A Windows 11 Enterprise or Education PC on version 23H2 still starts, runs and can report that it is up to date. What it will not receive is any monthly security fix released after November 10. This is a lifecycle change, not a failed update, so the remedy is moving the device to a supported version.

What ended on November 10

Microsoft's Windows message center notice says the November 2026 security update is the last update available for 23H2 Enterprise and Education. That update is KB5131087, which brings a device to OS build 22631.7711. Microsoft now recommends moving eligible devices to version 26H2, while its 60-day and 90-day reminders pointed to 25H2, which is also still supported.

The "up to date" message misleads because of how Windows is serviced. Microsoft releases a cumulative security update on the second Tuesday of each month, and its lifecycle FAQ says customers must be on a supported version of Windows to receive these monthly quality updates. A PC can have every update ever released for its version and still be on a version that gets no more fixes.

Check the edition as well as the version

Microsoft supports each annual Windows 11 feature update for 36 months on Enterprise and Education and for 24 months on Home, Pro, Pro Education and Pro for Workstations. The same version can therefore be supported on one PC and finished on the next. Pro Education follows the shorter schedule despite its name, while Enterprise multi-session and IoT Enterprise follow the longer one.

On a single PC, open Settings, then System, then About. The Windows specifications section shows the edition, version and OS build, and typing winver into the taskbar search and selecting it opens a window with the version and build. Compare what you find with this list:

  • Enterprise or Education on 23H2 got its last update on November 10 and should move first.
  • Enterprise or Education on 24H2 is supported until October 12, 2027.
  • Home or any Pro edition on 24H2 reached end of updates on October 13, 2026, so it is already overdue.
  • Home or any Pro edition on 23H2 reached end of updates in November 2025.
  • Any edition on 25H2 or 26H2 still receives monthly updates, though Home and Pro editions on 25H2 have only until October 12, 2027.
  • Version 26H1 is supported, but Microsoft scoped it to new devices that began reaching the market in early 2026 and does not offer it as an in-place update to existing PCs.

A managed fleet can pull the same facts from its device inventory, which may show build numbers instead of version names. Microsoft's release information page maps them: 22631 is 23H2, 26100 is 24H2, 26200 is 25H2, 26300 is 26H2 and 28000 is 26H1. Product names alone can hide which devices are still on 23H2, so export edition and build together, and include spare, loaner and rarely used PCs.

Why a 23H2 machine is a bigger move

Microsoft says versions 24H2, 25H2 and 26H2 share a common core operating system with an identical set of system files. The 26H2 features already arrive, dormant, in the monthly updates for 24H2 and 25H2, and a small enablement package switches them on with a single restart. That package requires 24H2 or 25H2 with the September 22, 2026 preview update, KB5124010, or a later cumulative update, so 23H2 is not a starting point. When 25H2 launched, Microsoft said devices on 23H2 or earlier needed a full operating system swap to reach it.

Treat each 23H2 machine as a full upgrade. Schedule it and expect staff to notice more change, because the PC also picks up what was added in 24H2 and 25H2. Microsoft's Intune documentation adds that a feature update installs with the latest applicable monthly quality update included.

Choose 25H2 or 26H2

Both versions receive monthly security updates. With no blocker, follow Microsoft's current recommendation and go to 26H2, which Microsoft lists with Enterprise and Education updates into October 2029, a year longer than 25H2's October 2028.

Choose 25H2 when a critical application's vendor has approved only 25H2. That detour costs little, because the later step from 25H2 to 26H2 is the enablement package. Also weigh how much change staff can absorb, since 26H2 turns on by default some features that 25H2 kept behind a temporary commercial control.

Where the upgrade comes from

On a PC with no update policies, open Settings, then Windows Update, and select Check for updates. If the upgrade is offered, select Download & install. Microsoft's September 29 announcement said 26H2 was first available to devices on 24H2 or 25H2 whose users had turned on the Get the latest updates as soon as they're available toggle, with availability expanding over the next few months, so a 23H2 PC may not be offered it right away.

On managed PCs, the organization's update policies decide what is offered and when. In Intune that is a feature update policy, and Microsoft says feature updates can be managed manually in Intune or automatically through Windows Autopatch. The policy requires Microsoft Intune Plan 1 and a Windows license with the Windows Autopatch entitlement, such as Microsoft 365 Business Premium, Windows Enterprise E3 or E5, or Windows Education A3 or A5. It works on Pro, Pro Education, Enterprise and Education devices that Intune manages and that are Microsoft Entra joined or hybrid joined.

In the Intune admin center, go to Devices, then Windows, then Windows updates, then Feature updates, and select Create profile. Give it a name, choose the version under Feature update to deploy, where only supported versions are listed, and select Make available to users as a required update so devices install it automatically based on their update settings. Under Rollout options, Make update available as soon as possible is the simplest choice for a small group. Assign the profile to a device group, check the settings on the Review + create page and select Create.

Intune can also release an upgrade gradually, but it puts at least 100 devices in each offer group, so a small office would land in a single group. Assign the profile to a two-PC pilot group first, and add everyone else once the pilot passes.

PCs managed with Group Policy instead of Intune can use the Select the target Feature Update version setting, under Windows Components, then Windows Update, then Manage updates offered from Windows Update. Enter Windows 11 as the product version and 26H2 or 25H2 as the target version. Microsoft says the device then moves to that version, or stays on it, until it reaches end of service or the policy is changed.

Run a pilot before the rest

Sort the 23H2 devices into those that can move now and those with an application or hardware dependency. Microsoft includes device readiness reporting with the same Windows Autopatch licenses, and Intune's Windows Feature Update Device Readiness Report does much of this sorting. Go to Reports, then Device management, then Windows updates, open the Reports tab and choose the report. Pick your target version under Select Target OS, choose the devices under Select Scope (Tags) and select Generate report.

Each device is rated Low risk, Medium risk, High risk or Replace device, with a column for unmet system requirements and counts of application and driver issues, and selecting a device name shows what was flagged. Medium risk can mean an app will be removed during the upgrade, leaving you to install a compatible version afterward, so check those devices too. Unknown means Intune could not determine readiness, which Microsoft ties to the device's Windows diagnostic data. The data can take up to about 52 hours to arrive, so run the report early.

Microsoft's guidance for 26H2 is to validate it in a pilot, test business-critical applications, representative hardware and workflows, then expand while monitoring deployment health and known issues. A small rollout plan is more useful than a general reminder to check Windows Update:

  • Pick two pilot PCs, such as the oldest model and the one running your most important application.
  • Check free disk space first, since Microsoft says the space needed to download and install updates is highly variable.
  • Confirm the user's files are backed up and that a recent file opens from the backup.
  • Keep laptops plugged in and switched on, because a shutdown or restart during installation stops the upgrade.
  • After the upgrade, confirm the new version in About, then select Check for updates and install what it offers.
  • Have the user print, scan, open line-of-business software and connect to remote systems for a day or two.
  • Then move the rest in small batches.

Plan the way back before you need it. Microsoft says that in most cases you have 10 days after an upgrade to return to the previous version from Settings, then System, then Recovery, by selecting Go back. Personal files are kept, but apps and drivers installed after the upgrade and any changes to settings are removed.

Going back also requires leaving the windows.old and $windows.~bt folders in place and removing any user accounts added after the upgrade. Finish pilot testing inside that window, and remember that a PC that goes back is on 23H2 again, with no further fixes coming.

Intune administrators have a second route. An update ring's Uninstall action rolls back the latest feature update within the period set by the ring's Set feature update uninstall period (2 – 60 days) setting. Microsoft warns that Uninstall can restart devices without letting users delay and does not work on an update applied by enablement package. It also pauses that update type on the ring, and when the pause ends, devices reinstall the update if it still applies.

Common mistakes and how to spot them

Intune's Feature update failures report, under Devices, then Monitor, flags several of these problems as alerts, but not all of them. Check for each:

  • A feature update profile that still targets 23H2. A profile keeps its version enforced until it is changed or removed, and its Support column should now read Not supported.
  • Trusting a profile's Support End Date for Pro PCs. Intune shows the Enterprise and Education date, so a 24H2 profile can look current while its Pro PCs passed their end date on October 13.
  • A deferral or pause in an update ring. Microsoft says to set Feature update deferral period (days) to 0 and keep feature updates unpaused, and the failures report shows PolicyConflictDeferral or PolicyConflictPause.
  • A pause that keeps coming back. A pause expires after 35 days, but Extend resets it to 35 days, so a ring can stay paused far longer.
  • A Group Policy setting, Select the target Feature Update version, that still names 23H2.
  • Diagnostic data set below Required, which feature update policies need.
  • The Microsoft Account Sign-In Assistant service turned off. Microsoft says Windows Update then does not offer feature updates, and the failures report can show DeviceRegistrationInvalidGlobalDeviceId.
  • Too little disk space, which the failures report shows as DiskFull.
  • Removing a device from the old profile before adding it to the new one, because a device managed by Windows Autopatch with no feature update policy is not offered any feature update.
  • Turning on Disable safeguards for Feature Updates to push past a hold, which Microsoft recommends only in an IT environment for validation.

When a PC has to wait

When a device is in more than one feature update profile, Microsoft says Windows Update offers only the latest applicable version, so add a stuck PC to the 26H2 profile before taking it out of the old one. When you replace update ring deferrals with a profile, assign the profile first, wait until devices show OfferReady in the Windows feature updates (Organizational) report, then set the deferral to 0. Microsoft says a device that scans before Windows Update finishes processing the profile can otherwise be offered a version you did not intend.

A safeguard hold is Microsoft stopping a device with a known issue from being offered a new version. On a PC that uses Windows Update without update policies, Settings shows a message that the update is on its way but not ready for the device. Managed fleets can see active holds, listed by eight-digit ID, in Windows Update for Business reports, and Intune's failures report shows a SafeguardHold alert with the ID in its Deployment Error Code column. Microsoft recommends against upgrading manually until the hold is released, and it details publicly discussed holds on the Known issues pages of its release health dashboard.

Holds only protect devices that use the Windows Update service, so a PC upgraded from installation media or WSUS gets no such check. If a hold lingers after Microsoft lists the issue as resolved, Microsoft says the most common cause is SSL inspection turned on for the Microsoft addresses Windows uses to update its compatibility data.

Give every exception an owner and a date for the next check. Make sure each one has the final November update.

Verify the result

Check each upgraded PC, not just the report. About should show the new version. With the November 10 update installed, the OS build reads 26200.9974 on 25H2 or 26300.9974 on 26H2, and later updates raise the number after the dot. PCs that receive hotpatch updates show 26200.9911 or 26300.9911 for November instead. A 23H2 exception should read 22631.7711, which confirms it has the final update.

In Intune, open the Windows Feature Update Report under Reports, then Windows Updates, choose the profile and select Generate report. A finished device shows an Update State of Installed with the substate Update Installed. Service data usually arrives within an hour, but device data refreshes every eight hours and appears only after data collection is set up, so check again the next day before chasing a device. In the failures report, an EndOfService alert marks a targeted device that is still on a version past its end of service date.

Keep the evidence. An export of the report, or a screenshot of each person's About page, is your record that every PC reached a supported version.

What to tell staff

Tell people when their PC will be upgraded, and ask them to save their work and leave laptops plugged in and switched on. Explain that the upgrade arrives through Windows Update or from IT, so any pop-up, email or website offering a Windows download should be reported, not clicked.

Mention what will look different. Microsoft says some features that were behind a temporary commercial control in 25H2 are on by default in 26H2, including Windows settings backup, app-specific taskbar actions and File Explorer improvements. Policies an administrator already configured are still honored, and some of these features have eligibility requirements.

A worked example

Imagine a 20-person architecture office where every PC is managed in Intune under licenses that include Windows Autopatch. The About pages show 12 laptops on Windows 11 Enterprise 23H2, four laptops on Enterprise 25H2 and four desktops on Windows 11 Pro 24H2.

The Pro desktops are the most overdue, having reached end of updates on October 13, but they are the easy case. With the October update installed, they meet the enablement package's prerequisite and can move to 26H2 with one restart. The 12 Enterprise 23H2 laptops need full upgrades, and the 25H2 laptops are supported and can wait.

The office manager runs the readiness report against 26H2. Eleven laptops come back Low risk and one High risk, because an old VPN client is flagged as needing an update before the upgrade. The rendering software's vendor supports 26H2, so there is no reason to stop at 25H2.

One desktop takes the 26H2 profile first, and the other three follow the next evening once it checks out. Two pilot laptops, including the one running the rendering software, are upgraded Thursday and tested Friday, well inside the 10-day window for going back. The VPN client is updated on the flagged laptop, and the remaining laptops join the profile next week. One shows a SafeguardHold alert, so it stays on 23H2 with the November update, joins the exceptions list with an owner and a recheck date, and gets the upgrade offer once Microsoft releases the hold.

What to do this week

  • Record the edition, version and build of every Windows PC, including spares.
  • Install the final November update on any 23H2 PC that cannot move yet.
  • Clear deferrals and pauses, and move devices from any 23H2 profile to a 26H2 profile.
  • Run the readiness report, or check disk space and key applications by hand.
  • Upgrade and test two pilot PCs, then schedule the rest.
  • List exceptions with an owner and a date for each.

Short answers to common follow-up questions

Can you pay for more 23H2 updates? Microsoft's notice does not mention any such option. The paid Extended Security Updates program in Microsoft's lifecycle FAQ is described for Windows 10 only, and the FAQ's Windows 11 guidance is to install the latest version before the current one reaches end of servicing.

What about Enterprise and Education PCs on 24H2? They are supported until October 12, 2027 and can move later through the enablement package. Intune marks a profile Support Ending when its version is within two months of its end date, which gives early warning.

What about schools with Windows 11 SE? Microsoft's lifecycle listing groups SE with Home and Pro and says 24H2 was the last supported SE version, so SE devices stopped receiving updates when 24H2 Home and Pro did on October 13. Microsoft's SE overview recommends moving to a device that supports another edition of Windows 11.

Where ALCO can help

ALCO's Microsoft 365 service includes Intune, and its mobile device management and asset management services keep managed laptops set up, locked down, tagged and accounted for. For help with the inventory, the readiness report or the pilot, the ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources