On this page · 10 sections
- What ends on 12 October 2027, edition by edition
- How 26H2 shipped: an enablement package, not a reinstall
- Which devices are affected: find them by build number
- What 26H2 changes for commercial PCs
- Deployment by tool: Intune, Autopatch, WSUS and Configuration Manager
- A ring plan and testing checklist
- Cost, India and global notes
- Implementation checklist
- How eCorpIT can help
- References
Summary. On 12 October 2027, Patch Tuesday, two groups of Windows 11 PCs get their last security update: Enterprise, Education, IoT Enterprise and Enterprise multi-session devices on version 24H2, and Home, Pro, Pro Education and Pro for Workstations devices on version 25H2. Microsoft's lifecycle pages print that end as 13 October 2027 at 06:59:59 Pacific Time, the convention they used for Windows 10. The fix has already shipped. Version 26H2 (build 26300) became generally available on 29 September 2026 as a small enablement package, KB5121794, for PCs on 24H2 or 25H2 that have KB5124010 or a later update, usually with one restart. Microsoft's status page of 28 October 2026 lists it as available for all eligible devices. 26H2 is supported until 10 October 2028 on Home and Pro and 9 October 2029 on Enterprise and Education. Three traps: Intune shows Enterprise dates, so a Pro fleet on 25H2 looks safe until 2028; 26H1 is not an upgrade path; and 24H2 Home and Pro already lost updates on 13 October 2026. From 7 November 2026, 339 days remain. Our verdict: target 26H2 once and finish by mid-2027.
About this article. For IT managers and managed service providers running Windows 11 fleets. On 7 November 2026 we checked every date, build and KB number against Microsoft's lifecycle page for each edition, the Windows 11 release information page, Microsoft's release health announcements, the 26H2 known issues page, the KB articles for the enablement package and its prerequisite, and the Intune and Autopatch documentation. Microsoft edits these pages often, so re-check before you commit a change window. The DPDP note is not legal advice, and no vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
If you still run Windows 10 PCs on Extended Security Updates, our guide to Windows 10 ESU ending in October 2027 covers the hardware decision. This guide covers the Windows 11 fleet.
What ends on 12 October 2027, edition by edition
Under the Modern Lifecycle Policy, Windows 11 stays supported only while customers keep current with Microsoft's published servicing requirements. Each annual feature update gets 24 months of servicing on Home, Pro, Pro Education and Pro for Workstations, and 36 months on Enterprise, Education, IoT Enterprise and Enterprise multi-session. That split is why one deadline hits two version numbers.
The table combines the edition lifecycle pages with the release information page, all read on 7 November 2026.
| Version (build) | Home, Pro, Pro Education, Pro for Workstations | Enterprise, Education, IoT Enterprise, multi-session | Status on 7 Nov 2026 |
|---|---|---|---|
| 23H2 (22631) | Ended 11 Nov 2025 | 10 Nov 2026 | Enterprise ends in 3 days |
| 24H2 (26100) | Ended 13 Oct 2026 | 12 Oct 2027 | Enterprise side hit by this deadline |
| 25H2 (26200) | 12 Oct 2027 | 10 Oct 2028 | Home and Pro side hit by this deadline |
| 26H1 (28000) | 14 Mar 2028 | 13 Mar 2029 | New devices only, no IoT Enterprise |
| 26H2 (26300) | 10 Oct 2028 | 9 Oct 2029 | Current release and the target |
| Enterprise LTSC 2024 (26100) | Not applicable | 9 Oct 2029 (IoT LTSC 2024 to 10 Oct 2034) | Not affected |
Four notes change who is affected:
- Home and Pro on 24H2 are already out. They reached end of updates on 13 October 2026, and the October 2026 security update was the last one. A Pro PC still on build 26100 gets no further fixes.
- Windows 11 SE has no path forward. Microsoft released no feature update after SE 24H2 and ended SE support in October 2026. SE fleets need hardware that runs another edition.
- Snapdragon 850 PCs stop at 26H2. The lifecycle pages say 26H2 is the last version for that processor. Our AI PC refresh comparison covers replacement options.
- Home PCs mostly move on their own. Home cannot defer feature updates, so it usually gets a new version before the end date. Pro devices can be deferred or pinned by policy, which is how they get stranded.
After 12 October 2027, affected PCs keep working without security updates. Microsoft has published no Extended Security Updates offer for Windows 11 versions; its lifecycle FAQ says to install the latest version before end of servicing.
