Microsoft Previews Safer Windows Ecosystem

•
June 30, 2025    

“All of the endpoint security features you’ve come to expect, without that pesky kernel-level access.”

See Also: Beyond Replication & Versioning: Securing S3 Data in the Face of Advanced Ransomware Attacks

While that’s not an actual marketing statement from Microsoft, it’s the subtext of the company’s latest missive on what it’s doing to make the Windows ecosystem more resilient, in the wake of the July 19, 2024, global meltdown caused by a faulty CrowdStrike software update.

Nearly one year later, the Redmond, Wash.-based tech giant is advancing plans to help the latest-generation Windows systems avoid such mishaps, or at least to recover quickly. Part of that overhaul involves giving third-party security tools the ability to still detect and eradicate viruses and block suspicious behavior, without them also needing kernel-level access to the operating system (see: After CrowdStrike Outage: Time to Rebuild Microsoft Windows?).

How this might look in practice remains to be seen. In July, Microsoft will share a beta version – aka “private preview” in Redmond-speak – of Windows 11 with the endpoint security software developers that comprise its Microsoft Virus Initiative 3.0 group of business partners.

“The new Windows capabilities will allow them to start building their solutions to run outside the Windows kernel,” said David Weston, vice president of enterprise and OS security at Microsoft, in a blog post.

“This means security products like antivirus and endpoint protection solutions can run in user mode just as apps do,” he said. “This change will help security developers provide a high level of reliability and easier recovery resulting in less impact on Windows devices in the event of unexpected issues.”

Faulty updates, including for security tools, have previously crashed Windows users’ systems, requiring vendors to roll them back. But none of those outages occurred at the scale seen last July, when the faulty CrowdStrike update disrupted 8.5 million Windows hosts – PCs, servers and virtual machines, causing many to display the infamous “blue screen of death” and reboot in an unending cycle.

Following that chaos, obviously the writing has been on the wall for Microsoft to get smarter about how security tools can interact with the kernel, as well as the OS’s ability to gracefully recover from mishaps. Last September, Microsoft gathered government officials and industry representatives for a private summit. In November 2024, the company announced its new Windows Resiliency Initiative, designed to ensure systems can recover more quickly and easily in the event of a disruption.

To help make that happen, the MVI 3.0 program details a number of specific security and reliability rules for vendors that look a lot like the steps CrowdStrike belatedly pledged to take post-July 2024. “Requirements include testing incident response processes and following safe deployment practices for updates to Windows endpoints,” Weston said. “Security product updates must be gradual, leverage deployment rings and leverage monitoring to minimize negative impacts.”

Program members Bitdefender, CrowdStrike, Eset, SentinelOne, Sophos, Trellix, Trend Micro and WithSecure have issued public testimonials saying they’re planning to work with the changes promised by Microsoft.

The upside from following such practices, which some endpoint security software vendors have said they were already doing, is that it will “help ensure any incident is either avoided or managed both efficiently and expediently,” said Juraj Malcho, CTO of Eset.

CrowdStrike pledged that its software will play by the new rules. “With the introduction of MVI 3.0, we’ve successfully met all the new standards and recognize how these rigorous requirements strengthen the overall ecosystem,” said Alex Ionescu, CrowdStrike’s chief technology innovation officer.

Microsoft hasn’t stated if it plans to revamp its homegrown Defender Antivirus software, formerly known as Windows Defender, which ships for free on all Windows PCs, so that it too will run outside the kernel. Not doing so would likely be catnip for anti-monopoly watchdogs.

Other open questions remain including: When will endpoint security tools that don’t require kernel-level access come to market? Also, does Microsoft plan to actively block – or allow IT administrators to block – security software that must run in kernel mode?

Organizations’ PC refresh cycles may also slow this feature coming to market. For desktop versions of Windows, as of May 2025, Statcounter reported that Windows 11 commanded 43% market share, behind Windows 10 – for which support will cease this October – at 53% and ahead of Windows 7 at 2% and Windows XP at 0.5%.

Black Is the New Blue

Locking down kernel-level access isn’t the only innovation Microsoft has planned.

The first version of a new feature called Quick Machine Recovery is set to debut in the coming months, enabled by default for home devices and which IT administrators can enable on devices running Windows 11 Pro and Enterprise.

Whenever a device restarts unexpectedly, it can get stuck in the Windows Recovery Environment, aka Windows RE, and QMR aims to address that problem.

In a widespread outage, “Microsoft can broadly deploy targeted remediations to affected devices via Windows RE – automating fixes with QMR and quickly getting users to a productive state without requiring complex manual intervention from IT,” Microsoft’s Weston said. The company has also promised upcoming features that help IT teams customize QMR for their own use.

Two other forthcoming features of note: Machines with the right specifications will gain access to “hotpatching” that can be used to install the most important Windows updates on a monthly basis, without users having to restart their PCs.

On the resilience front, Microsoft is developing a new, presumably paid service called Windows 365 Reserve. If a user loses access to their system – be it through loss, theft or system problems – they can use this service to gain “secure access to a temporary, pre-configured Cloud PC, which can be accessed across devices” until they regain access to their primary device, the company said.

Given the extent to which organizations continue to get disrupted not by errant software updates, but rather ransomware-wielding attackers, this may be an especially welcome offering.