"With the October 2026 security update, quick machine recovery extends to Windows Server 2025," the company said in a message center update.
Microsoft's announcement and the narrow change it delivers
Microsoft announced that IT administrators can now use quick machine recovery (QMR) on Windows Server 2025 after installing the October 2026 security update. The change is an extension of an existing recovery capability and is scoped to servers running the Windows Server 2025 release once the update is applied.
How Quick Machine Recovery (QMR) functions
QMR is built to repair critical boot failures without requiring physical access to affected systems. When enabled, it boots the device into the Windows Recovery Environment (WinRE) and launches the QMR Tool if Windows 11 fails to start because of a configuration change or a new driver. The tool sends crash data to Microsoft, which can then remotely apply fixes by adjusting settings or removing problematic drivers or updates. Microsoft describes QMR as a mechanism "to help restore devices experiencing widespread boot issues by using the Windows Recovery Environment (WinRE) to search Windows Update for applicable remediations."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildEnabling, configuring and disabling QMR via Group Policy
On Windows Server 2025, cloud remediation is disabled by default. Administrators who want QMR to retrieve and apply cloud-sourced remediations must explicitly enable that capability through Group Policy:
- Navigate to Computer Configuration > Administrative Templates > System > Quick Machine Recovery.
- Enable the "Enable Cloud Remediation" policy to allow retrieval and application of cloud-sourced remediation.
For local configuration, an administrator must sign in to the target server with administrator permissions and use the Local Group Policy Editor. In domain environments, administrators can use Group Policy Management on a Windows Server or an administration computer, but they also need permissions to edit the Group Policy Object (GPO) and to link it to the intended organizational unit (OU).
Microsoft also documents the explicit steps required to disable cloud and automatic remediation if administrators prefer to block remote actions:
- Open the local policy or domain GPO that manages the target Windows Server 2025 computers.
- Go to Computer Configuration > Administrative Templates > System > Quick Machine Recovery.
- Open Enable Cloud Remediation, select Disabled, and select Apply, then OK.
- Open Enable Auto Remediation, select Disabled, and select Apply, then OK.
- (Optional) Verify the effective configuration.
Origins and testing: from the July 2024 outage to faster scans
Microsoft introduced quick machine recovery in November 2024 as part of its Windows Resiliency Initiative at Ignite 2024. The feature was developed in response to a July 2024 outage caused by a buggy CrowdStrike Falcon update that rendered millions of Windows devices unbootable. QMR began testing in late March 2025, rolling out to Windows Insiders in the Beta Channel. In November (the source does not specify the year, but places the testing sequence after March 2025), Microsoft also began testing a faster QMR version that runs a single scan to fix systems with boot problems rather than looping through multiple solutions.
What this means for IT administrators, security teams, and enterprises
IT administrators: The new support in the October 2026 security update gives administrators an additional, remotely triggered recovery path for Windows Server 2025 machines, but it is opt-in for cloud remediation. Administrators who are cautious about cloud-sourced changes have clear Group Policy knobs to keep those capabilities disabled.
Security teams: QMR’s behavior—sending crash data to Microsoft and allowing remote adjustment of settings, driver removal, or update rollback—creates a trade-off between rapid remediation and centralized intervention. Teams will need to balance the speed of cloud remediation against organizational policies for remote changes.
Enterprises and operations teams: In domain environments, deploying QMR will require GPO-level permissions and careful OU targeting to ensure the right servers are covered. The documented disablement steps provide a straightforward method to prevent automatic or cloud-based remediation where required by compliance or operational constraints.
Microsoft’s extension of QMR to Windows Server 2025 puts a focused recovery tool into the hands of administrators who apply the October 2026 security update; it also preserves control for those who prefer to opt out of cloud-sourced or automatic fixes. The next practical question for organizations is whether to enable cloud remediation by default for faster recoveries, or to keep the feature disabled and manage remediations locally under strict administrative control.
Source: Bleeping Computer — Windows Server 2025 gets support for quick machine recovery
