Windows 11 Turns GOG Into a Live Compatibility Lab

GOG’s publishing technical manager says Windows 11 is now the harder target for classic games, and the store only sees each break after Microsoft ships a preview. Michał Obuchowski told that to RPG Site on July 15, 2026, after months of chasing elevation changes, video regressions, and retired networking APIs that 1990s PC titles still call.

Microsoft calls the security rewrite reasonable. GOG still has to rebuild how a 1998 installer asks for permission, how its cutscenes decode, and how its multiplayer stub loads, then ship those fixes DRM-free so a later Windows trim cannot brick the disc image in a player’s folder.

The Harder Target Is Windows 11

Obuchowski split the problem in two. Security is one pressure. Legacy cleanup is the other. Windows 11 is doing both at once, and the store cannot test a change until a preview lands on real hardware.

Windows 11 is honestly the harder target, and the pressure comes from two directions at once.

Michał Obuchowski, Publishing Technical Manager, GOG

He described Administrator Protection as a replacement for the old “click Yes” UAC prompt: Windows spins up a hidden, one-time admin account and a short-lived token gated behind Windows Hello. “It’s a reasonable security move, but for us it changes how a game asks for the permissions it needs,” he said. “And the catch is you don’t really know what actually changed until Microsoft ships a preview.”

Those previews were already unstable when he spoke. The first Administrator Protection flight, he said, was pulled back after release to be reworked. GOG was aiming at a moving target whose shape was not final. Six weeks later Microsoft shipped the feature for real machines anyway.

Piotr Gnyp, GOG’s senior PR, said the day-to-day preservation pipeline did not change when the store became independent and founder-led. Same team, same tests, same rights chase. The Windows side of the job still arrives as a surprise patch.

Administrator Protection Replaces the Old UAC Prompt

Optional update KB5120998, dated August 27, 2026, puts Administrator Protection on Windows 11 24H2 (build 26100.9278) and 25H2 (build 26200.9278). Microsoft’s own documentation says the feature is off by default. It covers Home, Pro, Enterprise, and Education. It does not cover Windows 365 Cloud PCs or Azure Virtual Desktop session hosts. A reboot is required after the toggle is flipped in Windows Security, Group Policy, or Intune.

Under the old UAC model an admin user received two tokens that still belonged to the same account and shared one profile. Installers could write to Program Files, touch the registry, and assume the elevated half of that profile would still be there. Administrator Protection throws that model out. After a Windows Hello check, Windows issues the process a token from a hidden, system-generated admin account with a different SID, then destroys the token when the process ends. Auto-elevation is gone. Every admin operation needs an interactive OK.

That is the same Administrator Protection breaking classic GOG games on PCs that turn the switch on. Most consumer machines will not see it until someone enables it, or until Microsoft finishes the staged rollout. GOG cannot wait for that moment, because the store has to certify titles against the preview Microsoft actually shipped.

UAC VERSUS ADMINISTRATOR PROTECTION

Microsoft is not pretending old software will glide through. The Learn page warns that some applications rely on admin rights always being present, and on the elevated profile remaining reachable while the app runs unelevated. Those apps need updates. A 1998 installer with no living publisher is not going to file that update.

Some applications might rely on admin rights always being present, and the elevated profile being accessible when running unelevated. With this new approach, some scenarios in those apps might need updates to work smoothly with the enhanced security model.

Microsoft, Administrator protection documentation

The Hidden Admin Account Windows Spins Up

The Windows Developer Blog names that hidden account a System Managed Administrator Account, or SMAA. File-system directories and registry hives are no longer shared between the unelevated user and the elevated task, which is the point: classic UAC bypasses that poked the shared profile are supposed to die. Microsoft also cited token theft at 39,000 incidents a day in the 2024 Digital Defense Report as the kind of abuse elevation invites.

The same isolation is what breaks installers that expected one profile. SSO credentials from the standard session do not carry into the elevated session. Mapped network drives can vanish. Settings written while elevated do not come back when the game later runs as a normal user. Microsoft tells IT not to enable the feature on devices that need Hyper-V or WSL, which is a large slice of the PCs that still run vintage toolchains next to current games.

Old Installers Lose the Shared Profile

Elevation events now log as 15031 (approved) and 15032 (denied, failed, or timed out) under the Microsoft-Windows-LUA provider. That is useful for a corporate desktop. It does nothing for a SafeDisc-era setup.exe that wrote its codec into System32 and then asked the game to find it at launch.

Obuchowski’s team has to change how each of those titles requests permission, then retest on a build that may be pulled again. The security model is the product Microsoft wants. The compatibility debt is GOG’s.

Classic Intros Fail in Spectacular Ways

The second pressure is the media stack Windows is retiring. Obuchowski listed DirectShow first. Newer Windows 11 builds, he said, shipped a regression that caused some classic game videos to break in spectacular ways. DirectPlay is already deprecated and needs wrapping with custom DLL stubs, or a title may not even start. Legacy drivers and old copy-protection schemes sit on the same pile. “That’s exactly the plumbing a lot of classic games quietly rely on,” he said, so every time a piece of it is retired, something from 1998 can stop booting.

Microsoft already tells developers that DirectShow is a legacy feature superseded by MediaPlayer, IMFMediaEngine, and Media Foundation, and that new code should move. Games shipped on CD-ROM in the late 1990s cannot move. Their intros, FMV cutscenes, and menu clips still talk to DirectShow filters, Indeo-era codecs, or Bink files that a codec pack on the PC can intercept and wreck.

WINDOWS PLUMBING GOG HAS TO REPLACE

• DirectShow video: Intros and cutscenes fail or go black after Windows 11 regressions, so GOG ships its own video wrapper instead of trusting the OS filter graph.
• DirectPlay networking: The legacy component is off by default; without a custom DLL stub, some titles never reach a menu.
• Copy protection: Old disc checks are hard to strip cleanly, which is why the store argues for shipping DRM-free in the first place.
• Elevation and writes: Installers that assumed a shared admin profile now hit a one-time token and a different SID.
• Path length: Huge mod stacks such as S.T.A.L.K.E.R. GAMMA still collide with how Windows treats long file paths.

Players have been living this without the security feature even on. GOG’s own support article for FMV failures still starts with uninstalling codec packs, adding ffdshow exclusions, and installing RAD’s Bink tools. A Steam copy of Gothic can fail on a PC where the GOG build, Union patch included, still launches. The difference is not a kinder Windows. It is a store that owns the wrapper.

One Wrapper Can Repair the Whole Catalogue

For titles in the GOG Preservation Program, Obuchowski said the team does not sit and wait for a forum flag. Community reports still matter, because players run hardware the lab will never see. Program games get continuous research and monitoring “as far as our capacity allows,” and the store tries to react to operating-system changes before the support queue explodes.

The clearest example was the video wrapper we shipped last year: Microsoft pushed a patch that broke video playback: intros and cutscenes stopped rendering correctly across a whole range of older games. We built a fix and rolled it into every affected title at once.

Michał Obuchowski, Publishing Technical Manager, GOG

That is the second-order job in one paragraph. Microsoft ships a patch. A whole decade of cutscenes dies. GOG fixes the wrapper once and pushes it through every affected SKU, then lists the work in the Preservation changelogs. The same pattern holds for the in-house input wrapper that gives keyboard-only classics a gamepad, and for One-Click Mods that have to survive Windows path limits.

GAMMA, he said, stacks hundreds of mods into a huge number of directories with very long file paths, which runs straight into how Windows handles path length. Packaging that into one click was one of the harder jobs the team has taken on. The harder a mod is to install by hand, the more work it takes to make it effortless, and none of that work is in Microsoft’s KB notes.

GOG Galaxy also lets a player turn off automatic updates and, where older builds are kept, roll back if a new patch wrecks saves or mods. Obuchowski pointed at Skyrim Special Edition without the Anniversary content as the case that made the policy deliberate. Forced latest-build stores do not offer that valve. When Windows is the thing that moves under the game, a rollback on the store side is the only brake the player has.

Why DRM-Free Survives When Copy Protection Cannot

Obuchowski tied the cleanup directly to copy protection. Old schemes may prove tricky to remove, he said, “making it ever more important to ship games DRM-free.” A title that still phones a disc check, a kernel driver, or a live license server dies twice: once when Windows drops the API, and again when the authentication host goes dark.

Gnyp made the same argument for new releases. Today’s games are tomorrow’s classics, and a DRM-free offline installer is simply easier to keep alive for the next thirty years. GOG’s own preservation blog put numbers on the habit: classic titles are only 20% of the catalog, but new users still arrive to buy those games, then stay for newer ones after they have a folder of installers they can keep.

That is why the Windows 11 breakage does not push the store toward more lock-in. The OS is deleting the hooks DRM used to hang on. A wrapped, DRM-free build that GOG can patch in-house is the product that still launches after the next preview. A Steam Gothic without the Union patch, or a console SKU that needs the storefront’s permission, does not get that second life.

The contradiction sits next to that win. GOG’s Preservation Program FAQ says the stamp is currently Windows-only. Priority is more games under the program before macOS or Linux. Plenty of the same customers already run those DRM-free installers through Lutris or a Steam Deck. The files travel. The official promise does not, yet.

267 Games Now Carry a Preservation Stamp

GOG launched the program in November 2024 with 100 games and a public commitment to spend its own money keeping them playable on current and future PCs. The public program page now lists 267 games in the Preservation Program, 1,436 listed improvements, and a 4.2 out of 5 average rating. A game only gets the stamp after quality tests, and after GOG has patched it until it meets the bar.

GOG PRESERVATION PROGRAM SNAPSHOT

• 267 games: Live on the public program page, up from a 100-game launch in November 2024.
• 1,436 improvements: The listed fix-and-upgrade count across stamped titles.
• 4.2 / 5: Average rating GOG prints next to the program totals.
• 20% classics: Share of the catalog GOG says still brings in most new buyers.

The first three Resident Evil games were in that original wave. Resident Evil HD Remaster and Resident Evil 0 joined on October 30, 2025, DRM-free, after Capcom signed off. Clive Barker’s Undying went in with a sixteen-game batch the same week, alongside Tomb Raider GOTY, Splinter Cell, and Hitman: Codename 47. Breath of Fire IV returned on April 25, 2025 with Windows 10 and 11 support after more than 22,000 Dreamlist votes, plus an upgraded DirectX renderer and a reworked audio engine.

On September 8, 2026, GOG added Star Trek: 25th Anniversary and Armikrog to the program and published 3D scans of original big boxes for those two plus Descent, Hitman: Codename 47, and Myst, built with the Big Box Collection project. The store is now scanning cardboard while the operating system deletes the APIs inside the boxes.

FROM THE 2010 RENAME TO KB5120998

1. 2008: GOG launches as a DRM-free store for classic PC games.
2. 2010: The company drops the Good Old Games name so new releases can sit beside the back catalog.
3. November 2024: The Preservation Program opens with 100 stamped titles and a promise of in-house maintenance.
4. 2025: GOG ships a catalogue-wide video wrapper after a Microsoft patch breaks intros and cutscenes.
5. April 25, 2025: Breath of Fire IV lands with Windows 11 support after 22,000 Dreamlist votes.
6. October 30, 2025: Resident Evil HD Remaster and Resident Evil 0 go DRM-free in the program.
7. July 15, 2026: Obuchowski describes Administrator Protection as a moving target whose first preview was pulled.
8. August 27, 2026: KB5120998 makes Administrator Protection available, still off by default.
9. September 8, 2026: GOG adds 3D box scans to five Preservation titles.

Obuchowski’s monitoring line is the operational core of those dates. Program games are supposed to keep working when Windows changes, not after a week of black loading screens. That only holds if the wrapper team sees the preview in time, and if the rights holder already let GOG strip the DRM that would have blocked the patch.

The Preview Cycle Does Not Slow Down

KB5120998 is optional. The toggle is off. Enterprise customers enable it with a custom OMA-URI; everyone else can find it under Account protection in Windows Security once the staged rollout reaches them. Nothing in that rollout pauses DirectShow regressions or DirectPlay stubs. The next Insider flight can still take out a cutscene GOG certified last month.

Gnyp said independence put preservation closer to the core of the company. The Windows bill did not move with the ownership papers. GOG still finds out what changed when Microsoft ships a preview, still wraps the API that vanished, and still ships the result as an offline installer a player can keep when the storefront of the day is gone.

The first Administrator Protection build was pulled and rewritten. The shipping one is already in an optional cumulative. GOG’s lab will be on the next preview either way, because a 1998 executable cannot update itself, and Windows 11 is not going to start carrying that baggage again.