How 26H2 shipped: an enablement package, not a reinstall
Microsoft made Windows 11, version 26H2, also called the Windows 11 2026 Update, generally available on 29 September 2026. Consumers who had turned on the Windows Update option to get the latest updates as soon as they are available saw it first, and Microsoft widened the offer through a gradual rollout, with safeguard holds on devices that have a known compatibility issue. By 28 October 2026 the 26H2 status page listed it as available for all eligible devices. Commercial customers could deploy it from day one through Windows Autopatch and their existing update tools.
KB5121794 explains the mechanics. Versions 24H2, 25H2 and 26H2 share one core operating system with an identical set of system files, so the 26H2 features already sit dormant on patched 24H2 and 25H2 PCs. The enablement package is a small switch that turns them on with a single restart. It also resets the support clock.
| Starting point | Route to 26H2 | Prerequisite | Typical downtime |
|---|---|---|---|
| 24H2 (any edition except LTSC) | Enablement package KB5121794 | KB5124010 or a later cumulative update | One restart |
| 25H2 (any edition) | Enablement package KB5121794 | KB5124010 or a later cumulative update | One restart |
| 23H2 | Full feature update | Normal upgrade checks | Full OS upgrade |
| 26H1 | Not covered by KB5121794 | Follow Microsoft's 26H1 guidance | Not applicable |
The prerequisite, KB5124010, is the 22 September 2026 non-security preview update (builds 26100.9550 and 26200.9550). It was also the last preview update 24H2 will get; supported 24H2 editions now receive security updates only.
The package installs only on a patched PC, so devices that rarely connect are your real risk. Because it switches features on rather than replacing the OS, most of the effort goes on change management and stragglers.
Moving Enterprise devices from 24H2 to 25H2 buys one year (to 10 October 2028) against two for 26H2, so target 26H2 unless a vendor has certified only 25H2.
Which devices are affected: find them by build number
The build number is the most reliable identifier: 22631 for 23H2, 26100 for 24H2, 26200 for 25H2, 26300 for 26H2 and 28000 for 26H1. One catch: Windows 11 Enterprise LTSC 2024 is also based on 24H2 and reports build 26100, so filter on edition too. LTSC devices identify as EnterpriseS.
Run this locally, through an Intune remediation script or through your RMM tool:
# Report edition, display version and build for the October 2027 inventory
$cv = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion'
[pscustomobject]@{
Computer = $env:COMPUTERNAME
Edition = $cv.EditionID # e.g. Professional, Enterprise, Education, EnterpriseS (LTSC)
DisplayVersion = $cv.DisplayVersion # e.g. 24H2, 25H2, 26H2
Build = "$($cv.CurrentBuild).$($cv.UBR)"
}
# Affected on 12 Oct 2027: Enterprise or Education on 26100 (not EnterpriseS), Professional on 26200
# Already out of servicing: Professional on 26100
Then sort every device into one of four buckets:
| Bucket | How to recognise it | Action |
|---|---|---|
| Already unsupported | Home or Pro on 26100; Enterprise on 22631 after 10 Nov 2026; any SE device | Upgrade or replace now |
| Affected on 12 Oct 2027 | Enterprise, Education or IoT Enterprise on 26100 (not LTSC); Home or Pro on 26200 | 26H2 by enablement package, in rings |
| Safe until 2028 or later | Enterprise or Education on 26200; any edition on 26300; LTSC 2024 | Plan the next annual update |
| Special case | 26H1 (28000), Snapdragon 850 | Check the OEM path separately |
In Intune, the Windows feature updates (Organizational) report gives the same answer without a script. Do not rely on version labels typed into a CMDB. They drift.
What 26H2 changes for commercial PCs
Three capabilities that sat behind temporary commercial controls are on by default in 26H2 for commercial devices:
- Windows settings backup. The new default applies only where admins have not set the policy; an explicit setting is honoured, and restore stays under admin control. If your data rules require backup to stay off, set the policy before the upgrade.
- App-specific actions on the taskbar.
- File Explorer improvements that were previously held back for commercial devices.
Built-in Sysmon stays off until you configure it, and quick machine recovery stays off on domain-joined or enterprise-managed devices unless you enable it. Administrator protection (just-in-time elevation with profile separation) is off by default in Windows, but Microsoft's Windows 11 security baselines for 24H2, 25H2 and 26H2 switch it on from the October 2026 security update, so tenants that apply the baseline already run it. After KB5124010, non-admin users could not open Remote Desktop sessions to 26H2 hosts with Administrator protection on, until the 28 October 2026 preview update KB5127936 fixed it.
