Microsoft shipped two Windows 11 versions in 2026, 26H1 on February 10 for new devices only and 26H2 on September 29. Updates ended for 24H2 Home and Pro on October 13, and 23H2 Enterprise and Education got their final update on November 10, so 23H2 is now out of updates on every edition. The next Windows 11 deadline is October 12, 2027, when 25H2 Home and Pro and 24H2 Enterprise and Education reach end of updates.

What ends when

Each yearly feature update gets 24 months of support on Home and Pro and 36 months on Enterprise and Education, and installing a newer version resets that clock. Microsoft groups Pro Education and Pro for Workstations with Home and Pro, and IoT Enterprise and Enterprise multi-session with Enterprise and Education.

After a version's end-of-updates date, its PCs stop receiving the monthly security and optional preview updates. Microsoft's release information page lists these dates:

  • 23H2 is out of updates on every edition.
  • 24H2 is out of updates on Home and Pro; Enterprise and Education end October 12, 2027.
  • 25H2 ends October 12, 2027 on Home and Pro and October 10, 2028 on Enterprise and Education.
  • 26H1 ends March 14, 2028 on Home and Pro and March 13, 2029 on Enterprise and Education.
  • 26H2 ends October 10, 2028 on Home and Pro and October 9, 2029 on Enterprise and Education.

Read builds with editions

Inventory tools often show a build number instead of a version name. In Microsoft's table, build 22631 is 23H2, 26100 is 24H2, 26200 is 25H2, 26300 is 26H2 and 28000 is 26H1, a version scoped to new devices. Windows 10 version 22H2 is build 19045.

A build number alone can mislead. A 24H2 Pro PC and a 24H2 Enterprise PC both report build 26100, but only the Enterprise one still gets updates, so record the edition beside every build.

The digits after the dot show the update level. After the November 10, 2026 security update, Microsoft lists 26100.9974, 26200.9974 and 26300.9974 for 24H2, 25H2 and 26H2, and 19045.7846 for Windows 10 under Extended Security Updates.

On a PC, Settings, then System, then About shows the edition and version under Windows specifications, and typing ver in a Command Prompt window shows the full number. In the Intune admin center, Devices, then All devices lets you open each enrolled device, and its Device details tab lists Operating system, Operating system edition, Operating system version, Last check-in and TPM version.

Windows 10 PCs still in use

Windows 10 reached end of support on October 14, 2025. The paid Extended Security Updates program keeps critical and important security updates coming, but only for Windows 10 version 22H2. Organizations buy it one year at a time, for at most three years after end of support, and it includes no new features, customer-requested nonsecurity fixes or general technical support.

Microsoft lists year one, which began in November 2025, at $61 per device through volume licensing, with a minimum of one license. The price doubles each year, and an organization that enrolls a PC in year two pays for year one as well.

Buying ESU doesn't switch it on. Each PC needs KB5066791 or a later update and then Microsoft's ESU Licensing Preparation Package, KB5072653. The ESU key comes from the Microsoft 365 admin center under Billing, then Your products, on the Volume licensing tab, and your account needs the Product Key Reader or VL Administrator role to see it. After you install and activate the key, slmgr.vbs /dlv in an elevated Command Prompt should show the ESU program with a License Status of Licensed.

Keep business PCs out of the consumer ESU program, which Microsoft says can't be used in commercial scenarios. It isn't offered to PCs joined to an Active Directory domain or Microsoft Entra, enrolled in device management or running in kiosk mode, and it ends October 12, 2027.

Decide what each Windows 10 PC needs

Under Microsoft's Windows 11 requirements, a PC needs a compatible 64-bit processor with two or more cores at 1 GHz or faster, 4 GB of memory, 64 GB of storage, UEFI firmware capable of Secure Boot, TPM 2.0 and DirectX 12 graphics with a WDDM 2.0 driver. An in-place upgrade also needs Windows 10 version 2004 or later with the September 14, 2021 security update or later. Then sort each PC:

  • If it meets the requirements, upgrade it, in Intune through a feature update policy or the update ring setting Upgrade Windows 10 devices to Latest Windows 11 release.
  • If it fails them, replace it, using ESU only as what Microsoft calls a temporary bridge.
  • If one application or device ties it to Windows 10, enroll it in ESU and set a retirement date.
  • If staff could work in a Windows 365 Cloud PC instead, a Windows 10 PC that connects to one is entitled to ESU for up to three years with an active subscription.

Run a January checkpoint

Name an owner and a January date now. At the checkpoint, export or copy each PC's edition, version and last check-in, and bring four lists:

  • PCs that no longer get updates, including 23H2 PCs, 24H2 Home and Pro PCs and Windows 10 PCs outside Extended Security Updates.
  • PCs that reach end of updates on October 12, 2027.
  • PCs that haven't checked in for 30 days or more, since nobody can vouch for their patch status.
  • Applications that need a pilot, each with a named tester.

Give every PC on the first list one decision and a date. Upgrade it, replace it, or, for a Windows 10 22H2 PC, enroll it in Extended Security Updates while you plan its upgrade or replacement.

Thirty days is the default for Intune's Compliance status validity period (days), under Endpoint security, then Device compliance, then Compliance policy settings, and you can set it from 1 to 120. A device that doesn't report within that period is treated as noncompliant. Pick one threshold and apply it at every checkpoint.

Between checkpoints, the Minimum OS version setting in a Windows compliance policy marks any PC below the version you enter as noncompliant. Enter it in the major.minor.build.revision format that the ver command shows. Where Conditional Access requires compliant devices, noncompliant PCs can lose access to email and other resources, so decide whether you want a flag or a block.

Move PCs to 26H2

Target 26H2, which has the latest end dates in the list above and is now available for all eligible devices. A 24H2 or 25H2 PC gets it directly as an enablement package, a small download that installs much like a monthly update. The three versions share a common core operating system with an identical set of system files; monthly updates already carry the 26H2 features in an inactive state, and the package turns them on with a restart. The PC first needs the September 22, 2026 preview update (KB5124010) or any later cumulative update.

The package requires 24H2 or 25H2, so plan a separate upgrade for any 23H2 PC. PCs that came with 26H1 follow their own dates.

Microsoft's IT pro guide recommends validating 26H2 in a pilot, testing business-critical applications, representative hardware and workflows, then expanding through existing update rings while monitoring deployment health and known issues. Recheck the 26H2 known issues page before each deployment date, and revisit the plan when Microsoft's guidance changes.

Set up the upgrade in Intune

In Intune, a feature update policy can lock Pro, Pro Education, Enterprise and Education PCs to a specific Windows release or target an upgrade to a newer one. It never downgrades a PC and stays in force until you change or remove it. It needs Intune Plan 1 and a Windows license with the Windows Autopatch entitlement, which Microsoft 365 Business Premium includes. To create one:

  • In the Intune admin center, go to Devices, then Windows, then Windows updates, open Feature updates and select Create profile.
  • Under Deployment settings, name it, pick 26H2 from Feature update to deploy and select Make available to users as a required update.
  • Under Rollout options, choose Make update available as soon as possible for the pilot or Make update available on a specific date for everyone else.
  • Under Assignments, add a device group, then select Review + create and Create.

Make update available gradually puts at least 100 devices in each offer group, so it can't stage a small fleet. Give the pilot and the main group separate device groups and policies instead.

If the same PCs have an update ring, create the feature update policy first and wait until the Windows Feature Update Report shows them as OfferReady. Only then set the ring's Feature update deferral period (days) to 0 and confirm feature updates aren't paused. Microsoft warns that if a PC scans after you remove a deferral but before Windows Update finishes processing the policy, it might be offered a version you didn't intend.

Restarts still follow the update ring. Setting Use deadline settings to Allow unlocks Deadline for feature updates (2 to 30 days), Grace period (0 to 7 days) and Auto reboot before deadline, which Microsoft recommends setting to Yes so restarts happen outside active hours.

Run the pilot before you expand

Pick at least one PC of each model and one person per business-critical application, and give the pilot a week of normal work. As of November 11, 2026, Microsoft's 26H2 known issues page lists five problems, all resolved, which show what to test:

  • USB headsets and speakers, since some USB Audio Class 1.0 devices showed Code 10 until the November 10, 2026 update.
  • Remote Desktop connections by non-admin users to PCs with Administrator protection turned on.
  • Virtual desktop sessions, since some devices, mostly Azure Virtual Desktop hosts using FSLogix, showed a black screen after sign-in.
  • Older applications that decode Dolby Digital (AC-3) audio, some of which closed unexpectedly.
  • Sign-in on PCs joined to an on-premises Active Directory domain, some of which lost their secure trust relationship.

Add your own line-of-business software, printers and scanners to the pilot, since no vendor list can clear them for you.

Plan as if there is no undo. Intune's update ring Uninstall action doesn't work on a feature update applied through an enablement package, and other feature updates can be removed only within the ring's Set feature update uninstall period (2 - 60 days).

Check the result

On an unmanaged PC, open Settings, then Windows Update, and check for updates. When Windows 11, version 26H2 is offered, select Download & install. After the restart, Windows specifications should show version 26H2, and your inventory should report build 26300.

In Intune, open Reports, then Windows Updates, then Windows Feature Update Report, select the policy and generate the report; each PC should reach Update Installed. Service-side status arrives in less than an hour, but client-side data refreshes every eight hours and needs your tenant to let Intune use Windows diagnostic data.

If the Windows Update page instead says the update is on its way but not ready for the PC, a safeguard hold is protecting it from a known issue, and Microsoft recommends not updating manually until the hold is released. In Intune, the Feature update failures report under Devices, then Monitor, shows a SafeguardHold alert with the hold's ID in the Deployment Error Code column; search for that ID on the release's known issues page.

Common mistakes and how to spot them

  • Expecting existing PCs to be offered 26H1, which Microsoft doesn't offer as an in-place update from 24H2 or 25H2.
  • Leaving a deferral or pause in an update ring, which shows up as Deferred in the Windows Feature Update Report or as a PolicyConflictDeferral or PolicyConflictPause alert in Feature update failures.
  • Taking Intune's Support End Date column as the Pro date, when Microsoft says it shows the Enterprise and Education date, a year later.
  • Holding PCs back with an update ring Pause, which expires after 35 days, instead of a feature update policy that pins the version.
  • Disabling the Microsoft Account Sign-In Assistant service (wlidsvc) or setting diagnostic data below Required, which feature update policies need; a DeviceRegistrationInvalidGlobalDeviceId alert points to the service.
  • Opting out of safeguard holds to force an upgrade, which Microsoft advises only in an IT environment for validation.
  • Installing 26H2 from media or Windows Server Update Services without checking known issues, since safeguard holds only protect PCs that update through Windows Update.

What to tell staff

Tell people which day their PC updates, and ask them to save work, leave it on and plugged in, and restart when prompted. Microsoft's IT pro guide lists app-specific taskbar actions and File Explorer navigation improvements as on by default in 26H2, so staff may notice changes.

The same guide says Windows settings backup is now enabled by default, and a Microsoft reply in its comments says that applies to newly set up devices rather than in-place upgrades. Ask staff to report, not click, any email or pop-up that offers a Windows upgrade.

A worked example

Imagine a twelve-person property management office on Microsoft 365 Business Premium, with every PC in Intune. Its January check shows eight Pro laptops on 25H2, three Pro desktops on 24H2, one laptop that hasn't checked in since October and a front-desk PC on Windows 10 22H2.

The desktops are already out of updates, so they go first. The office creates three 26H2 feature update policies, each with its own device group: Pilot, with one desktop and one laptop, as soon as possible; Desktops, with the other two, ten days later; and Laptops in April.

The bookkeeper tests the accounting software and check printer on the pilot desktop, and the office manager tests a USB headset on a video call from the pilot laptop. Both pass, so the Desktops date stands.

The missing laptop turns up in a drawer, takes the latest cumulative update and joins the Laptops group. Each PC is checked off when the report shows Update Installed and the inventory reports build 26300.

The front-desk PC runs under Extended Security Updates, and slmgr.vbs /dlv shows Licensed. Its Device details tab reports TPM version 1.2, below the Windows 11 requirement, so it gets a replacement date instead of an upgrade date.

Short answers to likely follow-up questions

Windows 11 Home PCs sit outside Intune feature update policies, which cover Pro, Pro Education, Enterprise and Education. Update them through Settings, then Windows Update, and track them separately.

Windows 10 PCs keep working without ESU, but their last update was the October 2025 security update. Microsoft recommends upgrading eligible ones or moving to a new Windows 11 PC.

Feature update policies don't apply during Windows Autopilot setup on a new PC. They take effect at its first Windows Update scan after provisioning, so check a new PC's version before handing it over.

What to do this week

  • Find every PC on 23H2, or on 24H2 Home or Pro, since those no longer get updates.
  • Confirm each Windows 10 PC is enrolled in Extended Security Updates and shows Licensed in slmgr.vbs /dlv, or has a replacement date.
  • Check that every PC still in support has the November 10, 2026 security update, which brings 24H2, 25H2 and 26H2 builds to .9974.
  • Check whether your licenses include the Windows Autopatch entitlement before you plan Intune feature update policies.
  • Name the checkpoint owner and put the January date on the calendar.

Where ALCO can help

ALCO's mobile device management service covers every managed phone and laptop, including setup, lockdown and tracking, and its asset tags and asset management service tags and tracks every device. ALCO's Microsoft 365 service covers Intune among other tools. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources