On Microsoft's second-Tuesday schedule, December's security update is due on Tuesday, December 8, 2026. Microsoft typically publishes monthly security updates at 10:00 a.m. Pacific Time, which is 11:00 a.m. Mountain. Each one is cumulative, carrying new security fixes along with those released earlier, so a PC that missed a month catches up by installing the latest update. Microsoft notes that most organizations consider these updates mandatory, and its November message center post recommends installing them promptly.

How the monthly cycle works

Microsoft's release history labels each update with the year, the month and a letter for the week of release. A 2026-11 B entry is November's security update, released in the second week. A D entry is the optional non-security preview, typically released in the fourth week so administrators can test changes headed for the next month's security update. OOB marks an out-of-band update for a problem that cannot wait, and version 25H2 received seven of them between January and October 2026.

The B release also carries the non-security changes from the prior month's preview. Out-of-band updates are cumulative too. Critical ones reach Windows Update client policies and WSUS automatically, like a monthly update, while noncritical ones come only from the Microsoft Update Catalog.

Restarts also changed this year. For updates released on and after July 28, 2026, Windows 11 versions 24H2, 25H2, 26H1 and 26H2 hold driver, .NET and firmware updates from Windows Update until the monthly security update, then install them together so the PC restarts once a month. Defender security intelligence, AI components, critical drivers and out-of-band updates still install as soon as they are available. Microsoft says this experience is rolling out gradually and is currently only available on devices not managed by IT departments.

December breaks the pattern

In a November 10, 2026 message center post, Microsoft says there will be no December 2026 non-security preview update because of minimal operations during the Western holidays and the new year, and that normal monthly servicing resumes in January 2027. That makes December 8 the last scheduled monthly update of 2026.

Last year had the same shape. The 25H2 release history shows the December 9, 2025 security update and nothing more until the January 13, 2026 security update, which was followed by out-of-band updates on January 17 and January 24. Until January, fixes for problems found after December 8 would come through out-of-band updates or, for non-security changes, Known Issue Rollback, described below.

Check which versions you run

On each PC, press the Windows key, type winver and press Enter to see the version and OS Build. Then find that version on Microsoft's Windows 11 release information page, where each row lists the update type, availability date, build and KB article.

Read the OS Build in two parts. The number before the dot identifies the version, such as 26200 for 25H2, and the number after it rises with each update. Match on the full build, because one KB number can cover several versions. After November's security update, a current PC shows:

  • Version 26H2, OS Build 26300.9974, from KB5132061.
  • Version 25H2, OS Build 26200.9974, from KB5132061.
  • Version 24H2 Enterprise or Education, OS Build 26100.9974, from KB5132061.
  • Version 26H1, OS Build 28000.3501, from KB5132059.
  • Windows 10, version 22H2 with ESU, OS Build 19045.7846, from KB5131096.

Version 26H1 is meant for new devices. Microsoft says it is not offered as an in-place update from 24H2 or 25H2, so a new laptop can be on a different build and KB from the rest of the office.

Find PCs that will miss the December update

Windows 11 version 24H2 Home and Pro reached end of updates on October 13, 2026. Version 23H2 Enterprise and Education followed on November 10, 2026, when Microsoft said November's update was the last for those editions. Version 24H2 Enterprise and Education keep getting security updates until October 12, 2027.

PCs past end of updates need a feature update to a supported version to keep receiving security fixes. Version 26H2, available since September 29, 2026, gets updates until October 10, 2028 on Home and Pro and October 9, 2029 on Enterprise and Education, while version 25H2 ends on October 12, 2027 for Home and Pro. Microsoft recommends 26H2, and its IT pro guide says eligible PCs on 24H2 or 25H2 get it as an enablement package, which installs similarly to a monthly quality update.

To start it, open Settings > Windows Update, select Check for updates, then select Download & install if version 26H2 is offered. Microsoft's guide names only 24H2 and 25H2 as eligible for the enablement package, so a PC on an older version needs a different route to a feature update; start that now rather than the week of December 8. If 26H2 is not offered, Microsoft's known issues pages link to its explanation of safeguard holds, which keep a device from being offered an update while a problem is open.

Windows 10 reached end of support on October 14, 2025. Since then, PCs get security updates only through Microsoft's paid Extended Security Updates (ESU) program, which requires Windows 10, version 22H2. Microsoft's consumer ESU program runs until October 12, 2027, but it can't be used in commercial scenarios, and enrollment is not offered for PCs joined to an Active Directory domain or Microsoft Entra, or enrolled in mobile device management.

Businesses buy ESU through Microsoft Volume Licensing at $61 per device for Year One, which began in November 2025. The price doubles each year for a maximum of three years, and buying in Year Two means paying for Year One as well. To confirm a PC is covered, run slmgr.vbs /dlv from an elevated Command Prompt; Microsoft says the output shows the name of the ESU program and a License Status of Licensed. Microsoft lists a separate activation ID for each ESU year, so check that the current year's program is the one licensed.

Read the known issues first

Microsoft's release health site has a known issues page for each supported version. Its table lists each problem with the update that caused it, its status and when it was last updated. Microsoft's pages use Confirmed for an issue under investigation or affecting users, and Resolved when a fix shipped in a named KB, which helps only once that update is installed.

Entries can appear weeks after the update that caused them. The 25H2 page lists a problem that left some USB Audio Class 1.0 devices showing Code 10 in Device Manager after the September 8 security update; the entry was opened on November 9 and resolved by the November 10 update. On November 11, Microsoft also opened an entry about SQL Server linked server connections staying open on server devices after the October 13 update, with an out-of-band fix promised within days. A pilot on your own hardware catches what the list has not caught yet.

Read the page for each version you run before the pilot and again before the wider release. Each update's release notes also include a Known issues in this update section.

What to do this week

Start these now so they are finished before December 8:

  • Confirm each PC shows the November build for its version.
  • List every PC on 23H2, on 24H2 Home or Pro, or on Windows 10 without ESU, and start moving the Windows 11 ones to a supported version.
  • Check the ESU license on each Windows 10 PC you plan to keep.
  • Choose one or two pilot PCs that use your critical software, printers and USB devices.
  • Pick the one task each pilot user will test, such as printing or opening the main business app.
  • Set active hours on each PC so automatic restarts avoid the working day.
  • Name one person to check the release at 11 a.m. Mountain on December 8 and to watch for out-of-band updates through the holidays.

What to tell staff

Send a short note before December 8:

  • Restart when Windows asks, at a convenient time.
  • Do not pause updates before leaving for the holidays.
  • Report anything that stops working after the restart, such as printing.

Hold the rest of the office during the pilot

A pilot only means something if the other PCs wait. If your PCs are managed with Microsoft Intune, put the pilot PCs in an update ring with Quality update deferral period (days) set to 0 and everyone else in a ring deferred by a day or two; Microsoft allows 0 to 30 days. Under Use deadline settings, Deadline for quality updates (2 to 30 days) and Grace period (0 to 7 days) set how long users have before the update installs and the PC restarts automatically.

In the same policy, Microsoft recommends setting Auto reboot before deadline to Yes, so the PC can restart outside active hours before the deadline. Setting Option to pause Windows updates to Disable stops users from pausing.

On PCs nobody manages centrally, use a short, dated pause. On the evening of December 7, open Settings > Windows Update on each PC outside the pilot, select Pick a date under Pause updates and choose Thursday, December 10. Microsoft says that when a pause ends, Windows checks for, downloads and installs the latest updates, so nobody has to remember to resume.

Decide how fast to move

Two checks set the pace on December 8. First, CISA's Known Exploited Vulnerabilities catalog lists vulnerabilities exploited in the wild and is meant as an input to prioritization. If a Windows vulnerability fixed in the December release appears there, shorten the pilot to a few hours and release the update the same day.

Second, an open known issue that matches your hardware or software means holding only the PCs it affects, applying Microsoft's workaround if one is listed, and releasing the rest. With nothing exploited and nothing matching, run the pilot for a day and follow the plan below.

Pilot first and confirm the build

On December 8, record the KB number and build from the 2026-12 B row on the release information page for each version you run, plus any open known issue that overlaps your PCs, printers or apps. Install the update on a pilot PC from Settings > Windows Update and restart it to finish the installation.

After the restart, confirm the OS Build matches the December build for that version. Then have the pilot user complete the critical task you chose and use any USB headset, scanner or label printer they depend on. Because of the one-restart experience, held driver and firmware updates can install in the same restart, so note anything else that changed that day.

Leave room before the holiday gap

If the pilot goes cleanly, release the update to everyone else within a day or two, so failures surface while staff are in the office. Then check each PC's OS Build again. For any PC that lags, check whether it is waiting on a restart or has updates paused. Microsoft's Windows Update FAQ also says some updates won't install automatically on a metered connection. A PC left switched off until January catches up by installing the latest cumulative update when it returns.

Microsoft releases out-of-band updates as needed, so one can still arrive after December 8. Have your named person check the Windows message center each week through the holidays or follow @WindowsUpdate on X, which Microsoft's release health pages point to.

Common mistakes and how to spot them

Watch for these mistakes and the quick check for each:

  • Taking a quiet Windows Update page as proof of coverage; a PC on an end-of-updates version gets no new security update, so check its version against the release information table.
  • Piloting only one version; if the office runs both 25H2 and 26H2, put a pilot PC on each.
  • Leaving a pause running; a pause can be extended again and again, so check Pause updates under Settings > Windows Update.
  • Setting a long deferral for everyone else; a deferral of a week or more moves the main release to mid-December or later, so check Quality update deferral period (days) on each ring.
  • Reading a hotpatch PC as behind; Microsoft's hotpatch calendar lists December as a hotpatch month, and hotpatch builds differ from standard ones, as November's 25H2 hotpatch build 26200.9911 did from 26200.9974.

A worked example

Imagine a twelve-person accounting office, mostly on Windows 11 Pro with no central management, whose front-desk PC prints checks. In mid-November the office manager finds ten PCs on OS Build 26200.9974, the November build for 25H2. Her own laptop is still on 24H2 Pro, past end of updates, so she checks for updates, installs 26H2 and confirms OS Build 26300.9974. An old Windows 10 PC that runs the scanner has no ESU, and buying it now would mean paying $61 for Year One plus double that for Year Two, so she replaces the PC instead.

On the evening of December 7 she pauses updates on every PC except the front-desk PC and her own laptop, picking Thursday, December 10 as the end date. At 11 a.m. Mountain on December 8 she records the KB number and build for 25H2 and 26H2, checks the CISA catalog, finds no open known issue that touches her printers, and updates the two pilot PCs, one on each version. A test check prints, her USB headset works and both builds match.

The pauses end on Thursday and the rest of the office installs the update. By Friday, December 11, two laptops still show the old build. One is waiting on a restart, and on the other the user had extended the pause to the end of the month. She restarts the first, resumes updates on the second and confirms both builds before the office closes for the holidays. Over the break she checks the message center each Monday for out-of-band updates.

Uninstalling an update is a last resort

Microsoft doesn't recommend removing installed updates, and because each update is cumulative, removing one also removes that month's security fixes. For problems caused by non-security changes, Microsoft can use Known Issue Rollback, which turns off only the change that caused the problem. Microsoft says it applies the rollback automatically through Windows Update for non-enterprise devices, while enterprise devices need a special Group Policy that Microsoft links from the known issues page.

Home and Pro versions run out sooner

Each annual feature update gets 24 months of support on Home and Pro and 36 months on Enterprise and Education. A Pro PC therefore needs its next version move a year sooner than an Enterprise PC on the same version.

Where ALCO can help

ALCO's services include mobile device management, described on alcohq.com as every managed phone and laptop set up, locked down and accounted for, and a help desk where every request is tracked with clear updates. The ALCO help desk is staffed 24 hours a day, including holidays, and calls are answered by a person. If you would rather not run the December pilot yourself, ALCO technicians serve businesses across Idaho and can schedule time with you.

Sources