Two changes can break things if you skipped earlier testing:
- Driver trust. Windows removes default trust for cross-signed kernel drivers. Drivers from the Windows Hardware Compatibility Program and an allow list of trusted legacy drivers stay allowed, and Windows audits compatibility for at least 100 hours and three restarts before it enforces. Old VPN clients, scanner and printer drivers, and endpoint agents are the usual suspects.
- WMIC is gone. Microsoft removed the WMIC utility from 24H2 and 25H2 in the August 2026 preview update, and it is no longer available as a Feature on Demand. A device that meets the enablement package prerequisite has therefore already lost it. On 23H2 it was disabled by default but could be added back, so 23H2 scripts that call
wmic.exewill fail after the upgrade. WMI itself is unaffected.
26H2 also adds Windows API support for the post-quantum algorithms ML-KEM and ML-DSA. Hotpatch continues on 26H2, with the October 2026 security update as its first baseline, and is not available on 26H1.
Deployment by tool: Intune, Autopatch, WSUS and Configuration Manager
Microsoft Intune feature update policies
A feature update policy pins devices to a named version and keeps them there until you change it, which makes it the cleanest way to move a fleet. The prerequisites:
| Requirement | Detail |
|---|---|
| Licences | Intune Plan 1, plus a Windows licence that includes the Windows Autopatch entitlement |
| Editions | Pro, Pro Education, Enterprise, Education; LTSC is not supported (use update rings) |
| Join state | Intune-managed, Microsoft Entra joined or hybrid joined |
| Device settings | Diagnostic data at Required or higher; Microsoft Account Sign-In Assistant (wlidsvc) running |
| Version choice | Only in-support versions appear in the list |
| Optional delivery | Offering the update as optional needs an Autopatch licence |
Five behaviours catch teams out:
- Intune shows Enterprise dates. The Support End Date column is for Enterprise and Education. A profile holding Pro devices on 25H2 shows support into 2028, while Pro 25H2 ends on 12 October 2027.
- Support Ending appears two months out. Intune flags a version within two months of its end date, so 24H2 profiles change status around 12 August 2027. Treat that as a final warning.
- Remove update ring deferrals in the right order. Microsoft recommends a feature update deferral of 0 days and no paused feature updates wherever a feature update policy applies. Assign the policy first, wait until devices show
OfferReadyin the report, then remove the deferral, or devices may be offered a version you did not intend.
- Pauses expire, policies do not. A pause in an update ring lapses after 35 days; a feature update policy stays until you change it.
- Safeguard holds win. Devices with a known compatibility issue are held back until Microsoft resolves it. Check the holds before you chase a stuck device.
Windows Autopatch multi-phase releases
Autopatch builds on the same feature update policies and adds multi-phase releases across your Autopatch groups. It creates one feature update policy per phase, generating policies at 04:00 and 16:00 UTC, so the first deployment date can only be the next day or later. For the deadline-driven cadence, Microsoft gives the goal completion date as:
first deployment date + (gradual rollout groups - 1) x 7 days + 5-day deadline + 2-day grace period
Worked example: four gradual rollout groups starting on Monday 16 August 2027 complete by 16 August + 21 + 5 + 2 days = 13 September 2027, leaving 29 days before 12 October. Pausing or resuming can take up to eight hours to reach devices, and Autopatch cannot roll back a feature update through its own workflows, so test a rollback procedure in Ring 0. For LTSC devices, Autopatch manages only quality updates.
WSUS and Configuration Manager
Microsoft deprecated Windows Server Update Services in September 2024: no new features, but it keeps publishing updates. Devices on 24H2 or 25H2 that update from WSUS get the enablement package when they install the feature update named Windows 11, version 26H2, which syncs under the Windows 11 product and the Upgrades classification. It is not offered as a separate Microsoft Update Catalog download. Approve it for a pilot computer group first.
Configuration Manager estates use WSUS underneath, so the same item applies. If you move the Windows Update workload of co-managed devices to Intune at the same time, devices can briefly update past the version in your policy, so create the Intune feature update policy and confirm OfferReady before you switch.
WSUS servers on Windows Server 2016 lose support on 12 January 2027, nine months before this deadline. Our Windows Server 2016 end-of-support playbook covers that move.
A ring plan and testing checklist
You are testing an activation, not a new operating system. Microsoft advises piloting first, testing business-critical apps and representative hardware, then widening through existing rings. The ring sizes below are an illustrative start for a 1,000-device fleet, not a Microsoft requirement.
| Ring | Example size | Who | Start | Exit criteria |
|---|---|---|---|---|
| Ring 0: IT test | 2% (20) | IT staff, one of each hardware model | Week 1 | Package installs, one restart, apps and VPN work |
| Ring 1: pilot | 5% (50) | Volunteers across departments and sites | Week 2 | No new helpdesk trend after 5 working days |
| Ring 2: broad A | 40% (400) | General users | Week 3 | Reports show 26300 builds |
| Ring 3: broad B | 48% (480) | Remaining users | Week 4 | Under 2% failures, each with a named owner |
| Ring 4: critical | 5% (50) | Executives, shop-floor, clinical or trading PCs | Week 5 | Business sign-off, scheduled windows |
The test checklist for Rings 0 and 1:
- Line-of-business apps on each hardware model, including anything that loads a kernel driver: VPN, endpoint detection, disk encryption, smart card middleware, scanners and label printers. VPN clients that cannot update themselves, such as AWS VPN Client 6.0, need a pushed version first.
- Scripts that call WMIC. Replace them with PowerShell CIM cmdlets such as
Get-CimInstance.
- Compliance policies with a maximum OS version or build rules, so 26300 builds are not marked non-compliant.
- Inventory and reporting queries that match on 26100 or 26200.
- Windows settings backup behaviour against your data policy.
- Remote Desktop with Administrator protection, if you apply the security baseline: confirm 26H2 hosts have KB5127936 or later.
- Hotpatch-enrolled devices: confirm hotpatch resumes after the upgrade.
- Snapdragon 850 devices: add them to the refresh list.
When to run it
You have most of a year, and no reason to wait for the last quarter:
- November 2026. Clear the already-unsupported devices, starting with Enterprise on 23H2, which loses updates on 10 November 2026, and Home and Pro on 24H2.
- January to March 2027. Inventory, prerequisite patching and Rings 0 and 1.
- By June 2027. Finish the broad rings. That also clears the Windows Update certificate rotation: certificates expire on 17 May and 19 June 2027, and 24H2 devices need the September 2025 security update or later before 19 June 2027 to keep reaching Windows Update. 25H2 and later need no action, and WSUS-fed devices are not affected.
- July to September 2027. Stragglers only; the Autopatch example shows mid-August is the last comfortable start for a full release.
Cost, India and global notes
The upgrade costs nothing in licences for supported editions; the costs are staff time and helpdesk load. Compare Windows 10, where commercial ESU costs $61 per device in Year One and doubles each year, and consumer ESU ends on 12 October 2027, the same day as this deadline. No equivalent paid route exists for a Windows 11 version, so a missed deadline cannot be bought back.
India. Indian SMEs running Windows 11 Pro on unmanaged PCs follow the 24-month Pro schedule, so those devices hit the deadline on 25H2 while nobody watches their builds. Section 8(5) of the Digital Personal Data Protection Act, 2023 requires a data fiduciary to take reasonable security safeguards to prevent a personal data breach, and an operating system without security updates is hard to defend under that duty. Our DPDP Rules compliance checklist explains why it applies from 13 May 2027. A practical first step is to enrol unmanaged business PCs in Intune or a supported RMM tool.
US, UK and EU. Microsoft publishes one date for every region and shows it in Pacific Time. Plan your change window around the October 2027 Patch Tuesday, not the 13 October timestamp.
Developer machines. Combine this with any Visual Studio 2026 move; our Visual Studio 2022 support guide notes that Visual Studio 2026 supports Windows 11 but not Windows 10 or Enterprise LTSC.
Implementation checklist
- Inventory by build and edition, then fix the already-unsupported devices first.
- Patch to the prerequisite: KB5124010 or later on every 24H2 and 25H2 device.
- Choose the tool per population: Intune or Autopatch for managed devices, WSUS on premises, Windows Update for unmanaged PCs.
- Clean up policy conflicts: deferral at 0, no paused feature updates, OfferReady before you switch.
- Run the rings and finish the broad ones by June 2027.
- Chase stragglers weekly and record each exception with an owner and a replacement date.
- Set the next reminder: 26H2 Home and Pro ends on 10 October 2028.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our cybersecurity services team can build the inventory, design Intune or Autopatch rings, test your apps and drivers against 26H2 and chase stragglers to the deadline. Talk to us at /contact-us/.
Last updated: 7 November 2026.
