Rust Revolution: Microsoft is Reinventing Windows Driver Security

This Week in IT, discover how Microsoft’s pivot to Rust could mark the end of notorious Windows driver vulnerabilities! Plus, M365 gets a new Loop service plan, which means the Loop app could be approaching GA, the new Outlook for Windows gets some key updates, and lots more of the week’s most important IT news.

00:00 – Start
01:07 – Windows Rust driver revolution
04:09 – Microsoft 365 Loop app servicing plan
06:54 – New Outlook for Windows updates
07:49 – Bing Enterprise Chat deployment controls
08:35 – Windows Terminal updates
09:34 – Microsoft Intune September updates

Transcript

This week in IT, discover how Microsoft’s pivot to Rust could spell the end of notorious Windows driver vulnerabilities. Plus, Microsoft 365 gets a new Loop app servicing plan, which means that Loop could be approaching general availability. Plus, the new Outlook client for Windows gets some key updates and all the rest of the most important IT news.

Welcome to This Week in IT, where I cover all the latest Windows, Microsoft 365 and Azure News. But before we get started, I’ve got a quick favour to ask. 70% of the people who watched last week’s video weren’t subscribed to the channel. As we go live with this video, we’re at around 780 subscribers and it would be great if we could push that up to around 800 this week. So I’d really love it if you did me a favour and subscribe to the channel and hit that bell notification so that we can meet this week’s target.

Back in April this year, Microsoft announced that it was going to be rewriting key parts of the Windows kernel in Rust. So most of the Windows kernel is written in C or C++. Now of course these are quite old programming languages and they’re not considered to be memory safe. So what that means is that programmers have to manually do all the checks to make sure that when they program code that it can’t be overtaken by a hacker maliciously that code as it sits in memory. So when Rust code is compiled, it automatically makes sure that memory objects can’t be easily accessed by hackers. So this is a great boon for programmers, for end users of course, because the code that’s developed whether it’s for an application or for an operating system is just more inherently safe.(…) Now Microsoft announced this back in April and then they started to put some of this new work into the actual Windows kernel in Windows Insider builds over the summer.

This week Mark Rynisovich announced on Twitter that Microsoft is making some Rust crates available in a GitHub repository that is going to allow developers to create drivers or rewrite existing drivers using two common development models. So the Windows driver model and the Windows driver framework.(…) So developers will be able to use these crates to rewrite their drivers in Rust. Now we’ve already seen this happening with printers but in a slightly different way.(…) So Microsoft is phasing out printer drivers in Windows. We covered this story a few weeks ago on This Week in IT and instead of requiring a third party to create a specific unique driver for a device, Microsoft is moving over to a standard that was developed by an organization called Mopria, I think it’s pronounced.(…)

Basically you plug it into this standard and you don’t need to create a unique piece of code in order to make your printer work. That does require you though to have printers that are compatible with the Mopria standard but of course going forwards over the next few years that will become a more widely spread standard. So things are really starting to change with the driver situation. Of course it’s going to be years before you know all devices have drivers that are programmed in Rust and not a non-memory safe language like C or C++. It’s going to take some time, you can’t make these kind of changes overnight but it’s interesting to see Microsoft really now push forwards with the memory safe programming Rust and it’s not just Windows doing this.

Linux is also moving towards using Rust a lot more in the kernel, of course for all of the same reasons.

Microsoft announced a new Loop service implant for Microsoft 365 this week. Now probably you know what Loop is, it’s really Microsoft’s version of Notion which has been hugely successful in the small to medium enterprise space. So this is the answer to that and it’s in preview at the moment has been available to all Office and Microsoft 365 subscribers for free at this stage. So what’s happening is we’ve got a new service plan, it’s called Loop App with WorkSpaces.(…) So this is going to be made available to those that have a Microsoft 365 business standard, business premium or an E3 and an E5 enterprise plan. It’s not going to be made available to any organization that has an Office 365 E3 or E5 plan, much like CoPilot is not going to be made available to those users either.

So, it looks like Microsoft is trying to push organizations gradually over to getting a Microsoft 365 subscription with these new products and technologies. Now it’s important to note that this new service plan only applies to the Loop App, so it doesn’t apply to Loop components that you might insert into a Teams chat or into an email in Outlook or into a whiteboard. This is specifically about that app.(…) Now if you’re using the preview at this stage and you’re not on one of the plans that Microsoft is going to officially support with the Loop App,(…)

Microsoft has said that you’ll be able to continue to use your WorkSpaces in the immediate or for the immediate future. So you’re safe for the moment, but it does mean of course that Microsoft might force you to move to one of those supported Microsoft 365 plans at some point. So you do need to be prepared for that if your users become more and more invested in the Loop App. The other interesting thing is that what you should note is that Loop components are stored in OneDrive. I think we all understand that now, but what I didn’t know is that Loop WorkSpaces are stored in syntax repository services. So there’s a different storage mechanism for WorkSpaces. Let me know in the comments what you think about the Loop App.

Is there going to be a place for this in your organization and how does it compare with OneNote? Maybe that’s enough. And would you move across to a Microsoft 365 subscription in order to get these new things like Loop and Copilot? If you’re on an Office E3 or E5 enterprise plan, I’d love to know what you think.

A couple of bits of news about the new Outlook for Windows clients. So the first thing is that it’s now available in the Microsoft Store to download. So previously you had to be signed up, I think, to a Microsoft 365 plan and you got the option to use it instead of the legacy desktop Outlook client by just flicking a toggle switch. And I’ve done that and I’ve started using it. I don’t think it’s quite ready yet. It’s pretty good. Obviously it’s missing a lot of features that you get in the legacy Outlook, but it’s going to be fine for a lot of people.(…) But you can go and download that now.(…) I don’t think you need to have a Microsoft 365 plan to use it. You can go and grab that from the store if you want to take a look at what’s going on there.

Another piece of news connected to the Outlook client for Windows this week, that is now that it has iCloud support. BingChat for enterprise are one big thing that Microsoft announced this week.(…) So initially when it was launched, I think it was not very long ago, maybe a couple of months ago, you could basically roll this out to everybody in your organization or to nobody. It was just on or off essentially. Now Microsoft has got a lot of feedback from organizations saying that we want some kind of ring-based deployment for this so that we can push it out to a limited number of users. And Microsoft has answered that. They’re now saying that you’ll be able to roll out Bing Enterprise chat to a limited set of users initially before you roll it out to your entire organization. So you can test it with a small subset of users if you like.

I haven’t heard much about Windows Terminal recently, but that is still being developed and gradually pushed forwards. We’re now on version 1.18 is the generally available version. Coming into preview 1.19, a couple of important features. So broadcast input. If you have several panes open in one tab, what this basically means is that whatever you input in one of the panes is going to appear on all of the other panes in the same tab. So I guess there are some uses for that. There’s also a new suggestion UI. So it will suggest as you’re typing, maybe what should come next. I believe you have to turn that on. It’s not turned on by default.(…) And they’re also adding the option to perform web searches from within the terminal itself. And I think again, in order to enable that, you’re going to need to add a little bit of code to your startup profile. So not enabled by default, but if you want that, it’s going to be added. Microsoft has published its monthly update news for Intune. So let’s go through what’s new.(…) So a couple of things. Let’s start with remote help.

The most important thing is that is now available on Mac OS. Of course, that was a major shortcoming of the solution because lots of people are now using Macs at work. So now that works in Mac OS. And also another big update is that the remote help sessions can now be initiated from the Intune admin portal. So before the helper would have to open remote help, the person being helped would also have to open it up. But now this whole thing can just be initiated from the admin portal, which would make it much easier, especially for the end user. There’s now Intune integration with Zebra Lifeguard OTA. So that’s over the air. And this is basically a firmware solution that allows access to a device really without any user interaction, as I’ve understood. So if you need to get into a device to perform some kind of remote support or change a setting or do something like that, you can now do this via firmware, get in, regardless if there’s some issue with the operating system, I suppose, or if the user can’t work something out about how to get this going. Intune Endpoint Privilege Management is also coming to Windows 365 devices.

So, this is a suite of features, the most important of which is the ability to configure privilege elevations. So for instance, you want a particular application to run with admin privileges, but you don’t want to give the user admin rights. So you can configure that application to start up with the rights that it needs to run properly without giving the user things that they should definitely not have access to. So that feature now coming to Windows 365.

And Microsoft announced that they want to provide, I mean, I hope this has actually happened, I haven’t checked, they want to provide day zero support for iOS 17 and the latest Mac OS release across all supported devices. So of course, those things have already been released, at least as far as I understand, I think definitely iOS 17 is now available for download. Not sure about the latest Mac OS release, you can let me know in the comments below, and you should get Intune support for all of those devices right from the get go. Thank you for watching. I really appreciate it.

If you found the video useful, do give it a thumbs up because that helps to get the video seen by more people on YouTube.(…) I’m going to leave you with another video that you might find interesting on the screen now. So do check that out. But that’s it for me for this week, and I’ll see you next time.