

There’s Something About the (Original) MSA

I can’t figure out what it is, but there’s something about my primary MSA that stymied the enrollment. As soon as I switched to a backup MSA and authenticated (using the MS Authenticator app on my iPhone), the process went through correctly. After a reboot, the Insider update showed up and downloaded (as you can see, it’s installing right now):

Troubleshooting Tips for Insider Enrollment

If a change of MSA doesn’t fix your issues, try looking for Group Policy that blocks preview build enrollment, or check to see if diagnostic data level is too low. Additional deets follow.

Fix the Diagnostic Data level

Navigate to Settings > Privacy & Security > Diagnostics & feedback and make sure “Diagnostic data” is set to Optional — or at minimum confirm it isn’t being suppressed or overridden by a policy. Without this, enrollment may silently fail even if everything else is correct. If the toggle is greyed out, a Group Policy or MDM policy is controlling it, and you’ll need to address that first via gpedit.msc or your MDM console.

Reset the “Manage preview builds” Group Policy

Open gpedit.msc (run as Administrator), then navigate to Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business. Find the policy named “Manage preview builds” and set it to Not Configured or, if you prefer explicit control, set it to Enabled with the sub-option that allows preview builds. Once done, open an elevated Command Prompt and run gpupdate /force to apply the change immediately without waiting for the next Group Policy refresh cycle.

Try a Personal MSA

MSAs can be of type “Work or School” or “personal.” The Insider program wants one that’s strictly personal. If all else fails, you can use a gmail, yahoo or icloud email address. MS free options include Outlook.com (though existing hotmail and live.com addresses still work, no new signups for those domains are allowed).

Insider Enrollment Issue Takeaways

Insider Program enrollment errors on modern workstation-class hardware almost always come down to one of three things: the diagnostic data level is too lowGroup Policy is actively blocking preview build enrollment, or there’s an account type mismatch — a work or school identity where a personal MSA is needed. It is almost never the hardware itself.

The ThinkStation P3 Ultra is a fully Insider-capable machine. It meets every technical requirement Microsoft publishes. The blocker, in my experience and in most reported cases, is configuration — either something an IT department put in place, or a default that Windows didn’t surface clearly during setup.

Work through the three steps above in order, and there’s a very good chance you’ll be selecting your Insider channel within a few minutes. And if you hit a variant of this error that the steps above didn’t resolve, drop the details in the comments below — include the exact error message text, whether the machine is domain- or Entra-joined, and what your gpresult output shows for the Windows Update for Business policies. The more detail you share, the faster we can help narrow it down.

Facebooklinkedin
Facebooklinkedin

X12 Gets New Insider Look

OK then. Now that I’ve fixed the boot problems on the X12 Detachable Tablet Gen 1, and rejoined the Insider Program, I’m looking around at what’s there (and what’s not, just yet). At long last. I can see the primary Insider channels (Experimental and Beta) as shown in the lead-in graphic. So finally, the X12 gets new Insider look and feel in Settings > WU > WIP and elsewhere. So glad!

As X12 Gets New Insider Look, Now What?

i can finally start looking for new features and capabilities under the Windows 11 umbrella, as MS continues working toward the upcoming 26H2 release. So far, as is often the case, I’m looking for things — such as the new-look Shut Down controls (see this WinAero story for info & screencaps) — that haven’t made it onto the X12 just yet. I know, I know: I can use ViveTool to turn them on. But I’m determined to wait and see how things emerge as MS widens its controlled release coverage.

That said, I am delighted to see my Insider Program options finally synch up with the Experimental and Beta channel offerings (with option to turn on Release Preview, as you see at bottom right in the screen cap). Now, I just need to be patient, and wait for more new features to start showing up.

Items of Particular Interest, IMO

Since I’ve got suitable boot media, I want to see if I can spot the Cloud Recovery option when booting into WinRE. Alas, Copilot says that’s an Experimental feature only, so I may need to switch the ThinkStation P3 Ultra Gen3 over to that channel.

Today’s Patch Tuesday, so I can check later (via Update History) to see the new Unified Update Experience at work. It should also be interesting to see if anything else shows up in today’s update announcements. Stay tuned! I’ll keep you posted…

Facebooklinkedin
Facebooklinkedin

Despite Throwing Error, Old_mscopilot_proxy.exe Is MIA

Here’s something interesting and mildly mystifying. If you use Reliability Monitor to keep tabs on Windows stability, you may have spotted old_mscopilot_proxy.exe as a problem item — I certainly have. My most recent entry occurred July 6, 2026, at 12:02 PM. That naturally sent me hunting for the file so I could understand what it was doing and if I could delete it safely. What I found — or rather, what I didn’t find — tells a nifty story about how Reliability Monitor actually works. Despite throwing error, old_mscopilot_proxy.exe is MIA when I try to search (and perhaps root) it out.

Despite Throwing Error, Old_mscopilot_proxy.exe Is MIA

Take a look at the lead-in graphic. It shows the error details from Reliability Monitor. Basically, it’s saying that the app has quit working. To be more specific, it says the program has “stopped interacting with Windows and was closed.” The version number provided — 149.0.4022.80 — follows a Chromium-based versioning scheme Microsoft adopted for its Copilot app. That’s an important and concrete clue about the file’s true origin.

Key factoid: the old_ prefix is a standard artifact of Microsoft’s in-place updater for Copilot. Before dropping a new executable, the updater renames the currently running binary to old_[filename].exe as a rollback maneuver. Once the new version installs successfully, that old_ file should be cleaned up automatically. In practice, that cleanup step fails silently with some regularity, leaving an orphaned executable on disk — and a crash record in the event log when the system subsequently tries to invoke it.

Seeking Old Copilot Files/Versions

Knowing where the file should be is not the same as finding it. I ran Get-ChildItem searches against C:\Windows, LocalAppData, Program Files, and the notoriously ACL-locked C:\Program Files\WindowsApps folder — all with -ErrorAction SilentlyContinue to suppress access-denied noise. Every search returned immediately with no output. I then queried the Windows Error Reporting archive and queue folders using Select-String to look for any .wer report referencing the file. Nothing there either. Finally, I launched Voidtools Everything as administrator, triggered a full C: rescan, and searched again. The file is completely absent, gone MIA.

Why Does ReliMon Report This Error?

Here’s the part that catches people off-guard, including your humble author. Reliability Monitor does not verify live disk state before displaying an error entry. It reads the Windows Application Event Log — specifically Event ID 1000 Application Error records. These persist independently of whether or not the executable they name still resides on disk. Such log entries cannot be selectively deleted in Windows, either. You’d have to clear the whole Application log to remove them, which is far too blunt an instrument for this situation.

When in Doubt, Do No Harm (Nothing)

There’s really no need to do anything about this error, except to recognize its (in)significance. The file is gone, the Windows Error Reporting reports are gone, and the Application event log entry from July 6 will age out of Reliability Monitor’s 28-day display window naturally — in my case, by August 3, 2026. If you want to confirm that the event log is the sole remaining source of the entry, run this command string in an elevated PowerShell session:

Get-WinEvent -LogName Application | Where-Object { $_.Message -like "*mscopilot_proxy*" } | Select-Object TimeCreated, Id, Message | Format-List

When I run it, I get hits from 7/6, but also 6/19, 6/12, 5/28, and then weekly back to 4/14. This, apparently, is a pretty constant (if bogus) error on the Flo6 system. Indeed, Copilot tells me “the ghost error pattern — where a file that no longer exists keeps appearing in Reliability Monitor — is surprisingly common and poorly documented.”

But once you understand that Reliability Monitor reads historical event log records rather than interrogating live disk state, these apparent mysteries resolve themselves. The file is gone, the risk is zero, and the entry will vanish from ReliMon on its own (though it remains in the error log). Sometimes the best fix is no fix at all, particularly when there’s nothing wrong, nor anything to repair. Here in Windows-World, doing nothing can come as a welcome relief. That’s my take, anywho…

Facebooklinkedin
Facebooklinkedin

WinGet List/Install Orders Seldom Match

If you run winget upgrade --all --include-unknown regularly, you have probably noticed something odd. The packages listed in the upgrade table rarely install in the order they appear. I hit this recently on my ThinkPad X12 Hybrid Tablet, where six packages needed attention: Google Chrome, Microsoft Teams, MiniTool Partition Wizard Free, Oh My Posh, Patch My PC Home Updater, and Windows App. They were listed in one sequence but installed in a noticeably different one. The explanation stems from WinGet’s dependency resolver. It’s worth understanding, and explains why WinGet list and install orders seldom match each other.

Why Do WinGet List/Install Orders Seldom Match?

As you can see in the lead-in screencap, the upgrade table that WinGet displays before installation is sorted alphabetically by package display name — that is the first (Name) column, not the Id column. It’s purely cosmetic: WinGet queries its source index, collects available updates, and orders the results for human readability. The order in that table carries no weight when determining which package installs first. Think of it as a shopping list arranged by aisle label, not a build sequence.

Install Order Shows a Dependency Graph

Before the first installer touches the PC, WinGet’s dependency resolution engine reads every package manifest in the upgrade set. It constructs a directed acyclic graph (DAG) of declared dependencies. Next, it runs a topological sort namedGetInstallationOrder() on the winget source. That produces an install sequence where no package arrives before its pre-reqs are satisfied. This re-ordered queue need not follow name or ID order.

The X12 Hybrid Tablet Run

In the screencap, you see the raw WinGet output from a recent run on the X12 Hybrid Tablet. Six packages are available, listed in alphabetical order by display name — Chrome, Teams, MiniTool, Oh My Posh, Patch My PC, Windows App. The three declared VCLibs and Windows App Runtime dependencies follwing that list reinforce that notion that other elements than those that appear are in the mix. In the end, the actual install order was MiniTool Partition Wizard, Patch My PC…, Chrome, Teams, Windows App, and finally, Oh-My-Posh.

When List Order and Install Order Do Align

Occasionally the two sequences match — but that is coincidence, not design. It happens when none of the packages in the upgrade set declare inter-package dependencies and WinGet’s internal queue order happens to mirror alphabetical sequence. As soon as one package declares a dependency on another — or on a shared runtime — the topological sort reshuffles the queue and the coincidence evaporates.

A Practical Takeaway

No need to manage this manually. Winget’s dependency resolver handles the sequencing reliably. Indeed, fighting it with flags like --skip-dependencies is rarely worth the risk. Tyring to drive this yourself, you might end up with a package that installs against a runtime version it does not actually support. Trust the DAG, watch the dependency notice block that appears before the first installer fires, and you will get a clear picture of why the WinGet upgrade install order looks the way it does.

Next time you notice that WinGet installs packages out of listing order, check the dependency notice block at the top of the install run. That block is where WinGet “shows its work.” That’s where the topological sort result gets laid out in plain text. It is one of those quiet, well-engineered behaviors that rewards users who take a moment to read the output carefully.

Further proof of my earlier contention (see this June 27 post) that “WinGet knows more than it says.” I think so, but you can make  your own judgement. Here in Windows-World, there’s plenty of room for multiple takes on what’s REALLY going on. This is mine…and I’m sticking to it!

 

Facebooklinkedin
Facebooklinkedin