Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Microsoft SaRA deprecation and Get Help replacement for Windows admin diagnostics

Security Tool/Service
First reported
Last updated
Happening score
H score 14
1 unique sources, 1 articles

Summary

Hide ▲

Microsoft removed SaRA, a scriptable Windows support utility, from in-support Windows updates starting March 10, changing the troubleshooting toolset available to administrators. The replacement is Get Help / GetHelpCmd.exe, which keeps similar command-line and remote-scriptable diagnostics for Microsoft 365 apps like Outlook and Teams. Microsoft says the new environment provides enhanced security, making the migration relevant for hardened enterprise support workflows.

Related Happenings

Windows cldflt.sys privilege escalation (CVE-2020-17103)

Vulnerability
H score28 First: 18.05.2026 01:30 Last: 18.05.2026 01:30 Sources 1

About this happening: A public MiniPlasma proof-of-concept has renewed concern around the Windows cldflt.sys Cloud Filter driver because it can elevate a standard user to SYSTEM on fu...

Open Happening

Microsoft MDASH enters limited private preview for AI-driven vulnerability discovery at scale

Security Tool/Service
H score26 First: 13.05.2026 16:46 Last: 13.05.2026 16:46 Sources 1

About this happening: Microsoft's MDASH has entered limited private preview, adding a new AI-driven vulnerability discovery service that can validate and prove exploitable defects at scale....

Open Happening

Microsoft May 2026 Patch Tuesday release

Security Patch Release
H score44 First: 13.05.2026 13:36 Last: 13.05.2026 13:36 Sources 1

About this happening: Microsoft's May 13, 2026 Patch Tuesday release fixed 138 vulnerabilities across its product portfolio, including Windows, Azure, and Edge. None of the flaws we...

Latest development: 01.06.2026 15:30

Belgium's Centre for Cybersecurity warned that CVE-2026-41089 in Windows Netlogon is being actively exploited in the wild after Microsoft patched the stack-based buffer overflow during the May 2026 Patch Tuesday. The flaw affects all currently supported Windows Server versions, including Windows Server 2025, and can let an unauthenticated attacker gain remote code execution on targeted domain controllers.

Open Happening

Windows 10 KB5087544 extended security update

Security Patch Release
H score15 First: 12.05.2026 21:58 Last: 12.05.2026 21:58 Sources 1

About this happening: Microsoft released Windows 10 KB5087544 for Windows 10 ESU/LTSC systems, addressing May 2026 Patch Tuesday vulnerabilities and a Remote Desktop warnings issue....

Open Happening

Microsoft Windows 11 mandatory Patch Tuesday updates (KB5089549, KB5087420)

Security Patch Release
H score26 First: 12.05.2026 21:09 Last: 12.05.2026 21:09 Sources 1

About this happening: Microsoft released mandatory Windows 11 cumulative updates for KB5089549 and KB5087420, delivering the May 2026 Patch Tuesday fixes for 120 vulnerabilities acr...

Open Happening

Timeline

  1. 06.04.2026 20:45 1 articles · 3mo ago

    SaRA deprecation and removal from Windows updates

    Mitigation Patch Update

    Microsoft deprecates and removes the Support and Recovery Assistant (SaRA) command-line utility from all in-support versions of Windows updates starting March 10, ending its scripted diagnostic use for Office, Microsoft 365, Outlook, and Windows systems and pushing administrators toward the replacement workflow.

    Show sources
    Open in new tab
  2. 06.04.2026 20:45 2 articles · 3mo ago

    Microsoft recommends Get Help as the SaRA replacement

    Initial Disclosure

    Microsoft tells IT administrators to migrate away from SaRA, use the Get Help command-line tool or GetHelpCmd.exe for remote troubleshooting, and rely on the replacement environment's enhanced security for Windows client diagnostics.

    Show sources
    Open in new tab