Microsoft released its November security updates on November 10 for all supported versions of Windows and recommends installing them promptly. The updates are cumulative, so a PC that installs this month's update also gets every earlier fix for its version. The announcement also notes separate PowerShell security updates for certain Windows and Server devices enrolled in hotpatching, so check Microsoft's release notes for the version and servicing setup you actually run.

How the monthly release works

Microsoft publishes Windows security updates on the second Tuesday of each month. Its release tables call them B releases, the same shorthand Intune uses, and call the non-security preview in the fourth week a D release. Microsoft says there will be no December 2026 preview because of minimal operations over the holidays, and normal monthly servicing resumes in January 2027.

A standard cumulative update needs a restart to finish; hotpatching, covered below, is the exception. Each version reaches a specific OS build once the update is installed, so a management tool that reports builds can show which PCs finished. A version 25H2 PC was on build 26200.9711 after October's security update, or a slightly higher October build if it also took that month's out-of-band or preview release. November's update brings it to 26200.9974.

Which update each version should get

Microsoft's release information lists a KB number and resulting OS build for each version:

  • Windows 11, version 26H2 gets KB5132061 and reaches OS build 26300.9974.
  • Windows 11, version 25H2 gets KB5132061 and reaches OS build 26200.9974.
  • Windows 11 Enterprise and Education, version 24H2, get KB5132061 and reach OS build 26100.9974.
  • Windows 11, version 26H1, which Microsoft scoped to new devices that came to market from early 2026, gets KB5132059 and reaches OS build 28000.3501.
  • Windows 11 Enterprise and Education, version 23H2, get their last update, KB5131087, and reach OS build 22631.7711.
  • Windows 10, version 22H2 PCs enrolled in Extended Security Updates (ESU) get KB5131096 and reach OS build 19045.7846.
  • Windows Server 2025 gets KB5131080 and reaches OS build 26100.33822.
  • Windows Server 2022 gets KB5131090 and reaches OS build 20348.5870.
  • Windows Server 2019 gets KB5131085 and reaches OS build 17763.9487.
  • Windows Server 2016 gets KB5131291 and reaches OS build 14393.9688.

Two groups are easy to miss. Windows 11 Home and Pro on version 24H2 reached end of updates on October 13, 2026, so they get nothing this month. Microsoft's KB5131096 notes also say commercial devices on Windows 10, version 22H2 need an ESU Year 2 license to keep receiving security updates, so a business PC licensed only for Year 1 won't get this one.

Microsoft recommends moving 24H2 Home and Pro devices to version 25H2 or 26H2. Its release information shows Home and Pro updates ending on October 12, 2027 for version 25H2 and October 10, 2028 for version 26H2, so 26H2 buys an extra year.

The exploited flaw this month is in Outlook

Microsoft's Security Update Guide marks one vulnerability in the November release as exploited, and it is in Outlook, not Windows. In CVE-2026-124194, an attacker sends a specially crafted message file, and opening it can make Outlook connect to an attacker-controlled location without the usual external-content warning. Microsoft says this discloses the user's NTLMv2 hash, which the attacker could use to authenticate as that user. The Preview Pane is not an attack vector, so the user has to open the file.

CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on November 10 with a November 24 due date for federal agencies. Microsoft lists Microsoft 365 Apps for Enterprise and Office LTSC 2021 and 2024 as affected, and the fix arrives as an Office update. A PC can therefore show the November Windows build and still run a vulnerable Outlook.

To update one PC, open Word, go to File > Account (Office Account in classic Outlook) and choose Update Options > Update Now, selecting Enable Updates first if Update Now isn't shown. If there is only an About button, Microsoft says the installation is either volume licensed or managed through Group Policy, so ask whoever manages it.

Decide how fast each machine needs it

CISA says organizations should use the KEV catalog as an input to their vulnerability management prioritization. Alongside KEV status, its June 2026 directive for federal agencies, BOD 26-04, asks whether the vulnerable system is publicly exposed, whether an attacker can automate the exploit and whether exploitation gives partial or total control. The directive binds only federal civilian agencies, but the same questions make a sensible checklist for a small office.

Microsoft's Windows Server team made a similar case in a November 2 post. It describes a routine path through normal validation and deployment rings, ideally in less than four weeks, and an accelerated path that moves through representative rings quickly. For actively exploited or otherwise critical risk, it recommends a practiced break-glass process that can deploy in hours or days.

For a small office this month, that puts the Office update first, along with any PC still on a build older than October's security update. Those PCs also lack the fix for CVE-2026-96951, an exploited Windows Shell flaw that let attackers evade Mark of the Web defenses, which CISA added to the KEV catalog on October 13. The rest of the Windows rollout can follow your routine schedule.

What changed besides the security fixes

The Windows 11 release notes list a fix for USB Audio 1.0 devices that failed to start and showed error code 10 in Device Manager. They also fix error 87 when adding a printer published in Active Directory through Settings > Bluetooth & devices > Printers & scanners > Add device, a problem Microsoft says the October update introduced and that does not generally affect existing printers or printing. A third fix covers Remote Desktop connections that failed on a certificate mismatch after the October non-security preview.

PowerShell script signing gets stricter. Scripts with invalid UTF-8 encoding might now fail signature validation even if they passed before, and Microsoft's fix is to save them with valid UTF-8 encoding and a byte order mark, then sign them again. As of November 11, Microsoft's release notes said it was not aware of any issues with the update.

Test with real work first

Include a device that uses the applications your team depends on in the initial rollout, and check that users can still sign in and complete a typical task afterward. Given this month's fixes, also try printing, a USB headset or speaker, Remote Desktop and any signed PowerShell scripts on that pilot device. Plan the remaining installations through your usual maintenance window. If you use hotpatching, confirm whether Microsoft's separate updates apply to your devices before marking the cycle complete.

Secure Boot certificates are still rolling out

Secure Boot works by checking the digital signature of software that runs before Windows starts against a set of trusted certificates. The certificates Microsoft issued in 2011 began expiring in June 2026, and the last of them, the Microsoft Windows Production PCA 2011, was scheduled to expire in October 2026. November's update adds targeting data that makes more PCs eligible to receive the replacement certificates automatically, and Microsoft says deployment through Windows Update continues across supported PCs and non-managed business devices in the coming months.

A PC without the new certificates still starts and still installs standard Windows updates. What it loses is new protection for the early boot process; Microsoft says that includes updates to Windows Boot Manager, the Secure Boot databases and revocation lists, and fixes for boot-level vulnerabilities. Microsoft also notes that a limited number of devices might restart one extra time after a certificate update is applied.

To check a PC, open Windows Security > Device security > Secure Boot. A fully updated device says Secure Boot is on and all required certificate updates have been applied. A message about hardware or firmware limitations means the device can't take the automated update, and Microsoft's advice is to contact the manufacturer. On business-managed devices the badges and notifications are off by default, but the status text still appears.

NTLM signing starts now and tightens in May 2027

The November updates begin a two-phase change to NTLM, a Windows authentication protocol. Windows clients now offer NTLM message signing by default on non-anonymous connections, which Microsoft says helps ensure each authenticated session establishes a cryptographic session key and reduces exposure to relay attacks. For now, servers still accept unsigned clients and audit them, and a client whose server doesn't return signing carries on without it rather than failing. From May 2027, Windows servers begin requiring signing by default and reject clients that don't offer it.

Microsoft says the audit events appear in the Microsoft-Windows-NTLM/Operational log as Event ID 4023 on servers and 4022 on clients, and that they are available on Windows Server 2019 and later with NTLM Enhanced auditing. Its support article includes a PowerShell script that finds connections without signing. Once the script returns nothing, an administrator can enforce signing early by setting the ServerRequireNtlmSign registry value to 1, with no restart required.

Kerberos isn't affected, anonymous connections are exempt in both phases, and guest account connections are also exempt. The practical step for a small office is to have whoever manages your servers run Microsoft's script before May 2027 and fix whatever it flags.

Hotpatched devices need one more update

Hotpatching lets eligible devices install security updates without restarting, between baseline updates that do need a restart. Baselines are planned for January, April, July and October, and Microsoft occasionally adds others for security reasons. November is a hotpatch month, so hotpatched Windows 11 PCs get KB5132043, with builds ending in .9911 rather than .9974. A hotpatch-enrolled device that isn't on the latest baseline gets both updates, plus a restart. Hotpatched Windows Server 2025 machines get KB5131077 instead, which brings them to build 26100.33730.

Microsoft also released standalone Windows PowerShell security updates for hotpatch-enrolled devices, KB5135385 for Windows 11, versions 26H2, 25H2 and 24H2, and KB5135386 for Windows Server 2025. They fix flaws involving web requests, PowerShell workflows and the Desired State Configuration (DSC) Archive Resource, are offered only after the November hotpatch is installed, and might need a restart if the updated files are in use. Microsoft lists KB5135385 as available through Windows Update only, not the Microsoft Update Catalog or WSUS. Because it reports the same builds as the hotpatch, look for the KB number itself in Update history.

Hotpatching needs Windows 11, version 24H2 or later (it isn't available on 26H1), an eligible license such as Microsoft 365 Business Premium, the latest baseline, virtualization-based security (VBS) turned on and an Intune Windows quality update policy with “When available, apply without restarting the device (‘Hotpatch’)” set to Allow. Devices that miss any of these get the standard update and a restart. To confirm enrollment, look for Enable hotpatching when available under Settings > Windows Update > Advanced options > Configured update policies, then check that System Information shows Virtualization-based security as Running.

Hotpatching doesn't end restarts entirely. Uninstalling a hotpatch requires one, and a PC upgraded to a new Windows version during a hotpatch month switches to standard updates until the next baseline.

Check a single PC

Without a management console, check each PC like this:

  • Open Settings > System > About and confirm the edition and version under Windows specifications.
  • Open Settings > Windows Update and select Check for updates; a restart prompt means the update isn't finished.
  • Open Settings > Windows Update > Update history and look for this month's KB number from the list above.
  • On a hotpatched PC, look for KB5132043 and KB5135385 instead.
  • In Word, open File > Account and run Update Options > Update Now.
  • Open Windows Security > Device security > Secure Boot and read the certificate status.
  • On a Windows 10 business PC, run slmgr.vbs /dlv in an elevated Command Prompt and confirm the Year 2 ESU program shows a License Status of Licensed.

Report exceptions instead of a percentage

A useful status report goes beyond “updates were pushed.” Check how many devices installed the update, how many are still waiting for a restart, and how many are offline or failed. A laptop that hasn't checked in may need a different next step from one that repeatedly fails installation. For a small office, a short exceptions list is usually easier to act on than a percentage alone.

Beyond restarts, offline devices and failures, add these exceptions:

  • A connection set as metered, where Microsoft says some updates won't install automatically.
  • Paused updates; Windows 11 allows a pause of up to 35 days, and users can extend it by picking a new end date.
  • Windows 11 Home or Pro still on version 24H2.
  • Any PC on version 23H2, which has now reached end of updates in every edition.
  • A Windows 10 business PC without an ESU Year 2 license.
  • A hotpatched device missing KB5135385.
  • An Office installation that hasn't taken its update.
  • A Secure Boot status that reports a hardware or firmware limitation.

To move a PC to a supported version, Microsoft's instructions are to open Settings > Windows Update, select Check for updates and, if the update is offered, select Download and install. For PCs staying on Windows 10, Microsoft says its consumer ESU program can't be used in commercial scenarios and isn't offered to devices joined to an Active Directory domain or Microsoft Entra, or enrolled in mobile device management. Business PCs need commercial ESU instead.

If you manage updates with Intune

Intune devices keep receiving monthly quality updates without a Windows quality update policy, and update rings control deferrals, deadlines, restarts and notifications. These ring settings matter most:

  • Quality update deferral period (days), from 0 to 30.
  • Deadline for quality updates, from 2 to 30 days under Use deadline settings, after which the update installs automatically.
  • Grace period, from 0 to 7 days, the minimum time after the deadline before restarts happen automatically.
  • Auto reboot before deadline, which Microsoft recommends setting to Yes so the device restarts when nobody is using it.
  • Option to pause Windows updates, which decides whether users can pause at all.

For a small office, two rings are usually enough, such as a pilot ring with no deferral and a second ring a few days behind. When one update can't wait, an expedite policy speeds up installation of that update on the devices you choose. Microsoft lists Intune Plan 1 and a Windows license that includes the Windows Autopatch entitlement among the requirements for quality update and expedite policies.

Common mistakes and how to spot them

Watch for these:

  • Counting a PC as done while it waits for a restart; Settings > Windows Update still shows the restart prompt.
  • Flagging a hotpatched PC as behind because its build ends in .9911; check Update history for KB5132043.
  • Assuming Windows Update patched Outlook; Office has its own Update Options under File > Account.
  • Leaving a pause in place; Settings > Windows Update shows the PC's update status.
  • Uninstalling the update to fix a problem, which Microsoft doesn't recommend; not all updates can be removed, so report the problem and check the release notes for known issues instead.
  • Turning off Secure Boot to clear a warning, which Microsoft advises against because it weakens protection against boot-level malware.

What to tell staff

Send staff a short note that says:

  • Save your work and restart when Windows asks, since the update isn't finished until then.
  • If the timing is bad, use Schedule the restart in Settings > Windows Update to pick a time, ideally the same day.
  • A PC might restart one extra time for a Secure Boot certificate update.
  • Update Office when asked, and don't open message files you weren't expecting.
  • Report anything that stopped working after the restart.
  • Report any email or pop-up offering a Windows update instead of clicking it.

Dates to plan around

Windows Server 2016 reaches end of updates on January 12, 2027, and the January 2027 security update is its last. The date applies to every edition, including Essentials, and Microsoft's support for Essentials features such as Remote Web Access ends the same day. Microsoft recommends planning an upgrade to Windows Server 2025, and ESU is available for the Standard and Datacenter editions for organizations that need more time.

Certificates that devices use to connect to Windows Update expire on May 17 and June 19, 2027, depending on the version. Microsoft says most in-support devices that are current with monthly updates need no action, and Windows 11, version 25H2 and later need none at all. Windows Server 2019 and 2016 need the July 2026 security update or later before May 17, 2027. Devices without the replacement certificates lose access to Windows Update after the applicable date, although the change doesn't apply to devices that get updates from WSUS.

Windows 11 Enterprise and Education, version 24H2, remain supported until October 12, 2027, the same day Home and Pro updates end for version 25H2. NTLM signing enforcement, covered above, arrives earlier, in May 2027.

A worked example

Imagine a ten-person insurance agency with nine Windows 11 Pro laptops, one Windows 10 PC and a Windows Server 2016 Standard file server, with Microsoft 365 Apps on every PC. On Tuesday the office manager updates Office everywhere, then pilots the Windows update on her own laptop, checking sign-in, printing, her USB headset and a client file before releasing it to everyone on Wednesday.

By Thursday, seven laptops show build 26200.9974 and the server has KB5131291. One laptop awaits a restart its owner scheduled for lunch. Another still reports version 24H2, so it was never offered KB5132061, and she starts its move to version 26H2 through Settings > Windows Update.

The Windows 10 PC is still on an October build, and slmgr.vbs /dlv shows only the Year 1 ESU program licensed. The agency needs a Year 2 license or a move to Windows 11. Microsoft lists Year One at $61 per device through Volume Licensing, with the price doubling each year, so she prices a replacement PC as well.

Her report lists the pending restart, the version 24H2 laptop and the Windows 10 decision, and it flags the file server. The server needs an upgrade plan or ESU by January 12, 2027, and it can't show the NTLM audit events, which Microsoft says are available on Windows Server 2019 and later. Each item gets an owner and a date.

What to do this week

  • Update Office on every PC that runs Outlook.
  • Pilot the Windows update on one PC that runs your key applications, then release it to the rest.
  • List each device that is pending restart, offline, failed, paused or unsupported.
  • Confirm every Windows 10 business PC holds an ESU Year 2 license.
  • Confirm the PowerShell updates on any hotpatched devices.
  • Check the Secure Boot status on at least one PC of each model you use.
  • Ask whoever manages your servers to start reviewing NTLM audit events.

Where ALCO can help

ALCO's listed services include Help Desk, Microsoft 365 (including Intune), mobile device management, cybersecurity and compliance, and hardware and licensing. If you would rather hand off the exceptions list, the ALCO help desk can work through it with your staff. It is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources