Posted on

[Solved] Help! Windows 365 Cloud PC Switch Feature Has Frozen My Local Host PC.

Windows 365 Switch Frozen? Here’s How to Escape a Locked Cloud PC Session

The Quick Fix TLDR:
  1. Minimize Everything: Press Win + Home. (If you can. Or try Win + End)
    • This minimizes all inactive windows. You won’t see it happen because the screen is frozen, but it forces the local OS to shift focus.
  2. Open Run: Press Win + R.
  3. Launch Terminal Blindly: Type wt (or cmd) and press Ctrl + Shift + Enter (to run as Admin).
  4. Accept UAC: Press Left Arrow, then Enter.
    • (This blindly accepts the “Yes” on the User Account Control prompt).
  5. Kill Explorer: Type the following and hit Enter:DOStaskkill /f /im explorer.exe
  6. (Optional) If explorer.exe did not auto restart type the following and hit Enter: explorer.exe

Your screen should blink black as the local Windows shell is killed, taking the frozen RDP session and Taskview with it and then should automatically restart.
Done.

It is the stuff of nightmares.

You are happily using the shiny new Windows 365 (task) Switch feature, bouncing between your local desktop and your Win365 Cloud PC seamlessly via Task View (Win + Tab) – when suddenly, everything stops.


The remote session freezes. But because Switch integrates so deeply with the local Win11 OS, it doesn’t just hang the window; it deadlocks your entire local PC.

The mouse moves, but you can’t click anything.

The Start menu won’t open. Alt + Tab does nothing. You are effectively locked out of your physical machine by the virtual one.

I found myself in this exact jam recently. The screen was frozen solid, and I was seconds away from a hard reboot when I managed to find a “blind” escape route.

Here is the quick fix if you are stuck right now, followed by why it happens and how to stop it coming back.

The “Proper” Escape Routes

While killing Explorer is effective, it is a bit like using a sledgehammer to crack a nut. If you have the presence of mind (and a responding keyboard), there are cleaner ways to get out.

I’ve listed these from best to worst:

Options: CommandWhat it doesRank
The Clean BreaktsdisconBest Option. It tells the Terminal Services client to disconnect immediately. It leaves your Cloud PC running in the background but drops you straight back to your local desktop.1
The InterruptCtrl + Alt + EndThis is the RDP version of Ctrl + Alt + Del. It sends the interrupt to the remote PC, which often jars the local session enough to break the input deadlock.2
The Sledgehammertaskkill /f /im explorer.exeAs detailed above. It kills the local shell. Messy, but it works when nothing else will.3
The ‘Hail Mary’ Quick Fix CombinationSee TLDR
Tries to escape to your Host PC, opens an elevated terminal or CMD, then kills explorer.exe and all associated hooks and processes – that are hopefully causing you to hang. (1) 4

Why Does This Happen?

Windows 365 Switch isn’t just a standard app; it hooks right into the Windows 11 shell to act as a native desktop.

When the RDP protocol flakes and has a radge, it is usually due to a network spike or a graphics rendering loop while in full-screen. It refuses to let go of the display and input hooks. Meaning you are left with local explorer.exe waiting for the RDP process to say “ready,” but the RDP process is aff tae the shaps. Result? Total deadlock.

Prevention is Better than Cure

In reality, but I’d rather not have to type blind commands to use my own PC, or have type blind commands anywhere really!

If you are an admin (fingers crossed if you are reading this, you are), you can push some Intune policies to stop this happening across your just your PC (selfish much!), or out to the entire Intune estate.
It comes down to telling the RDP client to prioritize local stability over fancy remote graphics, and for now – seems to do the trick.

I’ve drafted a separate guide on exactly which settings to change in Intune to keep your Cloud PCs stable, will be placed in the link below soon!

👉 Coming soon, …maybe: How to Stop Windows 365 Freezing with Intune RDP Policies

Next Read: 10x Faster IT Troubleshooting: How I Used AI to Solve a Mysterious Windows Process Loop

Posted on

What Are the Differences Between Microsoft Defender for Endpoint P1 & P2, and Is It Worth the Price Difference?

Microsoft Defender for Endpoint Plan 1 vs Plan 2

When it comes to protecting your business from cyber threats, Microsoft Defender for Endpoint (MDE) is a solid choice. But with two plans available — Plan 1 (P1) and Plan 2 (P2) — it can be tough to know which one is right for your organisation. In this article, we’ll break down the differences between the two plans and help you decide if the extra cost for Plan 2 is worth it.

Key Differences Between Plan 1 (P1) and Plan 2 (P2)

FeaturePlan 1 (P1)Plan 2 (P2)
Next-Generation ProtectionYesYes
Attack Surface ReductionYesYes
Device Control (e.g., USB management)YesYes
Endpoint FirewallYesYes
Network ProtectionYesYes
Web Content FilteringYesYes
Device-Based Conditional AccessYesYes
Centralised ManagementYesYes
Application ControlYesYes
APIs and SIEM ConnectorYesYes
Advanced Security ReportsYesYes
Endpoint Detection and Response (EDR)NoYes
Automated Investigation and RemediationNoYes
Threat and Vulnerability ManagementNoYes (with MDVM add-on)
Advanced Threat HuntingNoYes
SandboxingNoYes
Managed Threat Hunting ServiceNoYes
Threat IntelligenceYesYes
Microsoft Secure Score for DevicesYesYes

Plan 1: Basic Protection at a Lower Cost

Plan 1 is great for businesses that need essential protection without breaking the bank. Here’s what you get:

  • Core protection: Defends your devices from malware and other malicious software.
  • Device control: Manages access to USB devices and other peripherals.
  • Centralised management: Lets you manage and monitor your devices from one dashboard.

Plan 1 is a good choice for smaller companies or those with less complex security needs.

Plan 2: Advanced Protection for Greater Peace of Mind

Plan 2 takes endpoint security to the next level, offering everything in Plan 1 plus powerful features for businesses that need more advanced protection. These include:

  • Advanced threat detection and response: Finds and stops advanced threats that could bypass basic security measures.
  • Automated investigation and remediation: Reduces manual effort by automating threat analysis and response.
  • Threat and vulnerability management: Identifies and resolves vulnerabilities across your network.
  • Proactive threat hunting: Actively searches for potential threats before they cause damage.

If your organisation handles sensitive data or faces higher risks, Plan 2 is the better option, offering more comprehensive security tools.

Features Only Available in Plan 2

These are the exclusive features that come with Plan 2 — and they’re crucial for businesses that need extra layers of protection:

  • Endpoint Detection and Response (EDR): Detects and responds to sophisticated cyberattacks in real time.
  • Automated Investigation and Remediation: Speeds up incident response by automating security tasks.
  • Threat and Vulnerability Management: Helps spot and fix security weaknesses before they are exploited.
  • Advanced Threat Hunting: Proactively searches for hidden threats within your network.
  • Sandboxing: Safely analyses suspicious files to block potentially harmful content.
  • Managed Threat Hunting Service: Gives you expert help to track and eliminate emerging threats.

These additional capabilities make Plan 2 a powerful choice for businesses that need top-tier protection and quicker response times.

Is the Extra Cost for Plan 2 Worth It?

The choice between Plan 1 and Plan 2 depends on your company’s size, budget, and security needs. Here’s a quick breakdown:

  • Plan 1: Ideal for smaller organisations or those with basic security needs. It provides core protection and is included in Microsoft 365 E3/A3 licences.
  • Plan 2: Best for larger businesses or those that need enhanced security features like automated threat hunting and vulnerability management. Plan 2 comes with Microsoft 365 E5/A5/G5 licences.

If you don’t face significant cybersecurity risks, Plan 1 might be all you need. However, if you’re dealing with sensitive data, have a larger workforce, or need advanced protection, the added cost of Plan 2 could be worthwhile for the peace of mind it offers.