Microsoft announced that IT administrators can now use quick machine recovery on Windows Server 2025 after installing the October 2026 security update.
Quick machine recovery (QMR) lets IT admins fix critical boot failures with targeted Windows Update fixes without physical access to affected systems.
When enabled, it boots into the Windows Recovery Environment (WinRE) and launches the QMR Tool if Windows 11 fails to start because of a configuration change or a new driver. It then sends crash data to Microsoft, which can remotely fix issues by adjusting settings or removing problematic drivers or updates.
"With the October 2026 security update, quick machine recovery extends to Windows Server 2025," the company said in a message center update.
"Quick machine recovery is designed to help restore devices experiencing widespread boot issues by using the Windows Recovery Environment (WinRE) to search Windows Update for applicable remediations."
On Windows Server 2025, cloud remediation is disabled by default, but admins can enable it via Group Policy under Computer Configuration > Administrative Templates > System > Quick Machine Recovery to retrieve and apply cloud-sourced remediation.
For local configuration, admins must sign in to the target server with administrator permissions and use the Local Group Policy Editor. In domain configurations, they can use Group Policy Management on a Windows Server or an administration computer, but they also need permissions to edit the GPO and link it to the intended organizational unit (OU).
To disable QMR through Group Policy, admins have to explicitly turn off 'Enable Cloud Remediation' to prevent cloud-sourced remediation and disable 'Enable Auto Remediation' to block automatic application of local remediation packages.
This can be done by going through the following steps:
- Open the local policy or domain GPO that manages the target Windows Server 2025 computers.
- Go to Computer Configuration > Administrative Templates > System > Quick Machine Recovery.
- Open Enable Cloud Remediation, select Disabled, and select Apply, then OK.
- Open Enable Auto Remediation, select Disabled, and select Apply, then OK.
- (Optional) Verify the effective configuration.
Microsoft introduced quick machine recovery in November 2024 as part of its Windows Resiliency Initiative at Ignite 2024, in response to a July 2024 outage caused by a buggy CrowdStrike Falcon update that rendered millions of Windows devices unbootable.
It began testing in late March 2025, rolling it out to Windows Insiders in the Beta Channel. In November, it also began testing a faster version that now runs a single scan to fix systems with boot problems, rather than looping through solutions.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.