Preparing for the worst with Windows 11...how do I use sysprep and restore client data?

[YeOldeStonecat]

This, of course, is subject to change at any given moment in time. What's "latest" right now may not be so in several hours.

Agreed. We'll see many variations. Jus thought I read the current (this weeks) version was supposed to tighten up on the rules for minimum requirements.

By end of this year I'll be replacing my HP rig with a Lenovo Tiny Workstation anyways

 

[britechguy]

Jus thought I read the current (this weeks) version was supposed to tighten up on the rules for minimum requirements.

And it did, at least what's available somewhere. There were two articles on BleepingComputer that went up in very rapid succession where the first machine that was "below spec" installed just fine, but a couple of hours later, another refused to due to being below spec.

Knowing exactly who's got what ISO, and from where, even if they're all MS-sourced, is much like a game of 3-card monte right now.

 

[YeOldeStonecat]

Yeah I don't do it from an ISO unless it was direct from MS.
Mine went in via Microsoft Updates..so it was the latest as of yesterday I think....or was it 2x days ago when I pulled the trigger. Tired today, can't keep track.

 

[nlinecomputers]

And it did, at least what's available somewhere. There were two articles on BleepingComputer that went up in very rapid succession where the first machine that was "below spec" installed just fine, but a couple of hours later, another refused to due to being below spec.

Knowing exactly who's got what ISO, and from where, even if they're all MS-sourced, is much like a game of 3-card monte right now.

Microsoft has rolled out different builds to different groups before in early insider builds. Also while I don't think they are enforcing any CPU rules they do appear to be enforcing the TPM rules IF your hardware supports it but it is turned off or CAN support it but you don't have a module. If there's no way to have a proper TPM module you seem to be getting a free ride for now. YMMV

 

[britechguy]

YMMV

Hence my initial 3-card monte comment. It'll be a while until we can rely on "everyone having pretty much the same thing."

 

[GTP]

Sooo...has anyone else been stopped at the download stage from whynotwin11.com with warning about malware?

 

[nlinecomputers]

Warning from what? Uploaded to virus total?

 

[britechguy]

Sooo...has anyone else been stopped at the download stage from whynotwin11.com with warning about malware?

I haven't tried downloading from there, but only from the GitHub page. I have not had a single download warning, nor any detection afterward. I have had SmartScreen do it's thing where I have to hit the More info link then Run anyway button. But that's not uncommon for any "home grown" unsigned software.

 

[frase]

Sooo...has anyone else been stopped at the download stage from whynotwin11.com with warning about malware?

It is only due to it being an .exe AV's flip out with them all the time.

 

[Larry Sabo]

VirusTotal says says two out of 68 AV vendors flag it, but lists only Sophos as one of them.

Edit: Oops! I see that Bkav Pro was the other AV vendor that detected it. Never heard of them.

 

[nlinecomputers]

Probably a false positive….maybe….

 

[GTP]

Warning from what? Uploaded to virus total?

I trust Emsisoft. False positive or not.
It flagged as Trojan.GenericKD.37158995 (B)

I dont need the file that bad that I risk compromising mine, or my clients PC's.
I'm not going to disable security to download it just to see what Virus Total says.

I'm sure MS will have something like the Update Readiness Tool for this soon enough.

 

[britechguy]

Probably a false positive….maybe….

If only 2 of 68 engines flag it - false postive. I can't count the number of times I've had something flagged by 5 or fewer scanners that I absolutely, positively know to be safe. I'd never take a 2 of 68 as a meaningful risk - no matter the two.

 

[mikeroq]

That website is not affiliated with the tool.

See this github issue with a response from the developer:

WhyNotWin11.com is not owned by Me · Issue #66 · rcmaehl/WhyNotWin11

https://www.whynotwin11.com https://i.imgur.com/6Rlz443.png I haven't seen this mentioned anywhere. Is this from you @rcmaehl? The download link currently points to this repo's releases, but they m...

github.com

This website is not owned, operated, or affiliated with me. I'll see if I can get contact information via WHOIS or another means but definitely sketch. It's my fault for not buying the domain

 

[britechguy]

But, it appears that whynotwin11.ORG is. This is a screenshot from the software, directly downloaded from GitHub this afternoon (version 2.3.0):

 

[mikeroq]

Yes and .org just redirects to github so there's no confusion.

 

[GTP]

Still dodgy even from whynotwin11.org and redirected to Github

 

[frase]

I could create a user account without doing anything special. Was just sign in options>offline>Limited

 

[alexsmith2709]

I'm sure MS will have something like the Update Readiness Tool for this soon enough.

They do/did, its called WindowsPCHealthCheckSetup with filename WindowsPCHealthCheckSetup.msi but i cant find the actual MS link anymore as https://download.microsoft.com/down...55-bc657c939b47/WindowsPCHealthCheckSetup.msi that i downloaded from no longer works.

The Trojan is probably detected because of the way some of the detection works, as the code is on github if you know what you are looking for you could check and im sure others already have done. There is an issue on github which says it is a false positive https://github.com/rcmaehl/WhyNotWin11/issues/49

 

[britechguy]

@alexsmith2709

Microsoft has withdrawn it's own PC Health Check tool until it can be appropriately updated. I saw the official announcement via a post by an admin named Corinne on Sysnative.

It's a false positive. There are far too many who've been using it that are of "some sophistication" when it comes to security issues and there has been no raising of any red flags. Also, and I'll say it again, if only 2 of 68 scanners flag something, regardless of the 2, I've never seen a single circumstance where that condition does not indicate a false positive. It's one of the things that makes VirusTotal such a powerful tool that you can see "who flags and who doesn't."